By weakness (CWE)

CWE-457: related vulnerabilities

CVEs classified under CWE-457. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

67 published vulnerabilities

• CVE-2026-13825HIGH 8.8

  Google Chrome contains a flaw where certain memory in the browser's graphics component (Dawn) is not properly initialized before use. An attacker who crafts a malicious HTML page can trigger this condition and potentially corrupt the heap memory that Chrome relies on, leading to crashes or, in the worst case, arbitrary code execution. The vulnerability requires user interaction—the victim must visit the malicious page—but once they do, the attack executes with no additional privileges needed.

• CVE-2026-15132HIGH 8.8

  A vulnerability in Google Chrome's V8 JavaScript engine allows attackers to execute malicious code within the browser's sandbox by tricking users into visiting a specially crafted webpage. The flaw stems from improper handling of uninitialized variables, creating a memory safety issue that can be exploited without requiring special user permissions or authentication. This is a remote code execution (RCE) vulnerability that affects Chrome versions prior to 150.0.7871.115.

• CVE-2026-10960HIGH 8.3

  CVE-2026-10960 is a sandbox escape vulnerability in Google Chrome's video codec handling. An attacker who has already compromised Chrome's renderer process—the sandboxed component responsible for processing web content—can exploit an uninitialized variable in the codec logic to break out of the sandbox and gain full system access. The attack requires a crafted HTML page and user interaction, but once the renderer is compromised, the attacker can leverage this flaw to escalate to native code execution outside Chrome's security boundary.

• CVE-2026-14413HIGH 8.3

  Google Chrome contains a flaw in ANGLE (Almost Native Graphics Layer Engine), its graphics abstraction layer, where certain variables are not properly initialized before use. An attacker who has already compromised Chrome's renderer process—the sandbox component that runs web content—can exploit this uninitialized memory to potentially break out of the sandbox entirely, gaining full system access. The vulnerability requires user interaction (visiting a malicious webpage) but affects versions before 150.0.7871.46.

• CVE-2026-9972HIGH 8.3

  A vulnerability in Google Chrome on macOS could allow an attacker to escape the browser's security sandbox if the attacker has already compromised Chrome's renderer process. The flaw stems from uninitialized memory in the gamepad handling code. An attacker would need to trick a user into visiting a malicious website while Chrome is running, and would require a prior compromise of the renderer—a critical prerequisite that significantly limits real-world exploitation scenarios. Once exploited, the attacker could potentially gain full system access beyond Chrome's normal restrictions.

• CVE-2026-9963HIGH 7.5

  A memory initialization flaw in Google Chrome for iOS (versions before 148.0.7778.216) could allow an attacker to run malicious code within the browser's sandbox if a user visits a crafted webpage and performs specific touch interactions. The vulnerability requires active user engagement to exploit—simply landing on a malicious site is not enough. Code execution remains confined to the browser sandbox, limiting direct system compromise but still posing a meaningful threat to user data and browser security.

• CVE-2026-10973HIGH 7.4

  A flaw in Google Chrome's Dawn graphics component allowed attackers to extract sensitive data across website boundaries through a specially crafted web page. The vulnerability required user interaction (clicking or visiting a malicious page) but did not require any special privileges. An attacker could craft HTML that exploits uninitialized memory in Chrome's graphics processing to read data from other origins that should have been isolated, potentially exposing authentication tokens, personal information, or other sensitive content loaded in the same browser session.

• CVE-2026-10976HIGH 7.4

  A memory disclosure vulnerability exists in Google Chrome's graphics engine (Dawn) that could allow an attacker to read sensitive data from Chrome's process memory. The flaw stems from uninitialized variables being used without proper initialization checks. An attacker would need to trick a user into visiting a specially crafted webpage to trigger the vulnerability. The issue affects Chrome versions before 149.0.7827.53.

• CVE-2026-10008MEDIUM 6.5

  Google Chrome on Android contains an uninitialized memory flaw in the GPU rendering pipeline that could allow an attacker to extract sensitive data from the browser process. An attacker would craft a malicious HTML page that, when loaded by a user, exploits how the GPU handles uninitialized memory regions—leaking fragments of previously-used data that may contain sensitive information. This is a memory disclosure vulnerability, not a code execution flaw, but information leaks can enable follow-on attacks or expose credentials, tokens, and personal data.

