By vendor

Linux vulnerabilities

Known CVEs affecting Linux products, prioritized by severity, with SEC.co remediation and detection guidance.

1178 published vulnerabilities · page 7 of 12

• CVE-2026-53303HIGH 7.1

  A race condition exists in the Linux kernel's f2fs filesystem implementation that can occur when sysfs operations access extension list data without proper synchronization. When one process modifies the extension list while another reads it via sysfs, the reader may encounter inconsistent data—such as mismatched counts and array contents—potentially causing out-of-bounds memory access or displaying stale information. This requires local access to exploit and affects systems where untrusted local users can access sysfs interfaces.

• CVE-2026-53330HIGH 7.1

  A flaw exists in the Linux kernel's AMD display driver that allows code to read memory outside the bounds of a small array. The bug occurs when certain graphics hardware reports the maximum number of signal repeaters allowed by the DisplayPort specification. Because the array is sized one element too small, accessing data for the 8th repeater reads into adjacent memory. An attacker with local access could exploit this to leak sensitive kernel memory or trigger a system crash.

• CVE-2026-53346HIGH 7.1

  A flaw in how the Linux kernel's Rust compiler toolchain handles unwinding information for ARM64 systems can cause boot failures when certain kernel security features are enabled. Specifically, when the kernel is built with both Rust support and address sanitizer (KASAN) constructor patching enabled, compiler-generated initialization functions may be patched incorrectly, leading to a crash during system startup. The issue stems from a rustc compiler bug where the unwind table flag is not properly applied to all generated functions, only to explicitly declared ones.

• CVE-2026-53361HIGH 7.1

  A race condition flaw was found in the Linux kernel's Unix domain socket garbage collection mechanism. When multiple threads attempt to schedule garbage collection simultaneously, the gc_in_progress flag can become desynchronized, allowing garbage collection to run while the flag is incorrectly set to false. This creates a window where other socket operations relying on accurate garbage collection state can behave unpredictably, potentially leading to data corruption or denial of service. The issue affects local unprivileged users who can trigger socket operations.

• CVE-2026-8035HIGH 7.1

  CVE-2026-8035 is a denial-of-service vulnerability in National Instruments' PAL kernel driver that allows authenticated local users to crash the system. The flaw stems from inadequate input validation that fails to check for NULL pointers before dereferencing them in memory. An attacker with local system access can exploit this by supplying malformed input to the driver, causing an immediate kernel panic. The vulnerability affects NI-PAL version 26.3.0 and all earlier releases across both Windows and Linux platforms.

• CVE-2026-8036HIGH 7.1

  NI-PAL, National Instruments' process abstraction layer, contains an input validation flaw that allows authenticated local users to read and modify arbitrary memory regions on affected systems. An attacker with local access could exploit this to escalate their privileges. The vulnerability affects NI-PAL version 26.3.0 and earlier on both Windows and Linux platforms.

• CVE-2026-9154HIGH 7.1

  A vulnerability in Rapid7 InsightConnect's Sed Plugin allows authenticated users to write malicious files to any location on Linux systems. An attacker with valid credentials can exploit the 'expression' parameter to place arbitrary content at arbitrary file paths, potentially overwriting critical system or application files. This is a file-write vulnerability rather than code execution, but the impact depends heavily on what files an attacker targets.

• CVE-2026-46154HIGH 7.0

  A race condition exists in the Linux kernel's scheduler extension (sched_ext) cgroup interface that can lead to use-after-free memory access. When system administrators adjust cgroup scheduling parameters like weight, idle status, or bandwidth, the kernel reads a pointer to the scheduler without proper synchronization. If another process simultaneously disables and re-enables a different scheduler, the cached pointer becomes stale and points to freed memory. When the original operation tries to use this pointer, it dereferences already-freed kernel memory, potentially allowing local privilege escalation.

• CVE-2026-46164HIGH 7.0

  A memory management bug in the Linux kernel's Btrfs filesystem can cause the same memory region to be freed twice when a sysfs initialization step fails. This double-free condition can lead to memory corruption and potentially allow an attacker with local access to crash the system or execute code with elevated privileges. The issue occurs in error handling code that wasn't properly coordinated between two layers of the filesystem's initialization logic.

• CVE-2026-46299HIGH 7.0

  CVE-2026-46299 is a lock-handling bug in the Linux kernel's HFS+ filesystem driver that can allow a local attacker with moderate privileges to crash the system or potentially escalate privileges. The vulnerability occurs during filesystem mount when the code acquires a lock but fails to release it properly if certain filename validation steps fail. This causes the system to detect a memory leak while a critical lock is still held, triggering a kernel warning and potential system instability.

• CVE-2026-46309HIGH 7.0

  CVE-2026-46309 is a memory access control flaw in the Linux kernel's GPU driver (xe) that can leak sensitive data. When a privileged process uses a low-coherency GPU memory mode on CPU-cached buffers, the GPU can bypass CPU caches and read stale data directly from RAM—including sensitive information from previously freed memory of other processes. The fix validates GPU memory configuration requests to prevent this dangerous combination.

