By vendor

Google vulnerabilities

Known CVEs affecting Google products, prioritized by severity, with SEC.co remediation and detection guidance.

224 published vulnerabilities · page 1 of 3

• CVE-2026-10002HIGH 8.8

  A use-after-free memory flaw in PDFium, the PDF rendering engine embedded in Google Chrome, allows attackers to corrupt heap memory by tricking users into opening a specially crafted PDF file. The vulnerability affects Chrome versions before 148.0.7778.216 and requires user interaction to trigger. An attacker exploiting this could achieve code execution with the same privileges as the Chrome process.

• CVE-2026-10007HIGH 8.8

  Google Chrome versions prior to 148.0.7778.216 contain a use-after-free memory safety flaw in SVG rendering that allows attackers to execute arbitrary code within the browser's sandbox by tricking users into visiting a malicious webpage. An attacker needs only to craft a deceptive HTML page and convince a user to open it—no special privileges or complex interaction are required beyond the initial click.

• CVE-2026-10013HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's WebCodecs component that could allow an attacker to run malicious code within Chrome's sandbox by tricking a user into visiting a specially crafted website. The vulnerability affects Chrome versions before 148.0.7778.216 and requires user interaction (clicking a link or visiting a page) to be exploited. While the code execution occurs within the sandbox, this still represents a significant security risk as sandbox escapes are a known attack progression path.

• CVE-2026-10015HIGH 8.8

  Google Chrome versions before 148.0.7778.216 contain an integer overflow vulnerability in the WTF (Web Template Framework) component that allows attackers to execute arbitrary code within the browser's sandbox environment. An attacker can exploit this by tricking a user into visiting a specially crafted webpage, leading to potential code execution with the privileges of the browser process.

• CVE-2026-10016HIGH 8.8

  A use-after-free flaw exists in Google Chrome's DOM implementation that allows an attacker to execute code within the browser's sandbox by tricking a user into visiting a malicious website. The vulnerability affects Chrome versions before 148.0.7778.216 and requires user interaction (clicking a link or opening a page) but does not require any special permissions or account privileges.

• CVE-2026-10019HIGH 8.8

  A vulnerability in Google Chrome's ANGLE graphics library (versions before 148.0.7778.216) allows attackers to trick users into visiting a malicious webpage that leaks sensitive data from other websites the user is currently viewing. The flaw stems from improper handling of large numbers in memory calculations, which an attacker can exploit to read cross-origin information that should remain isolated. Users on Windows, macOS, and Linux systems running affected Chrome versions are at risk.

• CVE-2026-10021HIGH 8.8

  Google Chrome versions before 148.0.7778.216 contain a vulnerability in USB input handling that allows attackers to execute arbitrary code on a user's computer by tricking them into visiting a malicious website. The flaw stems from insufficient validation of untrusted data, meaning Chrome doesn't properly check or sanitize input before processing it through the USB subsystem. An attacker would need to craft a deceptive HTML page and convince a user to visit it, but once clicked, the attack requires no special privileges and can fully compromise the affected system.

• CVE-2026-10882HIGH 8.8

  Google Chrome contains a use-after-free vulnerability in its network handling code that can allow attackers to execute arbitrary code on a user's system. The flaw affects Chrome versions prior to 149.0.7827.53 and is triggered when a victim visits a specially crafted webpage. Because successful exploitation requires user interaction (visiting a malicious site), the attack surface is primarily limited to social engineering scenarios, though the browser's ubiquity makes this a meaningful threat.

• CVE-2026-10883HIGH 8.8

  A type confusion vulnerability in Google Chrome's ANGLE graphics library allows attackers to corrupt heap memory through specially crafted web pages. The flaw requires user interaction (visiting a malicious site) but can lead to complete system compromise—confidentiality, integrity, and availability are all at risk. Chrome versions before 149.0.7827.53 are affected.

• CVE-2026-10885HIGH 8.8

  A use-after-free vulnerability exists in Chrome for iOS that allows attackers to execute arbitrary code on an iPhone or iPad by tricking users into visiting a malicious webpage. The flaw affects Google Chrome on iOS versions before 149.0.7827.53. Because it requires user interaction (clicking a link or viewing a page) but needs no special privileges, it poses a meaningful risk to mobile users, particularly if weaponized through social engineering or drive-by downloads.

• CVE-2026-10888HIGH 8.8

  Google Chrome versions before 149.0.7827.53 contain a use-after-free memory vulnerability in the Cast Streaming feature that allows attackers on your local network to run arbitrary code on affected machines. An attacker doesn't need valid credentials or user interaction to exploit this—just the ability to send crafted network traffic to a vulnerable Chrome instance. This is a serious vulnerability because it bridges network access to code execution on systems within the same network segment.

• CVE-2026-10890HIGH 8.8

  Google Chrome contains a use-after-free vulnerability in its Cast functionality that could allow an attacker on your local network to corrupt the browser's memory and potentially execute malicious code. The flaw affects Chrome versions prior to 149.0.7827.53 and requires no user interaction to trigger—an attacker simply needs to send specially crafted network traffic to exploit it. This is a local network attack vector, meaning the attacker must be on the same network segment as the target system.

