By vendor

Linux vulnerabilities

Known CVEs affecting Linux products, prioritized by severity, with SEC.co remediation and detection guidance.

1003 published vulnerabilities · page 10 of 11

• CVE-2026-53227MEDIUM 5.5

  A memory management bug exists in the Linux kernel's Open vSwitch networking subsystem. When a network packet buffer fails to allocate during certain locking operations, the kernel attempts to free an invalid memory pointer, causing a crash. This vulnerability affects systems running vulnerable kernel versions, particularly in environments using Open vSwitch for virtualized networking.

• CVE-2026-53231MEDIUM 5.5

  A deadlock vulnerability exists in the Linux kernel's network PHY (physical layer) driver code. When the kernel uses its generic PHY driver (genphy) with SFP cage modules (small form-factor pluggable optical transceivers), an initialization sequence can cause the system to hang. The issue stems from improper handling of SFP bus setup under the RTNL (Real-Time NetLink) lock, which genphy acquires during probing but other PHY drivers do not. Systems attempting to initialize SFP cages through genphy will experience a complete deadlock, rendering network functionality unavailable until the system is restarted.

• CVE-2026-53236MEDIUM 5.5

  A vulnerability in the Linux kernel allows unprivileged users to attach Berkeley Packet Filter (cBPF) rules to TCP sockets in a way that could leak sensitive TCP connection information such as sequence and acknowledgment numbers. The fix restricts this socket option to only users with administrative network privileges (CAP_NET_ADMIN), preventing unprivileged applications from exploiting this side-channel to extract data about active TCP connections.

• CVE-2026-53237MEDIUM 5.5

  A NULL pointer dereference vulnerability exists in the Linux kernel's mvebu GPIO driver during system suspend and resume operations. The driver unconditionally calls PWM-related suspend and resume functions for all GPIO banks, but not all banks have PWM functionality. When a GPIO bank without PWM is processed, the code attempts to access memory through a NULL pointer, causing the system to crash. This vulnerability can be triggered by any user with local access to initiate a system suspend, making it a straightforward denial-of-service condition on affected systems.

• CVE-2026-53238MEDIUM 5.5

  A flaw in the Linux kernel's network labeling subsystem allows a local attacker with user-level privileges to trigger an out-of-bounds memory read. The vulnerability stems from incomplete validation when processing network configuration requests—specifically, the code checks the length of an IP address field but fails to validate the corresponding network mask field in the same way. An attacker can craft a malicious request that provides a properly-formatted address but a deliberately short mask, causing the kernel to read beyond the mask field's actual size and access uninitialized memory. This leads to a denial of service through a kernel crash.

• CVE-2026-53241MEDIUM 5.5

  The Linux kernel's ALSA (Advanced Linux Sound Architecture) sequencer contains a memory access vulnerability in its dummy port implementation. When the dummy sequencer port processes Unified MIDI Protocol (UMP) events, it copies event data into a temporary buffer that is sized for legacy events rather than the larger UMP event format. This causes the system to read beyond the buffer's actual size when forwarding the event to subscribers, potentially causing a kernel crash or information leak. The issue affects systems using ALSA's sequencer functionality with UMP event handling enabled.

• CVE-2026-53243MEDIUM 5.5

  A bug in the Linux kernel's rseq (restartable sequences) subsystem allows an uninitialized stack variable to be read and potentially leaked to userspace. The issue stems from how the C compiler evaluates the initialization of a local structure; it may read from the `ids.cpu_id` field before that field has been assigned a value, causing kernel memory to be exposed. This is a local privilege escalation risk affecting Linux systems where unprivileged users can trigger the vulnerable code path.

• CVE-2026-53245MEDIUM 5.5

  A parsing bug in the Linux kernel's Media Redundancy Protocol (MRP) implementation can cause the network stack to misinterpret protocol frames. The vulnerability occurs in how the kernel parses vector attribute fields within MRP Protocol Data Units (PDUs). When processing event sequences, the parser fails to correctly track its position in some cases—particularly when the number of events is a multiple of three, or when certain optional fields are present or absent. This can lead to the kernel applying spurious state changes to MRP applicant state machines or corrupting the offset used to parse subsequent protocol data, potentially triggering a denial of service.

• CVE-2026-53249MEDIUM 5.5

  CVE-2026-53249 addresses a privilege escalation and information disclosure risk in the Linux kernel related to IPv4 source routing options. The vulnerability stems from a lack of proper access controls on the LSRR (Loose Source and Record Route) and SSRR (Strict Source and Record Route) IP options, which allow unprivileged users to craft packets that traverse arbitrary network paths. An attacker with local access could exploit this to force traffic through controlled nodes, potentially revealing sensitive TCP sequence numbers and other protocol state information. The fix restricts these options to applications with CAP_NET_RAW capability, ensuring only privileged processes can use them.

• CVE-2026-53251MEDIUM 5.5

  A memory management flaw exists in the Linux kernel's Bluetooth ISO (Isochronous) connection handling. When the kernel routes Bluetooth ISO connections, it obtains a reference to a device object but fails to release it when the connection synchronization function exits, either normally or due to an error. This causes the reference count to remain elevated, potentially preventing the device from being properly cleaned up and leading to resource exhaustion over time.

• CVE-2026-53252MEDIUM 5.5

  A memory leak has been discovered in the Linux kernel's Bluetooth HCI subsystem. When Bluetooth device initialization fails early in the startup process, before the device is fully registered, a cleanup function is incorrectly skipped. This leaves behind unreleased memory from the SRCU (Sleepable RCU) synchronization mechanism, which accumulates per-CPU allocations that are never freed. While the leak itself doesn't directly compromise data confidentiality or integrity, repeated device failures can exhaust available memory and degrade system stability or cause denial of service.

