By weakness (CWE)

CWE-416: related vulnerabilities

CVEs classified under CWE-416. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

572 published vulnerabilities · page 1 of 6

• CVE-2026-10002HIGH 8.8

  A use-after-free memory flaw in PDFium, the PDF rendering engine embedded in Google Chrome, allows attackers to corrupt heap memory by tricking users into opening a specially crafted PDF file. The vulnerability affects Chrome versions before 148.0.7778.216 and requires user interaction to trigger. An attacker exploiting this could achieve code execution with the same privileges as the Chrome process.

• CVE-2026-10007HIGH 8.8

  Google Chrome versions prior to 148.0.7778.216 contain a use-after-free memory safety flaw in SVG rendering that allows attackers to execute arbitrary code within the browser's sandbox by tricking users into visiting a malicious webpage. An attacker needs only to craft a deceptive HTML page and convince a user to open it—no special privileges or complex interaction are required beyond the initial click.

• CVE-2026-10013HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's WebCodecs component that could allow an attacker to run malicious code within Chrome's sandbox by tricking a user into visiting a specially crafted website. The vulnerability affects Chrome versions before 148.0.7778.216 and requires user interaction (clicking a link or visiting a page) to be exploited. While the code execution occurs within the sandbox, this still represents a significant security risk as sandbox escapes are a known attack progression path.

• CVE-2026-10016HIGH 8.8

  A use-after-free flaw exists in Google Chrome's DOM implementation that allows an attacker to execute code within the browser's sandbox by tricking a user into visiting a malicious website. The vulnerability affects Chrome versions before 148.0.7778.216 and requires user interaction (clicking a link or opening a page) but does not require any special permissions or account privileges.

• CVE-2026-10882HIGH 8.8

  Google Chrome contains a use-after-free vulnerability in its network handling code that can allow attackers to execute arbitrary code on a user's system. The flaw affects Chrome versions prior to 149.0.7827.53 and is triggered when a victim visits a specially crafted webpage. Because successful exploitation requires user interaction (visiting a malicious site), the attack surface is primarily limited to social engineering scenarios, though the browser's ubiquity makes this a meaningful threat.

• CVE-2026-10885HIGH 8.8

  A use-after-free vulnerability exists in Chrome for iOS that allows attackers to execute arbitrary code on an iPhone or iPad by tricking users into visiting a malicious webpage. The flaw affects Google Chrome on iOS versions before 149.0.7827.53. Because it requires user interaction (clicking a link or viewing a page) but needs no special privileges, it poses a meaningful risk to mobile users, particularly if weaponized through social engineering or drive-by downloads.

• CVE-2026-10888HIGH 8.8

  Google Chrome versions before 149.0.7827.53 contain a use-after-free memory vulnerability in the Cast Streaming feature that allows attackers on your local network to run arbitrary code on affected machines. An attacker doesn't need valid credentials or user interaction to exploit this—just the ability to send crafted network traffic to a vulnerable Chrome instance. This is a serious vulnerability because it bridges network access to code execution on systems within the same network segment.

• CVE-2026-10890HIGH 8.8

  Google Chrome contains a use-after-free vulnerability in its Cast functionality that could allow an attacker on your local network to corrupt the browser's memory and potentially execute malicious code. The flaw affects Chrome versions prior to 149.0.7827.53 and requires no user interaction to trigger—an attacker simply needs to send specially crafted network traffic to exploit it. This is a local network attack vector, meaning the attacker must be on the same network segment as the target system.

• CVE-2026-10891HIGH 8.8

  A use-after-free vulnerability in Google Chrome's graphics (GFX) component allows an attacker to corrupt Chrome's memory by tricking a user into visiting a malicious webpage. Once the memory is compromised, the attacker could read sensitive data, modify page content, or crash the browser. The issue affects Chrome on Linux systems running versions before 149.0.7827.53.

• CVE-2026-10893HIGH 8.8

  A use-after-free memory vulnerability exists in Google Chrome's Chromoting remote desktop feature that could allow an attacker to run malicious code on a victim's computer through specially crafted network traffic. The flaw affects Chrome versions before 149.0.7827.53 and requires user interaction to trigger. The vulnerability has been assigned a CVSS score of 8.8 (High severity).

• CVE-2026-10895HIGH 8.8

  A use-after-free vulnerability in Chrome's Ozone component allows attackers to run arbitrary code on a user's computer by tricking them into visiting a malicious website. The flaw exists in versions of Chrome before 149.0.7827.53 and requires user interaction (clicking a link, visiting a page) but no special privileges. Once exploited, an attacker gains full control over the affected browser process and potentially the underlying system.

• CVE-2026-10896HIGH 8.8

  A use-after-free vulnerability in Chrome for iOS allows attackers to execute arbitrary code on affected devices when a user visits a malicious website. The flaw exists in memory management within Chrome's iOS implementation and does not require any special user interaction beyond visiting a crafted HTML page. Google has assigned this a Critical severity rating within Chromium's internal severity scale, and CVSS scoring reflects it as HIGH (8.8).

• CVE-2026-10902HIGH 8.8

  A use-after-free memory vulnerability exists in Chrome's Ozone component that allows attackers to execute arbitrary code by tricking users into visiting a specially crafted webpage. The flaw requires user interaction (clicking a link or visiting a site) but poses a critical threat because successful exploitation grants full control over the browser process and potentially the underlying system.

