By vendor

Google vulnerabilities

Known CVEs affecting Google products, prioritized by severity, with SEC.co remediation and detection guidance.

1195 published vulnerabilities · page 9 of 12

• CVE-2026-13937MEDIUM 6.5

  Google Chrome versions before 150.0.7871.47 contain a flaw in password policy enforcement that could allow an attacker who has already compromised the browser's rendering engine to steal sensitive information from websites you visit. The attacker would craft a malicious web page to extract data that should remain isolated between different websites. While this requires the renderer process to be compromised first, it represents a meaningful step in a multi-stage attack chain.

• CVE-2026-13940MEDIUM 6.5

  Google Chrome versions before 150.0.7871.47 contain a flaw in how the Cast feature handles uninitialized memory during type conversion. An attacker positioned on the same local network as a victim can send specially crafted network packets to trigger this bug, potentially reading sensitive data from Chrome's process memory without requiring user interaction or special privileges. The vulnerability is classified as medium severity.

• CVE-2026-13943MEDIUM 6.5

  Google Chrome on Android contains a flaw where uninitialized memory in the CSS rendering engine can leak sensitive data to attackers. An attacker crafts a malicious webpage and tricks a user into visiting it; the browser then exposes fragments of process memory—potentially containing passwords, tokens, or other confidential information—that the attacker can read. This affects Chrome versions before 150.0.7871.47 on Android.

• CVE-2026-13949MEDIUM 6.5

  A flaw in Google Chrome's payment handling on Android devices could allow an attacker to steal sensitive information from the browser's memory. The vulnerability requires a user to visit a malicious website, but does not require any special user privileges or browser configuration. An attacker could craft a deceptive web page that, when viewed, bypasses Chrome's security policies and leaks data from the payment system's process memory—potentially exposing payment-related information or other sensitive details stored there.

• CVE-2026-13953MEDIUM 6.5

  Google Chrome versions before 150.0.7871.47 contain a flaw in how the SplitView feature handles navigation security checks. An attacker who has already compromised Chrome's renderer process—the component that executes web content—can exploit this weakness to bypass built-in navigation restrictions by serving a crafted HTML page. The vulnerability requires the attacker to have prior control of the renderer process, which substantially limits the attack surface but remains serious in environments where renderer compromise is plausible.

• CVE-2026-13954MEDIUM 6.5

  Google Chrome on Android contains a flaw in how it enforces security policies when processing XML within web pages. An attacker can craft a malicious HTML page that, when visited by a user, allows the attacker to read sensitive data held in Chrome's process memory. This vulnerability requires user interaction (visiting a malicious page) but does not require the attacker to be authenticated or have special privileges. The vulnerability was patched in Chrome version 150.0.7871.47 and later.

• CVE-2026-13958MEDIUM 6.5

  Google Chrome on Windows contains a memory safety bug in its codec handling that can leak sensitive information to attackers. When a user visits a specially crafted webpage, Chrome may fail to properly initialize certain codec variables, allowing the attacker to read unencrypted data from the browser's memory. This is a confidentiality risk—attackers cannot modify or destroy data, but they may access things like cached credentials, session tokens, or other sensitive information stored in memory during codec operations.

• CVE-2026-13962MEDIUM 6.5

  A weakness in how Google Chrome validates PDF data could allow an attacker who has already compromised Chrome's renderer process to bypass navigation protections using a specially crafted webpage. The vulnerability requires both a prior compromise of the renderer and user interaction, limiting its real-world attack surface but representing a meaningful integrity risk once initial access is established.

• CVE-2026-13964MEDIUM 6.5

  Google Chrome's WebView component on Android contains a flaw that allows attackers to circumvent navigation restrictions through a specially crafted web page. An attacker could trick a user into visiting a malicious HTML page, which then bypasses security controls that normally prevent unauthorized navigation to restricted destinations. This is a policy enforcement gap rather than a code execution vulnerability, meaning the browser's security rules aren't being properly applied in certain conditions.

• CVE-2026-13985MEDIUM 6.5

  A flaw in Google Chrome's MediaCapture implementation allows attackers who have already compromised the browser's renderer process to trick users into interacting with fake UI elements. The attacker crafts a malicious HTML page that makes legitimate-looking interface components appear where they shouldn't, enabling social engineering attacks. This requires the renderer process to already be compromised, limiting the threat to scenarios where initial access has been established through other means.

• CVE-2026-13988MEDIUM 6.5

  A vulnerability in Google Chrome's Paint feature allows attackers to trick users with fake visual elements on web pages. An attacker could craft a deceptive HTML page that, when visited, displays misleading UI elements—such as fake browser controls or warning dialogs—to manipulate user behavior. This affects Chrome versions before 150.0.7871.47 and requires user interaction (clicking or viewing the page) to be exploited. The attack has no impact on data confidentiality or system availability, but could be used for social engineering, credential theft, or other deception-based attacks.

• CVE-2026-13990MEDIUM 6.5

  A vulnerability in Google Chrome's data transfer handling on Windows allows attackers who have already compromised the browser's renderer process to trick users into believing they are interacting with legitimate UI elements. The attacker would craft a malicious webpage that, once loaded, manipulates what appears on screen to deceive the user—for example, making a dangerous action look safe or hiding warning dialogs. This requires the renderer process to be compromised first, which is a meaningful prerequisite but not uncommon in real-world attack chains.

• CVE-2026-13996MEDIUM 6.5

  Google Chrome versions before 150.0.7871.47 contain a flaw in how it handles permissions that allows an attacker to trick users with a fake webpage. When users visit a malicious site, the browser may display misleading permission prompts or UI elements, making it appear that certain actions have been approved or denied when they actually haven't. This spoofing attack requires user interaction—the victim must visit the crafted page—but does not result in data theft or system crashes.