• CVE-2026-53257MEDIUM 5.5

  A vulnerability in the Linux kernel's WiFi configuration system (cfg80211) can cause the system to crash when certain advanced WiFi capability settings are inconsistent. Specifically, if Extended HE (EHT) capability information is present but the corresponding operational data is missing, the kernel may fail. This is a local vulnerability requiring an authenticated user on the system to trigger.

• CVE-2026-53258MEDIUM 5.5

  A memory leak exists in the Linux kernel's WiFi scanning code that occurs when 6 GHz band scanning fails. When cfg80211_scan() encounters an error during split 6 GHz scanning, the kernel allocates memory for an internal scan request (rdev->int_scan_req) but fails to properly release it. This happens because the cleanup function checks for rdev->scan_req being populated before freeing resources, but in this error condition both pointers end up NULL, causing the allocated memory to never be released. The leak is triggered through normal WiFi scanning operations, typically initiated by user-space tools like wpa_supplicant.

• CVE-2026-53261MEDIUM 5.5

  A memory leak exists in the Linux kernel's devlink subsystem where relationship state is not properly released in certain failure scenarios. Specifically, when a device driver (particularly SubFunction or SF drivers) creates a nested devlink relationship to its parent before completing registration, and then fails during the probe process, the relationship reference is leaked because the normal cleanup path is bypassed. This affects only systems where drivers follow this specific initialization pattern and experience probe failures.

• CVE-2026-53263MEDIUM 5.5

  A memory handling error in the Linux kernel's 6LoWPAN implementation—a compression protocol for IPv6 traffic over low-power wireless networks—causes two problems: it corrupts compressed multicast addresses by overwriting a required identifier field, and it leaks uninitialized kernel memory over the network. The vulnerability is triggered during the compression of IPv6 multicast addresses and affects systems that use 6LoWPAN for IoT or embedded network communication.

• CVE-2026-53269MEDIUM 5.5

  The Linux kernel's netfilter synproxy feature can experience a race condition when multiple processes simultaneously attempt to register network hooks. This occurs because the infrastructure registers these hooks on-demand when users add iptables targets or nftables expressions concurrently, without proper synchronization. A fix has been implemented by introducing a mutex (mutual exclusion lock) to serialize access to the reference counting mechanism, preventing the race condition from occurring.

• CVE-2026-53271MEDIUM 5.5

  A flaw in the Linux kernel's ksmbd server allows a local user to crash the system by exploiting a race condition in how the server handles SMB (Samba/Windows file-sharing) connections. When a client disconnects while the server is processing certain file-locking notifications, the server can attempt to dereference a NULL pointer, triggering a kernel panic. An authenticated local user with minimal privileges can reliably trigger this denial-of-service condition.

• CVE-2026-53274MEDIUM 5.5

  A flaw in the Linux kernel's SMC (Shared Memory Communications) socket implementation allows a local attacker without special privileges to freeze kernel worker threads and trigger system instability. By exploiting how the kernel copies user-provided socket settings, an attacker can intentionally stall the copy operation—using specialized memory tricks—while holding a critical lock. This causes other kernel operations to hang indefinitely, eventually triggering watchdog alerts and system degradation. The fix relocates the vulnerable copy operation outside the locked section.

• CVE-2026-11157MEDIUM 5.4

  A script injection vulnerability in Google Chrome's accessibility features allows attackers to inject arbitrary scripts and HTML into web pages if a user installs a malicious extension. The vulnerability, tracked as CVE-2026-11157, requires user interaction (installing an extension) to exploit, making it a social engineering vector rather than a network-based attack. Chrome versions before 149.0.7827.53 are affected.

• CVE-2026-11232MEDIUM 5.4

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the TabGroups feature handles network input, allowing attackers to deceive users through fake or misleading visual elements in the browser interface. An attacker would need to trick a user into visiting a malicious website or intercepting network traffic, but the actual attack surface is relatively narrow—the vulnerability requires user interaction and does not enable data theft or system crashes on its own.

• CVE-2026-11243MEDIUM 5.4

  Google Chrome versions before 149.0.7827.53 contain a flaw in how it handles downloads that allows an attacker to bypass navigation restrictions by serving a specially crafted web page. When a user visits the malicious page, the browser's normal safeguards that prevent unwanted navigation can be circumvented, potentially allowing redirection to unintended destinations or other restricted actions. The vulnerability requires user interaction (clicking or visiting a page) and affects Chrome on Windows, macOS, and Linux.

• CVE-2026-11666MEDIUM 5.4

  Google Chrome versions prior to 149.0.7827.103 contain a flaw where the browser fails to properly validate user-supplied input in certain UI elements. An attacker can exploit this by crafting a malicious HTML page that, when visited, displays fake browser UI components or dialogs—a technique known as UI spoofing. This could trick users into believing they're interacting with legitimate Chrome interface elements, potentially leading to credential theft, social engineering attacks, or other user-directed compromise. The vulnerability requires user interaction (visiting the crafted page) but no special privileges, making it a concern for general web browsing.

• CVE-2026-11701MEDIUM 5.4

  Google Chrome versions before 149.0.7827.103 contain a flaw in how the Guest View feature handles crafted HTML pages, allowing attackers to trick users with fake or misleading interface elements. An attacker would need to host a malicious webpage and convince a user to visit it while Chrome's Guest View is active. The vulnerability does not allow data theft or system compromise on its own, but the spoofed interface could be used to deceive users into taking actions they wouldn't otherwise take.