• CVE-2026-10977MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in Skia (Chrome's graphics rendering engine) that could allow an attacker who has already compromised your browser's renderer process to steal data from websites you visit. The attacker would need to trick you into viewing a specially crafted webpage. This is a real but narrowly scoped risk—it requires the renderer to already be under attacker control, limiting the immediate threat from casual browsing.

• CVE-2026-10994MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in the ANGLE graphics library that can leak sensitive data from your browser's memory. An attacker can craft a malicious webpage that, when you visit it, reads uninitialized memory and potentially extracts information like passwords, tokens, or other private data. The vulnerability requires user interaction (clicking or viewing the page) but does not require special browser permissions.

• CVE-2026-11033MEDIUM 6.5

  A memory initialization flaw in Chrome's WebML component on macOS allows attackers to steal sensitive data. When a user visits a malicious webpage, the browser may leak uninitialized memory contents—potentially exposing passwords, tokens, or other private information—without requiring any special user interaction beyond loading the page. The issue affects Chrome versions before 149.0.7827.53 on Apple's macOS.

• CVE-2026-11039MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in Skia (the graphics rendering engine) that could allow an attacker to trick users into visiting a malicious webpage and leak sensitive data from other websites the user has open. The vulnerability requires user interaction—clicking or visiting a link—but does not require any special system privileges. Once triggered, an attacker could read private information from cross-origin sources, such as data from other tabs or windows.

• CVE-2026-11057MEDIUM 6.5

  A flaw in the Skia graphics library used by Chrome allows attackers who have already compromised a browser's rendering engine to read sensitive data from memory by sending a specially crafted web page. The vulnerability requires two conditions: the attacker must first gain control of the renderer process (typically through a separate vulnerability), and the user must visit the malicious page. Once both are true, uninitialized memory regions become readable, potentially exposing passwords, tokens, or other sensitive information that happen to be in RAM.

• CVE-2026-11064MEDIUM 6.5

  A race condition in Google Chrome's GPU rendering engine on Android devices allows an attacker who has already compromised the renderer process to steal data from websites you're visiting. The attacker would trick you into viewing a specially crafted webpage, which exploits a timing gap in how the GPU handles memory to read sensitive information across security boundaries. This is a real but limited threat because the attacker must first gain control of Chrome's renderer—a significant prerequisite.

• CVE-2026-11067MEDIUM 6.5

  Google Chrome versions prior to 149.0.7827.53 contain a memory safety vulnerability in the Dawn graphics component that allows attackers to steal sensitive data from browser process memory. An attacker crafts a malicious webpage that, when visited, exploits the uninitialized memory access to leak information that could include cached passwords, session tokens, or other private data. The attack requires user interaction (visiting the page) but works across networks without special privileges.

• CVE-2026-11087MEDIUM 6.5

  A memory safety issue in Google Chrome's ANGLE graphics library allows an attacker who has already compromised the renderer process to steal sensitive data from other websites. The vulnerability requires user interaction (visiting a malicious web page) and affects Chrome on Windows, macOS, and Linux. The attacker gains read-only access to cross-origin data, meaning they cannot modify it or crash the browser, but confidentiality is at risk.

• CVE-2026-11089MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a memory disclosure vulnerability in its media handling code. If an attacker gains control of Chrome's renderer process—the component responsible for displaying web content—they can craft a malicious HTML page to read uninitialized data from memory, potentially exposing sensitive information like passwords, encryption keys, or other confidential data. The vulnerability requires a prior compromise of the renderer, meaning it's typically chained with another exploit to be effective in the wild.

• CVE-2026-11090MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in the ANGLE graphics library that can be exploited to leak data across website boundaries. An attacker could craft a malicious webpage that, when visited, causes Chrome to inadvertently expose sensitive information from other origins a user has open. This requires user interaction (visiting the malicious page) but does not require special privileges. The vulnerability affects Windows, macOS, and Linux systems running vulnerable Chrome versions.

• CVE-2026-11101MEDIUM 6.5

  A vulnerability in Google Chrome's Dawn graphics library allows attackers to steal sensitive data from other websites when a user visits a malicious web page. The flaw stems from uninitialized memory being used improperly, potentially exposing information the attacker shouldn't be able to access. Chrome versions before 149.0.7827.53 on Windows are affected.