• CVE-2026-53329HIGH 7.0

  A memory allocation vulnerability exists in the Linux kernel's AMD display driver. When reserving space for a data structure, the code calculates the required memory size using arithmetic that can overflow, potentially allocating far less memory than needed. This creates a heap overflow condition where subsequent operations write beyond the allocated buffer, potentially allowing local attackers with unprivileged access to crash the system or execute code. The fix replaces the unsafe allocation function with a safer variant that detects and prevents overflow conditions.

• CVE-2026-11166MEDIUM 6.8

  Google Chrome versions before 149.0.7827.53 contain a flaw in how it processes SVG (Scalable Vector Graphics) content that allows attackers to inject malicious scripts or HTML into web pages. An attacker would craft a specially designed HTML page and trick a user into visiting it; if the user does, arbitrary code could execute within the browser with the user's privileges, potentially stealing data, modifying page content, or performing actions on the user's behalf. The vulnerability requires user interaction and is rated Medium severity by Google's security team.

• CVE-2026-11628MEDIUM 6.8

  Google Chrome versions before 149.0.7827.103 contain a use-after-free memory error in the Ozone graphics subsystem. An attacker with physical access to a device can trigger this flaw to corrupt heap memory and potentially execute arbitrary code. While the Chromium project rates this as Critical, the CVSS score reflects the requirement for physical device access, which limits real-world exploitability for most organizations.

• CVE-2026-53196MEDIUM 6.8

  A vulnerability in the Linux kernel's USB serial driver for IO Technic devices allows a malicious USB device to overflow kernel memory when connected to a host system. The driver fails to properly validate the size of data it reads from a device's onboard memory, trusting an untrusted value from the device itself. When a crafted device is plugged in, it can write far more data into a small kernel buffer than it was designed to hold, potentially leading to code execution or system crash.

• CVE-2026-10004MEDIUM 6.5

  Google Chrome versions before 148.0.7778.216 contain a flaw in how they validate user input within the password-handling component. An attacker can craft a malicious HTML page that, when visited by a user, tricks the browser into displaying fake password prompts or other UI elements that appear legitimate. This is a spoofing attack—the attacker doesn't steal data directly, but deceives users into believing they're interacting with genuine Chrome interface elements, potentially leading them to enter credentials or take other unintended actions.

• CVE-2026-10018MEDIUM 6.5

  CVE-2026-10018 is a medium-severity integer overflow vulnerability in ANGLE (Almost Native Graphics Layer Engine), Google's graphics abstraction layer used in Chrome. An attacker can craft a malicious webpage that, when visited, causes Chrome to mishandle memory calculations in its graphics pipeline. This flaw allows the attacker to read sensitive data from the browser's process memory—potentially including cached credentials, session tokens, or other confidential information—without modifying or crashing the system. The vulnerability requires user interaction (visiting the malicious page) but does not require special privileges to exploit.

• CVE-2026-10912MEDIUM 6.5

  A flaw in Google Chrome's extension handling allows an attacker who has already compromised the renderer process to bypass the browser's same-origin policy—a core security boundary that prevents JavaScript from one website accessing data from another. An attacker would need to trick a user into visiting a specially crafted webpage to exploit this. The vulnerability affects Chrome versions prior to 149.0.7827.53 across Windows, macOS, and Linux.

• CVE-2026-11006MEDIUM 6.5

  A memory safety flaw in Google Chrome's Dawn graphics component (used for GPU rendering) allows attackers to read sensitive data from a user's memory by tricking them into visiting a specially crafted webpage. The vulnerability does not enable code execution or system crashes, but confidentiality is at risk. Chrome versions prior to 149.0.7827.53 are affected.

• CVE-2026-11008MEDIUM 6.5

  A flaw in Google Chrome's web app installation feature fails to properly validate user input, allowing an attacker who has already compromised Chrome's renderer process to extract sensitive data from other websites through a malicious webpage. The attacker would need to trick a user into visiting a crafted HTML page, but once the renderer is compromised, the vulnerability creates a pathway to leak cross-origin information that should remain isolated.

• CVE-2026-11013MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser validates user-supplied input within its networking code. An attacker who has already compromised Chrome's renderer process—the sandboxed component that executes web content—can craft a malicious HTML page to leak sensitive data from the renderer's memory. This is a post-compromise attack vector; the attacker must first gain code execution in the renderer sandbox, but once there, they can extract information that should remain private.

• CVE-2026-11014MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a vulnerability where insufficient policy enforcement in the extension system allows a malicious extension to circumvent Site Isolation—Chrome's security boundary that prevents one website from accessing another's data. An attacker must first convince a user to install the malicious extension, but once installed, the extension can read or modify data across websites that the user visits, potentially exposing sensitive information.

• CVE-2026-11016MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw where insufficient validation of network input allows a remote attacker who has already compromised the browser's renderer process to bypass the same-origin policy. An attacker could craft a malicious HTML page to force the compromised renderer to access resources or data from a different origin, violating the security boundary that normally prevents cross-origin access. This requires initial renderer process compromise—the attacker cannot trigger the vulnerability from an unauthenticated network position alone.

• CVE-2026-11017MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the Link Preview feature handles navigation restrictions. If an attacker first compromises Chrome's renderer process—the component that displays web content—they can craft a malicious HTML page to bypass restrictions that normally prevent unauthorized navigation. The vulnerability requires prior renderer compromise, limiting its immediate attack surface, but it does allow an attacker with that foothold to navigate to restricted locations without proper authorization.