• CVE-2026-11004MEDIUM 5.3

  CVE-2026-11004 is a memory disclosure vulnerability in Google Chrome's ANGLE graphics library. An attacker who has already compromised Chrome's renderer process can craft a malicious HTML page to read sensitive data from the browser's memory. While this requires prior compromise of the renderer, the ability to extract potentially sensitive information makes it a meaningful security concern for organizations running Chrome.

• CVE-2026-11098MEDIUM 5.3

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in GPU handling that allows an attacker with control of the renderer process to extract sensitive data from other websites. The vulnerability requires user interaction and a compromised renderer, making it a targeted risk rather than a mass-exploitation vector. The issue stems from insufficient validation when processing untrusted input, permitting cross-origin information disclosure.

• CVE-2026-11174MEDIUM 5.3

  CVE-2026-11174 is a Site Isolation bypass vulnerability in Google Chrome that allows an attacker who has already compromised a browser's renderer process to read sensitive data from other websites. The flaw stems from improper implementation of Chrome's Site Isolation feature, a critical security boundary that normally prevents one website from accessing another's data. An attacker would need to first gain control of the renderer process—typically through a separate vulnerability—and then use a specially crafted HTML page to circumvent this protection. While the attack requires a prior compromise, the consequence of success is confidentiality loss across site boundaries.

• CVE-2026-11246MEDIUM 5.3

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in IndexedDB—a browser feature for storing data locally—that fails to properly validate user input. If an attacker compromises the renderer process (the part of Chrome that displays web pages), they can craft a malicious HTML page to bypass the same-origin policy, a critical security boundary that normally prevents one website from accessing another's data. This requires the attacker to already control the renderer process, which limits the immediate threat but remains a meaningful integrity risk.

• CVE-2026-11678MEDIUM 5.3

  An integer overflow vulnerability exists in libyuv, an image processing library bundled with Google Chrome. The flaw allows an attacker who has already compromised Chrome's renderer process to read sensitive information from memory by serving a specially crafted HTML page. Because the attack requires prior renderer compromise, real-world exploitation involves a multi-stage attack chain rather than direct network exploitation.

• CVE-2026-12015MEDIUM 5.3

  A use-after-free vulnerability in Google Chrome's autofill feature allows attackers who have already compromised the browser's renderer process to leak sensitive information from memory. An attacker would need to trick a user into visiting a specially crafted webpage while the renderer is in a vulnerable state. This is not a remote code execution risk on its own, but represents a significant information disclosure threat once an attacker has a foothold in the rendering engine.

• CVE-2026-12025MEDIUM 5.3

  Google Chrome versions before 149.0.7827.115 contain a flaw in how the browser validates input within its Network component. An attacker who has already compromised Chrome's renderer process—the sandboxed environment that executes web content—can craft a malicious HTML page to leak sensitive data across security boundaries that normally prevent one website from accessing another's information. This is a privilege-escalation scenario: it requires the renderer to already be compromised, but then allows the attacker to exfiltrate data that should be protected by the browser's same-origin policy.

• CVE-2026-12033MEDIUM 5.3

  Google Chrome versions prior to 149.0.7827.115 contain an out-of-bounds memory read vulnerability in the VideoCapture component. An attacker who has already compromised Chrome's GPU process can exploit this flaw by serving a specially crafted webpage, allowing them to read sensitive data from the process's memory. This is a post-compromise attack requiring prior GPU process compromise and user interaction.

• CVE-2026-13023MEDIUM 5.3

  CVE-2026-13023 is a memory disclosure vulnerability in Google Chrome's GPU handling code. If an attacker has already compromised Chrome's renderer process—the sandboxed component that executes web content—they can craft a malicious HTML page to read uninitialized GPU memory, potentially exposing sensitive data from the browser's process memory. This requires two conditions: prior renderer compromise and user interaction with the malicious page. The vulnerability affects Chrome versions before 149.0.7827.197.

• CVE-2026-11276MEDIUM 5.1

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the Cast feature (which enables screen mirroring and media streaming to nearby devices) processes network traffic. An attacker physically present on the same local network can send specially crafted traffic to bypass access controls that would normally prevent unauthorized casting operations. This is a local network attack that doesn't require user interaction but is limited in scope—it cannot crash systems or execute arbitrary code, only manipulate casting permissions.

• CVE-2026-9942MEDIUM 5.0

  CVE-2026-9942 is a memory safety issue in ANGLE, the graphics abstraction layer used by Google Chrome. When a remote attacker has already compromised Chrome's renderer process, they can exploit this uninitialized memory condition to break out of Chrome's site isolation sandbox using a specially crafted HTML page. Site isolation is Chrome's primary defense against cross-site data theft; bypassing it allows an attacker to read data from other websites the user is visiting. This requires the renderer process to be already compromised, meaning it is a post-compromise escalation rather than an entry point.

• CVE-2026-9979MEDIUM 5.0

  CVE-2026-9979 is a site isolation bypass vulnerability in Google Chrome that allows an attacker to escape the security boundary between different websites if they have already compromised Chrome's rendering engine. An attacker would need to trick a user into visiting a malicious HTML page while the renderer process is already under their control. Site isolation is Chrome's core defense mechanism that prevents one website's scripts from accessing another website's data; this vulnerability undermines that protection in a limited but serious scenario.

• CVE-2026-9980MEDIUM 5.0

  Google Chrome versions before 148.0.7778.216 contain a flaw in how it validates input when printing documents. An attacker who has already compromised Chrome's rendering engine can exploit this to bypass Site Isolation, a security boundary that separates data between websites. This requires both a prior compromise of the renderer process and user interaction, making it a secondary attack in a chain rather than a standalone entry point.

• CVE-2026-34694MEDIUM 4.8

  Adobe Experience Manager Forms JEE contains a stored cross-site scripting (XSS) vulnerability in form fields that allows a high-privileged attacker to inject malicious JavaScript code. When other users visit a page containing the compromised form field, the malicious script executes in their browser, potentially compromising their session, credentials, or sensitive data. The vulnerability affects versions LTS SP1, 6.5.24.0 and earlier.

