By vendor

Google vulnerabilities

Known CVEs affecting Google products, prioritized by severity, with SEC.co remediation and detection guidance.

1195 published vulnerabilities · page 6 of 12

• CVE-2026-0150HIGH 7.8

  A flaw in Google Android's EdgeTPU firmware allows a local attacker with basic user privileges to overflow a buffer and gain root-level control of the device. The vulnerability stems from an integer overflow in the ExecuteGraph command handler that fails to properly validate array bounds before writing data. No special user interaction is required—an attacker with local access can trigger the issue directly.

• CVE-2026-0152HIGH 7.8

  A memory management vulnerability exists in Android's OSMMapPMRGeneric function that allows a local attacker to manipulate virtual memory allocation beyond intended boundaries. By exploiting a logic error in the code, an authenticated user on the device can escalate their privileges to a higher level without needing any special system permissions or user interaction. This is a serious flaw because privilege escalation on mobile devices can grant attackers access to sensitive data and system-level controls.

• CVE-2026-0153HIGH 7.8

  A buffer overflow vulnerability exists in Android's msg_to_host_buffer.cc component where the system fails to properly validate the size of data before writing to memory. An attacker with local access to a device can exploit this flaw to write data beyond the allocated buffer, potentially gaining elevated privileges without requiring special system permissions or user interaction. This is a straightforward but dangerous memory-safety issue that could allow unauthorized code execution at higher privilege levels.

• CVE-2026-10942HIGH 7.8

  Google Chrome on Windows contains a UI implementation flaw that allows a local attacker to escalate privileges by opening a malicious file. The vulnerability affects Chrome versions prior to 149.0.7827.53 and requires user interaction (opening a file) but no authentication. If exploited, an attacker could gain elevated system privileges on an affected machine.

• CVE-2026-11072HIGH 7.8

  A use-after-free flaw in Chrome's WebView component on Android allows a local attacker to run malicious code if a user opens a specially crafted file. The attacker needs physical or local access to the device and requires user interaction (opening the file), but once triggered, can gain full control over the affected application's privileges and data.

• CVE-2026-11103HIGH 7.8

  A flaw in Google Chrome's installer on Windows allows a local attacker to gain administrative privileges on a computer by tricking a user into opening a malicious file. The vulnerability exists in how the installer validates and processes files during installation or updates. While Chrome itself is a web browser, this weakness targets the installation mechanism—the software that sets up Chrome on your system—making it a local privilege escalation risk rather than a remote internet-based attack.

• CVE-2026-12449HIGH 7.8

  Google Chrome on Windows has a memory safety flaw in its Chromoting (remote desktop) feature that can allow a local attacker to gain elevated system privileges by opening a specially crafted file. The vulnerability affects Chrome versions before 149.0.7827.155 and requires user interaction but does not require special permissions to exploit. Once triggered, an attacker could potentially take full control of the affected machine.

• CVE-2026-12537HIGH 7.8

  Google's Gemini CLI and its accompanying GitHub Action contain a command injection vulnerability that allows an attacker to execute arbitrary code on a developer's machine or CI/CD pipeline before containerization takes place. An attacker can craft a malicious `.gemini` or `.env` configuration file that, when processed by the vulnerable tool, breaks out of intended command boundaries and runs attacker-controlled commands with the privileges of the user running the tool. This is particularly dangerous in headless CI environments where automation runs without human oversight.

• CVE-2026-13037HIGH 7.8

  A use-after-free memory flaw was discovered in Google Chrome's WebView component on Android devices. An attacker could craft a malicious HTML page that, when opened by a user, exploits this flaw to run arbitrary code within Chrome's sandbox. The vulnerability affects Chrome versions before 149.0.7827.197 and requires local access plus user interaction (opening a webpage), but once triggered, grants the attacker the ability to execute code with the privileges of the Chrome process.

• CVE-2026-13778HIGH 7.8

  A use-after-free vulnerability exists in Google Chrome's WebUSB implementation on macOS. When a user connects a malicious USB peripheral while Chrome is running, an attacker can trigger memory corruption that leads to arbitrary code execution with the privileges of the logged-in user. The flaw affects Chrome versions prior to 150.0.7871.47 on Mac systems and requires the user to interact with the malicious device; it cannot be exploited remotely.

• CVE-2026-13800HIGH 7.8

  Google Chrome on Windows has a flaw in its automatic updater that allows a local attacker to gain elevated system privileges by tricking a user into opening a malicious file. The vulnerability requires the attacker already has local system access and user interaction (such as opening a file), but once triggered, it can lead to complete system compromise. This is a high-severity issue affecting Chrome versions prior to 150.0.7871.47.

• CVE-2026-13827HIGH 7.8

  A use-after-free flaw in Chrome's Updater component on macOS allows a local attacker with standard user permissions to escalate privileges by tricking a user into opening a malicious file. The vulnerability exists in Chrome versions prior to 150.0.7871.47. While exploitation requires local access and user interaction, successful exploitation grants full system-level capabilities on the affected machine.