• CVE-2026-10891HIGH 8.8

  A use-after-free vulnerability in Google Chrome's graphics (GFX) component allows an attacker to corrupt Chrome's memory by tricking a user into visiting a malicious webpage. Once the memory is compromised, the attacker could read sensitive data, modify page content, or crash the browser. The issue affects Chrome on Linux systems running versions before 149.0.7827.53.

• CVE-2026-10893HIGH 8.8

  A use-after-free memory vulnerability exists in Google Chrome's Chromoting remote desktop feature that could allow an attacker to run malicious code on a victim's computer through specially crafted network traffic. The flaw affects Chrome versions before 149.0.7827.53 and requires user interaction to trigger. The vulnerability has been assigned a CVSS score of 8.8 (High severity).

• CVE-2026-10895HIGH 8.8

  A use-after-free vulnerability in Chrome's Ozone component allows attackers to run arbitrary code on a user's computer by tricking them into visiting a malicious website. The flaw exists in versions of Chrome before 149.0.7827.53 and requires user interaction (clicking a link, visiting a page) but no special privileges. Once exploited, an attacker gains full control over the affected browser process and potentially the underlying system.

• CVE-2026-10896HIGH 8.8

  A use-after-free vulnerability in Chrome for iOS allows attackers to execute arbitrary code on affected devices when a user visits a malicious website. The flaw exists in memory management within Chrome's iOS implementation and does not require any special user interaction beyond visiting a crafted HTML page. Google has assigned this a Critical severity rating within Chromium's internal severity scale, and CVSS scoring reflects it as HIGH (8.8).

• CVE-2026-10897HIGH 8.8

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in how the GPU rendering engine handles certain HTML constructs. An attacker can craft a malicious web page that, when visited by a user, exploits this flaw to break out of Chrome's security sandbox—the isolation layer that normally prevents malicious code from accessing the underlying operating system. This is a serious issue because sandbox escapes give attackers direct access to your computer's resources, files, and credentials.

• CVE-2026-10902HIGH 8.8

  A use-after-free memory vulnerability exists in Chrome's Ozone component that allows attackers to execute arbitrary code by tricking users into visiting a specially crafted webpage. The flaw requires user interaction (clicking a link or visiting a site) but poses a critical threat because successful exploitation grants full control over the browser process and potentially the underlying system.

• CVE-2026-10903HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's WebRTC implementation that allows an attacker to execute arbitrary code within Chrome's sandbox by convincing a user to visit a malicious website. The vulnerability affects Chrome versions prior to 149.0.7827.53 and can lead to complete compromise of the browser process, including reading sensitive data, modifying content, and disrupting availability.

• CVE-2026-10904HIGH 8.8

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in the V8 JavaScript engine that allows attackers to break out of the browser sandbox and run malicious code with full privileges. An attacker can exploit this by tricking a user into visiting a specially crafted website. Once triggered, the vulnerability bypasses Chrome's security boundary—the sandbox that normally isolates web content from the rest of the system—giving an attacker direct access to execute arbitrary code on the victim's machine.

• CVE-2026-10907HIGH 8.8

  A memory safety vulnerability in Google Chrome's ANGLE rendering library allows an attacker to craft a malicious webpage that, when visited by a user, could corrupt the browser's memory heap. This out-of-bounds write flaw can lead to code execution with the privileges of the user running Chrome. The vulnerability requires user interaction—someone must visit the compromised or attacker-controlled page—but needs no special browser configuration or user permissions to trigger the exploit.

• CVE-2026-10910HIGH 8.8

  Google Chrome contains a type confusion vulnerability in its V8 JavaScript engine that allows an attacker to execute arbitrary code within the browser's sandbox by sending a specially crafted HTML page to a user. The vulnerability requires user interaction (clicking a link or visiting a malicious site) but no special privileges. Once exploited, an attacker gains the ability to run code inside the sandbox, potentially leading to data theft, credential capture, or lateral movement to the underlying system.

• CVE-2026-10913HIGH 8.8

  A use-after-free vulnerability exists in the ANGLE graphics library component of Google Chrome on Windows. An attacker can craft a malicious HTML page that, when visited by a user, triggers memory corruption within Chrome's sandbox environment. While the sandbox limits direct system compromise, successful exploitation allows arbitrary code execution within that sandboxed context, potentially leading to data theft, credential capture, or lateral movement attempts. The vulnerability requires user interaction (visiting a malicious page) but no special privileges.

• CVE-2026-10914HIGH 8.8

  A use-after-free vulnerability in ANGLE (the graphics abstraction layer used by Chrome on Windows) allows an attacker to execute code within Chrome's sandbox by tricking a user into visiting a malicious website. The vulnerability affects Chrome versions before 149.0.7827.53 and requires user interaction (visiting a crafted HTML page) but does not require any special privileges. Once exploited, the attacker gains the capabilities of the Chrome sandbox process, which is a significant security boundary but still constrains their access compared to the host system.

• CVE-2026-10922HIGH 8.8

  CVE-2026-10922 is a same-origin policy bypass vulnerability in Google Chrome's Developer Tools that allows an attacker to access data or perform actions they normally shouldn't be able to. The flaw stems from inadequate validation of untrusted input, meaning malicious network traffic can exploit it if a user performs certain interactions with the DevTools interface. While the attack requires user interaction, it carries significant impact—unauthorized access to sensitive information, unauthorized modifications, or disruption of services are all possible. The vulnerability affects Chrome versions prior to 149.0.7827.53 across Windows, macOS, and Linux systems.