• CVE-2026-11233MEDIUM 4.7

  CVE-2026-11233 is a same-origin policy bypass vulnerability in Google Chrome's FoldableAPIs feature. An attacker who has already gained control of Chrome's renderer process—the component that executes web page code—can use a specially crafted HTML page to break through Chrome's security boundary and access data from websites the user visits. This requires the attacker to have already compromised the renderer, making it a secondary exploit rather than a direct entry point. The vulnerability affects Chrome versions prior to 149.0.7827.53.

• CVE-2026-11249MEDIUM 4.7

  Google Chrome versions before 149.0.7827.53 contain a use-after-free vulnerability in the Network component. If an attacker compromises Chrome's renderer process—the sandboxed part that runs web content—they could read sensitive data from the browser's memory using a specially crafted HTML page. This is a memory safety issue: the code attempts to access data after it has already been freed, potentially exposing unencrypted information that was in use moments before.

• CVE-2026-12463MEDIUM 4.7

  Google Chrome on Linux contains a flaw in how it handles Views that allows an attacker who has already compromised Chrome's rendering engine to inject malicious scripts or HTML content into web pages. This is a secondary attack—the attacker must first gain control of the renderer process before exploiting this vulnerability. The flaw affects Chrome versions prior to 149.0.7827.155 on Linux systems.

• CVE-2026-13034MEDIUM 4.7

  Google Chrome versions before 149.0.7827.197 contain a flaw in how it handles passwords that allows an attacker who has already compromised Chrome's renderer process to break out of site isolation—Chrome's critical security boundary that prevents malicious websites from accessing data belonging to other websites. An attacker would need to trick a user into visiting a specially crafted webpage after first gaining control of the renderer, but if successful, could view sensitive information like passwords or cookies from other sites.

• CVE-2026-46159MEDIUM 4.7

  A race condition in the Linux kernel's btrfs filesystem driver can leak uninitialized kernel memory to unprivileged local users. The vulnerability exists in the ioctl handler that reports storage space information. When block groups are concurrently removed by the system during the space query operation, the kernel copies more data to userspace than it actually wrote, exposing sensitive kernel memory. An attacker with local access can exploit this timing window to read information that should not be accessible.

• CVE-2026-46187MEDIUM 4.7

  The Linux kernel's RSI wireless driver has a race condition in how it shuts down worker threads. The driver uses two different methods to stop these threads: a self-terminating approach and an external stop command. When the self-terminating method completes first and then the external stop is called, the code tries to access a thread that has already been freed from memory—a use-after-free vulnerability. This affects local users with moderate privileges and can cause a system crash or unexpected behavior.

• CVE-2026-46194MEDIUM 4.7

  A race condition exists in the Linux kernel's F2FS file system implementation that can cause a kernel crash. When an inode is being dropped from memory, the extent node destruction process does not properly signal that no new extent nodes should be added. Meanwhile, concurrent write-back operations may attempt to insert new extent nodes, creating a collision that triggers a kernel bug check. The vulnerability affects systems using F2FS, particularly in multi-threaded I/O scenarios where inode cleanup and write-back operations overlap.

• CVE-2026-46272MEDIUM 4.7

  CVE-2026-46272 is a race condition in the Linux kernel's CoreSight Trace Memory Controller (TMC) Embedded Trace Receiver (ETR) driver. When a system attempts to run both performance tracing (perf) and sysfs-based hardware tracing simultaneously, a timing gap between buffer allocation and hardware enablement in sysfs mode allows the perf mode to initialize its own buffer state. This causes sysfs mode to later detect the unexpected state and trigger a kernel warning, resulting in denial of service through system instability. The vulnerability exists because the sysfs enablement process was split across two separate locking regions, creating a window where perf mode could intervene.

• CVE-2026-46298MEDIUM 4.7

  A race condition exists in the Linux kernel's PAPR HVPIPE driver that can cause a system deadlock. The vulnerability occurs when an interrupt fires on the same CPU while the driver's ioctl or release handlers are executing. If both try to acquire the same lock simultaneously, the system can become unresponsive. The issue is resolved by using interrupt-safe lock primitives that prevent interrupts from firing during critical sections, eliminating the deadlock scenario. This is primarily a local denial of service affecting systems running vulnerable kernel versions.

• CVE-2026-53008MEDIUM 4.7

  A race condition exists in the Linux kernel's ice driver that can cause a system crash when one CPU is cleaning up TX timestamp resources while another CPU is actively using them. The vulnerability occurs because pointer cleanup and flag clearing happen in the wrong order, allowing a concurrent operation to dereference a NULL pointer. The impact is limited to systems with the ice driver loaded and TX timestamping enabled, and requires local access to trigger.

• CVE-2026-53108MEDIUM 4.7

  A race condition exists in the Linux kernel's memory management on PowerPC 64-bit systems that can trigger a kernel crash (panic) when two processes simultaneously attempt incompatible operations on the same memory pages. Specifically, when one process moves memory pages between NUMA nodes using move_pages() while another process unmaps that memory via munmap(), the kernel can encounter an assertion failure. The vulnerability requires local access and moderate effort to trigger, but results in a denial of service affecting system availability.

• CVE-2026-0268MEDIUM 4.4

  A vulnerability in Palo Alto Networks' Prisma Access Agent for Linux allows a local user on an affected system to bypass security controls and route network traffic outside the intended VPN tunnel. This is a local attack that requires an authenticated user account and does not affect Windows, macOS, iOS, Android, or ChromeOS deployments. An attacker exploiting this could potentially access resources or send data outside the VPN tunnel without proper security monitoring.