• CVE-2026-14002MEDIUM 6.5

  Google Chrome versions before 150.0.7871.47 contain a flaw in how the browser handles geolocation permissions that allows an attacker who has already compromised Chrome's renderer process to trick users with fake permission dialogs or spoofed UI elements. An attacker would need to first gain control of the renderer process through another vulnerability or attack vector, then exploit this weakness to display misleading geolocation prompts, potentially deceiving users into granting location access they wouldn't otherwise grant.

• CVE-2026-14004MEDIUM 6.5

  A flaw in Google Chrome's CSS rendering engine can allow attackers to extract sensitive information from websites you visit. By crafting a malicious webpage, an attacker could potentially read data that should remain private between you and other websites you're logged into—such as account details or personal information. The vulnerability requires user interaction (clicking a link or visiting a page) and affects Chrome versions before 150.0.7871.47.

• CVE-2026-14007MEDIUM 6.5

  Google Chrome versions before 150.0.7871.47 contain a flaw in how it enforces the Permissions Policy—a security feature that controls what browser capabilities (like camera, microphone, geolocation) web pages can access. An attacker can craft a malicious HTML page that tricks the browser into allowing navigation or access that should have been blocked by policy. The vulnerability requires user interaction (clicking a link or opening the page), but once triggered, it can bypass navigation restrictions that administrators or page developers intended to enforce.

• CVE-2026-14008MEDIUM 6.5

  A memory disclosure vulnerability exists in Google Chrome's WebXR implementation on Android devices. An attacker can craft a malicious HTML page that, when visited by a user, reads uninitialized memory from the browser process. This could expose sensitive information such as encryption keys, authentication tokens, or other data previously used by the browser. The vulnerability requires user interaction—the victim must visit the crafted page—but does not require any special browser settings or user privileges to exploit.

• CVE-2026-14010MEDIUM 6.5

  Google Chrome on Windows contains a flaw in how it handles certain codec operations, leaving uninitialized memory accessible to attackers. By serving a specially crafted webpage, an attacker can trick a user into visiting a malicious site and extract sensitive data—such as fragments of passwords, encryption keys, or other in-memory secrets—that happened to be nearby in the browser process. This is a memory disclosure vulnerability that requires user interaction (clicking a link or visiting a site) but poses meaningful risk because the leaked data could be valuable to an attacker.

• CVE-2026-14014MEDIUM 6.5

  Google Chrome versions before 150.0.7871.47 contain a flaw in the Paint component that allows attackers to trick users into seeing a fake or misleading interface. An attacker would host a malicious webpage; when a user visits it, the page can manipulate what appears on screen to mimic legitimate UI elements (buttons, dialogs, login prompts) or hide the true nature of the content. This is a user-interaction vulnerability—the attack requires a victim to visit the crafted page, but no special browser settings or authentication bypass is needed.

• CVE-2026-14015MEDIUM 6.5

  A race condition in Google Chrome's WebRTC implementation on Windows allows an attacker to trick users into visiting a malicious webpage that leaks data across security boundaries. The vulnerability is triggered during a timing-sensitive sequence in the WebRTC audio/video processing stack, where data meant to be isolated between different website origins becomes accessible. An attacker would need user interaction—specifically, the victim must visit the crafted HTML page—but once there, sensitive information from other websites could be exposed without further prompting.

• CVE-2026-14016MEDIUM 6.5

  Google Chrome versions prior to 150.0.7871.47 contain a flaw in how SVG (Scalable Vector Graphics) content is processed that could allow an attacker to steal sensitive data from other websites. An attacker would need to trick a user into visiting a malicious webpage, but once there, the vulnerability could be exploited to access information the user has access to on other sites—bypassing the browser's normal cross-origin security boundary.

• CVE-2026-14019MEDIUM 6.5

  A flaw in Google Chrome's password manager implementation allowed attackers to steal sensitive cross-origin data through a specially crafted webpage. The vulnerability required user interaction—specifically clicking on a malicious HTML page—but did not require any special privileges or complex setup to exploit. Chrome versions prior to 150.0.7871.47 are affected.

• CVE-2026-14021MEDIUM 6.5

  A vulnerability in Google Chrome's StorageAccessAPI allows a remote attacker who has already compromised a user's Chrome renderer process to steal data from other websites that the user has visited. This requires both renderer compromise and user interaction with a malicious webpage, but if achieved, could leak sensitive cross-origin information. Chrome version 150.0.7871.47 and later address this issue.

• CVE-2026-14022MEDIUM 6.5

  Google Chrome versions before 150.0.7871.47 contain a flaw that allows attackers who have already compromised Chrome's renderer process to steal data from websites the user visits. The vulnerability stems from inadequate validation of network input and requires an attacker to first gain control of the renderer—typically through a separate browser exploit—then use a specially crafted webpage to exfiltrate sensitive cross-origin information that should be protected from access.

• CVE-2026-14023MEDIUM 6.5

  A flaw in Google Chrome's input validation allows attackers to bypass the same-origin policy—a fundamental browser security boundary—by sending users a specially crafted web page. This could enable unauthorized access to sensitive data from other websites the user is logged into. The vulnerability affects Chrome versions before 150.0.7871.47 and requires user interaction (visiting a malicious page).