• CVE-2026-10903HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's WebRTC implementation that allows an attacker to execute arbitrary code within Chrome's sandbox by convincing a user to visit a malicious website. The vulnerability affects Chrome versions prior to 149.0.7827.53 and can lead to complete compromise of the browser process, including reading sensitive data, modifying content, and disrupting availability.

• CVE-2026-10913HIGH 8.8

  A use-after-free vulnerability exists in the ANGLE graphics library component of Google Chrome on Windows. An attacker can craft a malicious HTML page that, when visited by a user, triggers memory corruption within Chrome's sandbox environment. While the sandbox limits direct system compromise, successful exploitation allows arbitrary code execution within that sandboxed context, potentially leading to data theft, credential capture, or lateral movement attempts. The vulnerability requires user interaction (visiting a malicious page) but no special privileges.

• CVE-2026-10914HIGH 8.8

  A use-after-free vulnerability in ANGLE (the graphics abstraction layer used by Chrome on Windows) allows an attacker to execute code within Chrome's sandbox by tricking a user into visiting a malicious website. The vulnerability affects Chrome versions before 149.0.7827.53 and requires user interaction (visiting a crafted HTML page) but does not require any special privileges. Once exploited, the attacker gains the capabilities of the Chrome sandbox process, which is a significant security boundary but still constrains their access compared to the host system.

• CVE-2026-10923HIGH 8.8

  A use-after-free memory flaw in Google Chrome's web app installation feature for Android allows a local attacker to crash the browser or execute arbitrary code by providing a malicious file. The vulnerability affects Chrome versions before 149.0.7827.53 and requires user interaction (opening or installing a crafted app). While the attack requires local access and user involvement, the consequences—including full system compromise through code execution—make this a significant risk for Android users.

• CVE-2026-10926HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's Cast functionality that allows an attacker positioned on the same local network to execute arbitrary code on an affected system. The flaw requires no user interaction and can be triggered through specially crafted network traffic. This is a local network attack with high impact—an attacker gaining code execution can read sensitive data, modify system files, and disrupt operations.

• CVE-2026-10932HIGH 8.8

  Google Chrome for Android contains a use-after-free vulnerability in its UI handling that allows an attacker to send a malicious HTML page to a user. If the user opens it, the flaw can corrupt Chrome's memory and potentially give the attacker control over the browser. The vulnerability was present in Chrome versions before 149.0.7827.53 on Android devices.

• CVE-2026-10939HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's WebRTC component that allows an attacker to execute arbitrary code within Chrome's sandbox by tricking a user into visiting a malicious webpage. The vulnerability affects Chrome versions prior to 149.0.7827.53 across Windows, macOS, and Linux. While the exploit requires user interaction (clicking a link or visiting a site), the impact is severe: an attacker gains code execution within the browser process.

• CVE-2026-10943HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's WebRTC component that allows attackers to execute arbitrary code within the browser's sandbox. An attacker can exploit this by crafting a malicious HTML page that, when visited by a user, triggers the vulnerability. Although the code execution occurs in a sandbox (limiting direct system access), the vulnerability has a CVSS score of 8.8, indicating it poses a significant risk to confidentiality, integrity, and availability. Chrome versions before 149.0.7827.53 are affected.

• CVE-2026-10945HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's PDF handling that allows attackers to execute code within Chrome's sandbox if they can trick a user into performing specific UI interactions with a malicious PDF file. The vulnerability affects Chrome versions prior to 149.0.7827.53 across Windows, macOS, and Linux systems.

• CVE-2026-10947HIGH 8.8

  A use-after-free bug in Google Chrome's WebRTC implementation allows attackers to execute arbitrary code within the browser's sandbox by serving a specially crafted webpage. The vulnerability affects Chrome versions before 149.0.7827.53 and requires user interaction—the victim must visit a malicious page—but once triggered, it grants an attacker near-complete control over the isolated browser process. This is a memory safety issue where freed memory is incorrectly accessed, a common source of high-impact browser exploits.

• CVE-2026-10948HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's WebRTC implementation that allows attackers to run malicious code within the browser's sandbox by tricking users into visiting a crafted webpage. The attacker needs user interaction (clicking a link or visiting a malicious site) but requires no special privileges or system access to exploit it. Once triggered, the vulnerability grants full read, write, and execution capabilities within the sandboxed Chrome process.

• CVE-2026-10951HIGH 8.8

  A use-after-free flaw in Chrome's Autofill feature on iOS allows attackers to corrupt device memory if a user is tricked into performing specific interactions with a malicious webpage. The vulnerability requires user interaction but can lead to complete system compromise—reading sensitive data, modifying files, or crashing the browser.

• CVE-2026-10952HIGH 8.8

  A use-after-free vulnerability in Google Chrome for iOS allows attackers to corrupt memory on affected iPhones by tricking users into visiting a malicious website. The flaw exists in how Chrome handles certain objects in memory after they've been freed, leaving dangling references that an attacker can manipulate through a crafted HTML page. If successfully exploited, this could lead to arbitrary code execution on the victim's device.