• CVE-2026-13844HIGH 7.8

  Google Chrome on Windows contains a use-after-free vulnerability in its updater component that allows a local attacker to escalate privileges to the OS level. An attacker would need to trick a user into opening a malicious file, after which the flaw in Chrome's update mechanism can be exploited to run code with system privileges. This affects Chrome versions prior to 150.0.7871.47.

• CVE-2026-13863HIGH 7.8

  A vulnerability in Google Chrome's CustomTabs feature on Android allows a local attacker to gain elevated system privileges by tricking a user into opening a malicious file. The flaw stems from inadequate validation of user-supplied input, meaning Chrome doesn't properly check file contents before processing them through CustomTabs. An attacker with local device access could craft a specially-designed file that, when opened, breaks out of Chrome's normal security boundaries and executes with higher privileges.

• CVE-2026-13927HIGH 7.8

  Google Chrome on Android contains a flaw in how it validates user-provided input within its user interface. A local attacker who can place a specially crafted file on an affected device and convince a user to interact with it could gain elevated privileges on the device. This is a local privilege escalation vulnerability that requires the attacker to already have some presence on the device and user interaction to succeed.

• CVE-2026-14018HIGH 7.8

  A use-after-free flaw in Chrome's Updater component on Windows allows a local attacker to escalate to full system-level privileges by delivering a specially crafted file. The vulnerability requires user interaction (such as opening a file) but no special permissions to exploit. Once triggered, an attacker gains complete control over the compromised system. Google has assigned this a Medium severity rating in Chromium but the CVSS score reflects high severity due to the combination of complete system compromise and the realistic attack vector for Windows users.

• CVE-2026-14060HIGH 7.8

  A flaw in Chrome's Chromoting component on Windows allows a local attacker to gain elevated privileges by opening a specially crafted file. The vulnerability stems from insufficient validation of untrusted input. To exploit this, an attacker must already have access to the target machine and user interaction is required—the victim must open the malicious file. Chrome versions prior to 150.0.7871.47 are affected.

• CVE-2026-14094HIGH 7.8

  A use-after-free memory vulnerability exists in Google Chrome's installer on Windows systems. An attacker with local access can exploit this flaw by providing a malicious file to cause Chrome to access memory that has already been freed, leading to a crash or potentially arbitrary code execution with elevated system privileges. This is a local attack requiring user interaction (such as opening or installing a malicious file), not a remote exploitation vector.

• CVE-2026-14124HIGH 7.8

  Google Chrome on Windows contains a flaw in how it handles credential provider operations that could allow a local attacker to escalate their privileges to system or administrator level by tricking a user into interacting with a specially crafted file. The vulnerability requires user interaction but no special privileges to exploit, making it a practical attack vector for malware or local attackers seeking elevated access.

• CVE-2026-28577HIGH 7.8

  A vulnerability in Android's window management system allows a locally authenticated attacker to perform a tapjacking attack—placing hidden overlay windows on top of legitimate applications to intercept user input or actions. This attack doesn't require user interaction to trigger and can result in unauthorized privilege escalation. The attacker needs only local access to the device (such as through an installed app), making it a practical threat in real-world scenarios.

• CVE-2026-28580HIGH 7.8

  CVE-2026-28580 is a local privilege escalation vulnerability affecting Google Android. An attacker with basic user-level access to a device can exploit an incorrect bounds check in multiple persistence-related functions to gain elevated privileges without requiring additional capabilities or interaction from the user. The issue stems from a synchronization problem that allows the attacker to manipulate persistent data in an unexpected way, ultimately escalating their permissions on the system.

• CVE-2026-28615HIGH 7.8

  CVE-2026-28615 is a local privilege escalation vulnerability in Google Android's Telecomm component that allows an attacker with limited user-level access to bypass permission checks and initiate unauthorized phone calls. The vulnerability requires no user interaction and no special execution privileges beyond standard app permissions, making it straightforward to exploit once an attacker gains initial device access.

• CVE-2026-9987HIGH 7.8

  A flaw in Google Chrome for Android allows a malicious file to trick the app's installation handler into running unauthorized code on your device. An attacker would need local access (physical proximity or prior compromise) and some user interaction to pull this off. The vulnerability stems from insufficient validation when Chrome processes installation-related files or requests.

• CVE-2026-11297HIGH 7.7

  A vulnerability in Google Chrome's Reader Mode on Android allows local attackers to bypass navigation restrictions by providing a specially crafted file. While the underlying input validation flaw is classified as low severity by Google's Chromium team, the CVSS scoring reflects the potential for high-impact integrity and availability consequences when successfully exploited. This is a local-only attack, meaning an attacker must already have some level of access to the device to deliver the malicious file.

• CVE-2026-0156HIGH 7.5

  CVE-2026-0156 is a memory safety flaw in Android's RTP (Real-time Transport Protocol) session handling that allows an attacker to crash or disrupt media streaming without authentication. The vulnerability exists in the collision-detection code that processes incoming RTP packets; a missing validation check can cause the system to attempt operations on a null pointer, triggering a denial-of-service condition. An attacker on the network can exploit this remotely by sending specially crafted RTP traffic.

• CVE-2026-10003HIGH 7.5

  A use-after-free vulnerability in Chrome's Views component allows attackers to execute arbitrary code on affected systems. The flaw requires user interaction—specifically, the victim must perform particular UI gestures after being convinced to visit a malicious webpage. Once triggered, the vulnerability grants the attacker the same privileges as the user running the browser, potentially leading to complete system compromise.