• CVE-2026-11031MEDIUM 4.3

  Google Chrome's Password Manager fails to properly validate input from network traffic before displaying it to users. An attacker can craft malicious network data that tricks the Password Manager interface into showing fake or misleading information—for example, a phishing prompt that looks legitimate. This affects Chrome versions before 149.0.7827.53 on Windows, macOS, and Linux.

• CVE-2026-11062MEDIUM 4.3

  Google Chrome versions before 149.0.7827.53 contain a vulnerability in how it enforces policies on browser extensions. An attacker could create a malicious extension that, if installed by a user, would be able to inject malicious scripts or HTML code into sensitive browser pages. While the technical barrier is relatively low (it requires social engineering to trick a user into installing the extension), the impact is limited to tampering with page content rather than stealing data or causing system crashes.

• CVE-2026-11107MEDIUM 4.3

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser handles the Downloads feature that allows an attacker to trick users with a deceptive webpage. Specifically, an attacker could craft a malicious HTML page that, when viewed in an affected Chrome browser, would display fake or misleading interface elements to deceive users—a technique called UI spoofing. The vulnerability requires user interaction (visiting the malicious page) but does not compromise confidentiality or system availability; the primary risk is deception around the integrity of what the user sees on their screen.

• CVE-2026-11126MEDIUM 4.3

  A flaw in Google Chrome's Developer Tools (DevTools) allows an attacker to access data from different websites if they can trick a user into installing a malicious browser extension. The vulnerability has a CVSS score of 4.3 (Medium severity) and requires user interaction—specifically, the user must be convinced to install the malicious extension. Once installed, the crafted extension can exploit improper input validation in DevTools to leak cross-origin data that should normally be protected by browser security policies.

• CVE-2026-11155MEDIUM 4.3

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in how CSS is processed that could allow an attacker to trick a user into visiting a malicious website where sensitive data from other sites (cross-origin data) could be leaked. The attack requires user interaction—specifically clicking a link or visiting a crafted page—but does not require the attacker to have special permissions or bypass other security controls. The leaked information would be visible only to the attacker, not modified or destroyed.

• CVE-2026-11156MEDIUM 4.3

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in how it handles CSS styling rules that can allow an attacker to extract data from other websites you have open in your browser. An attacker would need to trick you into visiting a malicious webpage, and if successful could read sensitive information from other tabs or windows—such as content from your email, banking site, or other services—that you're simultaneously visiting. This is a cross-origin data leak vulnerability affecting the browser's CSS implementation.

• CVE-2026-11159MEDIUM 4.3

  A memory safety issue in Google Chrome's Skia graphics library allows attackers to steal data from websites you visit. By crafting a malicious HTML page, an attacker could trick your browser into exposing information that should remain private to other websites—a cross-origin data leak. The vulnerability requires user interaction (clicking or viewing the page) but doesn't require special browser settings or authentication. Google patched this in Chrome 149.0.7827.53 and later versions.

• CVE-2026-11161MEDIUM 4.3

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in how it handles cross-origin data transfers. An attacker can craft a malicious HTML page that, when visited by a user, leaks sensitive information from websites the user is logged into or has visited. The vulnerability requires user interaction (clicking or visiting the page) but does not require special browser permissions or user sophistication to exploit.

• CVE-2026-11162MEDIUM 4.3

  Google Chrome versions before 149.0.7827.53 contain a vulnerability in how the browser handles CSS that can allow attackers to steal data from other websites. An attacker would need to trick a user into visiting a malicious webpage, but once there, the flawed CSS implementation could expose sensitive information from pages the user has open in other tabs or windows. The risk is limited to information disclosure—the vulnerability does not allow attackers to modify data or crash the browser.

• CVE-2026-11192MEDIUM 4.3

  Google Chrome's password manager has a flaw that fails to properly check information coming from the network. An attacker can exploit this by sending crafted network traffic to trick the browser's UI into displaying fake or misleading content—for example, mimicking legitimate login prompts or security warnings. The attacker cannot steal data or crash the browser, but they can manipulate what users see, potentially leading to credential theft or social engineering attacks if the spoofed interface convinces users to enter sensitive information.

• CVE-2026-11212MEDIUM 4.3

  A vulnerability in Google Chrome's developer tools (DevTools) fails to properly enforce security policies that should prevent extensions from accessing data across different websites. An attacker could trick a user into installing a malicious Chrome extension, which could then exploit this flaw to steal sensitive information from websites the user visits. The issue affects Chrome versions before 149.0.7827.53.

• CVE-2026-11216MEDIUM 4.3

  Google Chrome contains a flaw in how it displays security warnings for file input operations. An attacker can craft a malicious webpage that tricks users into performing specific mouse or keyboard actions—such as clicking or dragging—that trigger the file picker dialog. By manipulating the visual presentation of this dialog, the attacker can deceive the user about what action they're performing, potentially leading them to upload sensitive files or authorize unintended operations. This is a user-interaction vulnerability: it requires the attacker to convince the user to engage in the specific gestures, but once they do, the spoofed UI can create false impression of legitimacy.

• CVE-2026-11219MEDIUM 4.3

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser implements navigation controls. An attacker can craft a malicious HTML page that, when visited, bypasses intended navigation restrictions—essentially allowing the page to navigate the browser or access certain destinations in ways it shouldn't be able to. The attack requires user interaction (clicking or visiting the page), but no special browser privileges. While Chromium rates this as Low severity internally, the CVSS scoring reflects Medium severity due to the potential for integrity compromise through navigation spoofing.