• CVE-2026-10923HIGH 8.8

  A use-after-free memory flaw in Google Chrome's web app installation feature for Android allows a local attacker to crash the browser or execute arbitrary code by providing a malicious file. The vulnerability affects Chrome versions before 149.0.7827.53 and requires user interaction (opening or installing a crafted app). While the attack requires local access and user involvement, the consequences—including full system compromise through code execution—make this a significant risk for Android users.

• CVE-2026-10926HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's Cast functionality that allows an attacker positioned on the same local network to execute arbitrary code on an affected system. The flaw requires no user interaction and can be triggered through specially crafted network traffic. This is a local network attack with high impact—an attacker gaining code execution can read sensitive data, modify system files, and disrupt operations.

• CVE-2026-10928HIGH 8.8

  A script injection vulnerability in Google Chrome's Headless mode allows attackers to execute arbitrary code on a user's system through a malicious HTML page. The flaw requires user interaction—specifically, the victim must open a crafted webpage in an affected Chrome version—but once triggered, an attacker gains the same privileges as the user running the browser, including the ability to read files, modify data, or install malware.

• CVE-2026-10932HIGH 8.8

  Google Chrome for Android contains a use-after-free vulnerability in its UI handling that allows an attacker to send a malicious HTML page to a user. If the user opens it, the flaw can corrupt Chrome's memory and potentially give the attacker control over the browser. The vulnerability was present in Chrome versions before 149.0.7827.53 on Android devices.

• CVE-2026-10935HIGH 8.8

  A type confusion vulnerability in Google Chrome's V8 JavaScript engine allows attackers to execute arbitrary code within the browser's sandbox by tricking users into visiting a malicious website. The vulnerability affects Chrome versions prior to 149.0.7827.53 and requires user interaction (clicking a link or visiting a page). While the code executes within the sandbox, successful exploitation could allow attackers to read, modify, or delete user data accessible to the browser.

• CVE-2026-10936HIGH 8.8

  A type confusion flaw in Chrome's V8 JavaScript engine allows attackers to execute arbitrary code within the browser's sandbox by tricking users into viewing a specially crafted webpage. The vulnerability requires user interaction (clicking a link or visiting a site) but no authentication or special privileges. Successful exploitation could give an attacker the ability to run malicious code with the same permissions as the Chrome process.

• CVE-2026-10939HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's WebRTC component that allows an attacker to execute arbitrary code within Chrome's sandbox by tricking a user into visiting a malicious webpage. The vulnerability affects Chrome versions prior to 149.0.7827.53 across Windows, macOS, and Linux. While the exploit requires user interaction (clicking a link or visiting a site), the impact is severe: an attacker gains code execution within the browser process.

• CVE-2026-10941HIGH 8.8

  A memory access vulnerability in the Skia graphics engine used by Google Chrome allows attackers to run malicious code within Chrome's sandbox by tricking users into visiting a specially crafted webpage. The attack requires user interaction (clicking a link or visiting a site) but needs no special privileges. While the code runs in a sandbox environment, successful exploitation could compromise data confidentiality, integrity, and availability within that isolated context.

• CVE-2026-10943HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's WebRTC component that allows attackers to execute arbitrary code within the browser's sandbox. An attacker can exploit this by crafting a malicious HTML page that, when visited by a user, triggers the vulnerability. Although the code execution occurs in a sandbox (limiting direct system access), the vulnerability has a CVSS score of 8.8, indicating it poses a significant risk to confidentiality, integrity, and availability. Chrome versions before 149.0.7827.53 are affected.

• CVE-2026-10945HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's PDF handling that allows attackers to execute code within Chrome's sandbox if they can trick a user into performing specific UI interactions with a malicious PDF file. The vulnerability affects Chrome versions prior to 149.0.7827.53 across Windows, macOS, and Linux systems.

• CVE-2026-10947HIGH 8.8

  A use-after-free bug in Google Chrome's WebRTC implementation allows attackers to execute arbitrary code within the browser's sandbox by serving a specially crafted webpage. The vulnerability affects Chrome versions before 149.0.7827.53 and requires user interaction—the victim must visit a malicious page—but once triggered, it grants an attacker near-complete control over the isolated browser process. This is a memory safety issue where freed memory is incorrectly accessed, a common source of high-impact browser exploits.

• CVE-2026-10948HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's WebRTC implementation that allows attackers to run malicious code within the browser's sandbox by tricking users into visiting a crafted webpage. The attacker needs user interaction (clicking a link or visiting a malicious site) but requires no special privileges or system access to exploit it. Once triggered, the vulnerability grants full read, write, and execution capabilities within the sandboxed Chrome process.

• CVE-2026-10951HIGH 8.8

  A use-after-free flaw in Chrome's Autofill feature on iOS allows attackers to corrupt device memory if a user is tricked into performing specific interactions with a malicious webpage. The vulnerability requires user interaction but can lead to complete system compromise—reading sensitive data, modifying files, or crashing the browser.