• CVE-2026-14033MEDIUM 6.5

  Google Chrome on Windows contains a weakness in how it enforces policies related to media handling. An attacker can craft a malicious webpage that, when visited by a user, bypasses Chrome's site isolation feature—a critical security boundary that prevents one website from accessing data or capabilities of another. The vulnerability requires user interaction (clicking a link, visiting a page) and affects Chrome versions before 150.0.7871.47. While Chromium rates this as low severity internally, the CVSS score of 6.5 reflects the integrity impact of circumventing site isolation, making it a medium-severity concern in standard vulnerability assessment frameworks.

• CVE-2026-14035MEDIUM 6.5

  Google Chrome versions prior to 150.0.7871.47 contain a Bluetooth-related security flaw that allows an attacker to extract sensitive information from the browser's memory. An attacker would need to trick a user into visiting a malicious webpage; if successful, the attacker could read data that shouldn't be accessible, such as authentication tokens, session data, or other confidential information stored in memory. Chrome itself rates this as low severity, though the CVSS score reflects moderate risk due to the ease of exploitation and the sensitivity of potential data exposure.

• CVE-2026-14048MEDIUM 6.5

  A use-after-free flaw in Google Chrome's Chromecast component allows an attacker positioned on the same local network to extract sensitive data from the browser's memory using a specially crafted malicious peripheral device. The vulnerability affects Chrome versions before 150.0.7871.47 across Windows, macOS, and Linux systems.

• CVE-2026-14050MEDIUM 6.5

  A weakness in how Google Chrome enforces security policies for the Passwords feature before version 150.0.7871.47 could allow an attacker to trick users into visiting a malicious webpage that leaks sensitive data across different websites. The attacker cannot directly compromise the browser; instead, they must craft a convincing HTML page and convince the user to visit it. Once a user is on that page, the vulnerability permits unauthorized access to information from other origins—effectively bypassing the browser's same-origin policy protections.

• CVE-2026-14051MEDIUM 6.5

  A memory disclosure vulnerability exists in Google Chrome's GamepadAPI prior to version 150.0.7871.47. An attacker who has already compromised Chrome's renderer process can craft a malicious webpage to read uninitialized memory, potentially exposing sensitive data. The vulnerability requires user interaction (visiting a crafted page) and prior renderer compromise, making it a secondary risk in multi-stage attack chains rather than an entry vector.

• CVE-2026-14059MEDIUM 6.5

  A security weakness in Google Chrome's Related-Website-Sets feature allows attackers to trick users into visiting a malicious webpage that can steal data from other websites the user is logged into. The vulnerability affects Chrome versions before 150.0.7871.47 and requires user interaction (clicking a link or visiting the malicious page). While the Chromium project rated this as low severity, the CVSS score reflects a medium-risk profile because of its potential to expose sensitive cross-origin information without the user's knowledge.

• CVE-2026-14061MEDIUM 6.5

  A flaw in Google Chrome's Dawn graphics component allows attackers to trick users into visiting specially crafted web pages that can leak sensitive information from the browser's memory. The vulnerability requires user interaction—the victim must visit a malicious site—but once they do, attackers may be able to read data that should remain private, such as authentication tokens or other browser state. This affects Chrome versions before 150.0.7871.47 across Windows, macOS, and Linux systems.

• CVE-2026-14065MEDIUM 6.5

  CVE-2026-14065 is a navigation-bypass vulnerability in Google Chrome versions before 150.0.7871.47. An attacker who has already compromised Chrome's renderer process (the component that executes web page content) can craft a malicious HTML page to circumvent built-in navigation security controls. While this requires prior renderer compromise, the impact allows unauthorized navigation to restricted destinations. The Chromium project rates this as low severity, though the CVSS score of 6.5 reflects the potential for integrity violation.

• CVE-2026-14069MEDIUM 6.5

  An integer overflow vulnerability exists in the WebNN (Web Neural Network) component of Google Chrome versions before 150.0.7871.47. An attacker could craft a malicious HTML page that, when visited, exploits this flaw to read sensitive data from the browser's memory. The vulnerability requires user interaction (visiting a malicious site) but does not require any special privileges or system access.

• CVE-2026-14070MEDIUM 6.5

  A memory safety vulnerability in Google Chrome's WebNN (Web Neural Network) component allows attackers to leak sensitive data from the browser's memory. An attacker can craft a malicious webpage that, when visited by a user, exploits an integer overflow to read unintended data from the running process. While Chrome classified this as low severity internally, the confidentiality impact warrants attention from a defense perspective.

• CVE-2026-14071MEDIUM 6.5

  Google Chrome versions before 150.0.7871.47 contain a side-channel vulnerability in the WebAudio component that allows attackers to extract sensitive cross-origin data through a specially crafted webpage. An attacker would need to trick a user into visiting a malicious site, but once there, they could potentially read data from other websites the user has open—a serious breach of browser security boundaries. The vulnerability is rated MEDIUM severity due to its reliance on user interaction and limited scope of impact.

• CVE-2026-14074MEDIUM 6.5

  A side-channel vulnerability in Google Chrome's WebAuthentication implementation on iOS allows an attacker to leak sensitive cross-origin data through a crafted web page. The flaw exists in Chrome versions before 150.0.7871.47 and requires user interaction to trigger. An attacker would craft a malicious HTML page that, when visited by a victim, exploits timing or behavioral differences in the WebAuthentication API to infer or extract data from other websites the user has authenticated to.

• CVE-2026-14081MEDIUM 6.5

  Google Chrome versions before 150.0.7871.47 contain a flaw in DevTools policy enforcement that could allow an attacker to extract sensitive data from browser process memory. The vulnerability requires social engineering—convincing a user to install a malicious extension—but once installed, the extension can bypass DevTools restrictions to access confidential information. This is not a flaw users can trigger by visiting a website; it hinges on the user's decision to add untrusted code to their browser.