• CVE-2026-10005HIGH 7.5

  Google Chrome on macOS contains a use-after-free vulnerability in its WebAppInstalls component that can be exploited to execute arbitrary code. An attacker would need to convince a user to perform specific gestures within a crafted HTML page to trigger the flaw. This affects Chrome versions prior to 148.0.7778.216.

• CVE-2026-10006HIGH 7.5

  A race condition in Google Chrome's WebAudio component allows attackers to execute arbitrary code within the browser sandbox by serving a specially crafted HTML page to a user. The vulnerability requires user interaction (clicking or navigating to the malicious page) but does not require special privileges. Successfully exploiting this issue could allow an attacker to run code with the permissions of the Chrome process, potentially leading to data theft, malware installation, or further system compromise.

• CVE-2026-10009HIGH 7.5

  A mathematical error in Chrome's graphics rendering engine (Skia) could allow attackers to break out of the browser sandbox and run malicious code if they've already compromised the browser's rendering process. The vulnerability affects Chrome versions before 148.0.7778.216 and requires user interaction, such as visiting a malicious webpage, to trigger the exploit.

• CVE-2026-10022HIGH 7.5

  A type confusion flaw in Google Chrome's V8 JavaScript engine (CVE-2026-10022) allows attackers to execute arbitrary code within the browser sandbox if they can trick a user into installing a malicious Chrome extension. The vulnerability affects Chrome versions before 148.0.7778.216 and impacts Windows, macOS, and Linux systems. While the underlying Chromium severity is rated Medium by Google, the CVSS v3.1 score of 7.5 reflects the practical risk: an attacker gaining code execution inside the Chrome sandbox can read sensitive data, modify browser state, or escalate privileges. The attack requires social engineering to distribute the malicious extension, which limits opportunistic exploitation but remains a credible threat in targeted campaigns.

• CVE-2026-10899HIGH 7.5

  A use-after-free vulnerability exists in Google Chrome's Ozone display system on Linux that could allow an attacker to corrupt the browser's memory. If a user is tricked into performing specific UI interactions on a malicious webpage, the attacker could potentially execute code or crash the browser. This flaw affects Chrome versions prior to 149.0.7827.53 on Linux systems.

• CVE-2026-10900HIGH 7.5

  A use-after-free flaw in Google Chrome's password management feature on macOS allows attackers to corrupt memory and potentially execute code if they trick a user into performing specific interactions with a malicious webpage. The vulnerability requires user interaction and affects Chrome versions before 149.0.7827.53. While rated HIGH by CVSS, the attack surface is narrowed by the need for deliberate user gestures and the complexity of reliable exploitation.

• CVE-2026-10901HIGH 7.5

  A use-after-free memory flaw exists in Google Chrome's password manager on macOS. An attacker can trigger the vulnerability by convincing a user to interact with a specially crafted webpage in specific ways—for example, through unusual clicking patterns or drag-and-drop actions in the password UI. Successful exploitation allows remote code execution with the privileges of the Chrome process. This is a memory safety issue where the browser continues to reference password manager data after it has been freed, creating an opportunity for malicious code injection.

• CVE-2026-10906HIGH 7.5

  Google Chrome contains a use-after-free vulnerability in its WebAuthentication implementation that can lead to heap memory corruption. An attacker must craft a malicious HTML page and convince a user to interact with it in a specific way—such as clicking or gesturing within the web interface—to trigger the flaw. Successfully exploiting this could allow the attacker to execute arbitrary code or crash the browser. The vulnerability affects Chrome versions before 149.0.7827.53.

• CVE-2026-10946HIGH 7.5

  Google Chrome versions before 149.0.7827.53 contain a heap buffer overflow vulnerability in its media processing component. An attacker can exploit this by hosting a specially crafted HTML page and convincing a user to interact with it in specific ways—such as clicking, dragging, or performing other UI gestures. If successful, the attacker gains the ability to run arbitrary code, but crucially, that code executes within Chrome's sandbox, limiting lateral damage to the user's system. The vulnerability requires active user involvement, which raises the bar for exploitation but remains a meaningful risk given how often users interact with web content.

• CVE-2026-10969HIGH 7.5

  A flaw in Google Chrome's extension validation system allows attackers to escalate privileges if they've already compromised Chrome's rendering engine. An attacker would need to trick a user into viewing a specially crafted webpage while the renderer process is already under their control, leading to unauthorized system-level access. This is a High-severity issue affecting Chrome versions before 149.0.7827.53.

• CVE-2026-11058HIGH 7.5

  Google Chrome on Windows contains an integer overflow vulnerability in its CredentialProvider component that could allow an attacker who has already compromised the browser's rendering engine to escalate their privileges to the operating system level. The attacker would need to serve a specially crafted webpage to trigger the flaw. While the Chromium project rates this as Medium severity, the CVSS assessment reflects HIGH risk due to the potential for complete system compromise once the renderer is already under attacker control.