• CVE-2026-11104MEDIUM 6.5

  CVE-2026-11104 is a memory information disclosure flaw in ANGLE, a graphics abstraction library used by Google Chrome. An attacker who has already compromised Chrome's renderer process can craft a malicious HTML page to read uninitialized memory and leak sensitive data. This is not a trivial attack—it requires the renderer to be compromised first—but once that foothold exists, the vulnerability can amplify the damage by exposing additional secrets from the browser process. Chrome versions before 149.0.7827.53 are vulnerable.

• CVE-2026-11109MEDIUM 6.5

  A vulnerability in the ANGLE graphics library used by Google Chrome can leak sensitive data from websites you're viewing to an attacker. An attacker would need to trick you into visiting a specially crafted webpage, but requires no special browser extensions or user interaction beyond visiting the page. The vulnerability affects Chrome versions prior to 149.0.7827.53 on Windows, macOS, and Linux systems.

• CVE-2026-11110MEDIUM 6.5

  A flaw in Google Chrome's graphics rendering engine (ANGLE) can leak sensitive data from websites you visit to attackers. The vulnerability exists in Chrome versions before 149.0.7827.53 and requires a user to click on or interact with a malicious webpage. When exploited, it exposes confidential information that should remain isolated between different websites.

• CVE-2026-11123MEDIUM 6.5

  A flaw in ANGLE (the graphics abstraction layer used by Google Chrome) allows attackers to trick users into visiting a malicious website that reads sensitive information directly from Chrome's memory. The vulnerability was patched in Chrome version 149.0.7827.53. Because it requires user interaction (clicking a link or visiting a page), it's less critical than remotely exploitable flaws, but the memory disclosure risk—potentially exposing authentication tokens, cached data, or other secrets—warrants prompt patching.

• CVE-2026-11137MEDIUM 6.5

  CVE-2026-11137 is a memory disclosure vulnerability in ANGLE, the graphics abstraction layer used by Google Chrome. A remote attacker can trick a user into visiting a specially crafted webpage that reads uninitialized memory from the Chrome process, potentially exposing sensitive data like passwords, tokens, or other information temporarily stored in RAM. The attack requires user interaction (clicking a link or visiting a malicious site) but no special privileges. This affects Chrome versions prior to 149.0.7827.53 across Windows, macOS, and Linux.

• CVE-2026-11138MEDIUM 6.5

  A memory initialization flaw in Google Chrome's ANGLE graphics component allows attackers to expose sensitive data across different websites when users visit a malicious webpage. An attacker would need to craft a specially designed HTML page and trick a user into viewing it; the vulnerability itself requires no special browser configuration and affects all major operating systems where Chrome runs.

• CVE-2026-11141MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in the audio subsystem that can leak sensitive data from memory. An attacker who has already compromised the renderer process—the component that executes web content—can craft a malicious HTML page to read uninitialized memory and extract potentially confidential information. This requires an existing foothold in the renderer, making it a secondary-stage exploitation technique rather than a direct entry vector.

• CVE-2026-11268MEDIUM 6.5

  A vulnerability in Google Chrome's ANGLE graphics library on Windows allows an attacker to steal sensitive data from websites you visit. The flaw stems from uninitialized memory being used during graphics processing, which can leak information across security boundaries. An attacker would need to trick you into visiting a malicious webpage to exploit this—the vulnerability cannot be triggered remotely without user interaction. Chrome version 149.0.7827.53 and later patch this issue.

• CVE-2026-13833MEDIUM 6.5

  A memory initialization flaw in Chrome's graphics engine (ANGLE) on macOS allows attackers to steal sensitive data from websites you visit. An attacker hosting a malicious webpage can craft it to trigger the vulnerability when you visit—no special user interaction beyond normal browsing is required beyond clicking a link. The leaked data remains confined to your current browser session, but the confidentiality risk is material.

• CVE-2026-13923MEDIUM 6.5

  A flaw in Google Chrome's GPU rendering system on Android allows attackers to trick users into visiting a malicious website that extracts sensitive data from the browser's memory. The vulnerability stems from uninitialized memory in the GPU component—essentially, data that should have been cleared wasn't, leaving fragments of previous operations exposed. An attacker can craft a specially designed webpage that, when viewed by a Chrome user on Android, reads this uninitialized memory and exfiltrates information. Chrome version 150.0.7871.47 and later patch this issue.