• CVE-2026-14082MEDIUM 6.5

  A race condition in Google Chrome's storage subsystem allows attackers to access sensitive data across different websites through a specially crafted HTML page. The vulnerability requires user interaction—such as visiting a malicious webpage—but doesn't need special privileges or browser configuration to exploit. While Chromium's own severity rating is 'Low,' the confidentiality impact warrants a medium-severity classification due to the potential exposure of cross-origin data that should otherwise be isolated by browser security boundaries.

• CVE-2026-14085MEDIUM 6.5

  A side-channel vulnerability in Google Chrome's CSS rendering engine allows attackers to extract sensitive cross-origin data through a specially crafted webpage. An attacker can trick a user into visiting a malicious site that leaks information from other sites the user has open in the same browser—such as authentication tokens, form data, or private content. The vulnerability requires user interaction (visiting the malicious page) but does not need special browser settings or elevated privileges. Chrome versions prior to 150.0.7871.47 are affected.

• CVE-2026-14088MEDIUM 6.5

  A memory leakage vulnerability in Chrome's Canvas rendering on Android devices allows attackers to trick users into visiting a malicious webpage that can read sensitive data from the browser's memory. The attacker needs the user to interact with the page, but no special privileges or complex attack setup is required. Chrome versions prior to 150.0.7871.47 on Android are affected.

• CVE-2026-14096MEDIUM 6.5

  A flaw in Google Chrome's input handling on Android could allow an attacker to steal sensitive information across different websites, but only if they've already compromised Chrome's renderer process—the engine that executes web content. The attacker would need to trick the user into visiting a specially crafted webpage. This is a medium-severity issue affecting Chrome versions before 150.0.7871.47.

• CVE-2026-14098MEDIUM 6.5

  A flaw in how Google Chrome handles CSS allows an attacker to craft a malicious webpage that can read data from websites on different domains—a cross-origin information leak. The vulnerability affects Chrome versions before 150.0.7871.47. While the attack requires user interaction (visiting the malicious page), the potential impact is significant: sensitive information from other websites could be exposed to the attacker. This is classified as a medium-severity issue, though Chromium's own assessment rated the underlying CSS implementation flaw as low severity.

• CVE-2026-14100MEDIUM 6.5

  CVE-2026-14100 is a data leakage vulnerability in Google Chrome's NetworkCache component that allows attackers to extract sensitive information across website boundaries. An attacker crafts a malicious HTML page and tricks a user into visiting it; the flaw then permits unauthorized access to data that should remain isolated between different websites. While Google rates the underlying defect as low severity, the practical impact—cross-origin data exposure—warrants a medium CVSS score because it requires user interaction but reliably compromises confidentiality.

• CVE-2026-14103MEDIUM 6.5

  A use-after-free memory flaw in Google Chrome's SSL/TLS implementation on ChromeOS allows an attacker to craft a malicious webpage that, when visited, can leak sensitive data from the browser's memory. The vulnerability requires user interaction (visiting a malicious site) but does not require authentication and can run over the network. Chrome versions before 150.0.7871.47 are affected. While Chromium's security team rated this as Low severity, the CVSS 3.1 score of 6.5 reflects the potential for meaningful confidentiality impact.

• CVE-2026-14118MEDIUM 6.5

  A flaw in Chrome's developer tools allows attackers to trick users into leaking sensitive data from other websites through a specially crafted web page. The vulnerability requires users to perform specific interactions within DevTools, making it a social engineering attack rather than something that exploits silently. While Chromium rates this as low severity, the ability to cross origin boundaries and steal data elevates the practical risk for users who frequently interact with sensitive websites.

• CVE-2026-14119MEDIUM 6.5

  Google Chrome on Windows contains a type confusion vulnerability in its Bluetooth handling that could allow an attacker already present on your local network to read sensitive data from Chrome's process memory by presenting a specially crafted Bluetooth peripheral. The vulnerability affects Chrome versions before 150.0.7871.47. While the technical severity is rated Medium, the practical risk is moderated by the requirement that an attacker must already have local network access and the ability to present a malicious Bluetooth device.

• CVE-2026-14125MEDIUM 6.5

  A flaw in the ANGLE graphics library used by Google Chrome can leak sensitive data from a user's computer memory to an attacker through a malicious webpage. When a user visits a crafted HTML page, uninitialized memory containing potentially sensitive information becomes accessible, allowing the attacker to read data that should have been protected. The vulnerability requires user interaction—specifically visiting a malicious site—but no special privileges or complex setup are needed on the attacker's side.

• CVE-2026-14146MEDIUM 6.5

  Google Chrome versions before 150.0.7871.47 contain a flaw in how the browser processes CSS that could allow an attacker to trick users into visiting a malicious website and leak data from other websites the user has open. The vulnerability requires user interaction (clicking a link or visiting a page) but does not require the attacker to have special privileges or bypass browser security features. While Chromium's security team rated this Low severity internally, the CVSS score reflects a Medium risk due to the potential for unauthorized information disclosure across security boundaries.

• CVE-2026-14148MEDIUM 6.5

  A type confusion flaw in Google Chrome's CSS handling allows a remote attacker to trick a user into visiting a malicious webpage and potentially read sensitive data from the browser's process memory. The vulnerability requires user interaction (clicking a link or visiting a page) but no special privileges. While Chromium rates the severity as low, the ability to leak memory contents elevates practical risk for targeted attacks.

