By vendor

Microsoft vulnerabilities

Known CVEs affecting Microsoft products, prioritized by severity, with SEC.co remediation and detection guidance.

899 published vulnerabilities · page 6 of 9

• CVE-2026-58276HIGH 7.5

  A use-after-free vulnerability in Microsoft Edge (Chromium-based) allows an attacker to execute arbitrary code on a user's system by sending a specially crafted network message. The attack requires user interaction—such as visiting a malicious webpage or opening a crafted link—but does not require the attacker to be authenticated or have prior access to the system. Successful exploitation could give an attacker full control over the affected browser process and potentially the underlying machine.

• CVE-2026-58290HIGH 7.5

  A type confusion vulnerability in Microsoft Edge (Chromium-based) allows attackers to execute arbitrary code on a victim's system through network-based exploitation. The flaw arises from improper handling of incompatible data types in memory, which an attacker can abuse to overwrite code regions or manipulate execution flow. Successful exploitation requires user interaction—typically opening a malicious webpage—but once triggered, grants the attacker the same privileges as the logged-in user.

• CVE-2026-58292HIGH 7.5

  Microsoft Edge (Chromium-based) contains a flaw that fails to properly validate user input, allowing attackers to execute code on affected systems over the network. An attacker would typically need to trick a user into visiting a malicious webpage or interacting with crafted content, but once successful, the attacker gains the ability to run arbitrary code with the privileges of the Edge browser process.

• CVE-2026-58294HIGH 7.5

  Microsoft Edge (Chromium-based) contains a use-after-free memory safety defect that allows an attacker to execute arbitrary code on a user's system through the network. The vulnerability requires user interaction (such as visiting a malicious webpage) and relies on moderately complex attack conditions, but successful exploitation grants full system compromise. This is a memory corruption issue where freed memory is accessed improperly, a common source of serious security defects in browser engines.

• CVE-2026-58299HIGH 7.5

  Microsoft Edge for Android contains a race condition vulnerability that could allow an attacker to execute arbitrary code on a user's device through a network-based attack. The flaw exists in a time-of-check time-of-use (TOCTOU) scenario, where the application checks a security condition at one point but the actual use of that resource happens slightly later—giving an attacker a window to manipulate the state between those two moments. Successful exploitation requires user interaction and specific timing, but when achieved, grants the attacker the ability to run code with the privileges of the Edge browser process.

• CVE-2026-9071HIGH 7.5

  IBM WebSphere Application Server versions 9.0, 8.5, and Liberty versions 17.0.0.3 through 26.0.0.6 contain a vulnerability that allows remote attackers to crash or severely degrade server performance by sending specially crafted requests. The vulnerability causes the affected server to consume excessive memory, leading to denial of service. No authentication is required to exploit this issue, and attackers can trigger it over the network.

• CVE-2026-9901HIGH 7.5

  A use-after-free flaw in ANGLE (the graphics abstraction layer used by Chrome) allows an attacker to run malicious code on a target's machine. The attack requires two conditions: the attacker must first compromise Chrome's renderer process (the component that draws web content), and the victim must then visit a specially crafted web page. Once both conditions are met, arbitrary code can execute with the privileges of the compromised renderer process. This affects Chrome versions before 148.0.7778.216.

• CVE-2026-9909HIGH 7.5

  A flaw in Skia, the graphics rendering library used by Google Chrome, can be exploited by an attacker who has already compromised Chrome's sandboxed renderer process. The vulnerability stems from improper handling of integer values, which an attacker could leverage to execute arbitrary code within the sandbox by serving a specially crafted HTML page. While the vulnerability requires prior compromise of the renderer process, it represents a critical step in a potential attack chain that could lead to full browser compromise.

• CVE-2026-9933HIGH 7.5

  CVE-2026-9933 is a use-after-free memory vulnerability in Google Chrome's input handling code that allows attackers to corrupt heap memory on affected systems. Exploitation requires an attacker to trick a user into performing specific UI interactions (such as unusual mouse or keyboard gestures) while viewing a specially crafted HTML page. This is not a passive drive-by attack; active user participation is required. If successfully exploited, an attacker could execute arbitrary code with the privileges of the Chrome process, leading to complete compromise of the affected user's system.

• CVE-2026-9954HIGH 7.5

  A use-after-free vulnerability exists in Google Chrome's TabStrip component that can lead to memory corruption. An attacker must trick a user into performing specific UI interactions (like clicking or dragging tabs in a particular sequence) on a malicious website to potentially trigger the flaw. Successful exploitation could allow the attacker to read sensitive data, modify page content, or crash the browser. The vulnerability affects Chrome versions prior to 148.0.7778.216 across Windows, macOS, and Linux.