• CVE-2026-11149HIGH 7.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how Extensions are validated, allowing an attacker who has already compromised Chrome's rendering engine to bypass security boundaries and gain elevated privileges on the user's system. The attacker would need to trick a user into visiting a specially crafted webpage while the renderer process is already under attacker control. This vulnerability bridges a gap between renderer compromise and full system-level access, making it a serious escalation path in multi-stage attacks.

• CVE-2026-11151HIGH 7.5

  Google Chrome's Password Manager component fails to properly validate user-supplied input before processing it. This gap allows an attacker who has already compromised Chrome's renderer process—the sandboxed part of the browser that runs web content—to escape the sandbox and gain deeper access to the system. The attacker would need to craft a malicious HTML page and convince a user to visit it, but once the renderer is compromised, the insufficient input validation becomes the bridge to break out of Chrome's security boundaries.

• CVE-2026-11154HIGH 7.5

  A use-after-free flaw in Google Chrome's Dawn graphics component allows an attacker who has already compromised the renderer process to break out of Chrome's sandbox and potentially gain system-level access. The vulnerability requires the attacker to trick a user into opening a malicious webpage and demands prior compromise of the renderer process, making it a two-stage attack. Patching to Chrome 149.0.7827.53 or later closes this gap.

• CVE-2026-11239HIGH 7.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser handles extensions that could allow an attacker to escalate privileges if they've already compromised the renderer process—the sandboxed component responsible for running web pages and extensions. An attacker would need to trick a user into visiting a malicious webpage after the renderer is already compromised, but successful exploitation could grant them elevated system access.

• CVE-2026-11242HIGH 7.5

  Google Chrome versions prior to 149.0.7827.53 contain a vulnerability in how the browser handles untrusted input within plugins. An attacker who has already compromised Chrome's renderer process can craft a malicious HTML page to steal sensitive data from websites the user has visited, potentially exposing information that should remain isolated between different web domains. This requires the renderer to be compromised first, making it a secondary attack in a chain, but the confidentiality risk is significant.

• CVE-2026-11255HIGH 7.5

  A flaw in Google Chrome's Storage Access API fails to properly check user input, creating a security gap. If an attacker first compromises Chrome's renderer process—the part that runs web content—they could exploit this gap to steal data from websites you've visited, even across security boundaries that normally block such access. The issue affects Chrome versions before 149.0.7827.53, as well as the underlying operating systems on macOS, Linux, and Windows where Chrome runs.

• CVE-2026-11265HIGH 7.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in the Autofill feature that can allow attackers to steal sensitive data from other websites. An attacker can craft a malicious webpage that, when visited by a user, extracts information that should have been protected by browser isolation mechanisms. The vulnerability requires no user interaction beyond visiting the page and affects confidentiality but not system integrity or availability.

• CVE-2026-11296HIGH 7.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the ImageCapture feature handles certain operations, allowing an attacker who has already compromised the browser's rendering engine to gain elevated privileges on the system. The attacker would need to trick the user into visiting a malicious webpage while the renderer process is already under their control. This is a privilege escalation vulnerability rather than a remote code execution vulnerability, meaning the initial compromise must have already occurred.

• CVE-2026-11632HIGH 7.5

  A use-after-free flaw in Google Chrome's TabStrip component allows attackers to run arbitrary code on a victim's computer. The vulnerability requires an attacker to craft a malicious webpage and convince a user to perform specific interactions (like clicking or dragging tabs) to trigger the bug. Successful exploitation could give an attacker complete control over the affected system, including access to sensitive data, installation of malware, or lateral movement to other systems on the network.

• CVE-2026-11636HIGH 7.5

  A use-after-free vulnerability exists in Google Chrome's Autofill feature on Windows systems. An attacker can craft a malicious HTML page that, when combined with specific user interactions, may trigger memory corruption leading to code execution. The vulnerability requires user interaction—specifically certain UI gestures—to be exploited, but once triggered, the impact is severe. Chrome versions prior to 149.0.7827.103 are affected.

• CVE-2026-11639HIGH 7.5

  A use-after-free memory safety flaw exists in Google Chrome's compositing engine on macOS. If you visit a malicious webpage, an attacker could exploit this vulnerability to run arbitrary code on your system with the privileges of the Chrome process. The vulnerability was patched in Chrome 149.0.7827.103 and later versions.

• CVE-2026-11641HIGH 7.5

  A memory safety flaw in Google Chrome's Bluetooth implementation on Windows allows attackers to crash the browser or run malicious code if they can trick a user into specific interactions with a specially crafted webpage. The vulnerability requires user action and doesn't grant automatic exploitation, but once triggered, it could give an attacker full control over the affected browser process and any data within it.

• CVE-2026-11644HIGH 7.5

  A use-after-free vulnerability exists in Google Chrome's Views component on Linux systems. An attacker could exploit this by tricking a user into installing a malicious Chrome extension, which could then execute arbitrary code with the privileges of the Chrome process. This represents a critical-severity issue from Chromium's perspective, though the CVSS score reflects the requirement for user interaction (extension installation) as a limiting factor.

• CVE-2026-11667HIGH 7.5

  Google Chrome versions prior to 149.0.7827.103 contain an out-of-bounds read vulnerability in WebRTC processing that could allow an attacker with prior access to the GPU process to corrupt heap memory and potentially execute code. The attack requires user interaction (clicking a malicious link or visiting a crafted webpage) but could lead to serious data theft or system compromise.

