By vendor

Google vulnerabilities

Known CVEs affecting Google products, prioritized by severity, with SEC.co remediation and detection guidance.

1195 published vulnerabilities · page 10 of 12

• CVE-2026-0061MEDIUM 5.9

  CVE-2026-0061 is a privilege escalation vulnerability in Android's WindowState component that allows an attacker to manipulate the permission-granting UI through overlay attacks (tapjacking). By displaying a malicious overlay on top of the system permission dialog, an attacker can trick users into granting sensitive permissions without explicit awareness. The critical aspect is that this requires no special execution privileges and no user interaction in the traditional sense—the attack succeeds through visual deception rather than social engineering or code execution exploits.

• CVE-2026-0075MEDIUM 5.9

  CVE-2026-0075 is a SQL injection vulnerability in Google Android's contact database access functions that allows local attackers to escalate privileges without needing special permissions or user interaction. An attacker with local access to an Android device can exploit this flaw to read, modify, or delete contact information and potentially gain elevated system privileges.

• CVE-2026-11199MEDIUM 5.9

  Google Chrome versions before 149.0.7827.53 contain a flaw in how WebRTC handles network traffic that could allow an attacker positioned on the same network to steal sensitive information across website boundaries. The vulnerability requires the attacker to be in a privileged network position—such as on a shared Wi-Fi network or controlling network infrastructure—but does not require user interaction or special permissions. The risk is limited to information disclosure; the flaw cannot be used to modify data or crash the browser.

• CVE-2026-11238MEDIUM 5.9

  Google Chrome versions before 149.0.7827.53 contain a flaw in how DevTools handles extension interactions that could allow an attacker to extract sensitive data from process memory. The attack requires social engineering—convincing a user to install a malicious Chrome extension—but if successful, an attacker gains access to potentially confidential information stored in memory that the extension can observe. This is classified as a medium-severity issue despite Chromium's internal 'Low' rating, reflecting the real-world impact of memory disclosure combined with the user-interaction barrier.

• CVE-2026-14062MEDIUM 5.9

  Google Chrome and ChromeOS have a weakness in how they handle certain view operations that could let an attacker steal sensitive data from your computer's memory. The attack requires two things: you'd need to install a malicious extension (add-on), and the attacker would craft that extension specifically to read data from Chrome's internal memory. This is a medium-severity issue because while memory access is serious, it requires social engineering to get you to install the extension first.

• CVE-2026-14406MEDIUM 5.9

  A flaw in Chrome's V8 JavaScript engine allows an out-of-bounds memory read when a malicious browser extension executes. An attacker would first need to trick a user into installing a malicious extension, then use it to read sensitive data directly from the browser's memory. This is classified as a medium-severity issue because it requires social engineering to deliver the extension, but once installed, it can expose potentially sensitive information without further user interaction.

• CVE-2026-13976MEDIUM 5.8

  A flaw in how Google Chrome handles data validation within its storage system creates a pathway for attackers who have already compromised the browser's renderer process to potentially break out of Chrome's security sandbox. The vulnerability requires an attacker to serve a specially crafted HTML page and relies on user interaction, making it a multi-step attack rather than something triggering automatically. Chrome versions before 150.0.7871.47 are vulnerable.

• CVE-2026-0165MEDIUM 5.7

  CVE-2026-0165 is a medium-severity vulnerability in Android's RTCP (Real-Time Control Protocol) packet decoder that allows an attacker to read sensitive information from device memory without needing special permissions. The flaw stems from missing boundary checks that permit out-of-bounds memory access. Exploitation requires user interaction—such as accepting a call or media stream—but once triggered, the vulnerability can leak confidential data like encryption keys, authentication tokens, or other sensitive information stored in adjacent memory regions.

• CVE-2026-14063MEDIUM 5.7

  CVE-2026-14063 is a memory disclosure vulnerability in Google Chrome's Chromecast component that allows a local attacker to read sensitive data from the browser process. The flaw requires the attacker to be on the same network and the user to interact with malicious network traffic, but does not require elevated privileges. While individual impact is modest, this type of information leak can enable reconnaissance for more sophisticated attacks. Google rated the underlying issue as low severity, but the combination of local network access, user interaction requirement, and memory disclosure capability warrants MEDIUM priority in most enterprise environments.

• CVE-2025-48648MEDIUM 5.5

  CVE-2025-48648 is a denial-of-service vulnerability in Android's NotificationManagerService that allows a local attacker to exhaust system resources and crash the notification service. An attacker with basic user privileges can trigger this flaw without user interaction, causing persistent disruption to the device's notification functionality.

• CVE-2026-0018MEDIUM 5.5

  CVE-2026-0018 is a denial-of-service vulnerability in Android's AccessibilityManagerService that allows a local attacker with user-level privileges to crash or hang the accessibility subsystem persistently. No special permissions, code execution, or user interaction are required to trigger the flaw—an authenticated local process can simply send malformed input to designated service functions that fail to properly validate their parameters. This could degrade or disable accessibility features for affected users.

• CVE-2026-0042MEDIUM 5.5

  CVE-2026-0042 is a resource exhaustion vulnerability in Google Android's UBSan runtime component that allows a local attacker to cause a persistent denial of service. An attacker with basic user-level access can trigger the flaw without user interaction, exhausting system resources and rendering the device unavailable. The vulnerability does not enable unauthorized access or data theft—only availability disruption.