• CVE-2026-14155MEDIUM 6.5

  A flaw in Google Chrome's StorageAccessAPI—a mechanism that allows websites to request cross-origin data access—fails to enforce sufficient security policies. This permits an attacker to craft a malicious webpage that tricks users into leaking sensitive data from other websites. The vulnerability requires user interaction and is limited to information disclosure; it does not enable data modification or service disruption. Chrome versions prior to 150.0.7871.47 are affected.

• CVE-2026-14156MEDIUM 6.5

  A flaw in Google Chrome's StorageAccessAPI allowed attackers who had already compromised the browser's rendering engine to bypass the same-origin policy—a core security boundary that prevents malicious websites from accessing data belonging to other sites. The attacker would need to trick a user into visiting a specially crafted webpage while the renderer process was already compromised. This vulnerability affects Chrome versions before 150.0.7871.47.

• CVE-2026-14381MEDIUM 6.5

  Google Chrome versions before 150.0.7871.46 contain a flaw in the WebAppInstalls security UI that allows attackers to deceive users through carefully crafted web pages. An attacker can make Chrome's security indicators or install prompts appear fake, potentially tricking users into installing malicious web applications or granting unintended permissions. The vulnerability requires user interaction to exploit but poses a real risk because users rely on Chrome's visual cues to make trust decisions.

• CVE-2026-14384MEDIUM 6.5

  A memory safety flaw in Chrome's graphics rendering engine (ANGLE) allows attackers to read sensitive data across security boundaries on Windows systems. By serving a specially crafted webpage, an attacker can trick a user into visiting a malicious site and leak information that should remain private—such as data from other websites the user has open. The vulnerability requires user interaction (clicking or visiting a link) but does not require the attacker to be authenticated or have special privileges.

• CVE-2026-14386MEDIUM 6.5

  A memory access vulnerability in Chrome's graphics rendering engine (ANGLE) allows attackers to read sensitive data from your browser's memory by tricking you into visiting a specially crafted webpage. The vulnerability affects Chrome versions before 150.0.7871.46 and requires user interaction—you must click or view malicious content for the attack to work. An attacker cannot execute code or crash your browser, but they could potentially steal passwords, tokens, or other sensitive information stored in memory.

• CVE-2026-14388MEDIUM 6.5

  Google Chrome versions before 150.0.7871.46 contain a memory reading vulnerability in the ANGLE graphics library. A remote attacker can exploit this by serving a specially crafted HTML page to a user. If a user visits the malicious page, the attacker may extract sensitive information—such as passwords, encryption keys, or other data—from Chrome's process memory. The vulnerability requires user interaction (clicking a link or visiting a site) but does not require any special privileges or configuration.

• CVE-2026-14396MEDIUM 6.5

  A memory safety issue in the ANGLE graphics library used by Google Chrome allows attackers to read sensitive data across website boundaries. When a user visits a malicious webpage, an attacker can craft specific HTML content that triggers an out-of-bounds memory read. This flaw enables unauthorized access to data intended for other websites—a cross-origin information disclosure. The vulnerability requires user interaction (visiting a malicious page) but does not require any special browser configuration or credentials.

• CVE-2026-14399MEDIUM 6.5

  A memory initialization flaw in Chrome's graphics rendering engine (Dawn) could allow an attacker to trick a user into visiting a specially crafted webpage that reads sensitive data from the browser's memory. The issue affects Chrome versions before 150.0.7871.46 and requires user interaction—the victim must click through or visit a malicious site—but does not require any special system privileges. Once exploited, an attacker gains read access to information already in memory, potentially including cached credentials, session tokens, or other sensitive data processed by the browser.

• CVE-2026-14402MEDIUM 6.5

  A memory disclosure vulnerability in Google Chrome's ANGLE graphics library on Windows allows attackers to leak sensitive data from the browser process. An attacker can craft a malicious HTML page that, when visited by a user, reads uninitialized memory regions. While this does not allow code execution or system compromise, the leaked data could include passwords, session tokens, or other secrets resident in Chrome's memory space.

• CVE-2026-14404MEDIUM 6.5

  A flaw in Google Chrome's PDF rendering engine (PDFium) allows attackers to trick users with misleading visual elements in specially crafted PDF files. When you open a malicious PDF, the attacker can manipulate what appears on screen to deceive you about the file's true content or origin—for example, making a phishing document look legitimate. The vulnerability affects Chrome versions before 150.0.7871.46 and requires user interaction (opening the PDF) to exploit.

• CVE-2026-14408MEDIUM 6.5

  Google Chrome versions before 150.0.7871.46 contain a memory initialization flaw in Dawn (Chrome's graphics abstraction layer) that allows attackers to trick users into visiting malicious web pages and potentially read sensitive data from the browser process. The vulnerability requires user interaction—specifically clicking a link or visiting a crafted website—but does not require special permissions or an authenticated account.

• CVE-2026-14421MEDIUM 6.5

  A memory initialization flaw in Google Chrome's graphics library (Dawn) allows an attacker to trick users into visiting a malicious website that leaks sensitive data from the browser's memory. The vulnerability affects Chrome on ChromeOS systems prior to version 150.0.7871.46. While exploitation requires user interaction—clicking a link or visiting a crafted page—the flaw can expose information that might aid further attacks, such as cryptographic keys or session tokens. The impact is information disclosure only; the attacker cannot execute code or crash the system.

• CVE-2026-15109MEDIUM 6.5

  A memory initialization flaw in ANGLE (the graphics abstraction layer used by Chrome) could allow an attacker to trick a user into visiting a malicious website that leaks sensitive data from the browser's memory. The vulnerability requires user interaction—a user must click a link or visit the page—but once there, the flaw enables reading uninitialized memory that may contain passwords, tokens, or other private information.