• CVE-2026-9960HIGH 7.5

  A flaw in PDFium, the PDF rendering library used by Google Chrome, allows an attacker who has already compromised Chrome's renderer process to break out of the sandbox and run arbitrary code with elevated privileges by supplying a specially crafted font file. This represents a significant post-compromise risk for users who may have already been exposed to initial malware or browser exploits.

• CVE-2026-10968HIGH 7.4

  A vulnerability in Chrome's graphics rendering engine (Dawn) on Windows allows attackers to steal sensitive data from websites you're visiting. If an attacker first compromises Chrome's renderer process—the part that runs web content—they can craft a malicious webpage to leak information across website boundaries, bypassing Chrome's security isolation. This requires the attacker to have already gained control of the renderer, making it part of a multi-stage attack but with serious data-theft consequences once achieved.

• CVE-2026-57991HIGH 7.4

  Microsoft Edge (Chromium-based) contains a flaw in how it resolves symbolic links and shortcuts before accessing files. An attacker can craft a malicious link that, when clicked by a user, causes Edge to follow the link to an unintended location and disclose sensitive information over the network. The vulnerability requires user interaction (clicking the link) but does not require authentication and can affect systems across a network.

• CVE-2026-57993HIGH 7.4

  Microsoft Edge (Chromium-based) contains a server-side request forgery vulnerability that allows an attacker to trick the browser into making unauthorized network requests on behalf of the victim. An attacker can craft a malicious webpage that, when visited by an Edge user, causes Edge to access internal or restricted resources or spoof requests to third-party services. The attack requires user interaction (clicking a link or visiting a page) but can expose sensitive data or facilitate further attacks against internal systems or other users.

• CVE-2026-8646HIGH 7.4

  IBM WebSphere Application Server versions 9.0, 8.5, and Liberty versions 17.0.0.3 through 26.0.0.6 contain a flaw that allows attackers to craft malicious HTTP requests that bypass normal request processing. These smuggled requests can circumvent security controls, impersonate legitimate users, gain elevated privileges, and access sensitive data. The vulnerability requires specific conditions to exploit but poses significant risk to organizations relying on these servers.

• CVE-2026-9006HIGH 7.4

  IBM WebSphere Application Server versions 8.5 and 9.0 contain a server-side request forgery (SSRF) flaw when the Ajax Proxy feature is enabled. An attacker can exploit this to make unauthorized requests from the vulnerable server, potentially accessing internal resources, bypassing security controls, or extracting sensitive information. The vulnerability requires specific network conditions but does not require user interaction or authentication.

• CVE-2026-10845HIGH 7.3

  IBM WebSphere Application Server versions 8.5 and 9.0 contain an authentication bypass vulnerability in their JAX-WS (Java API for XML Web Services) implementations. An attacker on the network can exploit this flaw to bypass login controls and gain unauthorized access to affected applications without providing valid credentials. The vulnerability requires no user interaction and can be triggered remotely, making it a practical threat to organizations running these older WebSphere versions.

• CVE-2026-11115HIGH 7.3

  A use-after-free vulnerability exists in Google Chrome's update mechanism on Windows systems. An attacker with local access can exploit this flaw by crafting a malicious file, potentially escalating their privileges to system or administrator level. The vulnerability affects Chrome versions before 149.0.7827.53 and requires user interaction (such as opening or running a file) to trigger the exploit.

• CVE-2026-45481HIGH 7.3

  A cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint allows an authenticated user to inject malicious scripts into web pages. An attacker with valid SharePoint access can craft a specially formed input that bypasses input validation, causing the server to generate pages containing attacker-controlled JavaScript. When other authorized users view the compromised page, their browser executes the injected script in the context of the SharePoint application, enabling the attacker to impersonate them, steal session tokens, or perform actions on their behalf. The vulnerability requires user interaction (clicking a link or visiting a page) but poses significant risk within organizations that rely on SharePoint for document management and collaboration.

• CVE-2026-47634HIGH 7.3

  A vulnerability in Microsoft Office SharePoint allows someone with valid access to inject malicious content that tricks downstream components into displaying fake or spoofed information to other users. The attacker must have legitimate credentials and convince a user to interact with the malicious content, but once triggered, the attack succeeds reliably and can achieve high impact by either stealing sensitive data or modifying what users see.

• CVE-2026-58298HIGH 7.2

  A cross-site scripting (XSS) vulnerability in Microsoft Edge's Chromium engine allows attackers to inject malicious code into web pages viewed by users. An attacker can exploit this remotely over the network without requiring special privileges or user interaction, enabling them to spoof or impersonate content to deceive victims. The vulnerability affects the browser's input sanitization during page rendering.

• CVE-2026-11269HIGH 7.1

  Google Chrome versions prior to 149.0.7827.53 contain a vulnerability in how the browser handles extensions that allows an attacker positioned on the same network as a user to execute arbitrary code within Chrome's sandbox. The attacker must craft a malicious extension and the user must interact with it (such as installing or clicking something), making this a moderate-complexity attack. While Chromium rated this as low severity internally, the CVSS assessment reflects the potential for complete compromise of the sandboxed process.