• CVE-2026-0043MEDIUM 5.5

  CVE-2026-0043 is a medium-severity integer overflow vulnerability in Android's UBSan runtime library that can cause a persistent denial of service and local privilege escalation. The flaw resides in multiple functions within ubsan_throwing_runtime.cpp and requires only local access to exploit—no special privileges or user interaction are needed. Once triggered, the integer overflow can exhaust system resources or corrupt memory state, denying service to the affected device or enabling an attacker to elevate their privileges locally.

• CVE-2026-0060MEDIUM 5.5

  CVE-2026-0060 is a local denial-of-service vulnerability in Android's graphics driver management system. A local attacker with basic user privileges can trigger a persistent crash condition in the GraphicsDriverEnableAngleAsSystemDriverController component, rendering the graphics subsystem unavailable without requiring elevated permissions or user interaction. The issue stems from improper state handling in the updateState method.

• CVE-2026-0064MEDIUM 5.5

  CVE-2026-0064 is a resource exhaustion vulnerability affecting Google Android that allows a locally authenticated attacker to cause a persistent denial of service. The vulnerability exists in multiple code paths and requires only standard user privileges to trigger—no special permissions or user interaction are needed. Once exploited, the affected system can be rendered unresponsive or unstable until remediated.

• CVE-2026-0067MEDIUM 5.5

  A logic error in Android's ubsan_throwing_runtime.cpp file can be exploited by a local attacker to permanently deny service to affected devices. The vulnerability requires only basic user-level permissions and no special interaction to trigger, making it a straightforward availability threat for any Android user or administrator managing affected deployments.

• CVE-2026-0069MEDIUM 5.5

  CVE-2026-0069 is a resource exhaustion vulnerability in Android's signature verification code that allows a local attacker to crash the system without needing special privileges or user interaction. An attacker with basic local access can trigger excessive resource consumption in the APK checksum verification process, causing a denial of service.

• CVE-2026-0070MEDIUM 5.5

  A flaw in Android's DevicePolicyManagerService allows a local attacker with standard user privileges to hide critical system packages through improper validation of input parameters. This creates a denial-of-service condition by making essential system components inaccessible, potentially rendering the device unstable or non-functional without requiring any special permissions or user interaction.

• CVE-2026-0074MEDIUM 5.5

  CVE-2026-0074 is a denial-of-service vulnerability in Android's LauncherProcessImageListener component. An attacker with local system access can exhaust device resources through the getPreferredSize function, causing the launcher process to become unresponsive or crash. No special privileges or user interaction are required to trigger the flaw, making it a concern for multi-user devices and environments where untrusted code may run locally.

• CVE-2026-0079MEDIUM 5.5

  CVE-2026-0079 is a denial-of-service vulnerability in Android's ubsan_throwing_runtime.cpp component. An integer overflow flaw allows a local attacker to crash or hang affected systems persistently without requiring elevated privileges or user interaction. The vulnerability resides in multiple functions within the runtime component responsible for undefined behavior sanitization, making it accessible to processes running with standard user permissions.

• CVE-2026-0085MEDIUM 5.5

  A flaw in Android's contact data handling allows a local attacker to crash the system by inserting an unusually large contact name. The vulnerability exists in the DataRowHandler component, which fails to properly validate the size of contact name input before processing it. Because the attack requires only local access and no special privileges, any app on a compromised device could trigger the denial of service without user interaction.

• CVE-2026-12444MEDIUM 5.5

  A memory reading vulnerability exists in Google Chrome's Chromoting feature (Google's remote desktop tool) on Windows systems running versions prior to 149.0.7827.155. An attacker with local access to a machine can craft a malicious file that, when interacted with by a user, causes Chrome to read data outside its intended memory boundaries. This out-of-bounds read could expose sensitive information already present in the process's memory—such as cached authentication tokens, encryption keys, or other confidential data—without requiring elevated privileges or special system access. The vulnerability is not currently known to be exploited in the wild.

• CVE-2026-13914MEDIUM 5.5

  Google Chrome on macOS contains a vulnerability in its password handling that could allow a local attacker to read sensitive data from the browser's memory if the user interacts with a specially crafted file. The vulnerability affects Chrome versions before 150.0.7871.47 on Mac systems. An attacker would need local access to the affected system and require user interaction to trigger the vulnerability, but no special privileges are needed to exploit it.

• CVE-2026-13929MEDIUM 5.5

  A flaw in Google Chrome's Developer Tools on Android lets a local attacker trick the browser into ignoring certain navigation restrictions by supplying a malicious file. The attacker needs physical or local access to the device and user interaction (like opening a file), but doesn't require elevated permissions. The impact is limited to unauthorized navigation—not data theft or system crashes—making this a moderate-severity issue.

• CVE-2026-28573MEDIUM 5.5

  CVE-2026-28573 is a medium-severity vulnerability in Android's manifest configuration that allows a local attacker with limited user privileges to repeatedly crash or disable Android system functionality without needing to interact with the device directly. The flaw stems from missing permission validation in the AndroidManifest.xml processing, making it trivial to exploit once an attacker gains basic system access.

• CVE-2026-28575MEDIUM 5.5

  A logic error in Android's package installation code allows a locally authenticated attacker to exhaust device memory, causing the system to become unresponsive or crash. The vulnerability exists in how the system handles file transfers during app installation and requires only local access—no special permissions or user interaction needed to trigger the denial of service.