• CVE-2026-10954HIGH 8.8

  A use-after-free memory safety bug in Google Chrome's Actor component allows attackers to run malicious code within the browser's sandbox by tricking users into visiting a specially crafted web page. The vulnerability affects Chrome versions before 149.0.7827.53 and requires user interaction—specifically clicking a link or visiting a malicious site—but no special privileges. Once triggered, an attacker gains the ability to read, modify, or delete data and potentially escape the sandbox to affect the underlying operating system.

• CVE-2026-10956HIGH 8.8

  Google Chrome versions before 149.0.7827.53 contain a use-after-free vulnerability in the MimeHandlerView component that could allow an attacker to run malicious code within Chrome's sandbox. An attacker would need to trick a user into visiting a specially crafted webpage to trigger the flaw. If successful, the attacker could gain code execution inside the sandboxed process, potentially compromising user data or enabling further system compromise depending on sandbox escape possibilities.

• CVE-2026-10957HIGH 8.8

  A use-after-free flaw in Chrome's Glic component allows attackers to execute malicious code within the browser's sandbox by tricking users into visiting a specially crafted webpage. The vulnerability requires user interaction but needs no special privileges to exploit. An attacker could gain code execution in a sandboxed context, potentially reading sensitive data or further compromising the system depending on sandbox escape capabilities.

• CVE-2026-10958HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome for iOS that could allow an attacker to execute arbitrary code on a user's iPhone. The flaw requires tricking a user into performing specific gestures (such as taps or swipes) while viewing a malicious webpage. Once exploited, an attacker gains full control over the browser process, potentially compromising sensitive data, installing malware, or pivoting to other device functions. Google has addressed this issue in Chrome version 149.0.7827.53 and later.

• CVE-2026-10959HIGH 8.8

  Google Chrome on Android contains a use-after-free vulnerability in its Input component that could allow an attacker to execute arbitrary code within the browser's sandbox by tricking a user into visiting a malicious website. The vulnerability affects Chrome versions prior to 149.0.7827.53 and requires user interaction (clicking a link or visiting a crafted page) to trigger.

• CVE-2026-10975HIGH 8.8

  A use-after-free vulnerability in Google Chrome's WebRTC component allows an attacker to execute arbitrary code within the Chrome sandbox by tricking a user into visiting a specially crafted website. The vulnerability affects Chrome versions prior to 149.0.7827.53 and requires user interaction—specifically clicking a link or visiting a malicious page—but does not require any special privileges. Once exploited, an attacker gains the ability to run code with the same permissions as the Chrome process, potentially compromising sensitive data or escalating further.

• CVE-2026-10978HIGH 8.8

  A use-after-free vulnerability in Google Chrome's Chromoting component allows attackers to execute arbitrary code on Windows systems. An attacker can trigger the flaw by sending specially crafted network traffic to a target who is using Chrome's remote desktop or remote assistance feature. Successful exploitation grants the attacker the same privileges as the Chrome process, potentially leading to complete system compromise. The vulnerability requires user interaction (for example, accepting a remote connection or visiting a malicious site that initiates Chromoting), but otherwise presents a direct path to code execution without requiring special system privileges or authentication.

• CVE-2026-10982HIGH 8.8

  A use-after-free flaw in Google Chrome's WebXR implementation allows attackers to run malicious code within the browser's sandbox by tricking users into visiting a specially crafted webpage. The vulnerability affects Chrome versions before 149.0.7827.53 on Windows, macOS, and Linux. While sandboxed, successful exploitation could compromise user data and enable further attacks. User interaction (clicking a link or visiting a site) is required to trigger the vulnerability.

• CVE-2026-10988HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's Views component that could allow an attacker to escape the browser's sandbox. The flaw requires an attacker to first compromise Chrome's renderer process—the sandboxed component that processes web content—and then serve a specially crafted HTML page to trigger the vulnerability. If successfully exploited, an attacker could break out of the sandbox and execute code with the full privileges of the Chrome process, potentially compromising the underlying system. Chrome versions prior to 149.0.7827.53 are affected.

• CVE-2026-10991HIGH 8.8

  Google Chrome contains a use-after-free memory vulnerability in its V8 JavaScript engine that can allow an attacker to run malicious code within Chrome's sandbox. The flaw requires user interaction—specifically, the victim must perform certain UI gestures (like clicking or interacting with specific page elements) while viewing a specially crafted webpage. Once triggered, the vulnerability could allow code execution with the privileges of the Chrome process, potentially compromising the user's browsing session and data. This affects Chrome versions prior to 149.0.7827.53 across Windows, macOS, and Linux systems.

• CVE-2026-11000HIGH 8.8

  A use-after-free vulnerability in Google Chrome's font handling on Linux allows attackers to execute arbitrary code within the browser's sandbox by tricking users into visiting a specially crafted webpage. The vulnerability affects Chrome versions before 149.0.7827.53 and requires user interaction (clicking a link or viewing a page) to trigger, but carries no special privilege requirements.

• CVE-2026-11003HIGH 8.8

  Google Chrome versions before 149.0.7827.53 contain a use-after-free vulnerability in its WebRTC component that could allow an attacker to run arbitrary code within Chrome's sandbox by tricking a user into visiting a malicious web page. While the underlying flaw is rated Medium severity by Chromium, the CVSS score reflects the practical impact: network delivery with minimal user friction and full compromise of confidentiality, integrity, and availability within the sandboxed process.