• CVE-2026-45649HIGH 7.1

  A flaw in Microsoft Office apps on Android devices allows someone with local access to spoof or impersonate document content without requiring special permissions or user interaction beyond launching the app. An attacker with physical or logical access to the device could manipulate what appears in Word, Excel, or PowerPoint documents, potentially tricking the device owner or others into trusting falsified information. The vulnerability affects the access control layer that should prevent unauthorized modification of displayed document content.

• CVE-2026-47288HIGH 7.1

  CVE-2026-47288 is a high-severity integer overflow vulnerability in Windows Kerberos authentication that allows an authenticated attacker on an adjacent network to execute arbitrary code with system-level privileges. The flaw resides in how Kerberos handles certain numeric calculations, causing a wraparound condition that can be exploited to bypass security checks and inject malicious code. An attacker must already have valid credentials and network proximity to the target, which limits the immediate blast radius but makes this a serious concern for domain environments where lateral movement is a known threat model.

• CVE-2026-48569HIGH 7.1

  A flaw in Visual Studio Code's input handling allows a local attacker to circumvent a security mechanism without requiring elevated privileges or special user setup. The attacker must interact with the application through the user interface, but once triggered, the exploit can affect system-wide settings and processes beyond the application's normal scope. This is a local-attack surface issue that could allow an unauthorized actor to modify or access protected features.

• CVE-2026-57977HIGH 7.1

  Microsoft Edge (Chromium-based) contains a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious code into web pages viewed in the browser. An attacker can exploit this by crafting a specially designed webpage that, when visited by a user, executes unauthorized JavaScript in the victim's browser context. The primary risk is spoofing—attackers can impersonate legitimate content, steal session tokens, redirect users to phishing sites, or harvest credentials. This requires user interaction (clicking a link or visiting a malicious site), but the ease of social engineering makes it a practical attack vector.

• CVE-2026-57988HIGH 7.1

  Microsoft Edge (Chromium-based) contains a relative path traversal vulnerability that could allow an attacker to execute arbitrary code on a user's system over the network. The vulnerability requires user interaction—such as clicking a malicious link or visiting a compromised website—but once triggered, an attacker can bypass security controls and run code with the privileges of the Edge process.

• CVE-2026-58296HIGH 7.1

  A privacy vulnerability in Microsoft Edge for Android can expose users' personal information to attackers over the internet. An attacker could trick a user into performing certain actions on a compromised or attacker-controlled website, potentially revealing sensitive data stored or cached within the browser. The vulnerability requires user interaction to exploit, but once triggered, it bypasses normal privacy protections.

• CVE-2026-58297HIGH 7.1

  Microsoft Edge on Android contains a privacy flaw that allows attackers to access and transmit private user information over the network without authorization. The issue requires user interaction (such as visiting a malicious site) but does not require any special system access to exploit. An attacker can leverage this vulnerability to steal sensitive personal data from affected Android devices.

• CVE-2026-8035HIGH 7.1

  CVE-2026-8035 is a denial-of-service vulnerability in National Instruments' PAL kernel driver that allows authenticated local users to crash the system. The flaw stems from inadequate input validation that fails to check for NULL pointers before dereferencing them in memory. An attacker with local system access can exploit this by supplying malformed input to the driver, causing an immediate kernel panic. The vulnerability affects NI-PAL version 26.3.0 and all earlier releases across both Windows and Linux platforms.

• CVE-2026-8036HIGH 7.1

  NI-PAL, National Instruments' process abstraction layer, contains an input validation flaw that allows authenticated local users to read and modify arbitrary memory regions on affected systems. An attacker with local access could exploit this to escalate their privileges. The vulnerability affects NI-PAL version 26.3.0 and earlier on both Windows and Linux platforms.

• CVE-2026-34335HIGH 7.0

  A use-after-free memory vulnerability exists in Windows Ancillary Function Driver for WinSock (AFD.sys), affecting Windows 10 and Windows 11 across multiple versions, as well as Windows Server 2012 through 2025. An authenticated local attacker can exploit this flaw to escalate their privileges to SYSTEM level. The vulnerability requires local access and specific conditions to trigger, but once exploited, grants complete control over the affected system.

• CVE-2026-41108HIGH 7.0

  A memory safety flaw in Windows DNS could allow someone with local system access to break out of normal restrictions and gain full control of the computer. The vulnerability exists because DNS processes input in a way that can overflow a memory buffer, and an attacker positioned locally—such as a low-privilege user or service—could exploit this to run code with elevated permissions. This is not a remote vulnerability, but it poses a significant risk in multi-user or shared-system environments.