• CVE-2026-28576MEDIUM 5.5

  A SQL injection flaw in Android's Contacts Provider allows a local attacker with basic user permissions to read sensitive contact information from the device's contacts database without needing special privileges or user interaction. The vulnerability is limited to information disclosure—attackers cannot modify or delete data, but they can extract the entire contacts database contents.

• CVE-2026-28578MEDIUM 5.5

  A flaw in Android's device policy management system allows a local attacker to cause the device to become unstable or unresponsive by exploiting improper input validation in DevicePolicyManagerService. An attacker with basic user-level access can trigger this issue without user interaction, potentially disrupting device functionality. This is a local denial-of-service vulnerability with no remote attack vector.

• CVE-2026-28587MEDIUM 5.5

  CVE-2026-28587 is a local information disclosure vulnerability in Android's MmsSmsProvider component that allows an authenticated attacker to retrieve sensitive information without additional privileges or user interaction. The vulnerability stems from a missing permission check in the MmsSmsProvider.java file, potentially exposing SMS and MMS data to unauthorized local access.

• CVE-2026-34657MEDIUM 5.5

  CAI Content Credentials, a library used to manage and verify digital content authenticity, contains a path traversal flaw in versions [email protected], c2pa-v0.80.1 and earlier. The vulnerability allows an attacker to write files to arbitrary locations on a system by crafting a malicious archive that, when extracted by a user, exploits insufficient pathname validation. This is a local attack requiring user interaction—an end user must actively extract or open the malicious file for the attack to succeed.

• CVE-2026-10984MEDIUM 5.4

  Google Chrome on Android contains a flaw in how it handles accessibility features that allows attackers to trick users with a fake interface. By hosting a malicious webpage, an attacker can make Chrome display misleading or fraudulent content that mimics legitimate UI elements, potentially deceiving users into performing unintended actions. The vulnerability requires user interaction—specifically, a user must visit the crafted page—but does not require special privileges or complex setup.

• CVE-2026-11157MEDIUM 5.4

  A script injection vulnerability in Google Chrome's accessibility features allows attackers to inject arbitrary scripts and HTML into web pages if a user installs a malicious extension. The vulnerability, tracked as CVE-2026-11157, requires user interaction (installing an extension) to exploit, making it a social engineering vector rather than a network-based attack. Chrome versions before 149.0.7827.53 are affected.

• CVE-2026-11232MEDIUM 5.4

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the TabGroups feature handles network input, allowing attackers to deceive users through fake or misleading visual elements in the browser interface. An attacker would need to trick a user into visiting a malicious website or intercepting network traffic, but the actual attack surface is relatively narrow—the vulnerability requires user interaction and does not enable data theft or system crashes on its own.

• CVE-2026-11243MEDIUM 5.4

  Google Chrome versions before 149.0.7827.53 contain a flaw in how it handles downloads that allows an attacker to bypass navigation restrictions by serving a specially crafted web page. When a user visits the malicious page, the browser's normal safeguards that prevent unwanted navigation can be circumvented, potentially allowing redirection to unintended destinations or other restricted actions. The vulnerability requires user interaction (clicking or visiting a page) and affects Chrome on Windows, macOS, and Linux.

• CVE-2026-11666MEDIUM 5.4

  Google Chrome versions prior to 149.0.7827.103 contain a flaw where the browser fails to properly validate user-supplied input in certain UI elements. An attacker can exploit this by crafting a malicious HTML page that, when visited, displays fake browser UI components or dialogs—a technique known as UI spoofing. This could trick users into believing they're interacting with legitimate Chrome interface elements, potentially leading to credential theft, social engineering attacks, or other user-directed compromise. The vulnerability requires user interaction (visiting the crafted page) but no special privileges, making it a concern for general web browsing.

• CVE-2026-11701MEDIUM 5.4

  Google Chrome versions before 149.0.7827.103 contain a flaw in how the Guest View feature handles crafted HTML pages, allowing attackers to trick users with fake or misleading interface elements. An attacker would need to host a malicious webpage and convince a user to visit it while Chrome's Guest View is active. The vulnerability does not allow data theft or system compromise on its own, but the spoofed interface could be used to deceive users into taking actions they wouldn't otherwise take.

• CVE-2026-13977MEDIUM 5.4

  Google Chrome versions before 150.0.7871.47 contain a flaw in how the browser parses HTML that allows attackers to inject malicious scripts or HTML content into web pages. An attacker can craft a specially designed webpage that, when visited, injects arbitrary code into the page—potentially stealing data, capturing user credentials, or performing actions on the user's behalf. The vulnerability requires user interaction (visiting the malicious page) but does not require special browser permissions or system access.

• CVE-2026-14131MEDIUM 5.4

  Google Chrome versions prior to 150.0.7871.47 contain a flaw in the WebAppInstalls feature that fails to properly validate user-supplied input. An attacker who has already compromised the renderer process—the sandboxed component responsible for displaying web content—could exploit this to deceive users through visual spoofing attacks. The attacker could craft a deceptive HTML page that mimics legitimate Chrome UI elements, potentially tricking users into performing unintended actions. This is a post-compromise attack; the initial renderer compromise is the critical prerequisite.