• CVE-2026-45173MEDIUM 6.5

  Idira Identity Browser Extension, a credential and identity management tool available for Chrome, Firefox, and Edge, contains a flaw in how it validates the origin of web pages before executing sensitive operations. An attacker could create a malicious webpage that tricks an already-logged-in user into triggering unauthorized actions within their authenticated session. The vulnerability affects all versions before 26.8.1 and requires user interaction—specifically navigation to a crafted site—to exploit.

• CVE-2026-58523MEDIUM 6.5

  Microsoft Edge for Android contains an access control vulnerability that allows an attacker to bypass a security feature through network interaction. The vulnerability requires user interaction (such as clicking a malicious link) but does not require authentication. While an attacker cannot modify data or disrupt service, they can access confidential information the user would normally be restricted from viewing.

• CVE-2026-9882MEDIUM 6.5

  CVE-2026-9882 is a memory safety flaw in the ANGLE graphics library used by Google Chrome that allows attackers to steal data from websites you're visiting, provided they trick you into viewing a specially crafted web page. The vulnerability stems from an integer overflow—a programming error where a number wraps around unexpectedly—enabling unauthorized cross-origin data leakage. While the Chromium team rated this as "Critical," the CVSS base score of 6.5 reflects that successful exploitation requires user interaction (clicking or viewing content) and doesn't enable code execution or system-level damage. The flaw affects Chrome on Windows, macOS, and Linux systems.

• CVE-2026-9908MEDIUM 6.5

  CVE-2026-9908 is a memory disclosure flaw in Google Chrome's ANGLE graphics library that lets attackers read uninitialized or sensitive data from your browser process. An attacker crafts a malicious HTML page; when you visit it, the bug leaks information that shouldn't be accessible—such as encryption keys, session tokens, or other sensitive values that happened to be in memory. The vulnerability requires user interaction (clicking through to a malicious site) but no authentication, and it affects Chrome versions before 148.0.7778.216.

• CVE-2026-9912MEDIUM 6.5

  A flaw in Google Chrome's GPU processing on Android allows attackers to steal sensitive information from your device's memory. An attacker can craft a malicious web page that, when you visit it, extracts data from Chrome's process memory without your knowledge. No action from you is required beyond visiting the page—the vulnerability is triggered automatically during normal browsing.

• CVE-2026-9917MEDIUM 6.5

  Google Chrome on Android contains a flaw in its WebGL graphics processing that fails to properly initialize memory before use. When a user visits a malicious webpage, an attacker can read sensitive data left in process memory—such as parts of cached images, passwords, or other application state—without needing special permissions or bypass techniques. This affects Chrome versions before 148.0.7778.216 on Android devices.

• CVE-2026-9953MEDIUM 6.5

  CVE-2026-9953 is a memory safety bug in the ANGLE graphics library used by Google Chrome that allows an attacker to read sensitive data from the browser process. An attacker can craft a malicious HTML page that, when visited by a user, exploits an out-of-bounds read to leak information like passwords, session tokens, or other confidential data stored in Chrome's memory. The vulnerability requires user interaction (clicking a link or visiting a page) but does not require special privileges and works across Windows, macOS, and Linux. Google has assigned it high severity within Chromium's security framework.

• CVE-2026-9981MEDIUM 6.5

  A flaw in the Skia graphics rendering library within Google Chrome allows attackers to trick users into visiting malicious web pages that expose sensitive data from the browser's memory. The vulnerability requires user interaction (clicking a link or visiting a site) but needs no special privileges to exploit, making it a realistic threat to everyday Chrome users.

• CVE-2026-9996MEDIUM 6.5

  A flaw in Google Chrome's WebRTC component allows a remote attacker to trick a user into visiting a malicious webpage that reads sensitive data from the browser's memory. The vulnerability affects Mac users running Chrome versions before 148.0.7778.216. No user action beyond visiting a crafted page is required for the attacker to attempt exploitation.

• CVE-2026-11181MEDIUM 6.3

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the Media Session feature is implemented. An attacker can craft a malicious HTML page that, when visited by a user, bypasses the browser's same-origin policy—a fundamental security boundary that prevents websites from accessing data or functionality from other sites without permission. This could allow the attacker to read sensitive information, make unauthorized changes, or disrupt functionality within the context of other websites the user has open. The vulnerability requires user interaction (clicking a link or visiting a page) but does not require any special browser configuration.

• CVE-2026-11184MEDIUM 6.3

  Google Chrome versions before 149.0.7827.53 contain a flaw that allows attackers to bypass navigation controls through a specially crafted webpage. An attacker could craft a malicious HTML page that, when visited by a user, circumvents Chrome's built-in protections that normally restrict where the browser can navigate. This requires user interaction—the victim must visit the malicious page—but the barrier to exploitation is otherwise low. The vulnerability affects Chrome on Windows, macOS, and Linux systems.

• CVE-2026-11187MEDIUM 6.3

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in the Glic component that allows an attacker to bypass navigation restrictions by tricking users into visiting a specially crafted webpage. The vulnerability requires user interaction (clicking a link or visiting the malicious page) and affects users across Windows, macOS, and Linux platforms. While the immediate impact is moderate, the ability to circumvent navigation safeguards could enable follow-on attacks or unauthorized content access.

• CVE-2026-11308MEDIUM 6.3

  CVE-2026-11308 is a privilege escalation vulnerability in Google Chrome's extension system that allows an attacker to gain elevated permissions on a user's system. The attack requires social engineering—convincing a user to install a malicious browser extension—but once installed, the flaw in how Chrome enforces extension permissions allows the attacker to break out of the extension sandbox and perform actions at a higher privilege level than the extension should be allowed. This affects Windows, macOS, and Linux systems running Chrome versions prior to 149.0.7827.53.