• CVE-2026-10952HIGH 8.8

  A use-after-free vulnerability in Google Chrome for iOS allows attackers to corrupt memory on affected iPhones by tricking users into visiting a malicious website. The flaw exists in how Chrome handles certain objects in memory after they've been freed, leaving dangling references that an attacker can manipulate through a crafted HTML page. If successfully exploited, this could lead to arbitrary code execution on the victim's device.

• CVE-2026-10954HIGH 8.8

  A use-after-free memory safety bug in Google Chrome's Actor component allows attackers to run malicious code within the browser's sandbox by tricking users into visiting a specially crafted web page. The vulnerability affects Chrome versions before 149.0.7827.53 and requires user interaction—specifically clicking a link or visiting a malicious site—but no special privileges. Once triggered, an attacker gains the ability to read, modify, or delete data and potentially escape the sandbox to affect the underlying operating system.

• CVE-2026-10955HIGH 8.8

  A type confusion vulnerability exists in ANGLE, the graphics abstraction layer used by Google Chrome on Windows. An attacker can craft a malicious web page that, when visited by a user, exploits this flaw to access memory outside intended boundaries. This could lead to information disclosure, data corruption, or system crashes. The vulnerability requires user interaction (visiting a malicious page) but needs no special privileges to trigger.

• CVE-2026-10956HIGH 8.8

  Google Chrome versions before 149.0.7827.53 contain a use-after-free vulnerability in the MimeHandlerView component that could allow an attacker to run malicious code within Chrome's sandbox. An attacker would need to trick a user into visiting a specially crafted webpage to trigger the flaw. If successful, the attacker could gain code execution inside the sandboxed process, potentially compromising user data or enabling further system compromise depending on sandbox escape possibilities.

• CVE-2026-10957HIGH 8.8

  A use-after-free flaw in Chrome's Glic component allows attackers to execute malicious code within the browser's sandbox by tricking users into visiting a specially crafted webpage. The vulnerability requires user interaction but needs no special privileges to exploit. An attacker could gain code execution in a sandboxed context, potentially reading sensitive data or further compromising the system depending on sandbox escape capabilities.

• CVE-2026-10958HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome for iOS that could allow an attacker to execute arbitrary code on a user's iPhone. The flaw requires tricking a user into performing specific gestures (such as taps or swipes) while viewing a malicious webpage. Once exploited, an attacker gains full control over the browser process, potentially compromising sensitive data, installing malware, or pivoting to other device functions. Google has addressed this issue in Chrome version 149.0.7827.53 and later.

• CVE-2026-10959HIGH 8.8

  Google Chrome on Android contains a use-after-free vulnerability in its Input component that could allow an attacker to execute arbitrary code within the browser's sandbox by tricking a user into visiting a malicious website. The vulnerability affects Chrome versions prior to 149.0.7827.53 and requires user interaction (clicking a link or visiting a crafted page) to trigger.

• CVE-2026-10962HIGH 8.8

  A type confusion vulnerability in Google Chrome's media handling allows attackers to execute malicious code within the browser's sandbox through a specially crafted webpage. The vulnerability requires user interaction (visiting a malicious page) but poses significant risk because it bypasses browser security boundaries. Chrome versions prior to 149.0.7827.53 are affected across Windows, macOS, and Linux platforms.

• CVE-2026-10963HIGH 8.8

  A flaw in Google Chrome's V8 JavaScript engine allows attackers to run malicious code within Chrome's security sandbox by tricking users into visiting a specially crafted webpage. The vulnerability stems from an integer overflow—a mathematical error where a number becomes too large for its storage space—that can be exploited without requiring any special permissions or user complexity beyond clicking a link. While the code executes inside the sandbox rather than directly on the operating system, successful exploitation still enables attackers to potentially steal data, modify information, or degrade browser functionality.

• CVE-2026-10964HIGH 8.8

  A flaw in Google Chrome's JavaScript engine (V8) can allow an attacker to run malicious code within the browser's sandbox by tricking a user into visiting a specially crafted webpage. The vulnerability stems from an integer overflow—a type of memory handling error—that undermines the sandbox's security boundary. While the code runs in a confined environment, this still represents a significant security risk because it can be chained with other vulnerabilities to escape the sandbox and compromise the underlying system.

• CVE-2026-10965HIGH 8.8

  A vulnerability in Google Chrome's DevTools allows attackers to execute malicious code within Chrome's sandbox by tricking users into visiting a specially crafted webpage. The flaw stems from an integer overflow—a coding error where a number exceeds its maximum value—that can be exploited without requiring special browser settings or elevated permissions. Chrome versions before 149.0.7827.53 are affected.

• CVE-2026-10975HIGH 8.8

  A use-after-free vulnerability in Google Chrome's WebRTC component allows an attacker to execute arbitrary code within the Chrome sandbox by tricking a user into visiting a specially crafted website. The vulnerability affects Chrome versions prior to 149.0.7827.53 and requires user interaction—specifically clicking a link or visiting a malicious page—but does not require any special privileges. Once exploited, an attacker gains the ability to run code with the same permissions as the Chrome process, potentially compromising sensitive data or escalating further.