• CVE-2026-14132MEDIUM 5.4

  A flaw in Google Chrome's WebXR (extended reality) implementation allows attackers to trick users by displaying fake UI elements on web pages. An attacker crafting a malicious HTML page can exploit this to make users believe they're interacting with legitimate interface elements when they're actually interacting with attacker-controlled content. This requires user interaction and doesn't affect data confidentiality or system availability, but can be used for phishing or social engineering attacks.

• CVE-2026-14135MEDIUM 5.4

  Google Chrome versions prior to 150.0.7871.47 contain a vulnerability that allows an attacker who has already compromised Chrome's renderer process to trick users into seeing fake interface elements or UI components. The attacker would deliver a malicious HTML page that exploits insufficient input validation in the Network component, creating a spoofing condition. While the underlying severity is rated Low by Chromium, the CVSS score reflects moderate concern due to user interaction requirements and the need for prior renderer compromise.

• CVE-2026-14142MEDIUM 5.4

  A flaw in how Google Chrome handles extensions could allow an attacker who has already compromised your browser's rendering engine to trick you into clicking malicious UI elements by disguising them as legitimate browser controls. The attacker would need to first gain control of the renderer process—typically through a separate vulnerability or compromise—then exploit this weakness to display fake dialogs or buttons that appear to come from Chrome itself. This is a secondary attack that depends on prior compromise.

• CVE-2026-14150MEDIUM 5.4

  Google Chrome versions before 150.0.7871.47 contain a flaw in how the Speech feature validates user input. An attacker who has already gained control of Chrome's renderer process—the component that displays web pages—can exploit this to trick users into thinking they're interacting with legitimate browser UI when they're actually seeing forged content. This is a UI spoofing attack that requires the attacker to have compromised the renderer first, limiting the immediate threat but still worth addressing through timely patching.

• CVE-2026-9971MEDIUM 5.4

  A vulnerability in Google Chrome on iOS allows attackers to inject malicious scripts or HTML code into web pages when a user performs specific interactions with the browser. An attacker would need to craft a deceptive webpage and convince a user to engage with it in particular ways—such as specific taps or gestures—to trigger the injection. Once successful, the attacker gains the ability to run arbitrary code in the context of the webpage, potentially stealing data or modifying what the user sees.

• CVE-2026-11004MEDIUM 5.3

  CVE-2026-11004 is a memory disclosure vulnerability in Google Chrome's ANGLE graphics library. An attacker who has already compromised Chrome's renderer process can craft a malicious HTML page to read sensitive data from the browser's memory. While this requires prior compromise of the renderer, the ability to extract potentially sensitive information makes it a meaningful security concern for organizations running Chrome.

• CVE-2026-11005MEDIUM 5.3

  A flaw in ANGLE, the graphics abstraction layer used by Google Chrome on Windows, allows a remote attacker to read sensitive data from Chrome's renderer process memory. The attacker must first compromise the renderer process and trick a user into visiting a malicious webpage. Once those conditions are met, the attacker can extract potentially sensitive information from memory that they shouldn't have access to. This is an out-of-bounds read vulnerability—the code accesses memory locations it wasn't intended to reach.

• CVE-2026-11098MEDIUM 5.3

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in GPU handling that allows an attacker with control of the renderer process to extract sensitive data from other websites. The vulnerability requires user interaction and a compromised renderer, making it a targeted risk rather than a mass-exploitation vector. The issue stems from insufficient validation when processing untrusted input, permitting cross-origin information disclosure.

• CVE-2026-11145MEDIUM 5.3

  A race condition in Google Chrome's geolocation feature on Android devices allows attackers to steal sensitive information across website boundaries. By crafting a malicious webpage, an attacker can exploit a timing vulnerability to extract data from other origins—websites or apps—that the user has visited or is logged into. The vulnerability requires user interaction (visiting the malicious page) and specific technical conditions to trigger, but successful exploitation could expose authentication tokens, personal information, or other confidential data from legitimate services.

• CVE-2026-11174MEDIUM 5.3

  CVE-2026-11174 is a Site Isolation bypass vulnerability in Google Chrome that allows an attacker who has already compromised a browser's renderer process to read sensitive data from other websites. The flaw stems from improper implementation of Chrome's Site Isolation feature, a critical security boundary that normally prevents one website from accessing another's data. An attacker would need to first gain control of the renderer process—typically through a separate vulnerability—and then use a specially crafted HTML page to circumvent this protection. While the attack requires a prior compromise, the consequence of success is confidentiality loss across site boundaries.

• CVE-2026-11246MEDIUM 5.3

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in IndexedDB—a browser feature for storing data locally—that fails to properly validate user input. If an attacker compromises the renderer process (the part of Chrome that displays web pages), they can craft a malicious HTML page to bypass the same-origin policy, a critical security boundary that normally prevents one website from accessing another's data. This requires the attacker to already control the renderer process, which limits the immediate threat but remains a meaningful integrity risk.

• CVE-2026-11669MEDIUM 5.3

  A flaw in Google Chrome's media handling on ChromeOS allows an attacker who has already compromised the browser's renderer process to read sensitive information from memory using a specially crafted webpage. The attacker gains access to data that should not be accessible—such as passwords, cryptographic keys, or other process memory contents—without being able to modify or crash the system. This is a memory disclosure vulnerability that requires the renderer process to be already compromised, making it part of a multi-stage attack chain.

• CVE-2026-11678MEDIUM 5.3

  An integer overflow vulnerability exists in libyuv, an image processing library bundled with Google Chrome. The flaw allows an attacker who has already compromised Chrome's renderer process to read sensitive information from memory by serving a specially crafted HTML page. Because the attack requires prior renderer compromise, real-world exploitation involves a multi-stage attack chain rather than direct network exploitation.