• CVE-2026-11028HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's media handling on Linux and ChromeOS. If an attacker compromises Chrome's renderer process—the sandboxed component that interprets web content—they can craft a malicious HTML page to execute arbitrary code within that sandbox. This is a post-compromise attack that escalates the damage from a renderer breach but does not grant escape from the sandbox itself.

• CVE-2026-11030HIGH 8.8

  Google Chrome versions prior to 149.0.7827.53 contain a use-after-free vulnerability in the Network component that can be triggered by malicious network traffic. An attacker who crafts and delivers hostile network packets to a user's browser could potentially corrupt the heap memory, leading to code execution with the privileges of the browser process. User interaction (such as visiting a malicious website or receiving crafted network data) is required for exploitation.

• CVE-2026-11042HIGH 8.8

  Google Chrome versions before 149.0.7827.53 contain a use-after-free flaw in its Views component that can allow attackers to corrupt browser memory. An attacker must convince a user to perform specific interactions with a malicious webpage to trigger the vulnerability, potentially leading to code execution or data theft. While Chromium rates this as medium severity, the CVSS score of 8.8 reflects the high impact if successfully exploited.

• CVE-2026-11049HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's Password Manager that could allow an attacker to run malicious code within Chrome's sandbox by tricking a user into visiting a specially crafted website. The flaw affects Chrome versions before 149.0.7827.53 across Windows, macOS, and Linux. While the Chromium project rates this as medium severity, the CVSS score of 8.8 reflects the combination of network accessibility, lack of authentication requirements, and potential for high-impact code execution.

• CVE-2026-11050HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's V8 JavaScript engine that allows attackers to execute arbitrary code within the browser's sandbox by tricking users into visiting a malicious webpage. The flaw requires user interaction (clicking a link or visiting a site) but needs no special privileges to exploit. While Chromium's security team rated this as medium severity internally, the CVSS score of 8.8 reflects the high impact if successfully exploited—attackers could steal data, modify content, or crash the browser.

• CVE-2026-11054HIGH 8.8

  A use-after-free memory flaw in Chrome's WebRTC component allows an attacker to execute arbitrary code within the browser's sandbox by tricking a user into visiting a malicious webpage. The vulnerability affects Chrome versions prior to 149.0.7827.53 and impacts multiple operating systems including Windows, macOS, and Linux. Successful exploitation requires user interaction (clicking a link or visiting a site) but can lead to complete compromise of the affected browser process.

• CVE-2026-11055HIGH 8.8

  A use-after-free vulnerability in ANGLE (Google's graphics library) affects Chrome on Windows systems prior to version 149.0.7827.53. An attacker can craft a malicious webpage that, when visited, executes arbitrary code within Chrome's sandbox environment. While the Chromium team rated this as medium severity internally, the CVSS score of 8.8 reflects the practical impact: any user visiting a hostile site is at risk, no user interaction beyond clicking a link is required, and successful exploitation grants code execution.

• CVE-2026-11059HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's Blink rendering engine that allows attackers to execute arbitrary code within the browser's sandbox by tricking users into visiting a malicious website. The flaw affects Chrome versions prior to 149.0.7827.53 and requires user interaction (clicking a link or visiting a page) but poses significant risk because successful exploitation grants an attacker the ability to run code with the privileges of the Chrome process.

• CVE-2026-11060HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's media handling on Windows systems. An attacker can craft a malicious HTML page that, when visited by a user, exploits this flaw to execute arbitrary code within Chrome's sandbox. While the sandbox provides a layer of isolation, successful exploitation would still allow the attacker to run code with the privileges of the Chrome process, potentially leading to data theft, credential capture, or lateral movement to the system itself.

• CVE-2026-11068HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's WebSocket implementation that could allow an attacker to execute arbitrary code within the browser's sandbox by tricking a user into visiting a malicious webpage. The flaw affects Chrome versions before 149.0.7827.53 and impacts Windows, macOS, and Linux systems. While the underlying code defect is classified as Medium severity by the Chromium project, the CVSS score of 8.8 reflects the practical risk: an attacker needs only to convince a user to visit a crafted page, requires no special privileges, and can achieve full code execution within the sandbox boundary.

• CVE-2026-11071HIGH 8.8

  A use-after-free memory vulnerability exists in Google Chrome's Base component on Linux systems. An attacker who has already compromised Chrome's renderer process can craft a malicious web page to read sensitive data directly from the browser's memory. While the underlying flaw carries a Medium severity rating from Chromium, the CVSS score reflects the potential for information disclosure combined with the practical attack surface. Chrome version 149.0.7827.53 and later on Linux contain the fix.

• CVE-2026-11074HIGH 8.8

  A use-after-free vulnerability in Google Chrome's WebRTC component on Linux systems allows attackers to execute arbitrary code if a user visits a specially crafted webpage. The vulnerability stems from improper memory management in the WebRTC implementation, where code attempts to access memory that has already been freed. This can be exploited remotely without requiring special user privileges, though user interaction (visiting a malicious page) is necessary. The issue affects Chrome versions prior to 149.0.7827.53 on Linux.