• CVE-2026-42836HIGH 7.0

  A race condition in Windows' Function Discovery Service (fdwsd.dll) allows a user already logged into a machine to escalate their privileges to administrator level. The vulnerability exists because the service does not properly synchronize access to shared resources when multiple processes run concurrently, creating a narrow window where an attacker can manipulate the process. An authorized user would need local access and specific timing to exploit this, but successful exploitation grants full system-level permissions.

• CVE-2026-42911HIGH 7.0

  A use-after-free memory vulnerability exists in Windows' Ancillary Function Driver for WinSock (AFD.sys). An attacker who already has local access to a machine can exploit this flaw to gain elevated privileges, potentially running code with system-level permissions. The vulnerability requires specific conditions to trigger—it is not trivially exploitable—but once successful grants significant control over the affected system.

• CVE-2026-42912HIGH 7.0

  A race condition in Windows Telephony Service allows an attacker who already has local user access to exploit improper synchronization of shared resources and gain system-level privileges. The vulnerability requires the attacker to perform specific timing-dependent actions during concurrent operations—making it moderately difficult to exploit in practice, but reliably escalatable once triggered. No user interaction is required beyond the attacker's ability to run code as a local user.

• CVE-2026-42984HIGH 7.0

  A use-after-free memory vulnerability exists in the Windows Kernel that allows an authorized local user to escalate their privileges to a higher level of access. An attacker with standard user permissions could exploit this flaw to gain system-level control on an affected machine. The vulnerability requires local access and specific conditions to trigger, but successful exploitation would grant complete compromise of the target system.

• CVE-2026-44818HIGH 7.0

  A race condition vulnerability in Microsoft Office Excel could allow an attacker to execute code on a user's computer. The flaw arises from improper synchronization when multiple processes access shared resources simultaneously. An attacker would need to trick a user into opening a malicious Excel file, but once triggered, the vulnerability can grant full control over the affected system. The vulnerability affects multiple versions of Excel and Office across 365 subscriptions, on-premises deployments, and older perpetual licenses.

• CVE-2026-45596HIGH 7.0

  A use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (AFD) allows an authenticated attacker to elevate their privileges on a local system. The vulnerability requires the attacker to already have user-level access and involves a race condition during memory management. Successfully exploiting it grants the attacker full system-level control.

• CVE-2026-45597HIGH 7.0

  A race condition vulnerability in Windows UI Automation Manager allows an authorized local user to escalate privileges on affected systems. The flaw arises from improper synchronization when multiple processes access shared resources simultaneously. An attacker with existing local access can exploit timing windows to gain system-level privileges. This is not a remote vulnerability and requires prior authentication or local access, which narrows but does not eliminate the risk in shared computing environments.

• CVE-2026-45598HIGH 7.0

  A race condition in Windows' Ancillary Function Driver for WinSock (AFD.sys) allows an attacker who already has local access to a system to escalate their privileges to a higher level. The vulnerability stems from improper synchronization when the driver handles shared resources, meaning that under specific timing conditions, an attacker can exploit the flaw to gain elevated permissions. This is not a remote attack—the attacker must already have a foothold on the machine, such as a low-privileged user account or compromised application context.

• CVE-2026-45601HIGH 7.0

  A race condition in the Windows Ancillary Function Driver for WinSock allows someone already logged into a Windows system to escalate their privileges to a higher level of access. The vulnerability arises from improper synchronization of shared resources, meaning two processes can interfere with each other when accessing the same data simultaneously. An attacker with local user privileges can exploit this timing-dependent flaw to gain elevated system rights, though doing so requires specific conditions and is not trivial to reproduce reliably.

• CVE-2026-45603HIGH 7.0

  A race condition vulnerability exists in Windows' Ancillary Function Driver for WinSock (AFD) that allows an authorized local user to escalate privileges to a higher level on the system. The flaw arises from improper synchronization when multiple processes access a shared resource simultaneously, creating a narrow window of opportunity for an attacker to manipulate the driver's behavior. An authenticated user with basic local access can exploit this to gain elevated privileges, potentially achieving full system compromise. This is not a remote vulnerability and requires the attacker already has some level of access to the target machine.

• CVE-2026-45640HIGH 7.0

  A use-after-free vulnerability in the Windows Bluetooth Port Driver permits a user with local system access to escalate their privileges to a higher level. The flaw exists because the driver fails to properly manage memory when Bluetooth port operations conclude, leaving a freed memory region accessible for malicious manipulation. An attacker must already have some level of local authentication and user rights to exploit this issue, but successful exploitation grants full system control.

• CVE-2026-45653HIGH 7.0

  A heap-based buffer overflow vulnerability in the Windows Kernel allows a user with local system access to overflow a memory buffer, enabling them to execute code with elevated privileges. The attack requires an authenticated user account and moderate technical effort to exploit, but if successful grants attacker control over the affected system. This is a local privilege escalation issue, not a remote attack vector.