• CVE-2026-11696MEDIUM 5.3

  Google Chrome on Windows contains a memory safety bug where uninitialized video-handling code can leak sensitive data from the browser's renderer process. An attacker who has already compromised Chrome's renderer (the process that executes web page code) can craft a malicious HTML page to read uninitialized memory, potentially exposing passwords, session tokens, or other data. The flaw requires the renderer to be under attacker control and user interaction to trigger, making it a secondary attack component rather than a direct entry point. Chrome versions prior to 149.0.7827.103 are vulnerable.

• CVE-2026-12015MEDIUM 5.3

  A use-after-free vulnerability in Google Chrome's autofill feature allows attackers who have already compromised the browser's renderer process to leak sensitive information from memory. An attacker would need to trick a user into visiting a specially crafted webpage while the renderer is in a vulnerable state. This is not a remote code execution risk on its own, but represents a significant information disclosure threat once an attacker has a foothold in the rendering engine.

• CVE-2026-12025MEDIUM 5.3

  Google Chrome versions before 149.0.7827.115 contain a flaw in how the browser validates input within its Network component. An attacker who has already compromised Chrome's renderer process—the sandboxed environment that executes web content—can craft a malicious HTML page to leak sensitive data across security boundaries that normally prevent one website from accessing another's information. This is a privilege-escalation scenario: it requires the renderer to already be compromised, but then allows the attacker to exfiltrate data that should be protected by the browser's same-origin policy.

• CVE-2026-12033MEDIUM 5.3

  Google Chrome versions prior to 149.0.7827.115 contain an out-of-bounds memory read vulnerability in the VideoCapture component. An attacker who has already compromised Chrome's GPU process can exploit this flaw by serving a specially crafted webpage, allowing them to read sensitive data from the process's memory. This is a post-compromise attack requiring prior GPU process compromise and user interaction.

• CVE-2026-13023MEDIUM 5.3

  CVE-2026-13023 is a memory disclosure vulnerability in Google Chrome's GPU handling code. If an attacker has already compromised Chrome's renderer process—the sandboxed component that executes web content—they can craft a malicious HTML page to read uninitialized GPU memory, potentially exposing sensitive data from the browser's process memory. This requires two conditions: prior renderer compromise and user interaction with the malicious page. The vulnerability affects Chrome versions before 149.0.7827.197.

• CVE-2026-13030MEDIUM 5.3

  Google Chrome for Android contains a memory initialization flaw in its GPU component that allows attackers to read sensitive information from the browser process. When a user visits a malicious webpage on an affected Android device, the GPU fails to properly initialize memory regions, potentially exposing data such as cached credentials, session tokens, or other process memory contents to the attacker. This is not a crash or denial-of-service issue—the vulnerability specifically enables information disclosure.

• CVE-2026-13874MEDIUM 5.3

  A race condition exists in Google Chrome's DataTransfer mechanism that allows attackers to leak sensitive information from process memory. An attacker can craft a malicious HTML page that, when visited by a user, exploits timing vulnerabilities to read data that should be protected. While the attack requires user interaction (visiting a malicious website) and careful timing, the potential exposure of process memory contents makes this a meaningful privacy risk.

• CVE-2026-13875MEDIUM 5.3

  A flaw in how Google Chrome processes graphics instructions on Windows systems could allow an attacker who has already compromised your browser's rendering process to steal sensitive data from your computer's memory. The vulnerability requires the attacker to have already gained control of the renderer—the part of Chrome that displays web pages—and requires you to visit a specially crafted webpage. This is not a direct entry point for attackers, but rather a privilege escalation or lateral movement risk for those already inside your browser sandbox.

• CVE-2026-13877MEDIUM 5.3

  A vulnerability in Google Chrome's ANGLE graphics library allows an attacker who has already gained control of the browser's renderer process to read sensitive data from the browser's memory by tricking a user into viewing a specially crafted webpage. The attacker cannot exploit this directly from the internet—they must first compromise the renderer, making this a secondary attack that increases the severity of other browser vulnerabilities. Chrome versions before 150.0.7871.47 are affected.

• CVE-2026-13890MEDIUM 5.3

  A memory safety flaw in Google Chrome's Chromecast component allows an attacker who has already compromised the browser's renderer process to read sensitive data from process memory. The vulnerability requires user interaction (clicking a malicious link or visiting a crafted website) but does not lead to code execution or system crashes. Chrome versions prior to 150.0.7871.47 are affected across Windows, macOS, and Linux platforms.

• CVE-2026-13911MEDIUM 5.3

  A vulnerability in Google Chrome's spell-check feature allows an attacker who has already compromised the browser's rendering engine to read sensitive data from the Chrome process memory by tricking a user into visiting a malicious webpage. The vulnerability requires the attacker to have already gained control of the renderer process and the user to interact with the crafted page, making it a secondary exploitation target rather than a direct entry point. Chrome version 150.0.7871.47 and earlier are affected.

• CVE-2026-13933MEDIUM 5.3

  A vulnerability in Google Chrome versions before 150.0.7871.47 could allow an attacker who has already compromised Chrome's renderer process to read sensitive information from the browser's memory by tricking a user into visiting a malicious webpage. The attacker needs to have control of the renderer process first, limiting the scope of direct risk, but the ability to extract password-related data from memory represents a meaningful escalation once that foothold exists.