• CVE-2026-9989MEDIUM 6.3

  Google Chrome contained a flaw in how it handles media files that allowed attackers to bypass the same-origin policy—a critical browser security boundary. An attacker could craft a malicious video file that, when opened by a user in Chrome, would enable unauthorized access to sensitive data from other websites the user was visiting. The vulnerability requires user interaction (clicking a link or opening a file) but does not require special privileges or complex attack setup.

• CVE-2026-0046MEDIUM 6.2

  CVE-2026-0046 is a local privilege escalation vulnerability affecting Google Android that exploits a weakness in the InputInterceptor component of Letterbox.java. An attacker can overlay malicious UI elements on top of legitimate permission prompts, tricking users into granting permissions they did not intend to approve. What makes this particularly concerning is that exploitation requires no special system privileges and occurs without user awareness—the victim merely sees what appears to be a normal permission dialog. The result is unauthorized elevation of the attacker's application privileges within the Android system.

• CVE-2026-0055MEDIUM 6.2

  A path traversal vulnerability in Android's PackageInstallerService allows an attacker to write a Device Policy Controller (DPC) application to an unintended directory. By exploiting this flaw, an unprivileged local process can escalate its privileges without requiring user interaction or additional system permissions. The vulnerability affects multiple Android versions and could allow an attacker with local access to gain elevated capabilities on the device.

• CVE-2026-58300MEDIUM 6.2

  Microsoft Edge for Android contains a path traversal vulnerability that allows an attacker with local access to the device to read sensitive files. The vulnerability does not require user interaction or elevated privileges, making it a concern for any Android device running the affected version of Edge. An attacker would need physical or local network access to the device to exploit this issue.

• CVE-2026-10916MEDIUM 6.1

  CVE-2026-10916 is a cross-site scripting vulnerability in Google Chrome's developer tools that allows an attacker to inject malicious scripts or HTML content into a webpage. The attack requires two conditions: first, the attacker must have already compromised Chrome's renderer process (the component that executes web content), and second, the user must be tricked into visiting a specially crafted HTML page. While the initial compromise is a significant prerequisite, once achieved, this vulnerability enables the attacker to execute arbitrary code with the privileges of the browser session, potentially stealing sensitive data or performing actions on behalf of the user.

• CVE-2026-11034MEDIUM 6.1

  Google Chrome on Android contains a vulnerability in its Tab Group Sync feature that allows attackers to inject malicious scripts or HTML into web pages. An attacker with network access can craft malicious traffic to exploit insufficient input validation, potentially displaying fake content or stealing user information from websites. This affects Chrome versions prior to 149.0.7827.53.

• CVE-2026-11122MEDIUM 6.1

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the keyboard input handler processes certain HTML page elements. An attacker can craft a malicious webpage that, when visited by an unsuspecting user, injects arbitrary scripts or HTML content that executes in a security context where it shouldn't be allowed—a technique called Uniform Cross-Site Scripting (UXSS). This bypasses the browser's same-origin policy protections that normally prevent cross-domain attacks. The vulnerability requires user interaction (clicking or viewing the page) but affects all major platforms where Chrome runs.

• CVE-2026-11150MEDIUM 6.1

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in how the browser processes XML within HTML pages. An attacker can craft a malicious webpage that, when visited, injects arbitrary scripts or HTML content that execute in the context of unrelated sites (a technique known as Universal Cross-Site Scripting or UXSS). This bypasses the same-origin policy that normally prevents one site from accessing data or performing actions on another. The vulnerability requires user interaction—a victim must visit the attacker's page—but does not require any special browser configuration or user privileges to trigger.

• CVE-2026-11186MEDIUM 6.1

  Google Chrome versions prior to 149.0.7827.53 contain a vulnerability in CSS handling that allows attackers to inject malicious scripts or HTML into web pages users visit. An attacker would craft a specially designed webpage that, when opened in a vulnerable version of Chrome, bypasses security boundaries and executes unauthorized code in the context of other websites. This type of attack, known as Universal XSS (UXSS), is particularly dangerous because it affects the browser itself rather than individual websites, potentially compromising user data across multiple domains.

• CVE-2026-11205MEDIUM 6.1

  Google Chrome on iOS versions prior to 149.0.7827.53 contain a vulnerability that allows attackers to inject malicious scripts or HTML into web pages through crafted QR codes. The attack requires user interaction—specifically, the victim must engage with certain UI gestures in response to the attacker's QR code—but once triggered, the injected content runs with the privileges of the page being viewed. This is a cross-origin scripting (UXSS) issue, meaning the injected code can affect pages from different origins, potentially stealing session cookies, credentials, or sensitive data.

• CVE-2026-11229MEDIUM 6.1

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the application handles certain enterprise features that could allow someone with physical access to your device to gain elevated privileges. The vulnerability requires an attacker to be present at the machine itself and does not need you to take any action—they can exploit it directly. This is a local-only threat and cannot be exploited remotely over the internet.

• CVE-2026-11273MEDIUM 6.1

  Google Chrome versions before 149.0.7827.53 contain a vulnerability in the Omnibox (the address/search bar) that fails to properly validate user input. An attacker can craft a malicious HTML page that, when visited by a user who interacts with the Omnibox through specific UI actions, allows injection of arbitrary scripts or HTML content. This is a cross-site scripting variant (UXSS) that bypasses the normal security boundary between web pages. The attack requires user interaction and social engineering to be effective, but once triggered, can compromise the integrity and confidentiality of the browsing session.