• CVE-2026-47293HIGH 7.0

  A use-after-free vulnerability exists in Microsoft Office's Click-To-Run installation and update mechanism. An attacker with valid credentials on a local machine can exploit a memory management flaw to gain elevated (administrator) privileges. This is not a remote vulnerability—it requires an authorized user account and local access—but the privilege escalation risk makes it a meaningful threat in environments where credential compromise or insider activity is a concern.

• CVE-2026-47648HIGH 7.0

  CVE-2026-47648 is a privilege escalation vulnerability in Windows Storage that affects multiple versions of Windows 10, Windows 11, and Windows Server. An authorized local user can exploit an untrusted search path flaw to gain elevated privileges on a compromised system. The vulnerability requires local access and user interaction is not needed, but exploitation depends on specific system conditions. With a CVSS score of 7.0 (HIGH), this poses a meaningful risk to environments where local account compromise is plausible.

• CVE-2026-11166MEDIUM 6.8

  Google Chrome versions before 149.0.7827.53 contain a flaw in how it processes SVG (Scalable Vector Graphics) content that allows attackers to inject malicious scripts or HTML into web pages. An attacker would craft a specially designed HTML page and trick a user into visiting it; if the user does, arbitrary code could execute within the browser with the user's privileges, potentially stealing data, modifying page content, or performing actions on the user's behalf. The vulnerability requires user interaction and is rated Medium severity by Google's security team.

• CVE-2026-11218MEDIUM 6.8

  A flaw in Google Chrome's platform integration layer on Windows allows attackers to trick users into running malicious files that execute arbitrary code on their system. The vulnerability requires specific user interaction—the attacker must convince the victim to perform particular UI gestures when opening a crafted file. While Chrome's vendor assessment rates this as low severity, the combination of remote reach and code execution capability elevates the practical risk for organizations with large user populations.

• CVE-2026-11628MEDIUM 6.8

  Google Chrome versions before 149.0.7827.103 contain a use-after-free memory error in the Ozone graphics subsystem. An attacker with physical access to a device can trigger this flaw to corrupt heap memory and potentially execute arbitrary code. While the Chromium project rates this as Critical, the CVSS score reflects the requirement for physical device access, which limits real-world exploitability for most organizations.

• CVE-2026-45608MEDIUM 6.8

  A flaw in Windows DHCP Client allows a local attacker to read sensitive memory content without authentication. The vulnerability exists because the DHCP client fails to validate buffer boundaries before reading network configuration data, exposing information like cached credentials or system details to an attacker with local access. No user interaction is required, and the attacker does not need special privileges—standard user permissions are sufficient.

• CVE-2026-50507MEDIUM 6.8

  Windows BitLocker, Microsoft's full-disk encryption feature, contains a flaw that allows an attacker with physical access to a device to bypass its security protections without providing authentication credentials. The vulnerability affects multiple versions of Windows 10, Windows 11, and Windows Server platforms. Because the attack requires physical presence, the risk is somewhat contained to scenarios where an attacker can directly access hardware—such as a stolen laptop or a device left unattended in a hostile environment. The vulnerability is classified as medium severity, but organizations relying on BitLocker as a primary defense against data theft should treat this seriously.

• CVE-2026-58522MEDIUM 6.8

  Microsoft Edge for Android contains a flaw that allows an attacker with local access to a device to view sensitive files through relative path traversal. This occurs because the application improperly validates file paths, enabling an attacker to navigate beyond intended directories and access information they should not be able to reach. An attacker does not need special permissions or user interaction to exploit this vulnerability.

• CVE-2026-9261MEDIUM 6.8

  Canon EOS Network Setting Tool versions 1.5.0 and earlier use weak SSH encryption algorithms when communicating over the network. An attacker positioned to intercept traffic—such as on a shared network or via man-in-the-middle positioning—could potentially decrypt SSH sessions or forge authentication, compromising the confidentiality and integrity of communications between the tool and network devices. This affects both macOS and Windows users of the tool.

• CVE-2026-10004MEDIUM 6.5

  Google Chrome versions before 148.0.7778.216 contain a flaw in how they validate user input within the password-handling component. An attacker can craft a malicious HTML page that, when visited by a user, tricks the browser into displaying fake password prompts or other UI elements that appear legitimate. This is a spoofing attack—the attacker doesn't steal data directly, but deceives users into believing they're interacting with genuine Chrome interface elements, potentially leading them to enter credentials or take other unintended actions.