• CVE-2026-11018MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser enforces navigation policies. An attacker can craft a malicious HTML page that, when visited, tricks Chrome into allowing navigation to restricted destinations that should normally be blocked. The vulnerability requires user interaction—a person must visit the hostile page—but no special privileges are needed on the attacker's side. The core risk is integrity: an attacker can redirect you to unwanted sites, potentially enabling phishing, malware distribution, or social engineering attacks.

• CVE-2026-11020MEDIUM 6.5

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in how the browser handles extensions that process XML files. An attacker can craft a malicious XML file that, when processed by a vulnerable extension, leaks sensitive data from other websites the user has visited. The vulnerability requires user interaction—specifically, the user must open or interact with the malicious file—but does not require the attacker to have special privileges or bypass additional security controls. This is a cross-origin data leak, meaning information intended to be isolated between websites can be extracted by an attacker.

• CVE-2026-11022MEDIUM 6.5

  CVE-2026-11022 is a same-origin policy bypass vulnerability in Google Chrome's DevTools that requires an attacker to have already compromised the renderer process. An attacker could then use a specially crafted HTML page to escape origin restrictions, potentially accessing or modifying data from other websites in the same browser session. This is not a remote code execution vector but rather a privilege escalation within an already-compromised rendering context.

• CVE-2026-11023MEDIUM 6.5

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in how the browser handles web app installation that allows an attacker who has already compromised the browser's renderer process to bypass the same-origin policy. This means a specially crafted web page could be used to access or modify content from other websites in ways the browser is supposed to prevent. The attacker needs prior renderer compromise, limiting the immediate threat to users, but the bypass itself is reliable once that initial foothold exists.

• CVE-2026-11026MEDIUM 6.5

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in how extensions are handled that allows an attacker to bypass built-in navigation restrictions. The vulnerability requires social engineering—an attacker must trick a user into installing a malicious Chrome extension. Once installed, the extension can circumvent the browser's navigation safeguards, potentially redirecting users to unintended destinations or enabling other attack chains. This is classified as a Medium severity issue by Chromium's security team.

• CVE-2026-11027MEDIUM 6.5

  A vulnerability in Google Chrome's Glic component fails to properly validate untrusted input, allowing an attacker who has already compromised Chrome's renderer process to extract sensitive data across website boundaries using a specially crafted webpage. The attacker needs initial renderer process compromise but then gains the ability to read data from sites the user visits, bypassing normal browser security boundaries.

• CVE-2026-11032MEDIUM 6.5

  Google Chrome's Password Manager contained a flaw that could allow an attacker to trick users into visiting a malicious webpage and leak sensitive data from other websites the user visits. The vulnerability requires user interaction—visiting a crafted HTML page—but once triggered, could expose cross-origin information that should remain isolated between websites. This affects Chrome on Windows, macOS, and Linux systems.

• CVE-2026-11036MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a DOM implementation flaw that allows attackers to circumvent the same-origin policy—a fundamental browser security boundary. An attacker could craft a malicious HTML page that, when visited, tricks the browser into allowing cross-origin requests or data access that should normally be blocked. This requires user interaction (clicking a link, visiting a site) but does not require any special privileges. While the attack does not expose sensitive data directly, it enables unauthorized modification of web content or session state, potentially leading to account compromise or malware injection.

• CVE-2026-11038MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how Subresource Integrity (SRI) policies are enforced, allowing attackers to bypass Content Security Policy (CSP) protections through crafted network traffic. An attacker would need to trick a user into visiting a malicious webpage to exploit this vulnerability. The issue is classified as medium severity because it enables content injection attacks but does not directly compromise confidentiality or system availability.

• CVE-2026-11039MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in Skia (the graphics rendering engine) that could allow an attacker to trick users into visiting a malicious webpage and leak sensitive data from other websites the user has open. The vulnerability requires user interaction—clicking or visiting a link—but does not require any special system privileges. Once triggered, an attacker could read private information from cross-origin sources, such as data from other tabs or windows.

• CVE-2026-11045MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in GPU input validation that can leak sensitive data from memory. An attacker who has already compromised Chrome's renderer process can craft a malicious HTML page to read protected information. This is a stepping-stone attack—it requires prior renderer compromise but can extract valuable secrets afterward.

• CVE-2026-11048MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a vulnerability in how extensions are handled that could allow a malicious extension to bypass the same-origin policy—a core browser security feature that prevents websites from accessing data across different origins. An attacker would need to trick a user into installing a malicious extension, but once installed, the extension could potentially access or modify content on websites that it shouldn't normally be able to reach. This is a medium-severity issue that affects Chrome on Windows, macOS, and Linux.

• CVE-2026-11051MEDIUM 6.5

  A memory reading flaw exists in the ANGLE graphics component of Google Chrome on Linux systems prior to version 149.0.7827.53. An attacker can craft a malicious webpage that, when visited, reads data from Chrome's process memory—potentially exposing sensitive information like credentials, cryptographic keys, or other in-memory secrets. The vulnerability requires user interaction (clicking or viewing a link) but does not allow the attacker to modify data or crash the browser.