• CVE-2026-10978HIGH 8.8

  A use-after-free vulnerability in Google Chrome's Chromoting component allows attackers to execute arbitrary code on Windows systems. An attacker can trigger the flaw by sending specially crafted network traffic to a target who is using Chrome's remote desktop or remote assistance feature. Successful exploitation grants the attacker the same privileges as the Chrome process, potentially leading to complete system compromise. The vulnerability requires user interaction (for example, accepting a remote connection or visiting a malicious site that initiates Chromoting), but otherwise presents a direct path to code execution without requiring special system privileges or authentication.

• CVE-2026-10982HIGH 8.8

  A use-after-free flaw in Google Chrome's WebXR implementation allows attackers to run malicious code within the browser's sandbox by tricking users into visiting a specially crafted webpage. The vulnerability affects Chrome versions before 149.0.7827.53 on Windows, macOS, and Linux. While sandboxed, successful exploitation could compromise user data and enable further attacks. User interaction (clicking a link or visiting a site) is required to trigger the vulnerability.

• CVE-2026-10986HIGH 8.8

  A flaw in how Google Chrome processes media files can allow an attacker to execute code within Chrome's sandbox by tricking a user into opening a malicious file. The vulnerability stems from improper handling of numeric values in media processing, creating a window for code execution. While sandboxed, successful exploitation could grant an attacker access to sensitive data or control within the browser process.

• CVE-2026-10987HIGH 8.8

  Google Chrome versions before 149.0.7827.53 contain an integer overflow flaw in the V8 JavaScript engine that allows attackers to run malicious code within Chrome's sandbox using a specially crafted webpage. An attacker would need to trick a user into visiting a malicious site, but requires no special privileges or browser plugins. The vulnerability is rated High severity.

• CVE-2026-10988HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's Views component that could allow an attacker to escape the browser's sandbox. The flaw requires an attacker to first compromise Chrome's renderer process—the sandboxed component that processes web content—and then serve a specially crafted HTML page to trigger the vulnerability. If successfully exploited, an attacker could break out of the sandbox and execute code with the full privileges of the Chrome process, potentially compromising the underlying system. Chrome versions prior to 149.0.7827.53 are affected.

• CVE-2026-10989HIGH 8.8

  A flaw in Google Chrome's V8 JavaScript engine allows attackers to corrupt memory on a victim's computer through a specially crafted web page, but only if the user performs specific interactions with the page. The vulnerability requires user action and comes from an inappropriate implementation in Chrome versions before 149.0.7827.53. Once exploited, an attacker could read sensitive data, modify files, or crash the browser.

• CVE-2026-10991HIGH 8.8

  Google Chrome contains a use-after-free memory vulnerability in its V8 JavaScript engine that can allow an attacker to run malicious code within Chrome's sandbox. The flaw requires user interaction—specifically, the victim must perform certain UI gestures (like clicking or interacting with specific page elements) while viewing a specially crafted webpage. Once triggered, the vulnerability could allow code execution with the privileges of the Chrome process, potentially compromising the user's browsing session and data. This affects Chrome versions prior to 149.0.7827.53 across Windows, macOS, and Linux systems.

• CVE-2026-10995HIGH 8.8

  A heap buffer overflow vulnerability exists in Google Chrome's TabStrip component that could allow an attacker to corrupt memory on a user's system. The attack requires convincing a user to perform specific gestures while viewing a malicious webpage. While Chromium's maintainers classified this as medium severity, the actual impact—potential code execution with high integrity and confidentiality compromise—warrants close attention from security teams.

• CVE-2026-11000HIGH 8.8

  A use-after-free vulnerability in Google Chrome's font handling on Linux allows attackers to execute arbitrary code within the browser's sandbox by tricking users into visiting a specially crafted webpage. The vulnerability affects Chrome versions before 149.0.7827.53 and requires user interaction (clicking a link or viewing a page) to trigger, but carries no special privilege requirements.

• CVE-2026-11003HIGH 8.8

  Google Chrome versions before 149.0.7827.53 contain a use-after-free vulnerability in its WebRTC component that could allow an attacker to run arbitrary code within Chrome's sandbox by tricking a user into visiting a malicious web page. While the underlying flaw is rated Medium severity by Chromium, the CVSS score reflects the practical impact: network delivery with minimal user friction and full compromise of confidentiality, integrity, and availability within the sandboxed process.

• CVE-2026-11024HIGH 8.8

  A stack buffer overflow vulnerability exists in the Skia graphics library, which is used by Google Chrome. An attacker could craft a malicious HTML page that, when viewed by a user, potentially corrupts stack memory and compromises the browser process. The vulnerability requires user interaction (visiting a malicious webpage) but presents significant risk because it can lead to code execution with the privileges of the Chrome process. Google Chrome versions prior to 149.0.7827.53 are affected.

• CVE-2026-11028HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's media handling on Linux and ChromeOS. If an attacker compromises Chrome's renderer process—the sandboxed component that interprets web content—they can craft a malicious HTML page to execute arbitrary code within that sandbox. This is a post-compromise attack that escalates the damage from a renderer breach but does not grant escape from the sandbox itself.

• CVE-2026-11030HIGH 8.8

  Google Chrome versions prior to 149.0.7827.53 contain a use-after-free vulnerability in the Network component that can be triggered by malicious network traffic. An attacker who crafts and delivers hostile network packets to a user's browser could potentially corrupt the heap memory, leading to code execution with the privileges of the browser process. User interaction (such as visiting a malicious website or receiving crafted network data) is required for exploitation.