• CVE-2026-10018MEDIUM 6.5

  CVE-2026-10018 is a medium-severity integer overflow vulnerability in ANGLE (Almost Native Graphics Layer Engine), Google's graphics abstraction layer used in Chrome. An attacker can craft a malicious webpage that, when visited, causes Chrome to mishandle memory calculations in its graphics pipeline. This flaw allows the attacker to read sensitive data from the browser's process memory—potentially including cached credentials, session tokens, or other confidential information—without modifying or crashing the system. The vulnerability requires user interaction (visiting the malicious page) but does not require special privileges to exploit.

• CVE-2026-10912MEDIUM 6.5

  A flaw in Google Chrome's extension handling allows an attacker who has already compromised the renderer process to bypass the browser's same-origin policy—a core security boundary that prevents JavaScript from one website accessing data from another. An attacker would need to trick a user into visiting a specially crafted webpage to exploit this. The vulnerability affects Chrome versions prior to 149.0.7827.53 across Windows, macOS, and Linux.

• CVE-2026-11006MEDIUM 6.5

  A memory safety flaw in Google Chrome's Dawn graphics component (used for GPU rendering) allows attackers to read sensitive data from a user's memory by tricking them into visiting a specially crafted webpage. The vulnerability does not enable code execution or system crashes, but confidentiality is at risk. Chrome versions prior to 149.0.7827.53 are affected.

• CVE-2026-11008MEDIUM 6.5

  A flaw in Google Chrome's web app installation feature fails to properly validate user input, allowing an attacker who has already compromised Chrome's renderer process to extract sensitive data from other websites through a malicious webpage. The attacker would need to trick a user into visiting a crafted HTML page, but once the renderer is compromised, the vulnerability creates a pathway to leak cross-origin information that should remain isolated.

• CVE-2026-11013MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser validates user-supplied input within its networking code. An attacker who has already compromised Chrome's renderer process—the sandboxed component that executes web content—can craft a malicious HTML page to leak sensitive data from the renderer's memory. This is a post-compromise attack vector; the attacker must first gain code execution in the renderer sandbox, but once there, they can extract information that should remain private.

• CVE-2026-11014MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a vulnerability where insufficient policy enforcement in the extension system allows a malicious extension to circumvent Site Isolation—Chrome's security boundary that prevents one website from accessing another's data. An attacker must first convince a user to install the malicious extension, but once installed, the extension can read or modify data across websites that the user visits, potentially exposing sensitive information.

• CVE-2026-11016MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw where insufficient validation of network input allows a remote attacker who has already compromised the browser's renderer process to bypass the same-origin policy. An attacker could craft a malicious HTML page to force the compromised renderer to access resources or data from a different origin, violating the security boundary that normally prevents cross-origin access. This requires initial renderer process compromise—the attacker cannot trigger the vulnerability from an unauthenticated network position alone.

• CVE-2026-11017MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the Link Preview feature handles navigation restrictions. If an attacker first compromises Chrome's renderer process—the component that displays web content—they can craft a malicious HTML page to bypass restrictions that normally prevent unauthorized navigation. The vulnerability requires prior renderer compromise, limiting its immediate attack surface, but it does allow an attacker with that foothold to navigate to restricted locations without proper authorization.

• CVE-2026-11018MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser enforces navigation policies. An attacker can craft a malicious HTML page that, when visited, tricks Chrome into allowing navigation to restricted destinations that should normally be blocked. The vulnerability requires user interaction—a person must visit the hostile page—but no special privileges are needed on the attacker's side. The core risk is integrity: an attacker can redirect you to unwanted sites, potentially enabling phishing, malware distribution, or social engineering attacks.

• CVE-2026-11020MEDIUM 6.5

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in how the browser handles extensions that process XML files. An attacker can craft a malicious XML file that, when processed by a vulnerable extension, leaks sensitive data from other websites the user has visited. The vulnerability requires user interaction—specifically, the user must open or interact with the malicious file—but does not require the attacker to have special privileges or bypass additional security controls. This is a cross-origin data leak, meaning information intended to be isolated between websites can be extracted by an attacker.

• CVE-2026-11022MEDIUM 6.5

  CVE-2026-11022 is a same-origin policy bypass vulnerability in Google Chrome's DevTools that requires an attacker to have already compromised the renderer process. An attacker could then use a specially crafted HTML page to escape origin restrictions, potentially accessing or modifying data from other websites in the same browser session. This is not a remote code execution vector but rather a privilege escalation within an already-compromised rendering context.

• CVE-2026-11023MEDIUM 6.5

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in how the browser handles web app installation that allows an attacker who has already compromised the browser's renderer process to bypass the same-origin policy. This means a specially crafted web page could be used to access or modify content from other websites in ways the browser is supposed to prevent. The attacker needs prior renderer compromise, limiting the immediate threat to users, but the bypass itself is reliable once that initial foothold exists.