• CVE-2026-11080HIGH 8.8

  A use-after-free memory vulnerability exists in Google Chrome's WebView component on Android devices. An attacker can craft a malicious HTML page that, when visited by a user, triggers memory corruption in the browser's heap. This could allow the attacker to execute arbitrary code or crash the application. The vulnerability affects Chrome versions before 149.0.7827.53 on Android.

• CVE-2026-11116HIGH 8.8

  Google Chrome contains a use-after-free memory vulnerability in its Chromoting remote desktop feature that can be triggered by malicious network traffic. An attacker can send specially crafted packets to a targeted user, leading to arbitrary code execution on the victim's machine. The vulnerability requires user interaction—specifically, the user must be engaged in an active Chromoting session—but once triggered, it grants the attacker the same privileges as the Chrome process.

• CVE-2026-11117HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's Views component on Windows systems. An attacker can exploit this flaw by crafting a malicious HTML page that, when visited by a user, allows remote code execution on the victim's machine. The vulnerability affects Chrome versions prior to 149.0.7827.53 and requires user interaction (visiting a malicious site), but once triggered, grants the attacker full system compromise capabilities.

• CVE-2026-11118HIGH 8.8

  A memory safety vulnerability exists in Google Chrome's WebRTC implementation that could allow attackers to run malicious code within the browser's sandbox. The flaw stems from a use-after-free condition—where the browser continues using memory that has already been freed—which can be triggered by visiting a specially crafted webpage. No special permissions or user interaction beyond clicking a link or viewing a page are required, making this a significant remote code execution risk despite being contained within the sandbox.

• CVE-2026-11125HIGH 8.8

  A use-after-free memory flaw in Google Chrome's compositing system allows attackers to run arbitrary code within Chrome's sandbox by tricking users into visiting a malicious webpage. The vulnerability affects Chrome versions before 149.0.7827.53 across Windows, macOS, and Linux. While contained by the sandbox, successful exploitation could grant an attacker the same privileges as the Chrome process, potentially compromising sensitive browser data and operations.

• CVE-2026-11130HIGH 8.8

  A use-after-free vulnerability in Google Chrome's media handling allows attackers to run malicious code within Chrome's sandbox by tricking users into visiting a specially crafted website. While the underlying Chromium project rates this as Medium severity, the CVSS score of 8.8 reflects the practical risk: it requires user interaction (clicking a link or visiting a site), but once triggered, it can lead to full compromise of the Chrome process, potentially exposing sensitive data or enabling further attacks on the underlying system.

• CVE-2026-11136HIGH 8.8

  Google Chrome versions prior to 149.0.7827.53 contain a use-after-free vulnerability in the Canvas component that allows attackers to execute arbitrary code within the browser sandbox. An attacker can exploit this flaw by crafting a malicious HTML page that, when visited by a user, triggers memory corruption and leads to code execution. The vulnerability requires user interaction (visiting a webpage) but needs no special privileges to trigger.

• CVE-2026-11144HIGH 8.8

  A use-after-free memory flaw in Google Chrome's media handling allows an attacker to execute malicious code within Chrome's sandbox by tricking a user into opening a specially crafted video file. While sandboxed, successful exploitation could still grant an attacker significant control over the affected browser process and potentially access to sensitive user data.

• CVE-2026-11147HIGH 8.8

  A use-after-free vulnerability exists in Chrome's WebML (Web Machine Learning) component on Windows. An attacker can craft a malicious HTML page that, when visited by a user, triggers code execution within Chrome's sandbox. Although the sandbox contains the damage, the vulnerability allows an attacker to breach browser process isolation and execute arbitrary code with the privileges of the Chrome renderer process.

• CVE-2026-11164HIGH 8.8

  A use-after-free vulnerability exists in Blink, Google Chrome's rendering engine, affecting versions prior to 149.0.7827.53. An attacker can craft a malicious HTML page that, when visited by a user, exploits this memory safety flaw to execute arbitrary code within the Chrome sandbox. While sandboxed, successful exploitation grants an attacker code execution capabilities on the victim's machine, potentially enabling further compromise.

• CVE-2026-11177HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's Omnibox (the combined address and search bar). An attacker can craft a malicious HTML page that, when a user performs specific interactions with the Omnibox, triggers memory corruption. Successful exploitation requires user interaction—the attacker cannot silently compromise a machine, but if a targeted user visits a crafted page and engages with the address bar in a particular way, the attacker could potentially execute arbitrary code with the privileges of the Chrome process.

• CVE-2026-11188HIGH 8.8

  A use-after-free vulnerability in Chrome's USB handling on Android devices allows an attacker to escape the browser's security sandbox by tricking a user into visiting a specially crafted webpage. Once the sandbox is bypassed, the attacker could gain elevated privileges on the device. The vulnerability affects Chrome versions prior to 149.0.7827.53 on Android.

• CVE-2026-11201HIGH 8.8

  Google Chrome versions prior to 149.0.7827.53 contain a use-after-free vulnerability in the ServiceWorker component that allows arbitrary code execution. The vulnerability requires an attacker to convince a user to install a malicious Chrome extension, after which the attacker can exploit memory handling flaws to run code with the privileges of the browser. This is not a vulnerability in the browser itself that users encounter passively—it requires social engineering to trick a user into voluntarily installing a compromised extension.