• CVE-2026-11221MEDIUM 4.3

  A weakness in Google Chrome's PointerLock feature allows a threat actor who has already gained control of the browser's renderer process to deceive users through fake on-screen elements. The attacker would craft a malicious HTML page that tricks the browser into displaying misleading UI, potentially impersonating legitimate interface elements. This requires the renderer process to be compromised first, making it a secondary attack that typically follows another successful exploit.

• CVE-2026-11228MEDIUM 4.3

  Google Chrome before version 149.0.7827.53 contains a flaw in how it handles file input operations that allows attackers to deceive users through visual manipulation. If an attacker can trick a user into performing specific clicks or interactions on a malicious webpage, they can spoof the browser interface—making fake buttons, dialogs, or other UI elements appear legitimate. This is a social engineering attack that relies on user interaction; the vulnerability itself is in Chrome's file input implementation.

• CVE-2026-11234MEDIUM 4.3

  Google Chrome versions before 149.0.7827.53 contain a vulnerability in the FoldableAPIs feature that allows a remote attacker to bypass site isolation—Chrome's core security boundary that separates web pages from each other—if the attacker has already compromised the renderer process. Site isolation is one of Chrome's strongest defenses against malicious websites stealing data from other tabs or extensions. This vulnerability requires both a compromised renderer and user interaction, limiting the immediate threat but warranting timely patching.

• CVE-2026-11245MEDIUM 4.3

  CVE-2026-11245 is a user interface spoofing vulnerability in Google Chrome's payment handling system. An attacker can craft a deceptive HTML page that tricks users into believing they are interacting with legitimate payment dialogs or security prompts, potentially leading to credential theft, social engineering, or other forms of user deception. The vulnerability requires user interaction (clicking or engaging with the malicious page) to be exploited, limiting its scope but not eliminating risk in realistic phishing or drive-by attack scenarios.

• CVE-2026-11252MEDIUM 4.3

  Google Chrome versions before 149.0.7827.53 contain a flaw in how it enforces content policies that could allow an attacker to bypass certain access controls through a specially crafted web page. The vulnerability requires user interaction—an attacker would need to trick someone into visiting a malicious page—but does not leak sensitive data or crash the browser. Instead, it could allow unauthorized modification of content or settings the user intended to protect.

• CVE-2026-11253MEDIUM 4.3

  Google Chrome contained a flaw in how it handled permissions that could allow an attacker to trick users into visiting a specially crafted web page and leak data from other websites the user was visiting. The vulnerability requires user interaction (clicking or viewing a malicious page) and only affects data confidentiality, not system availability or integrity. Google has patched this in Chrome 149.0.7827.53 and later.

• CVE-2026-11254MEDIUM 4.3

  Google Chrome versions prior to 149.0.7827.53 contain a UI spoofing vulnerability in its permissions implementation. An attacker can craft a malicious HTML page that, when visited by a user, displays fake permission prompts or other interface elements to deceive users into granting access or performing unintended actions. The attack requires user interaction—specifically, the victim must visit the attacker's page—but does not require any special browser configuration or privilege level.

• CVE-2026-11257MEDIUM 4.3

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser implements navigation controls. An attacker can craft a malicious HTML page that, when visited by a user, bypasses the browser's built-in restrictions on where a page can navigate. This allows the attacker to redirect the user to unintended destinations or perform unwanted navigation actions, potentially leading to phishing, credential harvesting, or distribution of malware. The vulnerability requires user interaction (clicking or visiting the page) and affects Chrome on Windows, macOS, and Linux.

• CVE-2026-11259MEDIUM 4.3

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the Cast feature validates user-supplied input. This allows an attacker to craft a malicious webpage that, when visited, can bypass Chrome's same-origin policy—a critical security boundary that prevents websites from accessing data belonging to other sites. The attack requires user interaction (visiting the page) but requires no special privileges. While Chromium rates the underlying severity as Low, the ability to circumvent same-origin policy elevates practical risk.

• CVE-2026-11260MEDIUM 4.3

  Google Chrome versions before 149.0.7827.53 contain a flaw in how it handles permissions that allows attackers to bypass the browser's Content Security Policy (CSP) protections via a specially crafted webpage. While the underlying browser vulnerability severity is rated as low, the CVSS assessment elevates this to medium risk because it requires user interaction but could enable an attacker to execute unintended behavior or inject content that CSP should block. The issue affects Chrome on Windows, macOS, and Linux.

• CVE-2026-11261MEDIUM 4.3

  Google Chrome versions before 149.0.7827.53 contain a flaw in how it handles PDF rendering that could allow an attacker to trick users into believing they're viewing legitimate content when they're not. If an attacker has already compromised Chrome's rendering engine (the component that displays web pages), they can craft a specially designed HTML page to perform UI spoofing—making fake buttons, warnings, or other interface elements appear authentic. This is a medium-severity issue because it requires both a prior compromise of the renderer process and user interaction to be exploited.

• CVE-2026-11264MEDIUM 4.3

  Google Chrome versions before 149.0.7827.53 contain a flaw in how Content Security Policy (CSP) is enforced. An attacker can craft a malicious HTML page that, when visited by a user, bypasses the browser's CSP protections. This allows the attacker to inject or execute content that the website owner intended to block, potentially leading to credential theft, session hijacking, or other attacks that degrade site security. The vulnerability requires user interaction—the victim must visit the malicious page—and does not directly compromise the browser itself or enable data exfiltration.

• CVE-2026-11266MEDIUM 4.3

  Google Chrome versions before 149.0.7827.53 contain a flaw in the Safe Browsing feature that allows a remote attacker to bypass its protections by delivering a specially crafted file. An attacker would need to trick a user into opening or interacting with the malicious file, but if successful, the user's safety checks could be circumvented, potentially allowing access to sites or content that Safe Browsing would normally block.