• CVE-2026-10000HIGH 8.3

  A use-after-free memory vulnerability exists in Google Chrome's password management system on Windows. An attacker who has already compromised Chrome's renderer process (the sandboxed component that displays web pages) could exploit this flaw through a malicious HTML page to escape the sandbox and gain system-level access. This is a multi-stage attack: the attacker must first achieve renderer compromise, then leverage this vulnerability to break out of Chrome's security boundary.

• CVE-2026-10001HIGH 8.3

  A use-after-free flaw in Chrome's PerformanceManager could let an attacker escape the browser sandbox if they've already compromised the rendering engine. The attack requires a specially crafted web page and user interaction, but success could grant full system access. This affects Chrome versions before 148.0.7778.216.

• CVE-2026-10012HIGH 8.3

  A use-after-free flaw in Chrome's Skia graphics library allows an attacker who controls the browser's renderer process to escape the sandbox and execute arbitrary code on the underlying system. The attack requires a malicious HTML page and user interaction, but once the renderer is compromised, the vulnerability enables full system compromise. This is particularly dangerous because renderer exploits are common entry points; this flaw raises the stakes by providing a bridge from that compromised renderer to the host OS.

• CVE-2026-10014HIGH 8.3

  A use-after-free memory flaw in Chrome's WebMIDI implementation on Android allows an attacker who has already compromised Chrome's renderer process to escape the sandbox through a specially crafted web page. This is a privilege escalation attack: the attacker must first breach the renderer sandbox, then exploit this vulnerability to break out and gain full device access.

• CVE-2026-10017HIGH 8.3

  A memory read vulnerability exists in Google Chrome's Headless mode that could allow an attacker to escape the browser's security sandbox. If an attacker first compromises the renderer process—the part of Chrome that interprets web pages—they could craft a malicious HTML page to trigger an out-of-bounds read, potentially breaking out of the sandbox and gaining broader system access. This vulnerability requires the renderer to already be compromised, which is a significant precondition, but the consequence of successful exploitation is severe.

• CVE-2026-10020HIGH 8.3

  A flaw in Chrome's Skia graphics library on Android allows an attacker who has already compromised Chrome's renderer process to escape the security sandbox and gain full device access. The vulnerability requires the user to visit a specially crafted webpage, but the heavy lifting—compromising the renderer first—means this is a two-stage attack. Chrome versions before 148.0.7778.216 on Android are affected.

• CVE-2026-10884HIGH 8.3

  A use-after-free memory vulnerability exists in Google Chrome's Chromecast component that could allow an attacker to escape the browser's sandbox if the attacker has already compromised the renderer process. The vulnerability requires user interaction and specific browser conditions, but successful exploitation could grant an attacker unauthorized access to the host system. Google has assigned this a Critical severity rating within Chromium's threat model.

• CVE-2026-10889HIGH 8.3

  A memory reading flaw in Chrome's ANGLE graphics library can let an attacker who has already gained control of the browser's rendering process break out of the Chrome sandbox and access the underlying system. The attack requires a specially crafted web page and user interaction, but once the renderer is compromised, this vulnerability opens a direct path to full system compromise. Chrome versions before 149.0.7827.53 are affected.

• CVE-2026-10894HIGH 8.3

  A use-after-free flaw in Chrome's printing subsystem on Linux could allow an attacker who already controls the browser's renderer process to break out of Chrome's sandbox protections and gain full system access. The vulnerability is triggered by a specially crafted web page and affects Chrome versions before 149.0.7827.53. While this requires initial compromise of the renderer process, it represents a critical escalation path from web content to system privileges.

• CVE-2026-10898HIGH 8.3

  A stack buffer overflow vulnerability exists in the GPU component of Google Chrome versions prior to 149.0.7827.53. An attacker who has already compromised Chrome's renderer process can exploit this flaw through a malicious HTML page to break out of the browser sandbox and gain system-level code execution. While the attacker must first compromise the renderer—typically through a separate browser vulnerability or social engineering—the sandbox escape itself represents a critical escalation path that transforms a contained compromise into full system compromise.

• CVE-2026-10905HIGH 8.3

  A memory safety flaw in Google Chrome's network code allows an attacker who has already compromised the browser's renderer process to escape the sandbox and gain full system access. The vulnerability requires user interaction (opening a malicious HTML page) but poses significant risk because successful exploitation bypasses Chrome's core security boundary—the sandbox that isolates the browser from the operating system.

• CVE-2026-10908HIGH 8.3

  A use-after-free vulnerability exists in Google Chrome's full-screen functionality on Windows systems. An attacker who has already compromised Chrome's rendering engine could exploit a specially crafted web page to escape the browser sandbox and execute arbitrary code with higher privileges. This requires the attacker to have initial renderer process access, but once achieved, the flaw could allow them to run code outside the sandbox protection layer.

• CVE-2026-10909HIGH 8.3

  A use-after-free vulnerability in Google Chrome's Dawn graphics engine allows an attacker who has already compromised the browser's renderer process to escape the sandbox through a malicious webpage. This is a high-severity issue because it bridges two separate security boundaries—first gaining control within Chrome's renderer, then breaking out to execute arbitrary code on the underlying operating system.