• CVE-2026-11230HIGH 8.8

  Google Chrome versions prior to 149.0.7827.53 contain a use-after-free vulnerability in the Extensions subsystem that could allow an attacker to execute arbitrary code within Chrome's sandbox. An attacker would need to trick a user into visiting a malicious HTML page. While Chromium initially categorized this as low severity, the CVSS score reflects the real-world impact: complete compromise of confidentiality, integrity, and availability within the sandboxed context.

• CVE-2026-11262HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's TabStrip component that allows attackers to execute arbitrary code on a victim's machine. The flaw requires user interaction—specifically, visiting a malicious webpage—but once triggered, grants full code execution privileges. Chrome versions prior to 149.0.7827.53 are affected. Despite Chromium's internal severity rating of 'Low', the CVSS 3.1 score reflects the real-world impact: remote code execution with no authentication needed, complete compromise of confidentiality, integrity, and availability.

• CVE-2026-11303HIGH 8.8

  A use-after-free vulnerability in PDFium, the PDF rendering engine embedded in Google Chrome, allows attackers to execute arbitrary code within Chrome's sandbox by tricking users into opening a specially crafted PDF file. While the vulnerability requires user interaction (opening a malicious PDF), the impact is severe: an attacker gains code execution inside the sandboxed Chrome process, potentially leading to data theft, system compromise, or further exploitation. The vulnerability affects Chrome versions prior to 149.0.7827.53 across Windows, macOS, and Linux platforms.

• CVE-2026-11304HIGH 8.8

  A use-after-free flaw in PDFium, the PDF rendering engine used by Google Chrome, allows attackers to corrupt heap memory when a user opens a specially crafted PDF file. An attacker could exploit this to potentially execute arbitrary code or crash the browser. The vulnerability requires user interaction (opening a malicious PDF) but is otherwise straightforward to exploit remotely.

• CVE-2026-11305HIGH 8.8

  A use-after-free flaw in PDFium, the PDF rendering engine embedded in Google Chrome, allows attackers to execute arbitrary code within Chrome's sandbox by tricking users into opening a malicious PDF file. The vulnerability affects Chrome versions prior to 149.0.7827.53 across Windows, macOS, and Linux. While Chromium assigned this a Low security severity rating, the CVSS score of 8.8 reflects the practical risk: a remote attacker needs only a crafted PDF and user interaction to achieve code execution with high impact on confidentiality, integrity, and availability.

• CVE-2026-11306HIGH 8.8

  A memory safety bug in Google Chrome's PDF rendering engine (PDFium) allows attackers to run malicious code within Chrome's sandbox by sending a victim a specially crafted PDF file. The attacker needs the user to open the PDF—there's no way to trigger this remotely without interaction. While the Chromium team rated the issue as Low severity internally, the actual impact is significant: an attacker gains arbitrary code execution within the browser sandbox, potentially stealing data or performing other malicious actions. This affects Chrome on Windows, macOS, and Linux.

• CVE-2026-11307HIGH 8.8

  A use-after-free memory bug in PDFium—the PDF rendering library bundled with Google Chrome—allows attackers to run arbitrary code within Chrome's sandbox by sending a malicious PDF file. The vulnerability requires user interaction (opening the PDF) but can fully compromise a victim's browser process, stealing data or installing malware. While Google rated this as low severity internally, the CVSS score of 8.8 reflects the serious consequences: an attacker gains code execution with high impact to confidentiality, integrity, and availability.

• CVE-2026-11629HIGH 8.8

  A use-after-free vulnerability in Google Chrome's Ozone component allows attackers to crash the browser or corrupt its memory by tricking users into visiting a specially crafted webpage. The attacker needs the victim to click a link or visit a malicious site—no special privileges are required. Chrome versions before 149.0.7827.103 are affected.

• CVE-2026-11630HIGH 8.8

  Google Chrome versions prior to 149.0.7827.103 contain a use-after-free vulnerability in its file input handling. An attacker can craft a malicious HTML page that, when visited by a user, triggers improper memory management in Chrome's file handling code. This allows the attacker to corrupt memory on the victim's computer, potentially leading to arbitrary code execution. The vulnerability requires user interaction (visiting a malicious webpage) but affects users across Windows, macOS, and Linux systems.

• CVE-2026-11633HIGH 8.8

  Google Chrome on macOS contains a use-after-free vulnerability in its Bluetooth handling code. This flaw allows a remote attacker to execute arbitrary code on a victim's machine if that person connects to or interacts with a malicious Bluetooth peripheral while using an unpatched version of Chrome. The vulnerability affects Chrome versions prior to 149.0.7827.103 on Mac systems.

• CVE-2026-11637HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's Views component on macOS that allows attackers to execute arbitrary code on a victim's machine. The flaw is triggered when a user visits a specially crafted webpage, requiring no special privileges or complex setup. Google has classified this as a critical severity issue in the underlying Chromium project. This vulnerability affects Chrome versions prior to 149.0.7827.103 on macOS systems.