• CVE-2026-13947MEDIUM 5.3

  Google Chrome versions before 150.0.7871.47 contain a memory safety issue in the Extended Reality (XR) feature that could let an attacker read sensitive data from the browser's rendering process. The attack requires two preconditions: the renderer process must already be compromised, and the user must interact with a malicious webpage. An attacker cannot exploit this vulnerability through the network alone—they need initial code execution within Chrome's sandbox first.

• CVE-2026-13950MEDIUM 5.3

  Google Chrome versions before 150.0.7871.47 contain a flaw in GPU memory handling that could allow an attacker who has already compromised your browser's renderer process to read sensitive data from memory. The attacker would need to trick you into viewing a specially crafted web page. This is a medium-severity issue that affects confidentiality but not integrity or availability.

• CVE-2026-13961MEDIUM 5.3

  Google Chrome on Windows contains a flaw in its Developer Tools that fails to properly validate user input. An attacker can craft a malicious webpage that, when visited by a user, tricks them into performing specific interactions with DevTools. This manipulation allows the attacker to read sensitive data stored in the browser's process memory, such as authentication tokens, cached credentials, or other confidential information. The vulnerability requires social engineering—convincing a user to engage with DevTools in a particular way—which makes it moderately difficult to exploit in the wild, but the potential information disclosure is significant.

• CVE-2026-13969MEDIUM 5.3

  A vulnerability in Google Chrome for Android allows attackers who have already compromised Chrome's renderer process to read sensitive information from memory through a specially crafted webpage. The flaw stems from the use of uninitialized memory in the UI component, which can leak data that was previously stored in that memory location. An attacker would need to first gain control of the renderer process—typically through a separate compromise—making this a secondary attack vector rather than a direct entry point.

• CVE-2026-13970MEDIUM 5.3

  Google Chrome versions prior to 150.0.7871.47 contain a flaw in how the browser handles uninitialized memory in media processing. An attacker who has already compromised Chrome's renderer process—the component that interprets web content—can craft a malicious HTML page that leaks sensitive information from the browser's memory to the attacker. This is not a vulnerability that allows initial system compromise; it requires a prior breach of the renderer process, typically through another security flaw. Once that foothold exists, however, an attacker could extract passwords, authentication tokens, private keys, or other confidential data residing in memory.

• CVE-2026-13971MEDIUM 5.3

  Google Chrome contains a memory safety issue in its Skia graphics library that could allow an attacker to leak sensitive information from the browser's renderer process. If an attacker first compromises the renderer (the part of Chrome that processes web content), they can craft a malicious web page that reads uninitialized memory—data left over from previous operations that shouldn't be accessible. This could expose passwords, session tokens, or other sensitive data. The vulnerability requires the attacker to already have compromised the renderer and requires user interaction to visit the malicious page, making it a secondary concern in most attack chains.

• CVE-2026-13975MEDIUM 5.3

  A memory safety vulnerability exists in the ANGLE graphics library within Google Chrome on macOS that could allow an attacker to read sensitive data from Chrome's memory. The vulnerability requires two conditions: the attacker must first compromise Chrome's renderer process (the part that displays web content), and the user must visit a malicious web page. Once both conditions are met, an attacker could potentially extract sensitive information such as passwords, session tokens, or other data present in Chrome's memory at the time of exploitation.

• CVE-2026-13989MEDIUM 5.3

  Google Chrome versions before 150.0.7871.47 contain a flaw in how the PageInfo feature displays information to users. An attacker who has already compromised Chrome's rendering engine can craft a malicious webpage that tricks users into believing they are interacting with a legitimate interface element, when in fact they are not. This is a UI spoofing attack—the attacker cannot steal data or crash the browser, but can deceive users about what they're seeing on screen.

• CVE-2026-14012MEDIUM 5.3

  Google Chrome versions before 150.0.7871.47 contain a side-channel vulnerability in how the browser processes CSS that could allow an attacker to leak sensitive information from the browser process's memory. By crafting a malicious HTML page and tricking a user into viewing it, an attacker could potentially extract data that should remain private. The flaw is specific to how CSS rendering interacts with memory access patterns, creating a timing or behavioral difference that leaks information—a classic side-channel attack vector.

• CVE-2026-14049MEDIUM 5.3

  Google Chrome contained a flaw in how it handled GPU operations that could allow an attacker to read sensitive data from memory. The attacker would need to first compromise Chrome's renderer process (the component that processes web page content) and then trick a user into visiting a malicious webpage. If successful, they could extract information that should have remained private. This issue affected Chrome versions before 150.0.7871.47 across Windows, macOS, and Linux systems.

• CVE-2026-14112MEDIUM 5.3

  Google Chrome versions before 150.0.7871.47 contain a flaw in how the browser handles certain user interactions on web pages. An attacker who tricks a user into performing specific gestures (like clicking or dragging) on a malicious webpage can potentially read sensitive data from Chrome's memory. While the Chromium team rates this as low severity, the ability to extract process memory elevates the practical risk. The vulnerability requires active user participation—it cannot be exploited passively.

• CVE-2026-14117MEDIUM 5.3

  A weakness in Google Chrome's developer tools on Windows allows a remote attacker to trick a user into performing specific actions that could leak sensitive information from the browser's process memory. An attacker would craft a malicious webpage and convince a user to interact with it in a specific way—typically involving the DevTools interface—to extract data. This is not a widespread, easily exploitable flaw; it requires user interaction and specific gestures to trigger.