• CVE-2026-13940MEDIUM 6.5

  Google Chrome versions before 150.0.7871.47 contain a flaw in how the Cast feature handles uninitialized memory during type conversion. An attacker positioned on the same local network as a victim can send specially crafted network packets to trigger this bug, potentially reading sensitive data from Chrome's process memory without requiring user interaction or special privileges. The vulnerability is classified as medium severity.

• CVE-2026-13943MEDIUM 6.5

  Google Chrome on Android contains a flaw where uninitialized memory in the CSS rendering engine can leak sensitive data to attackers. An attacker crafts a malicious webpage and tricks a user into visiting it; the browser then exposes fragments of process memory—potentially containing passwords, tokens, or other confidential information—that the attacker can read. This affects Chrome versions before 150.0.7871.47 on Android.

• CVE-2026-13958MEDIUM 6.5

  Google Chrome on Windows contains a memory safety bug in its codec handling that can leak sensitive information to attackers. When a user visits a specially crafted webpage, Chrome may fail to properly initialize certain codec variables, allowing the attacker to read unencrypted data from the browser's memory. This is a confidentiality risk—attackers cannot modify or destroy data, but they may access things like cached credentials, session tokens, or other sensitive information stored in memory during codec operations.

• CVE-2026-14008MEDIUM 6.5

  A memory disclosure vulnerability exists in Google Chrome's WebXR implementation on Android devices. An attacker can craft a malicious HTML page that, when visited by a user, reads uninitialized memory from the browser process. This could expose sensitive information such as encryption keys, authentication tokens, or other data previously used by the browser. The vulnerability requires user interaction—the victim must visit the crafted page—but does not require any special browser settings or user privileges to exploit.

• CVE-2026-14010MEDIUM 6.5

  Google Chrome on Windows contains a flaw in how it handles certain codec operations, leaving uninitialized memory accessible to attackers. By serving a specially crafted webpage, an attacker can trick a user into visiting a malicious site and extract sensitive data—such as fragments of passwords, encryption keys, or other in-memory secrets—that happened to be nearby in the browser process. This is a memory disclosure vulnerability that requires user interaction (clicking a link or visiting a site) but poses meaningful risk because the leaked data could be valuable to an attacker.

• CVE-2026-14051MEDIUM 6.5

  A memory disclosure vulnerability exists in Google Chrome's GamepadAPI prior to version 150.0.7871.47. An attacker who has already compromised Chrome's renderer process can craft a malicious webpage to read uninitialized memory, potentially exposing sensitive data. The vulnerability requires user interaction (visiting a crafted page) and prior renderer compromise, making it a secondary risk in multi-stage attack chains rather than an entry vector.

• CVE-2026-14070MEDIUM 6.5

  A memory safety vulnerability in Google Chrome's WebNN (Web Neural Network) component allows attackers to leak sensitive data from the browser's memory. An attacker can craft a malicious webpage that, when visited by a user, exploits an integer overflow to read unintended data from the running process. While Chrome classified this as low severity internally, the confidentiality impact warrants attention from a defense perspective.

• CVE-2026-14088MEDIUM 6.5

  A memory leakage vulnerability in Chrome's Canvas rendering on Android devices allows attackers to trick users into visiting a malicious webpage that can read sensitive data from the browser's memory. The attacker needs the user to interact with the page, but no special privileges or complex attack setup is required. Chrome versions prior to 150.0.7871.47 on Android are affected.

• CVE-2026-14125MEDIUM 6.5

  A flaw in the ANGLE graphics library used by Google Chrome can leak sensitive data from a user's computer memory to an attacker through a malicious webpage. When a user visits a crafted HTML page, uninitialized memory containing potentially sensitive information becomes accessible, allowing the attacker to read data that should have been protected. The vulnerability requires user interaction—specifically visiting a malicious site—but no special privileges or complex setup are needed on the attacker's side.