• CVE-2026-11646HIGH 8.8

  A use-after-free flaw in Google Chrome's ViewTransitions feature allows attackers to run arbitrary code within Chrome's sandbox by tricking users into visiting a malicious website. The vulnerability exists in Chrome versions before 149.0.7827.103 and requires user interaction—specifically clicking or otherwise engaging with a crafted HTML page. While the code runs in a sandboxed environment (limiting direct system access), it still represents a significant threat because sandbox escapes are a known attack progression.

• CVE-2026-11648HIGH 8.8

  A use-after-free memory flaw exists in Google Chrome's full-screen functionality on Windows. An attacker can craft a malicious web page that, when visited, exploits this flaw to corrupt the browser's memory heap. This could allow the attacker to execute arbitrary code on the victim's machine with the same privileges as the user running Chrome. The vulnerability requires user interaction (clicking or navigating to the malicious page) but no special privileges or complex setup.

• CVE-2026-11649HIGH 8.8

  Google Chrome versions before 149.0.7827.103 contain a use-after-free vulnerability in the V8 JavaScript engine that allows attackers to execute arbitrary code within the Chrome sandbox by serving a malicious HTML page. The flaw requires user interaction (clicking a link or visiting a site) but does not require special privileges. While the sandbox limits the immediate blast radius, successful exploitation could grant an attacker control over the browser process and access to user data like credentials, session tokens, and browsing history.

• CVE-2026-11650HIGH 8.8

  A use-after-free flaw in Google Chrome's V8 JavaScript engine allows attackers to execute arbitrary code within the browser's sandbox by tricking users into visiting a malicious website. The vulnerability affects Chrome versions before 149.0.7827.103 and requires user interaction (clicking a link or visiting a page). While the code runs in a sandboxed environment, successful exploitation could allow attackers to break out of the sandbox or pivot to other browser features, making this a serious but not trivial attack vector.

• CVE-2026-11657HIGH 8.8

  Google Chrome on macOS contains a use-after-free memory flaw in its Payments feature that allows an attacker to run malicious code on a user's machine. The vulnerability is triggered when a user visits a specially crafted website, making it relatively easy to exploit in the wild. Chrome versions before 149.0.7827.103 on macOS are affected. This is a remote code execution risk that requires user interaction (clicking a link or visiting a site) but no special privileges.

• CVE-2026-11664HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's Payments component that could allow an attacker to corrupt browser memory and potentially execute arbitrary code. An attacker would need to trick a user into visiting a malicious website to trigger the flaw. The issue affects Chrome versions prior to 149.0.7827.103 and is considered high-severity by Google's security team.

• CVE-2026-11670HIGH 8.8

  A use-after-free vulnerability in Google Chrome's PDF renderer allows attackers to run malicious code within the browser's sandbox by crafting a specially designed PDF file. The attack requires user interaction—specifically, opening a malicious PDF—but once triggered, it can lead to complete compromise of the affected browser process. This affects Chrome versions prior to 149.0.7827.103 across Windows, macOS, and Linux systems.

• CVE-2026-11673HIGH 8.8

  A use-after-free vulnerability in Google Chrome's InterestGroups feature allows attackers to execute arbitrary code within the browser's sandbox by tricking users into visiting a malicious webpage. The vulnerability affects Chrome versions prior to 149.0.7827.103 and can be exploited without requiring user privileges beyond normal web browsing.

• CVE-2026-11674HIGH 8.8

  A use-after-free flaw in Google Chrome's Guest View feature allows attackers to run malicious code within the browser sandbox by tricking users into visiting a specially crafted webpage. While the exploit runs in a sandboxed environment, a successful attack could still compromise sensitive data or enable further system compromise. The vulnerability affects Chrome versions before 149.0.7827.103 and requires user interaction to trigger.

• CVE-2026-11680HIGH 8.8

  Google Chrome contains a use-after-free vulnerability in its Media component that could allow an attacker to run malicious code within Chrome's sandbox by tricking a user into visiting a specially crafted website. The flaw affects Windows systems running Chrome versions prior to 149.0.7827.103. While the exploit requires user interaction (clicking a link or visiting a site), the potential impact is severe: an attacker could steal sensitive data, modify files, or cause denial of service, all while operating within Chrome's restricted sandbox environment.

• CVE-2026-11681HIGH 8.8

  A use-after-free vulnerability exists in the Ozone display layer of Google Chrome on Linux systems. An attacker can craft a malicious HTML page that, when visited by a user, triggers improper memory management and causes heap corruption. This can lead to a crash or arbitrary code execution on the victim's machine. The vulnerability requires user interaction (clicking a link or visiting a site) but does not require any special browser configuration or elevated privileges.

• CVE-2026-11683HIGH 8.8

  Google Chrome contains a use-after-free vulnerability in its WebCodecs component that allows remote attackers to execute arbitrary code within the browser sandbox. An attacker would need to trick a user into visiting a specially crafted webpage to trigger the flaw. Once exploited, the attacker gains code execution privileges within Chrome's sandbox environment, which limits but does not eliminate the potential for system compromise depending on sandbox escape possibilities.

• CVE-2026-11687HIGH 8.8

  A memory safety flaw in Google Chrome's graphics rendering engine (Dawn) on macOS allows attackers to corrupt memory on a victim's computer by tricking them into visiting a malicious website. The vulnerability exists in Chrome versions before 149.0.7827.103 and can lead to complete compromise of the affected system.