• CVE-2026-14153MEDIUM 5.3

  Google Chrome versions before 150.0.7871.47 contain a UI spoofing vulnerability in the Glic component. An attacker can craft a malicious HTML page that, when viewed by a user who performs specific UI gestures (like clicks or interactions), displays fake interface elements that deceive the user into believing they're interacting with legitimate browser controls or content. This is a social engineering attack that relies on user interaction but can expose sensitive information through misdirection.

• CVE-2026-14391MEDIUM 5.3

  An integer overflow vulnerability exists in ANGLE (a graphics abstraction layer used by Chrome) that could allow an attacker who has already compromised your browser's renderer process to read sensitive data from memory. The flaw affects Google Chrome on Windows versions before 150.0.7871.46 and requires both a successful initial compromise and user interaction with a malicious webpage to trigger. While the bar to exploitation is moderately high, the potential exposure of process memory contents warrants timely patching.

• CVE-2026-14414MEDIUM 5.3

  A flaw in Skia, the graphics library used by Google Chrome, allows an attacker who has already compromised Chrome's renderer process to read sensitive information from memory by tricking a user into visiting a malicious webpage. The vulnerability requires the attacker to control the renderer—a significant prerequisite—but once achieved, could leak data like passwords, tokens, or other secrets stored in memory.

• CVE-2026-9985MEDIUM 5.3

  A flaw in Google Chrome and ChromeOS allows an attacker who has already compromised the browser's renderer process to read sensitive data from the browser's memory by tricking a user into viewing a malicious webpage. The vulnerability stems from insufficient validation of media-related input. While this requires an initial renderer compromise, it can expose information that should have remained private within the browser process.

• CVE-2026-11276MEDIUM 5.1

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the Cast feature (which enables screen mirroring and media streaming to nearby devices) processes network traffic. An attacker physically present on the same local network can send specially crafted traffic to bypass access controls that would normally prevent unauthorized casting operations. This is a local network attack that doesn't require user interaction but is limited in scope—it cannot crash systems or execute arbitrary code, only manipulate casting permissions.

• CVE-2026-10010MEDIUM 5.0

  Google Chrome on Android versions prior to 148.0.7778.216 contain a vulnerability in input handling that allows an attacker who has already compromised Chrome's renderer process to bypass site isolation protections through a specially crafted HTML page. Site isolation is a critical Chrome security boundary designed to keep sensitive data from different websites separate in memory. This flaw undermines that protection, though it requires the attacker to have already gained code execution within the browser engine itself.

• CVE-2026-11281MEDIUM 5.0

  Google Chrome on Windows contains an integer overflow vulnerability in its Chromoting remote desktop component that could allow a local attacker with user-level privileges to read sensitive information from the browser's memory. The attack requires user interaction and relies on sending a specially crafted Event Tracing for Windows (ETW) event. This is a local-only attack requiring existing system access, not a remote exploitation vector.

• CVE-2026-11290MEDIUM 5.0

  An integer overflow vulnerability exists in the WebView component of Google Chrome on Android devices running versions prior to 149.0.7827.53. A local attacker with limited privileges can exploit this flaw by tricking a user into opening a specially crafted file, leading to a denial of service that crashes the browser or WebView. This is a local attack that requires user interaction and does not compromise confidentiality or integrity.

• CVE-2026-9903MEDIUM 5.0

  Google Chrome versions prior to 148.0.7778.216 contain a vulnerability in Site Isolation, a security feature designed to prevent malicious websites from accessing data from other sites you visit. An attacker who has already compromised Chrome's renderer process—the part that interprets web content—can craft a specially designed MHTML file (a web archive format) that bypasses this protection. This requires the attacker to have gained initial access to the renderer process and the user to open the malicious file, but if successful, it could allow unauthorized access to sensitive information across site boundaries.

• CVE-2026-9942MEDIUM 5.0

  CVE-2026-9942 is a memory safety issue in ANGLE, the graphics abstraction layer used by Google Chrome. When a remote attacker has already compromised Chrome's renderer process, they can exploit this uninitialized memory condition to break out of Chrome's site isolation sandbox using a specially crafted HTML page. Site isolation is Chrome's primary defense against cross-site data theft; bypassing it allows an attacker to read data from other websites the user is visiting. This requires the renderer process to be already compromised, meaning it is a post-compromise escalation rather than an entry point.

• CVE-2026-9979MEDIUM 5.0

  CVE-2026-9979 is a site isolation bypass vulnerability in Google Chrome that allows an attacker to escape the security boundary between different websites if they have already compromised Chrome's rendering engine. An attacker would need to trick a user into visiting a malicious HTML page while the renderer process is already under their control. Site isolation is Chrome's core defense mechanism that prevents one website's scripts from accessing another website's data; this vulnerability undermines that protection in a limited but serious scenario.

• CVE-2026-9980MEDIUM 5.0

  Google Chrome versions before 148.0.7778.216 contain a flaw in how it validates input when printing documents. An attacker who has already compromised Chrome's rendering engine can exploit this to bypass Site Isolation, a security boundary that separates data between websites. This requires both a prior compromise of the renderer process and user interaction, making it a secondary attack in a chain rather than a standalone entry point.