• CVE-2026-14399MEDIUM 6.5

  A memory initialization flaw in Chrome's graphics rendering engine (Dawn) could allow an attacker to trick a user into visiting a specially crafted webpage that reads sensitive data from the browser's memory. The issue affects Chrome versions before 150.0.7871.46 and requires user interaction—the victim must click through or visit a malicious site—but does not require any special system privileges. Once exploited, an attacker gains read access to information already in memory, potentially including cached credentials, session tokens, or other sensitive data processed by the browser.

• CVE-2026-14402MEDIUM 6.5

  A memory disclosure vulnerability in Google Chrome's ANGLE graphics library on Windows allows attackers to leak sensitive data from the browser process. An attacker can craft a malicious HTML page that, when visited by a user, reads uninitialized memory regions. While this does not allow code execution or system compromise, the leaked data could include passwords, session tokens, or other secrets resident in Chrome's memory space.

• CVE-2026-14408MEDIUM 6.5

  Google Chrome versions before 150.0.7871.46 contain a memory initialization flaw in Dawn (Chrome's graphics abstraction layer) that allows attackers to trick users into visiting malicious web pages and potentially read sensitive data from the browser process. The vulnerability requires user interaction—specifically clicking a link or visiting a crafted website—but does not require special permissions or an authenticated account.

• CVE-2026-14421MEDIUM 6.5

  A memory initialization flaw in Google Chrome's graphics library (Dawn) allows an attacker to trick users into visiting a malicious website that leaks sensitive data from the browser's memory. The vulnerability affects Chrome on ChromeOS systems prior to version 150.0.7871.46. While exploitation requires user interaction—clicking a link or visiting a crafted page—the flaw can expose information that might aid further attacks, such as cryptographic keys or session tokens. The impact is information disclosure only; the attacker cannot execute code or crash the system.

• CVE-2026-15109MEDIUM 6.5

  A memory initialization flaw in ANGLE (the graphics abstraction layer used by Chrome) could allow an attacker to trick a user into visiting a malicious website that leaks sensitive data from the browser's memory. The vulnerability requires user interaction—a user must click a link or visit the page—but once there, the flaw enables reading uninitialized memory that may contain passwords, tokens, or other private information.

• CVE-2026-26824MEDIUM 6.5

  libxls, a widely-used library for reading Microsoft Excel files, has a memory safety issue that could allow an attacker to crash applications or potentially leak sensitive information. The vulnerability exists in how the library initializes internal data structures when parsing Excel file containers. An attacker who crafts a malicious Excel file and tricks a user or application into opening it could trigger the vulnerability. This is a moderate-severity issue affecting the library through version 1.6.3.

• CVE-2026-9754MEDIUM 6.5

  CVE-2026-9754 is a medium-severity information disclosure vulnerability in MongoDB that allows an authenticated user holding the read role to extract small amounts of uninitialized stack memory by sending specially crafted filemd5 commands. An attacker with valid database credentials and read permissions can trigger this flaw to leak sensitive data that may reside in memory, such as encryption keys, session tokens, or other confidential information. The vulnerability does not enable privilege escalation, data modification, or denial of service—only unauthorized information disclosure.

• CVE-2026-9917MEDIUM 6.5

  Google Chrome on Android contains a flaw in its WebGL graphics processing that fails to properly initialize memory before use. When a user visits a malicious webpage, an attacker can read sensitive data left in process memory—such as parts of cached images, passwords, or other application state—without needing special permissions or bypass techniques. This affects Chrome versions before 148.0.7778.216 on Android devices.

• CVE-2026-11696MEDIUM 5.3

  Google Chrome on Windows contains a memory safety bug where uninitialized video-handling code can leak sensitive data from the browser's renderer process. An attacker who has already compromised Chrome's renderer (the process that executes web page code) can craft a malicious HTML page to read uninitialized memory, potentially exposing passwords, session tokens, or other data. The flaw requires the renderer to be under attacker control and user interaction to trigger, making it a secondary attack component rather than a direct entry point. Chrome versions prior to 149.0.7827.103 are vulnerable.

• CVE-2026-13023MEDIUM 5.3

  CVE-2026-13023 is a memory disclosure vulnerability in Google Chrome's GPU handling code. If an attacker has already compromised Chrome's renderer process—the sandboxed component that executes web content—they can craft a malicious HTML page to read uninitialized GPU memory, potentially exposing sensitive data from the browser's process memory. This requires two conditions: prior renderer compromise and user interaction with the malicious page. The vulnerability affects Chrome versions before 149.0.7827.197.