• CVE-2026-11690HIGH 7.5

  A memory safety vulnerability in Google Chrome's media handling on macOS allows an attacker who has already compromised the browser's renderer process to read and write memory outside intended boundaries. By hosting a malicious HTML page, the attacker can exploit this flaw to execute arbitrary code even within Chrome's sandbox environment. The vulnerability affects Chrome versions prior to 149.0.7827.103 on macOS.

• CVE-2026-11694HIGH 7.5

  A use-after-free flaw in Google Chrome's ServiceWorker implementation could allow an attacker who has already compromised the renderer process to run malicious code within the sandbox. The vulnerability requires user interaction (visiting a specially crafted webpage) but poses a direct path to code execution for an attacker with partial system access.

• CVE-2026-1220HIGH 7.5

  A race condition in Google Chrome's V8 JavaScript engine could allow an attacker to trick the browser into confusing data types when processing a malicious webpage. An attacker would need to craft a specific HTML page and convince a user to visit it, but if successful, the vulnerability could lead to information disclosure, data tampering, or application crashes. Chrome versions before 144.0.7559.99 are affected.

• CVE-2026-12445HIGH 7.5

  Google Chrome versions before 149.0.7827.155 contain a use-after-free vulnerability in the Extensions subsystem. An attacker can exploit this by tricking a user into installing a malicious Chrome extension, potentially leading to heap corruption and arbitrary code execution on the victim's machine. The vulnerability requires user interaction (extension installation) but poses significant risk because users may not scrutinize extension permissions closely.

• CVE-2026-12455HIGH 7.5

  A use-after-free memory vulnerability exists in Google Chrome's tab strip component that could allow an attacker to corrupt the browser's heap memory. The attack requires convincing a user to perform specific UI actions (such as interacting with tabs in a particular sequence) while viewing a malicious webpage. If exploited successfully, an attacker could gain the ability to read sensitive data, modify browser behavior, or crash the application. This vulnerability affects Chrome versions prior to 149.0.7827.155 across Windows, macOS, and Linux systems.

• CVE-2026-12462HIGH 7.5

  A use-after-free vulnerability in Chrome's media handling allows an attacker who has already compromised the renderer process to execute arbitrary code within the browser sandbox. The vulnerability requires user interaction (such as opening a malicious HTML page) but poses a serious risk because it enables code execution even when the renderer is already isolated from the system. This vulnerability affects Chrome versions prior to 149.0.7827.155.

• CVE-2026-13029HIGH 7.5

  A use-after-free flaw in Chrome's Web Authentication system allows attackers to corrupt the browser's heap memory. The vulnerability requires both user interaction—tricking someone into installing a malicious Chrome extension—and the extension itself to be crafted specifically to exploit the weakness. If successfully exploited, an attacker could potentially execute arbitrary code within the Chrome process, compromising browsing security and data confidentiality.

• CVE-2026-13283HIGH 7.5

  Google Chrome on Android contains a use-after-free vulnerability in its AdFilter component that could allow an attacker to run malicious code on a user's device. An attacker would need to trick a user into performing specific touch gestures on a specially crafted webpage to trigger the flaw. This is a memory safety issue where freed memory is accessed, leading to potential code execution with the privileges of the browser process.

• CVE-2026-13794HIGH 7.5

  Google Chrome on Windows contains a flaw in its web app installation feature that fails to properly validate user-supplied input. An attacker can craft a malicious HTML page that, when visited by a user who performs specific interactions with Chrome's UI, triggers arbitrary code execution on the affected system. The vulnerability requires user interaction but grants complete control over the compromised machine.

• CVE-2026-13802HIGH 7.5

  Google Chrome versions before 150.0.7871.47 contain a use-after-free vulnerability in the Views component that allows an attacker to execute arbitrary code on an affected system. The attack requires a user to visit a specially crafted webpage and perform specific UI interactions—such as clicking or navigating—that trigger the vulnerable code path. While user interaction is required, successful exploitation could grant the attacker full control over the affected Chrome process and any data it can access.

• CVE-2026-13807HIGH 7.5

  A use-after-free vulnerability exists in Google Chrome's import functionality on iOS. An attacker can exploit this by hosting a malicious file and convincing a user to perform specific gestures (such as importing the file) within the browser. If successful, the attacker gains the ability to run arbitrary code on the affected device with the privileges of the Chrome process. The vulnerability affects Chrome versions before 150.0.7871.47.

• CVE-2026-13814HIGH 7.5

  Google Chrome versions prior to 150.0.7871.47 contain a use-after-free vulnerability in the Views component that can lead to heap corruption. An attacker would need to craft a malicious HTML page and socially engineer a user into performing specific UI interactions to trigger the flaw. If exploited, this could allow code execution or data theft on the affected machine.

• CVE-2026-13824HIGH 7.5

  Google Chrome versions before 150.0.7871.47 contain a security flaw in how it enforces policies for browser extensions. An attacker who has already compromised Chrome's renderer process—the component that executes web content—can exploit insufficient policy checks to escalate their privileges and gain deeper control of the browser. The attack requires user interaction (such as visiting a malicious webpage) but bypasses normal security boundaries once the renderer is compromised.