• CVE-2026-11057MEDIUM 6.5

  A flaw in the Skia graphics library used by Chrome allows attackers who have already compromised a browser's rendering engine to read sensitive data from memory by sending a specially crafted web page. The vulnerability requires two conditions: the attacker must first gain control of the renderer process (typically through a separate vulnerability), and the user must visit the malicious page. Once both are true, uninitialized memory regions become readable, potentially exposing passwords, tokens, or other sensitive information that happen to be in RAM.

• CVE-2026-11067MEDIUM 6.5

  Google Chrome versions prior to 149.0.7827.53 contain a memory safety vulnerability in the Dawn graphics component that allows attackers to steal sensitive data from browser process memory. An attacker crafts a malicious webpage that, when visited, exploits the uninitialized memory access to leak information that could include cached passwords, session tokens, or other private data. The attack requires user interaction (visiting the page) but works across networks without special privileges.

• CVE-2026-11069MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the Cast feature validates user input, allowing an attacker to craft a malicious HTML page that bypasses the browser's same-origin policy. If a user visits the attacker's page, it could potentially access or modify data from other websites the user is logged into, though without stealing that data directly. This is a moderate-severity issue affecting Windows, macOS, and Linux users.

• CVE-2026-11073MEDIUM 6.5

  A use-after-free vulnerability exists in Google Chrome's WebGL rendering engine that could allow an attacker to steal sensitive data from your browser's memory. An attacker would need to trick you into visiting a malicious webpage to exploit this flaw. While the vulnerability requires user interaction to trigger, the potential exposure of process memory—which may contain cached passwords, authentication tokens, or other sensitive information—makes it a meaningful security concern. The issue affects Chrome versions prior to 149.0.7827.53.

• CVE-2026-11075MEDIUM 6.5

  A flaw in Google Chrome's V8 JavaScript engine allows an attacker to read sensitive data from a browser process's memory by tricking a user into visiting a malicious webpage. The vulnerability exists in Chrome versions before 149.0.7827.53 and requires no special privileges to exploit—only user interaction to visit a crafted page. While the attacker cannot modify data or crash the browser, they can potentially extract confidential information like passwords, session tokens, or other data resident in memory.

• CVE-2026-11078MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser's FileSystem implementation validates cross-origin requests. If an attacker compromises Chrome's renderer process—the sandboxed component that executes web content—they can craft a malicious HTML page to bypass the same-origin policy, a foundational browser security mechanism that prevents one website from accessing data or resources belonging to another. The vulnerability requires the renderer to already be compromised, meaning an attacker would need to have successfully exploited a prior vulnerability to reach this point, making it a secondary but meaningful risk in a multi-stage attack chain.

• CVE-2026-11081MEDIUM 6.5

  A flaw in how Google Chrome handles Canvas operations before version 149.0.7827.53 allows attackers to circumvent browser same-origin policy protections. An attacker can craft a malicious HTML page that, when visited by a user, breaks the security boundary that normally prevents one website from accessing data or resources belonging to another. The attack requires user interaction (visiting the page) but no special browser configuration.

• CVE-2026-11083MEDIUM 6.5

  Google Chrome's password manager contained a flaw that could allow an attacker to trick users into leaking sensitive cross-origin data through a specially crafted webpage. The vulnerability requires user interaction—such as visiting a malicious site—but poses a meaningful risk because password managers are trusted to protect sensitive credentials and related information. An attacker exploiting this could potentially access data that should remain isolated between different websites.

• CVE-2026-11084MEDIUM 6.5

  A flaw in Google Chrome's password manager allows attackers to trick users into visiting a specially crafted website that can leak sensitive data from other websites the user has visited. The vulnerability requires user interaction—specifically, the victim must click on or interact with a malicious page—but once triggered, it can expose cross-site information that should normally be protected by browser security boundaries. This affects Chrome versions before 149.0.7827.53 on Windows, macOS, and Linux systems.

• CVE-2026-11087MEDIUM 6.5

  A memory safety issue in Google Chrome's ANGLE graphics library allows an attacker who has already compromised the renderer process to steal sensitive data from other websites. The vulnerability requires user interaction (visiting a malicious web page) and affects Chrome on Windows, macOS, and Linux. The attacker gains read-only access to cross-origin data, meaning they cannot modify it or crash the browser, but confidentiality is at risk.

• CVE-2026-11089MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a memory disclosure vulnerability in its media handling code. If an attacker gains control of Chrome's renderer process—the component responsible for displaying web content—they can craft a malicious HTML page to read uninitialized data from memory, potentially exposing sensitive information like passwords, encryption keys, or other confidential data. The vulnerability requires a prior compromise of the renderer, meaning it's typically chained with another exploit to be effective in the wild.

• CVE-2026-11090MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in the ANGLE graphics library that can be exploited to leak data across website boundaries. An attacker could craft a malicious webpage that, when visited, causes Chrome to inadvertently expose sensitive information from other origins a user has open. This requires user interaction (visiting the malicious page) but does not require special privileges. The vulnerability affects Windows, macOS, and Linux systems running vulnerable Chrome versions.