• CVE-2026-13030MEDIUM 5.3

  Google Chrome for Android contains a memory initialization flaw in its GPU component that allows attackers to read sensitive information from the browser process. When a user visits a malicious webpage on an affected Android device, the GPU fails to properly initialize memory regions, potentially exposing data such as cached credentials, session tokens, or other process memory contents to the attacker. This is not a crash or denial-of-service issue—the vulnerability specifically enables information disclosure.

• CVE-2026-13947MEDIUM 5.3

  Google Chrome versions before 150.0.7871.47 contain a memory safety issue in the Extended Reality (XR) feature that could let an attacker read sensitive data from the browser's rendering process. The attack requires two preconditions: the renderer process must already be compromised, and the user must interact with a malicious webpage. An attacker cannot exploit this vulnerability through the network alone—they need initial code execution within Chrome's sandbox first.

• CVE-2026-13950MEDIUM 5.3

  Google Chrome versions before 150.0.7871.47 contain a flaw in GPU memory handling that could allow an attacker who has already compromised your browser's renderer process to read sensitive data from memory. The attacker would need to trick you into viewing a specially crafted web page. This is a medium-severity issue that affects confidentiality but not integrity or availability.

• CVE-2026-13969MEDIUM 5.3

  A vulnerability in Google Chrome for Android allows attackers who have already compromised Chrome's renderer process to read sensitive information from memory through a specially crafted webpage. The flaw stems from the use of uninitialized memory in the UI component, which can leak data that was previously stored in that memory location. An attacker would need to first gain control of the renderer process—typically through a separate compromise—making this a secondary attack vector rather than a direct entry point.

• CVE-2026-13970MEDIUM 5.3

  Google Chrome versions prior to 150.0.7871.47 contain a flaw in how the browser handles uninitialized memory in media processing. An attacker who has already compromised Chrome's renderer process—the component that interprets web content—can craft a malicious HTML page that leaks sensitive information from the browser's memory to the attacker. This is not a vulnerability that allows initial system compromise; it requires a prior breach of the renderer process, typically through another security flaw. Once that foothold exists, however, an attacker could extract passwords, authentication tokens, private keys, or other confidential data residing in memory.

• CVE-2026-13971MEDIUM 5.3

  Google Chrome contains a memory safety issue in its Skia graphics library that could allow an attacker to leak sensitive information from the browser's renderer process. If an attacker first compromises the renderer (the part of Chrome that processes web content), they can craft a malicious web page that reads uninitialized memory—data left over from previous operations that shouldn't be accessible. This could expose passwords, session tokens, or other sensitive data. The vulnerability requires the attacker to already have compromised the renderer and requires user interaction to visit the malicious page, making it a secondary concern in most attack chains.

• CVE-2026-9942MEDIUM 5.0

  CVE-2026-9942 is a memory safety issue in ANGLE, the graphics abstraction layer used by Google Chrome. When a remote attacker has already compromised Chrome's renderer process, they can exploit this uninitialized memory condition to break out of Chrome's site isolation sandbox using a specially crafted HTML page. Site isolation is Chrome's primary defense against cross-site data theft; bypassing it allows an attacker to read data from other websites the user is visiting. This requires the renderer process to be already compromised, meaning it is a post-compromise escalation rather than an entry point.

• CVE-2026-11159MEDIUM 4.3

  A memory safety issue in Google Chrome's Skia graphics library allows attackers to steal data from websites you visit. By crafting a malicious HTML page, an attacker could trick your browser into exposing information that should remain private to other websites—a cross-origin data leak. The vulnerability requires user interaction (clicking or viewing the page) but doesn't require special browser settings or authentication. Google patched this in Chrome 149.0.7827.53 and later versions.

• CVE-2026-11668MEDIUM 4.3

  Google Chrome and Chrome OS contain a weakness in their video codec processing that could allow a remote attacker to steal data from other websites. The flaw stems from uninitialized memory in the codec layer—essentially, the browser fails to properly initialize certain memory regions before use. An attacker can craft a malicious video file that, when opened by a user, exploits this memory state to read sensitive information across security boundaries. The vulnerability affects Chrome on Linux and Chrome OS versions prior to 149.0.7827.103.