• CVE-2026-11267MEDIUM 4.3

  A vulnerability in Google Chrome's extension framework allows a malicious extension to bypass content security policy (CSP) protections if a user installs it. The issue stems from insufficient policy enforcement mechanisms that fail to properly validate extension behavior. While the underlying Chromium severity is rated as Low, the CVSS assessment elevates it to Medium due to the user interaction requirement combined with potential integrity impact. An attacker would need to socially engineer a user into installing a compromised extension—a realistic but not trivial attack vector.

• CVE-2026-11286MEDIUM 4.3

  A flaw in Google Chrome's Wallet component allows attackers who have already compromised a browser's renderer process to trick users with fake UI elements displayed on a web page. This requires the attacker to first gain control of the renderer—the part of the browser that displays web content—which is a significant prerequisite but not impossible in real-world scenarios where other vulnerabilities or social engineering may be chained together.

• CVE-2026-11292MEDIUM 4.3

  Google Chrome versions before 149.0.7827.53 contain a flaw in the Blink rendering engine that allows attackers to bypass Content Security Policy (CSP) protections through a specially crafted webpage. An attacker would need to trick a user into visiting a malicious site, where the weakness could enable injection of unintended content or scripts that CSP was supposed to prevent. While Chromium rates this as low severity, the CVSS score reflects moderate impact potential because CSP bypass can lead to unauthorized modifications of page behavior.

• CVE-2026-11294MEDIUM 4.3

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in password handling that allows attackers to create fake or misleading login screens through specially crafted web pages. An attacker would need to trick a user into visiting a malicious website, but once there, the browser's UI protections don't adequately prevent visual deception. This is not an authentication bypass—it's a user interface trick that could mislead people about whether they're interacting with legitimate Chrome UI or attacker-controlled content.

• CVE-2026-11300MEDIUM 4.3

  Google Chrome versions before 149.0.7827.53 contain a flaw in how it handles permissions that allows an attacker to trick users with a specially crafted web page. The attack doesn't steal data or crash the browser—instead, it displays fake permission dialogs or UI elements that might convince a user to grant access they shouldn't. The attacker needs the victim to visit the malicious page, but no special user configuration is required beforehand.

• CVE-2026-11309MEDIUM 4.3

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser enforces policies for the History feature. An attacker can craft a deceptive webpage that tricks users into believing they're interacting with legitimate browser UI elements or content. While the vulnerability requires user interaction and doesn't directly expose sensitive data or crash the browser, the spoofing capability could be weaponized in social engineering campaigns to steal credentials or manipulate user behavior.

• CVE-2026-11668MEDIUM 4.3

  Google Chrome and Chrome OS contain a weakness in their video codec processing that could allow a remote attacker to steal data from other websites. The flaw stems from uninitialized memory in the codec layer—essentially, the browser fails to properly initialize certain memory regions before use. An attacker can craft a malicious video file that, when opened by a user, exploits this memory state to read sensitive information across security boundaries. The vulnerability affects Chrome on Linux and Chrome OS versions prior to 149.0.7827.103.

• CVE-2026-11695MEDIUM 4.3

  Google Chrome prior to version 149.0.7827.103 contains a flaw in its password handling logic that could allow an attacker to leak sensitive data across website boundaries. An attacker would need to craft a malicious HTML page and convince a user to visit it, but the vulnerability itself does not require the user to take additional actions beyond normal browsing. The leaked data is restricted to information accessible within the browser context of the affected user.

• CVE-2026-12446MEDIUM 4.3

  Google Chrome versions before 149.0.7827.155 contain a flaw in how passwords are handled that allows attackers to trick users into visiting a malicious website, which can then leak sensitive information from other websites the user has visited. The vulnerability requires user interaction—specifically clicking a link or visiting a crafted page—but does not require the user to install anything or be an administrator. Once triggered, an attacker gains access only to what the browser can see, not the user's entire system.

• CVE-2026-13021MEDIUM 4.3

  Google Chrome versions prior to 149.0.7827.197 contain a flaw in how it handles device-bound session credentials that could allow an attacker to bypass the browser's same-origin policy—a critical security boundary that normally prevents websites from accessing data belonging to other sites. An attacker could craft a malicious HTML page that, when visited by a user, potentially gains unauthorized access to sensitive information from other origins. The vulnerability requires user interaction (visiting a malicious page) and is limited to information disclosure; it does not enable data modification or system unavailability.

• CVE-2026-9935MEDIUM 4.3

  CVE-2026-9935 is a memory safety issue in Google Chrome's ANGLE graphics library that allows attackers to steal sensitive data from other websites. When you visit a malicious webpage, an attacker can craft it to leak information that should be isolated to other sites you have open. The vulnerability requires user interaction—you must visit the attack page—but the bar for exploitation is otherwise low. Google has classified this as High severity internally, though the CVSS score reflects a more limited scope.

• CVE-2026-12453MEDIUM 4.2

  Google Chrome versions before 149.0.7827.155 contain a flaw where insufficient input validation allows an attacker who has already compromised the browser's renderer process to circumvent the same-origin policy through a specially crafted webpage. This means a sandboxed renderer could potentially access or modify data from websites it should not be able to reach, though the attacker must first gain control of the renderer itself—a significant prerequisite.

• CVE-2026-12456MEDIUM 4.2

  A vulnerability in how Google Chrome handles extensions before version 149.0.7827.155 allows a malicious extension to bypass the same-origin policy, which normally prevents web pages from accessing data belonging to other websites. An attacker would need to trick a user into installing a specially crafted malicious extension. If successful, the extension could read or modify sensitive information from other websites the user visits. This is a user-consent attack—the user must be socially engineered into installing the extension first.