• CVE-2026-13831HIGH 7.5

  A memory safety vulnerability in Google Chrome's GPU processing component allows an attacker who has already compromised a Chrome renderer process to break out of the sandbox and execute arbitrary code with elevated privileges. The vulnerability stems from improper bounds checking in GPU memory operations, allowing out-of-bounds read and write access. An attacker would need to deliver a malicious HTML page to a user and have that page run within an already-compromised renderer context to exploit this flaw.

• CVE-2026-13855HIGH 7.5

  A use-after-free vulnerability exists in the Ozone subsystem of Google Chrome on Linux. An attacker can exploit this by crafting a malicious webpage that tricks a user into performing specific mouse or keyboard gestures, leading to arbitrary code execution on the affected system. The vulnerability requires user interaction but allows full compromise of the browser process and potentially the underlying system.

• CVE-2026-13856HIGH 7.5

  Google Chrome on Android contains a vulnerability in its Speech feature that could allow an attacker to gain elevated privileges on your device. The vulnerability requires two conditions: first, the attacker must have already compromised Chrome's rendering engine (the part that displays web content), and second, you must visit a malicious webpage. If both happen, the attacker could escalate from their limited renderer access to higher system privileges, potentially compromising your device more completely. Google has released Chrome version 150.0.7871.47 or later to fix this issue.

• CVE-2026-13891HIGH 7.5

  Google Chrome versions before 150.0.7871.47 contain a vulnerability in how the browser's extension system validates user input. An attacker who has already compromised Chrome's rendering engine can exploit this weakness to escape the browser's sandbox and gain system-level privileges. The attack requires a specially crafted web page and user interaction, but once executed allows the attacker to move from browser context to full machine control.

• CVE-2026-13925HIGH 7.5

  Google Chrome on Windows contains a flaw in how it handles downloaded files that could allow an attacker to run malicious code on your computer. The attack requires tricking a user into performing specific actions (like clicking or dragging) while viewing a specially crafted webpage. Once triggered, the vulnerability grants full control over the affected system, including the ability to read sensitive data, modify files, or disable functionality.

• CVE-2026-13968HIGH 7.5

  A vulnerability in Google Chrome's DevTools allows attackers to run malicious code within a sandboxed environment if they can trick a user into performing specific actions with a crafted file. The flaw stems from inadequate validation of user-supplied input, making it possible for remote attackers to execute arbitrary code without needing special privileges or system access. While the code runs in a sandbox—which limits potential system-wide damage—successful exploitation could still grant attackers access to sensitive data or capabilities within that sandbox context.

• CVE-2026-14064HIGH 7.5

  A use-after-free flaw in Chrome's PageInfo component on Android allows attackers to run malicious code on affected devices. The attack requires social engineering—convincing a user to perform specific UI interactions with a specially crafted webpage. While the underlying defect is classified as 'Low' severity by Chromium, the potential for complete system compromise (data theft, modification, or disruption) combined with the user interaction requirement results in a HIGH CVSS score of 7.5.

• CVE-2026-14114HIGH 7.5

  Google Chrome on Android versions prior to 150.0.7871.47 contain a flaw in how the WebAppInstalls feature handles certain file types. An attacker with local access to a device can exploit this to make the browser display fake buttons, warnings, or interface elements that trick users into taking unwanted actions. While the underlying severity designation from Google's security team is 'Low,' the CVSS score reflects the potential for integrity impact if a user is socially engineered through the spoofed UI.

• CVE-2026-14115HIGH 7.5

  CVE-2026-14115 is a privilege escalation vulnerability in Google Chrome's Cast feature that allows an attacker who has already compromised Chrome's renderer process to gain elevated system privileges through a specially crafted HTML page. While the underlying Chromium defect is rated Low severity by Google's own assessment, the CVSS 3.1 score reflects the potential for complete system compromise (confidentiality, integrity, and availability impact) once an attacker reaches the renderer process. The vulnerability affects Chrome versions before 150.0.7871.47 and impacts Windows, macOS, and Linux users.

• CVE-2026-14409HIGH 7.5

  A vulnerability in Chrome's V8 JavaScript engine allows attackers to run malicious code within the browser's sandbox if a user performs specific interactions with a crafted webpage. While the vulnerability requires user engagement and is marked as 'Low' severity by Google's internal classification, the CVSS score of 7.5 reflects the potential for complete compromise of user data within the browser process. All Chrome versions before 150.0.7871.46 are affected.

• CVE-2026-14426HIGH 7.5

  A use-after-free flaw in Google Chrome's V8 JavaScript engine allows attackers to execute code within the browser's sandbox if they trick a user into performing specific UI interactions on a malicious webpage. The attack requires both a crafted HTML page and active user participation, making it a targeted rather than passive threat. Chrome versions prior to 150.0.7871.46 are vulnerable.

• CVE-2026-15111HIGH 7.5

  A use-after-free memory vulnerability exists in Google Chrome's rendering engine that could allow an attacker to corrupt heap memory and potentially execute code if a user interacts with a specially crafted webpage in specific ways. The vulnerability affects Chrome versions prior to 150.0.7871.115 and requires user interaction to exploit, but successful exploitation could lead to data theft, system compromise, or denial of service.