• CVE-2026-11698HIGH 8.8

  Google Chrome on macOS contains a use-after-free vulnerability in its Bluetooth handling code that allows attackers to corrupt heap memory when a victim visits a malicious website. The vulnerability affects Chrome versions before 149.0.7827.103 and requires user interaction (clicking a link or visiting a site) but does not require special privileges. Successful exploitation can lead to data theft, system compromise, or application crash.

• CVE-2026-11699HIGH 8.8

  A use-after-free vulnerability exists in the Bluetooth component of Google Chrome on macOS. An attacker can craft a malicious webpage that, when visited by a user, exploits this flaw to corrupt the browser's memory and potentially execute arbitrary code. The vulnerability requires user interaction (visiting a link or webpage) but does not require the victim to have any special privileges. Google has assigned it high severity and has released a patch in Chrome version 149.0.7827.103.

• CVE-2026-11933HIGH 8.8

  MongoDB Server contains a use-after-free vulnerability in its server-side JavaScript engine when processing BSON documents. An authenticated user with read access who can execute server-side JavaScript code—through operators like $where or $function—can trigger the server to read memory that has already been freed. This can leak sensitive data from the mongod process or crash the server entirely.

• CVE-2026-12007HIGH 8.8

  A use-after-free vulnerability in Google Chrome's core rendering engine on Windows allows attackers to execute arbitrary code by tricking users into visiting a malicious webpage. The flaw exists in memory management logic—when Chrome processes certain HTML constructs, it may attempt to access memory that has already been freed, enabling an attacker to overwrite that freed memory with malicious code. No special user privileges or system access are required; the attack succeeds if a user simply visits a crafted page in a vulnerable Chrome version.

• CVE-2026-12020HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's Autofill feature on macOS. When a user visits a malicious website, an attacker can craft HTML that triggers heap memory corruption. The flaw allows potential arbitrary code execution with the same privileges as the Chrome browser process. All macOS users running Chrome versions prior to 149.0.7827.115 are at risk.

• CVE-2026-12035HIGH 8.8

  Google Chrome on Windows contains a use-after-free vulnerability in its Views component that could allow an attacker to corrupt memory on a victim's computer. The flaw requires user interaction—clicking or interacting with a malicious webpage—but once triggered, an attacker could potentially execute arbitrary code with the privileges of the Chrome process. This is a remote attack that does not require the victim to install software or bypass authentication.

• CVE-2026-12291HIGH 8.8

  CVE-2026-12291 is a use-after-free vulnerability in Firefox and Thunderbird's HTTP networking component. When a browser or email client processes certain HTTP interactions, freed memory can be incorrectly accessed, allowing an attacker to execute arbitrary code on the user's system. The vulnerability requires user interaction—such as clicking a malicious link or visiting a compromised website—but does not require any special system privileges. An attacker with network access can deliver the exploit to any user.

• CVE-2026-12439HIGH 8.8

  Google Chrome contains a use-after-free vulnerability in its Digital Credentials component that could allow an attacker to corrupt heap memory and potentially execute arbitrary code. The flaw requires user interaction—specifically, visiting a specially crafted webpage—but poses a critical risk because it affects a widely deployed browser across multiple operating systems. Users running Chrome versions prior to 149.0.7827.155 are at risk.

• CVE-2026-12441HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's file input handling on Linux systems. An attacker can craft a malicious HTML page that, when visited by a user, exploits this memory safety flaw to corrupt the browser's heap and potentially execute arbitrary code. The vulnerability affects Chrome versions prior to 149.0.7827.155 and requires user interaction (clicking or interacting with the page).

• CVE-2026-12442HIGH 8.8

  A use-after-free flaw in Google Chrome's password handling on Android allows remote attackers to run malicious code on a victim's device. An attacker could craft a deceptive HTML page that, when visited by an Android user, exploits freed memory in Chrome's password system to gain arbitrary code execution. This is a critical-severity bug that requires user interaction—the victim must visit the malicious page—but once triggered, can fully compromise the device.

• CVE-2026-12443HIGH 8.8

  A use-after-free vulnerability in Google Chrome's Web Authentication subsystem allows attackers to execute arbitrary code by tricking users into visiting a malicious website. The flaw affects Chrome versions before 149.0.7827.155 across Windows, macOS, and Linux. An attacker would need to craft a deceptive HTML page and convince a user to visit it; successful exploitation grants the attacker the same privileges as the compromised browser process.

• CVE-2026-12452HIGH 8.8

  A use-after-free memory flaw in Google Chrome's Downloads feature on Android devices allows an attacker to corrupt heap memory and potentially take control of your browser by getting you to visit a malicious website. No special user permissions or browser configuration is required—the vulnerability triggers automatically when you land on a crafted page. The issue is confirmed fixed in Chrome version 149.0.7827.155 and later.

• CVE-2026-13026HIGH 8.8

  A use-after-free flaw in Chrome's Digital Credentials feature on macOS could let an attacker trick a user into visiting a malicious webpage, potentially corrupting Chrome's memory and achieving arbitrary code execution. The vulnerability affects Chrome versions before 149.0.7827.197 on Apple's macOS platform.