• CVE-2026-10911HIGH 8.3

  CVE-2026-10911 is a sandbox escape vulnerability in Google Chrome that allows a remote attacker to break out of the browser's security sandbox if they have already compromised the renderer process. The attack requires crafted HTML content and user interaction, but once successful, it grants an attacker full system access. This is a chained attack scenario: an attacker must first compromise the renderer (the part of Chrome that displays web content) through a separate vulnerability, then use this flaw to escape the sandbox and gain control of the underlying system.

• CVE-2026-10915HIGH 8.3

  A use-after-free memory vulnerability exists in Google Chrome on iOS that allows an attacker who has already compromised the browser's renderer process to break out of the sandbox and gain deeper system access. The vulnerability requires the attacker to serve a specially crafted HTML page and involves a complex attack chain but poses severe risk because successful exploitation can lead to full compromise of the device. Chrome versions prior to 149.0.7827.53 on iOS are affected.

• CVE-2026-10917HIGH 8.3

  Google Chrome versions before 149.0.7827.53 contain a media handling flaw that allows an attacker who has already compromised the browser's renderer process to escape the sandbox and gain broader system access. The vulnerability requires user interaction (visiting a specially crafted webpage) but poses a significant risk because renderer compromises are common entry points in real attacks. Once inside the renderer, the flaw gives an attacker a path to elevated privileges on the underlying operating system.

• CVE-2026-10918HIGH 8.3

  A use-after-free vulnerability in Google Chrome's Viz component allows an attacker who has already compromised the browser's renderer process to potentially escape the sandbox and gain deeper system access. The attacker would need to trick a user into visiting a malicious webpage, but the actual exploitation requires prior renderer compromise, making this a multi-stage attack. While not currently known to be exploited in the wild, the vulnerability represents a meaningful privilege escalation path for sophisticated threat actors who have achieved initial browser process compromise.

• CVE-2026-10919HIGH 8.3

  A use-after-free bug in Chrome's ANGLE graphics library before version 149.0.7827.53 allows an attacker who already controls the browser's rendering process to break out of the sandbox and gain full system access. The attacker must trick a user into visiting a malicious webpage, but once the renderer is compromised, this flaw provides a path to escape Chrome's isolation boundaries.

• CVE-2026-10920HIGH 8.3

  A validation flaw in Chrome's WebShare feature on macOS allows an attacker who has already compromised the browser's renderer process to break out of the sandbox through a specially crafted webpage. This is a post-compromise privilege escalation risk—the attacker must first gain code execution within the renderer, but if successful, can gain full system access. Chrome versions before 149.0.7827.53 are affected.

• CVE-2026-10921HIGH 8.3

  A flaw in Google Chrome's graphics processing library (Dawn) could allow an attacker to break out of the browser's security sandbox if they've already compromised the rendering engine. The vulnerability stems from an integer overflow—a situation where a number calculation wraps around and produces an incorrect value—that could be triggered by a specially crafted webpage. While the attacker would need to have already gained access to the renderer process, successfully exploiting this could grant them the same privileges as the operating system user running Chrome, potentially leading to full system compromise.

• CVE-2026-10924HIGH 8.3

  A mathematical error in Chrome's Chromecast component allows an attacker who has already compromised Chrome's rendering engine to break out of the browser sandbox and gain full system access. The attacker needs to trick a user into visiting a malicious webpage while the renderer is already compromised. This is a serious vulnerability because sandbox escape means the attacker moves from limited browser permissions to unrestricted control of the entire device.

• CVE-2026-10925HIGH 8.3

  A memory corruption flaw exists in the Skia graphics library within Google Chrome on macOS. An attacker who has already compromised Chrome's renderer process can exploit this out-of-bounds write to break out of the browser sandbox and gain system-level access. The attack requires user interaction (visiting a malicious webpage) but bypasses Chrome's primary security boundary once the renderer is under attacker control.

• CVE-2026-10927HIGH 8.3

  A memory reading flaw in Google Chrome's graphics component (Dawn) prior to version 149.0.7827.53 allows attackers who have already compromised the browser's renderer process to escape the sandbox through a specially crafted webpage. This is a two-stage attack: first an attacker must find a way into the renderer, then this vulnerability allows them to break out entirely.

• CVE-2026-10929HIGH 8.3

  A memory safety flaw in ANGLE (the graphics abstraction layer used by Chrome) allows an attacker who has already compromised Chrome's sandboxed renderer process to escape that sandbox and gain full system access on Android devices. The attacker must trick a user into visiting a malicious webpage. This affects Chrome versions prior to 149.0.7827.53 on Android.

• CVE-2026-10933HIGH 8.3

  A use-after-free vulnerability exists in Google Chrome's audio processing component on Windows systems. An attacker who has already compromised Chrome's renderer process could exploit this flaw through a specially crafted web page to escape the browser sandbox and gain higher privileges on the system. This requires an initial renderer compromise, but if successful, could lead to full system takeover.