• CVE-2026-15117HIGH 7.5

  A use-after-free vulnerability exists in Google Chrome's Payments feature that could allow an attacker to corrupt computer memory if a user is tricked into performing specific interactions with a malicious webpage. The vulnerability affects Chrome versions prior to 150.0.7871.115 and requires the attacker to craft a deceptive HTML page and convince the user to engage in particular UI gestures. If successfully exploited, an attacker could potentially read sensitive data, modify system behavior, or crash the browser.

• CVE-2026-34711HIGH 7.5

  A flaw in CAI Content Credentials—a technology for tracking and verifying the authenticity of digital content—allows an attacker to crash applications using affected versions by sending specially crafted input that triggers an integer overflow. No user action is required; the attack can be executed remotely. The vulnerability affects multiple platforms including iOS, macOS, Android, Windows, and Linux systems that implement the c2pa-web or c2pa libraries.

• CVE-2026-58299HIGH 7.5

  Microsoft Edge for Android contains a race condition vulnerability that could allow an attacker to execute arbitrary code on a user's device through a network-based attack. The flaw exists in a time-of-check time-of-use (TOCTOU) scenario, where the application checks a security condition at one point but the actual use of that resource happens slightly later—giving an attacker a window to manipulate the state between those two moments. Successful exploitation requires user interaction and specific timing, but when achieved, grants the attacker the ability to run code with the privileges of the Edge browser process.

• CVE-2026-9901HIGH 7.5

  A use-after-free flaw in ANGLE (the graphics abstraction layer used by Chrome) allows an attacker to run malicious code on a target's machine. The attack requires two conditions: the attacker must first compromise Chrome's renderer process (the component that draws web content), and the victim must then visit a specially crafted web page. Once both conditions are met, arbitrary code can execute with the privileges of the compromised renderer process. This affects Chrome versions before 148.0.7778.216.

• CVE-2026-9909HIGH 7.5

  A flaw in Skia, the graphics rendering library used by Google Chrome, can be exploited by an attacker who has already compromised Chrome's sandboxed renderer process. The vulnerability stems from improper handling of integer values, which an attacker could leverage to execute arbitrary code within the sandbox by serving a specially crafted HTML page. While the vulnerability requires prior compromise of the renderer process, it represents a critical step in a potential attack chain that could lead to full browser compromise.

• CVE-2026-9922HIGH 7.5

  A use-after-free vulnerability exists in Google Chrome's GPU rendering engine on macOS. The flaw allows an attacker who has already compromised Chrome's renderer process to execute arbitrary code by serving a specially crafted HTML page. This is a post-compromise risk: the attacker must first break into the renderer sandbox, but if successful, can then escalate to full code execution with system privileges. The vulnerability affects Chrome versions prior to 148.0.7778.216 on macOS.

• CVE-2026-9933HIGH 7.5

  CVE-2026-9933 is a use-after-free memory vulnerability in Google Chrome's input handling code that allows attackers to corrupt heap memory on affected systems. Exploitation requires an attacker to trick a user into performing specific UI interactions (such as unusual mouse or keyboard gestures) while viewing a specially crafted HTML page. This is not a passive drive-by attack; active user participation is required. If successfully exploited, an attacker could execute arbitrary code with the privileges of the Chrome process, leading to complete compromise of the affected user's system.

• CVE-2026-9934HIGH 7.5

  A use-after-free memory flaw exists in Google Chrome's Aura component (which handles window management and input) before version 148.0.7778.216. An attacker could exploit this by convincing a user to interact with a specially crafted webpage using specific mouse or keyboard gestures. Successful exploitation would allow the attacker to run arbitrary code on the victim's machine with the privileges of the Chrome process.

• CVE-2026-9954HIGH 7.5

  A use-after-free vulnerability exists in Google Chrome's TabStrip component that can lead to memory corruption. An attacker must trick a user into performing specific UI interactions (like clicking or dragging tabs in a particular sequence) on a malicious website to potentially trigger the flaw. Successful exploitation could allow the attacker to read sensitive data, modify page content, or crash the browser. The vulnerability affects Chrome versions prior to 148.0.7778.216 across Windows, macOS, and Linux.

• CVE-2026-9956HIGH 7.5

  A use-after-free vulnerability in Google Chrome on iOS allows remote attackers to execute arbitrary code if a user can be tricked into performing specific gestures on a malicious webpage. The vulnerability requires user interaction but doesn't require special privileges or system access, making it a realistic attack vector for threat actors hosting compromised or attacker-controlled sites.

• CVE-2026-9960HIGH 7.5

  A flaw in PDFium, the PDF rendering library used by Google Chrome, allows an attacker who has already compromised Chrome's renderer process to break out of the sandbox and run arbitrary code with elevated privileges by supplying a specially crafted font file. This represents a significant post-compromise risk for users who may have already been exposed to initial malware or browser exploits.