• CVE-2026-11093MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser handles printing functionality that could allow an attacker who has already compromised Chrome's rendering engine to steal sensitive data from websites the user visits. The attacker would need to trick the user into visiting a malicious webpage after gaining control of the renderer process. This is a medium-severity issue because it requires an intermediate compromise and user interaction, but the potential for cross-origin data leakage makes it worth prompt attention.

• CVE-2026-11096MEDIUM 6.5

  A memory reading flaw in Chrome's WebRTC component allows attackers to trick users into visiting a malicious webpage that steals sensitive data from the browser's memory. The vulnerability requires user interaction (clicking a link or visiting a site) but needs no special privileges, making it a practical attack vector for information theft. Google patched this in Chrome version 149.0.7827.53 and later.

• CVE-2026-11104MEDIUM 6.5

  CVE-2026-11104 is a memory information disclosure flaw in ANGLE, a graphics abstraction library used by Google Chrome. An attacker who has already compromised Chrome's renderer process can craft a malicious HTML page to read uninitialized memory and leak sensitive data. This is not a trivial attack—it requires the renderer to be compromised first—but once that foothold exists, the vulnerability can amplify the damage by exposing additional secrets from the browser process. Chrome versions before 149.0.7827.53 are vulnerable.

• CVE-2026-11105MEDIUM 6.5

  A flaw in Google Chrome's WebUI component fails to properly validate user-supplied input, allowing an attacker who has already compromised Chrome's renderer process to trick the browser into leaking sensitive data from other websites. The vulnerability requires the renderer to be compromised first, which significantly limits the attack surface. Chrome versions before 149.0.7827.53 are affected.

• CVE-2026-11106MEDIUM 6.5

  A flaw in Google Chrome's media handling allows attackers to trick users into visiting a malicious web page that can steal private data from other websites the user has visited. The vulnerability requires user interaction—someone must click a link or visit the crafted page—but once they do, an attacker can bypass Chrome's normal security boundaries that keep websites isolated from each other. This affects Chrome on Windows, macOS, and Linux systems.

• CVE-2026-11109MEDIUM 6.5

  A vulnerability in the ANGLE graphics library used by Google Chrome can leak sensitive data from websites you're viewing to an attacker. An attacker would need to trick you into visiting a specially crafted webpage, but requires no special browser extensions or user interaction beyond visiting the page. The vulnerability affects Chrome versions prior to 149.0.7827.53 on Windows, macOS, and Linux systems.

• CVE-2026-11110MEDIUM 6.5

  A flaw in Google Chrome's graphics rendering engine (ANGLE) can leak sensitive data from websites you visit to attackers. The vulnerability exists in Chrome versions before 149.0.7827.53 and requires a user to click on or interact with a malicious webpage. When exploited, it exposes confidential information that should remain isolated between different websites.

• CVE-2026-11121MEDIUM 6.5

  CVE-2026-11121 is a medium-severity vulnerability in Skia, the graphics rendering engine used by Google Chrome. The flaw involves improper validation of untrusted input that could allow an attacker who has already compromised the browser's renderer process to extract sensitive data across origin boundaries using a specially crafted web page. This is not an initial entry point into systems, but rather a post-compromise escalation vector that broadens the damage an attacker can do once inside the browser process.

• CVE-2026-11123MEDIUM 6.5

  A flaw in ANGLE (the graphics abstraction layer used by Google Chrome) allows attackers to trick users into visiting a malicious website that reads sensitive information directly from Chrome's memory. The vulnerability was patched in Chrome version 149.0.7827.53. Because it requires user interaction (clicking a link or visiting a page), it's less critical than remotely exploitable flaws, but the memory disclosure risk—potentially exposing authentication tokens, cached data, or other secrets—warrants prompt patching.

• CVE-2026-11128MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in the Web Share feature that allows attackers to steal data from other websites. The vulnerability requires tricking a user into clicking or interacting with elements on a malicious webpage. Once triggered, an attacker can access information from cross-origin sources—essentially reading data they shouldn't have access to. This is a client-side issue affecting individual users rather than servers, and the bar for exploitation is user interaction on a crafted page.

• CVE-2026-11129MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser handles extensions that could allow an attacker to steal sensitive data from websites you visit. An attacker would need to trick you into visiting a malicious webpage, but if successful, they could read information from other sites you have open—potentially including login credentials, private messages, or financial data. This is a medium-severity issue that affects Chrome on Windows, macOS, and Linux.

• CVE-2026-11132MEDIUM 6.5

  A flaw in Chrome's Paint component allows attackers to bypass the same-origin policy—a fundamental browser security boundary—by tricking users into visiting a malicious webpage. The vulnerability affects Chrome versions before 149.0.7827.53. While an attacker cannot steal data directly through this weakness, they can modify or inject content in ways the browser should have blocked, potentially enabling follow-up attacks that compromise user sessions or inject malware. The flaw requires user interaction (visiting a crafted page) but is otherwise straightforward to exploit.

• CVE-2026-11133MEDIUM 6.5

  A vulnerability in Google Chrome's Paint feature allows attackers to bypass the same-origin policy—a critical browser security boundary—through a specially crafted web page. An attacker could trick a user into visiting a malicious site and potentially access or modify content from another origin without permission. The vulnerability requires user interaction (clicking a link or visiting a page) but does not require special privileges. Chrome versions before 149.0.7827.53 are affected.