• CVE-2026-14154MEDIUM 4.8

  CVE-2026-14154 is a UI spoofing vulnerability in Google Chrome's DevTools that requires an attacker to trick a user into installing a malicious extension. Once installed, the extension can display fake interface elements to deceive users, potentially leading to credential theft or social engineering attacks. While Google rates this as low severity, the attack chain depends on user action to install the extension, which limits but does not eliminate risk.

• CVE-2026-34694MEDIUM 4.8

  Adobe Experience Manager Forms JEE contains a stored cross-site scripting (XSS) vulnerability in form fields that allows a high-privileged attacker to inject malicious JavaScript code. When other users visit a page containing the compromised form field, the malicious script executes in their browser, potentially compromising their session, credentials, or sensitive data. The vulnerability affects versions LTS SP1, 6.5.24.0 and earlier.

• CVE-2026-11233MEDIUM 4.7

  CVE-2026-11233 is a same-origin policy bypass vulnerability in Google Chrome's FoldableAPIs feature. An attacker who has already gained control of Chrome's renderer process—the component that executes web page code—can use a specially crafted HTML page to break through Chrome's security boundary and access data from websites the user visits. This requires the attacker to have already compromised the renderer, making it a secondary exploit rather than a direct entry point. The vulnerability affects Chrome versions prior to 149.0.7827.53.

• CVE-2026-11249MEDIUM 4.7

  Google Chrome versions before 149.0.7827.53 contain a use-after-free vulnerability in the Network component. If an attacker compromises Chrome's renderer process—the sandboxed part that runs web content—they could read sensitive data from the browser's memory using a specially crafted HTML page. This is a memory safety issue: the code attempts to access data after it has already been freed, potentially exposing unencrypted information that was in use moments before.

• CVE-2026-12463MEDIUM 4.7

  Google Chrome on Linux contains a flaw in how it handles Views that allows an attacker who has already compromised Chrome's rendering engine to inject malicious scripts or HTML content into web pages. This is a secondary attack—the attacker must first gain control of the renderer process before exploiting this vulnerability. The flaw affects Chrome versions prior to 149.0.7827.155 on Linux systems.

• CVE-2026-13034MEDIUM 4.7

  Google Chrome versions before 149.0.7827.197 contain a flaw in how it handles passwords that allows an attacker who has already compromised Chrome's renderer process to break out of site isolation—Chrome's critical security boundary that prevents malicious websites from accessing data belonging to other websites. An attacker would need to trick a user into visiting a specially crafted webpage after first gaining control of the renderer, but if successful, could view sensitive information like passwords or cookies from other sites.

• CVE-2026-13812MEDIUM 4.7

  A vulnerability in Google Chrome for iOS allows attackers to inject malicious scripts or HTML into web pages through specific user interactions. An attacker would need to convince a user to perform particular gestures on a crafted webpage to exploit this flaw. The vulnerability stems from insufficient validation of user-supplied input before processing it in the browser's rendering engine.

• CVE-2026-13808MEDIUM 4.6

  Google Chrome on iOS versions before 150.0.7871.47 contain a flaw in how the browser validates user-supplied data, allowing someone with physical access to an iOS device to extract sensitive information from the browser's memory. This is a local-only attack that requires hands-on device access, but the potential exposure of sensitive data makes it worth patching promptly.

• CVE-2025-48571MEDIUM 4.3

  A logic error in Android's Bluetooth management code (btm_sec.cc) creates a window where attackers can intercept incoming SMS messages. An attacker on the network could exploit this to read message content without needing special device permissions, but requires user interaction to succeed—for instance, the user must be engaged in a Bluetooth operation when the interception occurs. The vulnerability carries medium severity; while SMS interception is serious, the requirement for user interaction and network proximity limits the attack surface.

• CVE-2026-0140MEDIUM 4.3

  CVE-2026-0140 is a remote information disclosure vulnerability in Android's RTP (Real-time Transport Protocol) packet handling. An integer overflow in the RtpPacket::decodePacket function allows an attacker to read data beyond intended memory boundaries when processing specially crafted RTP packets. The flaw requires user interaction—such as receiving and processing a malicious RTP stream—but does not need special privileges. An attacker could potentially extract sensitive information from device memory without executing code.

• CVE-2026-0141MEDIUM 4.3

  A flaw in Android's RTCP application packet handling allows an authenticated attacker to read sensitive data from device memory without triggering a system crash or requiring user interaction. An attacker with network access and valid credentials can craft a malformed packet that bypasses a bounds check, exposing information that could be used in further attacks. This is a classic information disclosure vulnerability—the attacker cannot modify or delete data, but they can peek at what should remain hidden.

• CVE-2026-0155MEDIUM 4.3

  CVE-2026-0155 is a memory reading vulnerability in Google Android's ImsMediaBitReader component. An attacker with basic login access can trigger the code to read data outside intended memory boundaries, potentially exposing sensitive information. This does not require the victim to take any action and does not allow attackers to modify or crash the system—only to peek at unauthorized data in memory.

• CVE-2026-0157MEDIUM 4.3

  CVE-2026-0157 is a memory safety issue in Android's RTCP header processing that allows a logged-in attacker to read sensitive data from device memory without user action. The flaw exists in the RtcpHeader::decodeRtcpHeader function, which fails to validate data boundaries before reading, potentially exposing information like session keys, media content, or other in-memory secrets to a remote attacker with network access and valid credentials.