• CVE-2026-10934HIGH 8.3

  Google Chrome on Android contains a use-after-free vulnerability in its Autofill feature that could allow an attacker to escape the browser sandbox. The flaw requires an attacker to first compromise Chrome's renderer process—the component responsible for parsing and displaying web content—and then trick a user into visiting a malicious webpage. If successful, the attacker could break out of Chrome's security sandbox and gain broader access to the device. This vulnerability affects Chrome versions prior to 149.0.7827.53 on Android.

• CVE-2026-10940HIGH 8.3

  A race condition vulnerability in Chrome's media codec handling allows an attacker who has already compromised Chrome's renderer process to escape the browser sandbox on Windows systems. The attacker would need to trick a user into visiting a specially crafted website, but once the renderer is compromised, this flaw could give the attacker full system-level access. Chrome versions before 149.0.7827.53 on Windows are affected.

• CVE-2026-10949HIGH 8.3

  A heap buffer overflow vulnerability in Google Chrome's video handling component allows an attacker who has already compromised Chrome's renderer process to escape the browser sandbox and gain system-level access. The attacker would need to craft a malicious HTML page to trigger the overflow, but exploitation requires the renderer to be already compromised—making this a post-compromise escape vector rather than a direct attack from an untrusted webpage. Chrome versions before 149.0.7827.53 are vulnerable on Windows, macOS, and Linux systems.

• CVE-2026-10953HIGH 8.3

  A use-after-free vulnerability exists in Google Chrome for Android versions prior to 149.0.7827.53. An attacker who has already compromised Chrome's renderer process can exploit this flaw by crafting a malicious HTML page to break out of the browser sandbox and gain system-level access to the Android device. This is a post-compromise escalation risk rather than a direct entry point, but it significantly amplifies the impact of any renderer exploit.

• CVE-2026-10960HIGH 8.3

  CVE-2026-10960 is a sandbox escape vulnerability in Google Chrome's video codec handling. An attacker who has already compromised Chrome's renderer process—the sandboxed component responsible for processing web content—can exploit an uninitialized variable in the codec logic to break out of the sandbox and gain full system access. The attack requires a crafted HTML page and user interaction, but once the renderer is compromised, the attacker can leverage this flaw to escalate to native code execution outside Chrome's security boundary.

• CVE-2026-10961HIGH 8.3

  Chrome for iOS users running versions prior to 149.0.7827.53 face a critical sandbox escape vulnerability. A malicious website can exploit a use-after-free memory flaw to break out of Chrome's security sandbox if the attacker first compromises the renderer process—the component that handles webpage content. Once the sandbox is escaped, an attacker gains direct access to the device, potentially leading to theft of credentials, personal data, or malware installation. The vulnerability requires user interaction (visiting a crafted page) but is otherwise remotely exploitable.

• CVE-2026-10967HIGH 8.3

  A use-after-free flaw exists in Chrome's SurfaceCapture feature on Android that allows an attacker to escape the browser sandbox. The vulnerability requires the attacker to first compromise Chrome's renderer process and then trick a user into visiting a malicious webpage. If successful, the attacker could break out of Chrome's security sandbox and gain elevated privileges on the device. This affects Chrome versions before 149.0.7827.53 on Android.

• CVE-2026-10970HIGH 8.3

  Google Chrome versions prior to 149.0.7827.53 contain a vulnerability in how the browser validates input data related to Interest Groups—a feature used for targeted advertising. An attacker who has already compromised Chrome's renderer process (the part that executes web content) can exploit insufficient input validation to break out of the browser's sandbox—the security boundary designed to isolate web content from the rest of your system. This requires the attacker to first gain renderer access and trick a user into visiting a crafted webpage, but if successful, allows full control over the victim's machine.

• CVE-2026-11010HIGH 8.3

  A use-after-free memory safety bug in Chrome's WebShare feature on Android allows an attacker who has already compromised the browser's renderer process to escape the sandbox and gain elevated system privileges by tricking a user into visiting a malicious webpage. While the initial compromise requires the renderer to already be under attacker control, the sandbox escape represents a critical escalation path.

• CVE-2026-11012HIGH 8.3

  A use-after-free vulnerability exists in Google Chrome's Serial API on Android devices running versions before 149.0.7827.53. An attacker who has already compromised Chrome's renderer process can exploit this flaw by serving a specially crafted HTML page to achieve a sandbox escape—breaking out of Chrome's security isolation layer. While the underlying Chromium issue is rated Medium severity by Google, the CVSS 3.1 score of 8.3 reflects the HIGH impact potential when combined with renderer compromise.

• CVE-2026-10887HIGH 8.1

  A use-after-free flaw in Chrome's Chromoting remote desktop feature on macOS allows attackers to execute arbitrary code by sending specially crafted network traffic. The vulnerability exists in versions prior to 149.0.7827.53 and requires no user interaction—an attacker on the network can trigger the bug remotely, making this a critical threat to any Mac user running an affected Chrome version.

• CVE-2026-10930HIGH 8.1

  An out-of-bounds read vulnerability in ANGLE (the graphics translation layer used by Chrome on macOS) allows attackers to read sensitive memory from your system by tricking you into visiting a malicious website. The flaw affects Chrome versions before 149.0.7827.53 on Apple macOS. While the attacker cannot directly modify data or take control of your system through this specific vulnerability, they can extract confidential information—including passwords, encryption keys, or other sensitive data stored in memory—and cause Chrome to crash.