• CVE-2026-12457MEDIUM 4.2

  Google Chrome versions prior to 149.0.7827.155 contain a flaw in how extensions are implemented that allows an attacker who has already compromised Chrome's renderer process to escape the site isolation sandbox and access content from different websites. Site isolation is Chrome's core defense that prevents malicious code running on one site from stealing data from another. This vulnerability requires the attacker to have already gained code execution in the renderer—a significant prerequisite—but if achieved, it undermines that critical isolation boundary.

• CVE-2026-12460MEDIUM 4.2

  Google Chrome versions prior to 149.0.7827.155 contain a weakness in how the browser enforces file system access policies. An attacker who has already compromised Chrome's renderer process (the part that executes web content) can exploit this flaw by serving a specially crafted PDF file to bypass Site Isolation—Chrome's security feature that isolates web content from different sites. The vulnerability requires both an existing renderer compromise and user interaction, limiting its standalone exploitability but reflecting a real protection gap once a renderer is already under attacker control.

• CVE-2026-13024MEDIUM 4.2

  Google Chrome versions prior to 149.0.7827.197 contain a flaw in how it validates user input during navigation operations. An attacker who has already compromised Chrome's renderer process—the component that interprets and displays web content—can exploit this weakness to bypass Chrome's site isolation security feature. Site isolation is a critical defense that prevents malicious websites from accessing data belonging to other sites. This vulnerability requires an attacker to have already gained control of the renderer process, making it a secondary attack that follows initial compromise.

• CVE-2026-9986MEDIUM 4.2

  CVE-2026-9986 is a UI spoofing vulnerability in Google Chrome's OptimizationGuide component that could let an attacker deceive users about what they're seeing on a webpage. The vulnerability requires the attacker to have already compromised Chrome's rendering process—the engine that draws web content. While this limits the immediate attack scope, it represents a meaningful escalation risk for adversaries who have achieved code execution in that sandboxed component. The flaw stems from inadequate validation of user-supplied input before it's used to generate on-screen elements.

• CVE-2026-10998MEDIUM 4.0

  CVE-2026-10998 is a memory safety issue in Google Chrome's media handling code that allows an attacker positioned on the same local network to read data from memory locations they shouldn't have access to. The vulnerability exists in Chrome versions before 149.0.7827.53. An attacker would need to send specially crafted network traffic to trigger an out-of-bounds read, which could potentially expose sensitive information resident in the browser's memory. This is a local-network-only threat, meaning the attacker must be on your network segment to exploit it.

• CVE-2026-8662LOW 3.3

  A path traversal flaw exists in Rapid7 InsightConnect's Compression Plugin on Linux systems. An authenticated attacker can supply specially crafted filenames to the create_archive function that cause files to be written outside their intended directory. However, because the attacker cannot control the file contents—only the path—the damage is limited to corrupting legitimate files rather than injecting malicious data. Exploitation requires valid credentials, making this primarily a risk for insider threats or compromised service accounts.

• CVE-2026-11240LOW 3.1

  CVE-2026-11240 is a low-severity input validation flaw in Google Chrome's Loader component that allows a remote attacker to bypass the browser's site isolation security feature, but only if they have already compromised the renderer process. Site isolation is Chrome's defense mechanism that runs each website in a separate process to prevent one compromised site from accessing data from another. An attacker would need to deliver a specially crafted HTML page to exploit this, making it a post-compromise risk rather than a direct remote code execution vector. The vulnerability affects Chrome versions prior to 149.0.7827.53.

• CVE-2026-11244LOW 3.1

  CVE-2026-11244 is a low-severity flaw in Google Chrome's WebAuthentication feature that allows inadequate validation of user-supplied input. An attacker with prior access to Chrome's renderer process—the component responsible for displaying web pages—could craft a malicious HTML page to circumvent the browser's same-origin policy, a fundamental security boundary that prevents scripts from one website accessing data from another. This is not a direct remote code execution and requires both renderer process compromise and user interaction to succeed.

• CVE-2026-11251LOW 3.1

  A flaw in Chrome's password manager allows a sophisticated attacker to read stored password information if they can first compromise Chrome's renderer process through a malicious web page. The vulnerability requires multiple conditions to exploit: the attacker must already control the rendering engine, the user must interact with the page, and the attack surface is limited to sensitive credential disclosure. Chrome versions before 149.0.7827.53 are affected. This is not a zero-click issue and does not allow code execution or system-level access.

• CVE-2026-11675LOW 3.1

  Google Chrome contained a memory reading vulnerability in its Skia graphics library that could allow an attacker to steal sensitive data from other websites. The attacker would first need to compromise Chrome's renderer process—the sandboxed component that handles web page rendering—and then trick a user into visiting a specially crafted webpage. If successful, the flaw could leak cross-origin data, meaning information from a different website than the one the user thought they were visiting. This vulnerability affects Chrome versions prior to 149.0.7827.103 across Windows, macOS, and Linux systems.

• CVE-2026-11684LOW 3.1

  A policy enforcement gap in Google Chrome's Network component allowed attackers who had already compromised Chrome's utility process to steal cross-origin data by serving a specially crafted HTML page. This is a post-compromise attack where the attacker has already gained some level of access to the browser process itself, then exploits this weakness to read data that should be isolated between different websites.

• CVE-2026-11691LOW 3.1

  Google Chrome contained a flaw in its New Tab Page that could allow attackers who had already compromised Chrome's renderer process to steal data from websites across different origins. The vulnerability required an attacker to have already broken into the renderer—the sandboxed component that runs web content—and then trick a user into visiting a malicious HTML page. While the Chromium security team rated this High severity internally, the calculated CVSS score is Low (3.1) because the attack requires both prior renderer compromise and user interaction.