• CVE-2026-11026MEDIUM 6.5

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in how extensions are handled that allows an attacker to bypass built-in navigation restrictions. The vulnerability requires social engineering—an attacker must trick a user into installing a malicious Chrome extension. Once installed, the extension can circumvent the browser's navigation safeguards, potentially redirecting users to unintended destinations or enabling other attack chains. This is classified as a Medium severity issue by Chromium's security team.

• CVE-2026-11027MEDIUM 6.5

  A vulnerability in Google Chrome's Glic component fails to properly validate untrusted input, allowing an attacker who has already compromised Chrome's renderer process to extract sensitive data across website boundaries using a specially crafted webpage. The attacker needs initial renderer process compromise but then gains the ability to read data from sites the user visits, bypassing normal browser security boundaries.

• CVE-2026-11032MEDIUM 6.5

  Google Chrome's Password Manager contained a flaw that could allow an attacker to trick users into visiting a malicious webpage and leak sensitive data from other websites the user visits. The vulnerability requires user interaction—visiting a crafted HTML page—but once triggered, could expose cross-origin information that should remain isolated between websites. This affects Chrome on Windows, macOS, and Linux systems.

• CVE-2026-11036MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a DOM implementation flaw that allows attackers to circumvent the same-origin policy—a fundamental browser security boundary. An attacker could craft a malicious HTML page that, when visited, tricks the browser into allowing cross-origin requests or data access that should normally be blocked. This requires user interaction (clicking a link, visiting a site) but does not require any special privileges. While the attack does not expose sensitive data directly, it enables unauthorized modification of web content or session state, potentially leading to account compromise or malware injection.

• CVE-2026-11038MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how Subresource Integrity (SRI) policies are enforced, allowing attackers to bypass Content Security Policy (CSP) protections through crafted network traffic. An attacker would need to trick a user into visiting a malicious webpage to exploit this vulnerability. The issue is classified as medium severity because it enables content injection attacks but does not directly compromise confidentiality or system availability.

• CVE-2026-11039MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in Skia (the graphics rendering engine) that could allow an attacker to trick users into visiting a malicious webpage and leak sensitive data from other websites the user has open. The vulnerability requires user interaction—clicking or visiting a link—but does not require any special system privileges. Once triggered, an attacker could read private information from cross-origin sources, such as data from other tabs or windows.

• CVE-2026-11045MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in GPU input validation that can leak sensitive data from memory. An attacker who has already compromised Chrome's renderer process can craft a malicious HTML page to read protected information. This is a stepping-stone attack—it requires prior renderer compromise but can extract valuable secrets afterward.

• CVE-2026-11048MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a vulnerability in how extensions are handled that could allow a malicious extension to bypass the same-origin policy—a core browser security feature that prevents websites from accessing data across different origins. An attacker would need to trick a user into installing a malicious extension, but once installed, the extension could potentially access or modify content on websites that it shouldn't normally be able to reach. This is a medium-severity issue that affects Chrome on Windows, macOS, and Linux.

• CVE-2026-11057MEDIUM 6.5

  A flaw in the Skia graphics library used by Chrome allows attackers who have already compromised a browser's rendering engine to read sensitive data from memory by sending a specially crafted web page. The vulnerability requires two conditions: the attacker must first gain control of the renderer process (typically through a separate vulnerability), and the user must visit the malicious page. Once both are true, uninitialized memory regions become readable, potentially exposing passwords, tokens, or other sensitive information that happen to be in RAM.

• CVE-2026-11067MEDIUM 6.5

  Google Chrome versions prior to 149.0.7827.53 contain a memory safety vulnerability in the Dawn graphics component that allows attackers to steal sensitive data from browser process memory. An attacker crafts a malicious webpage that, when visited, exploits the uninitialized memory access to leak information that could include cached passwords, session tokens, or other private data. The attack requires user interaction (visiting the page) but works across networks without special privileges.

• CVE-2026-11069MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the Cast feature validates user input, allowing an attacker to craft a malicious HTML page that bypasses the browser's same-origin policy. If a user visits the attacker's page, it could potentially access or modify data from other websites the user is logged into, though without stealing that data directly. This is a moderate-severity issue affecting Windows, macOS, and Linux users.

• CVE-2026-11073MEDIUM 6.5

  A use-after-free vulnerability exists in Google Chrome's WebGL rendering engine that could allow an attacker to steal sensitive data from your browser's memory. An attacker would need to trick you into visiting a malicious webpage to exploit this flaw. While the vulnerability requires user interaction to trigger, the potential exposure of process memory—which may contain cached passwords, authentication tokens, or other sensitive information—makes it a meaningful security concern. The issue affects Chrome versions prior to 149.0.7827.53.