• CVE-2026-9963HIGH 7.5

  A memory initialization flaw in Google Chrome for iOS (versions before 148.0.7778.216) could allow an attacker to run malicious code within the browser's sandbox if a user visits a crafted webpage and performs specific touch interactions. The vulnerability requires active user engagement to exploit—simply landing on a malicious site is not enough. Code execution remains confined to the browser sandbox, limiting direct system compromise but still posing a meaningful threat to user data and browser security.

• CVE-2026-9990HIGH 7.5

  Google Chrome on macOS contains a use-after-free vulnerability in its web app installation feature that could allow an attacker to corrupt memory on a user's system. The vulnerability requires a user to perform specific interactions with a malicious webpage, but once triggered, it could potentially give an attacker the ability to read sensitive data, modify files, or crash the browser. The issue affects Chrome versions before 148.0.7778.216 on Mac systems.

• CVE-2026-10968HIGH 7.4

  A vulnerability in Chrome's graphics rendering engine (Dawn) on Windows allows attackers to steal sensitive data from websites you're visiting. If an attacker first compromises Chrome's renderer process—the part that runs web content—they can craft a malicious webpage to leak information across website boundaries, bypassing Chrome's security isolation. This requires the attacker to have already gained control of the renderer, making it part of a multi-stage attack but with serious data-theft consequences once achieved.

• CVE-2026-10973HIGH 7.4

  A flaw in Google Chrome's Dawn graphics component allowed attackers to extract sensitive data across website boundaries through a specially crafted web page. The vulnerability required user interaction (clicking or visiting a malicious page) but did not require any special privileges. An attacker could craft HTML that exploits uninitialized memory in Chrome's graphics processing to read data from other origins that should have been isolated, potentially exposing authentication tokens, personal information, or other sensitive content loaded in the same browser session.

• CVE-2026-10976HIGH 7.4

  A memory disclosure vulnerability exists in Google Chrome's graphics engine (Dawn) that could allow an attacker to read sensitive data from Chrome's process memory. The flaw stems from uninitialized variables being used without proper initialization checks. An attacker would need to trick a user into visiting a specially crafted webpage to trigger the vulnerability. The issue affects Chrome versions before 149.0.7827.53.

• CVE-2026-0131HIGH 7.3

  A vulnerability in Android's RTP packet processing allows a local attacker to access memory outside intended boundaries, potentially escalating their privileges. The flaw stems from an integer overflow in the RtpPacket::decodePacket function. An attacker with basic local access can trigger the vulnerability if a user interacts with a malicious RTP stream—for example, by opening a crafted media file or accepting a call with specially prepared audio/video data.

• CVE-2026-11035HIGH 7.3

  Google Chrome on Android contains a flaw in how it handles Custom Tabs—a feature that allows apps to open web content within their own interface. An attacker with local access to a device can exploit this vulnerability by crafting a malicious XML file, potentially gaining elevated privileges on the system. The issue affects Chrome versions prior to 149.0.7827.53. While the base severity from Chromium is listed as Medium, the overall risk score reflects the complete attack chain impact.

• CVE-2026-11115HIGH 7.3

  A use-after-free vulnerability exists in Google Chrome's update mechanism on Windows systems. An attacker with local access can exploit this flaw by crafting a malicious file, potentially escalating their privileges to system or administrator level. The vulnerability affects Chrome versions before 149.0.7827.53 and requires user interaction (such as opening or running a file) to trigger the exploit.

• CVE-2026-11269HIGH 7.1

  Google Chrome versions prior to 149.0.7827.53 contain a vulnerability in how the browser handles extensions that allows an attacker positioned on the same network as a user to execute arbitrary code within Chrome's sandbox. The attacker must craft a malicious extension and the user must interact with it (such as installing or clicking something), making this a moderate-complexity attack. While Chromium rated this as low severity internally, the CVSS assessment reflects the potential for complete compromise of the sandboxed process.

• CVE-2026-58296HIGH 7.1

  A privacy vulnerability in Microsoft Edge for Android can expose users' personal information to attackers over the internet. An attacker could trick a user into performing certain actions on a compromised or attacker-controlled website, potentially revealing sensitive data stored or cached within the browser. The vulnerability requires user interaction to exploit, but once triggered, it bypasses normal privacy protections.

• CVE-2026-58297HIGH 7.1

  Microsoft Edge on Android contains a privacy flaw that allows attackers to access and transmit private user information over the network without authorization. The issue requires user interaction (such as visiting a malicious site) but does not require any special system access to exploit. An attacker can leverage this vulnerability to steal sensitive personal data from affected Android devices.

• CVE-2026-0083HIGH 7.0

  A race condition in Android's NFC (Near Field Communication) event handling code allows a local attacker with basic system access to escalate their privileges to access sensitive data or modify system files. The vulnerability requires precise timing exploitation but no special permissions or user interaction to trigger, making it a significant local security concern.

• CVE-2026-0125HIGH 7.0

  CVE-2026-0125 is a race condition vulnerability in Android's VPU (Video Processing Unit) driver that allows a local attacker to escalate their privileges. An attacker with a low-privilege local account can trigger a use-after-free condition in the vpu_ioctl.c file by timing requests carefully, potentially gaining higher-level access to the device without needing special permissions or user interaction. This is a serious flaw because it requires only local access and basic user privileges to exploit.