• CVE-2026-11134MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the Media component handles certain HTML content. An attacker can craft a malicious webpage that, when visited by a user, leaks sensitive data that should be restricted to one website (cross-origin data) to an attacker-controlled site. The vulnerability requires user interaction—the victim must visit the crafted page—but no special browser configuration or user privileges are needed. This is a confidentiality risk, not a data destruction or service disruption issue.

• CVE-2026-11135MEDIUM 6.5

  Google Chrome's Autofill feature fails to properly enforce security policies, allowing attackers to trick users into bypassing security controls through specially crafted web pages. An attacker cannot steal data directly, but can manipulate what gets filled into form fields—potentially leading users to submit sensitive information to the wrong destination or trigger unintended actions. The vulnerability requires user interaction (clicking or interacting with the page) and affects Chrome versions before 149.0.7827.53.

• CVE-2026-11137MEDIUM 6.5

  CVE-2026-11137 is a memory disclosure vulnerability in ANGLE, the graphics abstraction layer used by Google Chrome. A remote attacker can trick a user into visiting a specially crafted webpage that reads uninitialized memory from the Chrome process, potentially exposing sensitive data like passwords, tokens, or other information temporarily stored in RAM. The attack requires user interaction (clicking a link or visiting a malicious site) but no special privileges. This affects Chrome versions prior to 149.0.7827.53 across Windows, macOS, and Linux.

• CVE-2026-11138MEDIUM 6.5

  A memory initialization flaw in Google Chrome's ANGLE graphics component allows attackers to expose sensitive data across different websites when users visit a malicious webpage. An attacker would need to craft a specially designed HTML page and trick a user into viewing it; the vulnerability itself requires no special browser configuration and affects all major operating systems where Chrome runs.

• CVE-2026-11139MEDIUM 6.5

  A flaw in Google Chrome's Paint implementation allows attackers to steal sensitive information from one website and expose it to another. An attacker can craft a specially designed web page that, when visited by a user, exploits this vulnerability to read data across security boundaries that browsers normally enforce. The vulnerability affects Chrome versions before 149.0.7827.53 and requires user interaction—the victim must visit the malicious page—but does not require special permissions or system access.

• CVE-2026-11140MEDIUM 6.5

  A memory reading vulnerability in Google Chrome's Chromecast feature allows an attacker who has already compromised the browser's renderer process to steal sensitive data from the browser's memory by serving a specially crafted web page. The vulnerability requires the attacker to have control of the renderer—the component that displays websites—but once achieved, they can extract information without needing special privileges or modifying the page's normal function.

• CVE-2026-11141MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in the audio subsystem that can leak sensitive data from memory. An attacker who has already compromised the renderer process—the component that executes web content—can craft a malicious HTML page to read uninitialized memory and extract potentially confidential information. This requires an existing foothold in the renderer, making it a secondary-stage exploitation technique rather than a direct entry vector.

• CVE-2026-11142MEDIUM 6.5

  A flaw in Google Chrome's Paint feature prior to version 149.0.7827.53 allows attackers to bypass the browser's same-origin policy through a maliciously crafted webpage. An attacker could trick a user into visiting their page and potentially access or manipulate content that should be isolated from other websites. The vulnerability requires user interaction but poses a meaningful integrity risk to web security boundaries.

• CVE-2026-11143MEDIUM 6.5

  Google Chrome on Linux contains an out-of-bounds memory read vulnerability affecting versions prior to 149.0.7827.53. The flaw resides in Chrome's extension handling mechanism and allows a malicious extension—installed by a user—to read sensitive data directly from the browser's process memory. An attacker would need to trick a user into installing the malicious extension, but once installed, the extension can harvest information like passwords, session tokens, or other in-memory secrets without triggering additional user interaction.

• CVE-2026-11160MEDIUM 6.5

  Google Chrome on Linux versions before 149.0.7827.53 contains a memory reading flaw in its input handling. An attacker can trick a user into visiting a specially crafted webpage, causing Chrome to leak sensitive data from the browser process's memory—such as cached passwords, session tokens, or other confidential information. The vulnerability requires user interaction (clicking a link or visiting a site) but no special privileges, and affects only Linux systems.

• CVE-2026-11168MEDIUM 6.5

  A vulnerability in Google Chrome's extension system allows an attacker who has already compromised the browser's renderer process to extract sensitive data from memory using a specially crafted webpage. The vulnerability requires the attacker to have control over the renderer process first, which limits the immediate attack surface but poses significant risk if combined with other exploits. The issue stems from improper implementation in how extensions interact with the rendering engine.

• CVE-2026-11176MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser handles media content that could allow an attacker to trick a user into visiting a malicious webpage and steal sensitive data from other websites the user is logged into. The attacker cannot exploit this remotely without user interaction—the victim must visit the crafted page—but once there, the browser's media handling could be bypassed to reveal cross-origin information that should remain private.

• CVE-2026-11180MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how SVG (Scalable Vector Graphics) content is handled that could allow an attacker to steal data from other websites. An attacker would need to trick a user into visiting a malicious webpage, but does not require any special browser plugins or user permissions beyond normal browsing. The vulnerability affects Chrome on Windows, macOS, and Linux.