• CVE-2026-12459MEDIUM 6.1

  Google Chrome versions prior to 149.0.7827.155 contain a vulnerability in the Serial component that allows attackers to inject malicious scripts or HTML into web pages through a specially crafted HTML file. The attack requires user interaction (clicking or otherwise engaging with the malicious page) but does not require the victim to have special privileges. The injected content can compromise page integrity and access sensitive user data within the affected browser context.

• CVE-2026-13836MEDIUM 6.1

  Google Chrome versions before 150.0.7871.47 contain a CSS handling flaw that allows attackers to inject malicious scripts or HTML into pages you visit. An attacker would craft a deceptive webpage and trick you into opening it; the browser's CSS parser would then execute the attacker's code in the context of a legitimate site you trust. This is a 'universal cross-site scripting' (UXSS) vulnerability—more severe than typical XSS because it bypasses the normal boundaries between websites.

• CVE-2026-14000MEDIUM 6.1

  Google Chrome versions before 150.0.7871.47 contain a flaw in how the browser processes XML within HTML pages. An attacker can craft a malicious webpage that, when visited, injects unauthorized scripts or HTML content that executes with the privileges of the current webpage—a technique known as Unintended Cross-Site Scripting (UXSS). This allows attackers to steal data, manipulate page content, or perform actions on behalf of the user without additional user interaction beyond viewing the page.

• CVE-2026-14001MEDIUM 6.1

  Google Chrome versions before 150.0.7871.47 contain a flaw in how the browser handles network-related content that allows attackers to inject malicious scripts or HTML code into web pages you visit. An attacker would craft a specially designed webpage; when you visit it, the injected code runs in your browser with the privileges of the website you're viewing, potentially stealing data or performing actions on your behalf. This type of attack, known as UXSS (Universal XSS), bypasses Chrome's normal security boundaries.

• CVE-2026-14068MEDIUM 6.1

  Google Chrome on iOS contains a flaw in how it handles the Omnibox (address bar) that can allow an attacker to inject malicious scripts or HTML content into a webpage you're viewing. The vulnerability requires a user to perform specific gestures in the browser interface—such as interacting with the address bar in a particular way—after visiting a specially crafted webpage. This is a cross-site scripting variant (UXSS) that affects Chrome versions before 150.0.7871.47 on iOS devices.

• CVE-2026-14083MEDIUM 6.1

  Google Chrome versions before 150.0.7871.47 contain a vulnerability that allows attackers to inject malicious scripts or HTML into web pages through insufficient input validation. An attacker would need to trick a user into visiting a specially crafted webpage, but once successful, the injected code can run with the same privileges as the visited site, potentially stealing session data, modifying page content, or performing actions on behalf of the user.

• CVE-2026-14145MEDIUM 6.1

  Google Chrome versions prior to 150.0.7871.47 contain a vulnerability in how CSS (Cascading Style Sheets) is processed that allows attackers to inject malicious scripts or HTML content into web pages. An attacker would need to trick a user into visiting a specially crafted webpage; if successful, the injected code runs with the privileges of the visited site, potentially compromising user data or enabling further attacks. This is classified as a Universal XSS (UXSS) vulnerability, meaning the attack bypasses normal browser security boundaries.

• CVE-2026-14147MEDIUM 6.1

  Google Chrome versions before 150.0.7871.47 contain a flaw in CSS handling that allows an attacker to inject malicious scripts or HTML into web pages viewed by users. The vulnerability requires user interaction (clicking a link or visiting a crafted page) and affects the security boundary between websites, potentially allowing one site to compromise another or steal sensitive data. While Chromium classified this as low severity internally, the cross-site nature of the exploit and the ease of triggering it via a simple crafted HTML page elevate the practical risk.

• CVE-2026-15127MEDIUM 6.1

  A flaw in how Google Chrome handles WebGL—a web technology for rendering graphics—allows attackers to inject malicious scripts or HTML into pages you visit. An attacker could craft a deceptive webpage that, when opened in a vulnerable Chrome browser, executes unauthorized code with the privileges of the web page you're viewing. This is a form of cross-site scripting (XSS) attack. The vulnerability affects Chrome versions prior to 150.0.7871.115.

• CVE-2026-15128MEDIUM 6.1

  A flaw in how Google Chrome handles web forms before version 150.0.7871.115 allows attackers to inject malicious scripts or HTML into pages viewed by users. An attacker would craft a specially designed webpage and trick a user into visiting it, at which point the injected code runs in the user's browser with access to sensitive page content. This is a cross-site scripting (XSS) variant that bypasses normal browser protections.

• CVE-2026-53765MEDIUM 6.1

  Chrome DevTools for agents (chrome-devtools-mcp) is a tool that allows coding agents to control and inspect a live Chrome browser. Versions 0.20.0 through 1.0.x contain a local privilege escalation vulnerability affecting macOS and Linux systems. An attacker with local access to the same machine can exploit predictable file paths to write a symlink that causes the application to overwrite files belonging to higher-privileged users when the daemon starts. The vulnerability has been fixed in version 1.1.0.

• CVE-2026-53766MEDIUM 6.1

  Chrome DevTools for agents (chrome-devtools-mcp) contains a path validation flaw that allows an attacker with local access to bypass workspace boundary restrictions. By placing symbolic links inside an authorized workspace directory that point to files outside that boundary, an attacker can read sensitive files or overwrite files they should not have access to. This circumvents the security controls meant to confine agent operations to specific directories. The vulnerability affects versions 0.24.0 through 1.0.x and is resolved in version 1.1.0.