• CVE-2026-12469MEDIUM 4.3

  A memory initialization flaw in Google Chrome's GPU rendering engine on Android can allow attackers to steal sensitive data from other websites. When you visit a malicious webpage, the attacker could potentially read information from other sites you're currently accessing in different tabs or windows, thanks to uninitialized data being exposed through graphics processing. This is a local attack requiring user interaction—the victim must click on or interact with a crafted link—but the potential for cross-origin data leakage makes it a meaningful security concern for mobile users.

• CVE-2026-14418MEDIUM 4.3

  A vulnerability in Google Chrome's ANGLE graphics library prior to version 150.0.7871.46 could allow an attacker to leak data from other websites if a user visits a malicious page. The issue stems from uninitialized memory being processed in a way that exposes cross-origin information. While the CVSS score is moderate (4.3), the Chromium team rated it as High severity due to the nature of cross-origin data exposure. An attacker would need to trick a user into visiting a crafted HTML page, but no special privileges are required.

• CVE-2026-9921MEDIUM 4.3

  Google Chrome on Android contains a flaw in its WebGL graphics processing where memory buffers may not be properly initialized before use. An attacker can exploit this by crafting a malicious HTML page that, when visited, allows them to read sensitive information from other websites—a cross-origin data leak. The vulnerability requires user interaction (clicking a link or viewing a page) but does not require special privileges or complex attack setup.

• CVE-2026-9935MEDIUM 4.3

  CVE-2026-9935 is a memory safety issue in Google Chrome's ANGLE graphics library that allows attackers to steal sensitive data from other websites. When you visit a malicious webpage, an attacker can craft it to leak information that should be isolated to other sites you have open. The vulnerability requires user interaction—you must visit the attack page—but the bar for exploitation is otherwise low. Google has classified this as High severity internally, though the CVSS score reflects a more limited scope.

• CVE-2026-47330LOW 3.3

  CVE-2026-47330 is a local privilege escalation and cache poisoning vulnerability affecting Ubuntu Linux systems with AppArmor SAUCE patches. An unprivileged user can trigger uninitialized variable handling in AppArmor's notification code, causing incorrect caching of security policy responses. While the CVSS score is low (3.3), the issue undermines AppArmor's integrity by allowing cache corruption that could affect subsequent policy enforcement decisions.

• CVE-2026-47336LOW 3.3

  Ubuntu Linux 6.8 has a bug in its AppArmor security module that could allow an unprivileged local user to bypass or weaken network socket access controls. The issue stems from an uninitialized variable in the code that mediates AF_INET and AF_INET6 (IPv4 and IPv6) socket access. While the vulnerability requires local access and does not enable data theft or system crashes, it undermines the purpose of AppArmor's fine-grained network policy enforcement, potentially allowing a local user to perform network operations that should have been restricted.

• CVE-2026-9920LOW 3.1

  Google Chrome on Android contains a vulnerability in GPU memory handling that could allow an attacker who has already compromised the browser's renderer process to access sensitive data from websites that should be isolated from each other. The vulnerability stems from uninitialized memory in the GPU code path, which under specific conditions could leak cross-origin data through a malicious webpage. This requires the renderer process to be compromised first, making it a secondary exploitation step rather than a direct entry point.

• CVE-2026-9944LOW 3.1

  CVE-2026-9944 is a memory safety issue in the ANGLE graphics library used by Google Chrome. An attacker who has already compromised Chrome's renderer process can craft a malicious webpage to leak sensitive data from other websites or origins. The vulnerability requires the renderer to be compromised first, limiting the attack surface, but the data leakage potential is real once that initial foothold exists. Chrome versions before 148.0.7778.216 are vulnerable on Windows, macOS, and Linux.

• CVE-2026-15168LOW 2.5

  Wireshark's BLF (Binary Logging Format) file parser in recent versions contains a flaw that could leak sensitive information when a user opens a specially crafted BLF file. An attacker would need to trick a user into opening a malicious file locally—this is not a remote attack and requires user interaction. The risk is limited to potential disclosure of small amounts of data; the vulnerability does not enable system compromise, privilege escalation, or denial of service.