• CVE-2026-11182MEDIUM 6.5

  Google Chrome contains a vulnerability in how it processes SVG (Scalable Vector Graphics) content that could allow an attacker to steal sensitive data from websites you visit. An attacker would need to trick you into visiting a malicious webpage, but if successful, they could potentially read information that should be protected between different websites—such as authentication tokens, account details, or other private data. The vulnerability affects Chrome versions before 149.0.7827.53.

• CVE-2026-11183MEDIUM 6.5

  CVE-2026-11183 is a memory safety vulnerability in Google Chrome's GWP-ASan security feature that allows an attacker with local access to read sensitive data from the browser's memory by tricking a user into opening a malicious file. While the flaw requires user interaction and doesn't allow remote code execution, it can expose confidential information such as cached credentials, session tokens, or other sensitive data held in process memory.

• CVE-2026-11189MEDIUM 6.5

  A flaw in Google Chrome's developer tools allowed attackers to bypass navigation restrictions through malicious browser extensions. If a user installed a crafted extension, an attacker could manipulate Chrome's navigation controls to reach restricted pages or resources. The vulnerability requires user action—specifically, convincing someone to install the malicious extension—but once installed, no additional user interaction is needed for the bypass itself.

• CVE-2026-11190MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how it handles browser extensions. An attacker could create a malicious extension that, if installed by a user, bypasses Chrome's access control protections. This means the extension could perform actions it should not be permitted to do—such as accessing restricted resources or modifying system behavior—without proper authorization checks. The attack requires user action to install the extension, but once installed, the damage is contained to what the extension itself can access rather than affecting the entire system.

• CVE-2026-11193MEDIUM 6.5

  Google Chrome's Password Manager contained a flaw that failed to properly enforce access controls, allowing an attacker to bypass security restrictions through a malicious webpage. An attacker could craft a specially designed HTML page that, when visited by a user, circumvents the protections meant to prevent unauthorized access to password management features. This requires user interaction—the victim must visit the attacker's page—but no special privileges are needed on the attacker's side. The vulnerability does not lead to data theft or system crashes, but rather prevents the password manager from properly enforcing who can access its functions.

• CVE-2026-11194MEDIUM 6.5

  A vulnerability in Google Chrome's network implementation could allow an attacker to trick users into visiting a specially crafted webpage that leaks sensitive data from other websites the user is logged into. The attack requires user interaction (clicking or visiting the malicious page) but does not require special browser configuration or user privileges. While the confidentiality impact is high, the vulnerability does not allow attackers to modify data or disable services.

• CVE-2026-11195MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser handles MHTML (MIME Encapsulation of Aggregate HTML Documents) content. An attacker can craft a malicious web page that, when visited by a user who performs specific interactions with the page (such as clicking or other UI gestures), leaks sensitive data from websites the user has visited in other browser tabs or windows. The vulnerability requires user interaction to trigger and does not allow attackers to modify data or crash the browser, but it does enable unauthorized access to cross-origin information that should remain private.

• CVE-2026-11196MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a type confusion bug in XML processing that allows an attacker to craft a malicious XML file. When a user opens this file in Chrome, the vulnerability can leak sensitive data from the browser's memory without requiring special user permissions or network-level access. The flaw affects Windows, macOS, and Linux users. While the attack requires user interaction (opening a file), the potential exposure of process memory makes this a notable security concern for organizations where users handle untrusted documents.

• CVE-2026-11197MEDIUM 6.5

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in how Worker threads enforce same-origin policy. An attacker who has already compromised your browser's rendering engine can craft a malicious webpage to trick the Worker into allowing cross-origin requests it should block. This is a post-compromise scenario—the attacker must first gain control of the renderer process—but once inside, they can escalate their privileges by accessing data from other websites.

• CVE-2026-11200MEDIUM 6.5

  A flaw in Google Chrome's WebRTC implementation allows attackers to steal private data from other websites through a malicious HTML page. An attacker would need to trick a user into visiting their crafted webpage while Chrome is running, but no special technical privileges are required. The vulnerability affects Chrome versions before 149.0.7827.53 across Windows, macOS, and Linux.

• CVE-2026-11206MEDIUM 6.5

  A vulnerability in Google Chrome's Service Worker implementation allows attackers to access sensitive data from websites you visit, even data that should be restricted to specific origins. An attacker can craft a malicious web page that, when visited, exploits insufficient policy checks to leak cross-origin information. This requires user interaction—you must visit the attacker's page—but once there, the browser's protections are bypassed without additional warnings or user awareness.

• CVE-2026-11208MEDIUM 6.5

  A use-after-free vulnerability exists in the codec handling components of Google Chrome versions prior to 149.0.7827.53. An attacker can craft a malicious HTML page that, when visited by a user, exploits this memory safety flaw to read sensitive data directly from the browser process's memory. The vulnerability requires user interaction (visiting a malicious site) but does not require any special privileges to exploit.

• CVE-2026-11209MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how it handles password data that could allow an attacker who has already compromised Chrome's renderer process to read sensitive information from memory using a specially crafted webpage. The vulnerability requires that the attacker first gain control of the renderer process—a significant precondition—but once achieved, could expose data stored in process memory without modifying or disabling system functions.

• CVE-2026-11210MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in Safe Browsing that allows attackers to bypass access controls when a user opens a specially crafted RAR archive file. An attacker would need to trick a user into opening a malicious RAR file, but once they do, the browser's safety mechanisms fail to properly restrict what the file can access. This is a moderate-severity issue that affects Chrome on Windows, macOS, and Linux.

• CVE-2026-11217MEDIUM 6.5

  CVE-2026-11217 is a medium-severity flaw in Google Chrome's Fenced Frames feature that could allow an attacker who has already compromised a renderer process to circumvent Chrome's site isolation security boundary. Site isolation is a core defense that prevents malicious websites from accessing data from other sites in your browser. A remote attacker would need to trick a user into visiting a specially crafted webpage while the renderer has already been compromised, creating a two-stage attack scenario. Google has rated this as low severity on the Chromium scale, though the CVSS score reflects the integrity impact of bypassing site isolation.

• CVE-2026-11220MEDIUM 6.5

  A flaw in Google Chrome's navigation handling prior to version 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to bypass the browser's site isolation protection using a specially crafted HTML page. Site isolation is a critical Chrome security boundary designed to prevent malicious websites from accessing data from other sites. This vulnerability requires the attacker to have already gained code execution in the renderer process, making it a secondary or chained attack rather than a direct entry point.

• CVE-2026-11222MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser's tab strip displays security information to users. An attacker can craft a malicious webpage that tricks the browser's security UI, making it appear as though the user is visiting a legitimate website when they are actually on a attacker-controlled domain. This is a user-interface spoofing vulnerability that relies on tricking the visual indicators users depend on to verify they're on the correct website.

• CVE-2026-11223MEDIUM 6.5

  A vulnerability in Google Chrome allows an attacker who has already compromised the browser's renderer process to bypass the same-origin policy—a fundamental security boundary that prevents malicious websites from accessing data belonging to other sites. The attacker would craft a specially designed HTML page to exploit insufficient input validation in Chrome's network handling. This requires the renderer process to be compromised first, making it a secondary attack that compounds an existing breach rather than a standalone entry point.

• CVE-2026-11225MEDIUM 6.5

  Google Chrome before version 149.0.7827.53 contains a flaw that allows attackers to perform domain spoofing—making a malicious website appear to come from a trusted domain. An attacker would need to trick a user into visiting a crafted link, but once clicked, the browser's address bar or other visual indicators could misrepresent the true origin of the site. This affects Chrome on Windows, macOS, and Linux.

• CVE-2026-11227MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how it displays security information in tab hover cards—the small popup that appears when you hover over a browser tab. An attacker can craft a deceptive domain name that, when displayed in this hover card, makes it appear to be a legitimate website you trust. This is a domain spoofing attack: the user sees what looks like one domain but is actually visiting a different one. The vulnerability requires user interaction (hovering over the tab and being deceived) but could help an attacker trick users into thinking they're on a safe site when they're not.

• CVE-2026-11258MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser handles file system access permissions. An attacker can craft a malicious webpage that, when visited, tricks users into performing specific clicks or gestures that bypass the browser's normal access controls. This allows the attacker to gain unauthorized access to files on the user's computer that would normally be protected. The vulnerability requires user interaction and social engineering to exploit, but once triggered, could expose sensitive files.

• CVE-2026-11271MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in password handling that could allow an attacker to trick users into revealing data from other websites. The vulnerability requires the attacker to craft a malicious webpage and convince the user to interact with it in a specific way—there is no automatic exploitation. The risk is confined to information disclosure; attackers cannot modify data or disrupt service. While the underlying Chromium project rates this as low severity, the CVSS score reflects the relatively low barrier to user interaction and the potential for cross-origin data leakage.

• CVE-2026-11284MEDIUM 6.5

  Google Chrome versions prior to 149.0.7827.53 contain a side-channel vulnerability in the Performance APIs that allows an attacker to extract sensitive data across website boundaries. An attacker can craft a malicious webpage that, when visited by a user, leaks information from other websites the user is viewing or has visited. This works because certain performance measurement features can infer timing details that reveal cross-origin data, even though browsers are designed to isolate websites from each other.

• CVE-2026-11288MEDIUM 6.5

  A vulnerability in Google Chrome's CSS handling allows an attacker to leak data from websites you visit to a different origin through a malicious webpage. The flaw stems from insufficient enforcement of browser security policies that normally prevent one website from accessing information from another. An attacker would need to trick you into visiting their crafted page while you're logged into or actively using other sites, but no special browser configuration or advanced user interaction is required beyond a standard click. This is a medium-severity issue affecting multiple operating systems through Chrome.

• CVE-2026-11289MEDIUM 6.5

  A side-channel vulnerability in Google Chrome's Paint component allows attackers to leak sensitive cross-origin data through a specially crafted web page. An attacker would need to trick a user into visiting a malicious website, but once there, the vulnerability could expose information from other websites the user has open—a serious privacy breach. The issue affects Chrome versions before 149.0.7827.53 across Windows, macOS, and Linux.