• CVE-2026-11075MEDIUM 6.5

  A flaw in Google Chrome's V8 JavaScript engine allows an attacker to read sensitive data from a browser process's memory by tricking a user into visiting a malicious webpage. The vulnerability exists in Chrome versions before 149.0.7827.53 and requires no special privileges to exploit—only user interaction to visit a crafted page. While the attacker cannot modify data or crash the browser, they can potentially extract confidential information like passwords, session tokens, or other data resident in memory.

• CVE-2026-11078MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser's FileSystem implementation validates cross-origin requests. If an attacker compromises Chrome's renderer process—the sandboxed component that executes web content—they can craft a malicious HTML page to bypass the same-origin policy, a foundational browser security mechanism that prevents one website from accessing data or resources belonging to another. The vulnerability requires the renderer to already be compromised, meaning an attacker would need to have successfully exploited a prior vulnerability to reach this point, making it a secondary but meaningful risk in a multi-stage attack chain.

• CVE-2026-11081MEDIUM 6.5

  A flaw in how Google Chrome handles Canvas operations before version 149.0.7827.53 allows attackers to circumvent browser same-origin policy protections. An attacker can craft a malicious HTML page that, when visited by a user, breaks the security boundary that normally prevents one website from accessing data or resources belonging to another. The attack requires user interaction (visiting the page) but no special browser configuration.

• CVE-2026-11083MEDIUM 6.5

  Google Chrome's password manager contained a flaw that could allow an attacker to trick users into leaking sensitive cross-origin data through a specially crafted webpage. The vulnerability requires user interaction—such as visiting a malicious site—but poses a meaningful risk because password managers are trusted to protect sensitive credentials and related information. An attacker exploiting this could potentially access data that should remain isolated between different websites.

• CVE-2026-11084MEDIUM 6.5

  A flaw in Google Chrome's password manager allows attackers to trick users into visiting a specially crafted website that can leak sensitive data from other websites the user has visited. The vulnerability requires user interaction—specifically, the victim must click on or interact with a malicious page—but once triggered, it can expose cross-site information that should normally be protected by browser security boundaries. This affects Chrome versions before 149.0.7827.53 on Windows, macOS, and Linux systems.

• CVE-2026-11087MEDIUM 6.5

  A memory safety issue in Google Chrome's ANGLE graphics library allows an attacker who has already compromised the renderer process to steal sensitive data from other websites. The vulnerability requires user interaction (visiting a malicious web page) and affects Chrome on Windows, macOS, and Linux. The attacker gains read-only access to cross-origin data, meaning they cannot modify it or crash the browser, but confidentiality is at risk.

• CVE-2026-11089MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a memory disclosure vulnerability in its media handling code. If an attacker gains control of Chrome's renderer process—the component responsible for displaying web content—they can craft a malicious HTML page to read uninitialized data from memory, potentially exposing sensitive information like passwords, encryption keys, or other confidential data. The vulnerability requires a prior compromise of the renderer, meaning it's typically chained with another exploit to be effective in the wild.

• CVE-2026-11090MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in the ANGLE graphics library that can be exploited to leak data across website boundaries. An attacker could craft a malicious webpage that, when visited, causes Chrome to inadvertently expose sensitive information from other origins a user has open. This requires user interaction (visiting the malicious page) but does not require special privileges. The vulnerability affects Windows, macOS, and Linux systems running vulnerable Chrome versions.

• CVE-2026-11093MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser handles printing functionality that could allow an attacker who has already compromised Chrome's rendering engine to steal sensitive data from websites the user visits. The attacker would need to trick the user into visiting a malicious webpage after gaining control of the renderer process. This is a medium-severity issue because it requires an intermediate compromise and user interaction, but the potential for cross-origin data leakage makes it worth prompt attention.

• CVE-2026-11096MEDIUM 6.5

  A memory reading flaw in Chrome's WebRTC component allows attackers to trick users into visiting a malicious webpage that steals sensitive data from the browser's memory. The vulnerability requires user interaction (clicking a link or visiting a site) but needs no special privileges, making it a practical attack vector for information theft. Google patched this in Chrome version 149.0.7827.53 and later.

• CVE-2026-11101MEDIUM 6.5

  A vulnerability in Google Chrome's Dawn graphics library allows attackers to steal sensitive data from other websites when a user visits a malicious web page. The flaw stems from uninitialized memory being used improperly, potentially exposing information the attacker shouldn't be able to access. Chrome versions before 149.0.7827.53 on Windows are affected.

• CVE-2026-11104MEDIUM 6.5

  CVE-2026-11104 is a memory information disclosure flaw in ANGLE, a graphics abstraction library used by Google Chrome. An attacker who has already compromised Chrome's renderer process can craft a malicious HTML page to read uninitialized memory and leak sensitive data. This is not a trivial attack—it requires the renderer to be compromised first—but once that foothold exists, the vulnerability can amplify the damage by exposing additional secrets from the browser process. Chrome versions before 149.0.7827.53 are vulnerable.

• CVE-2026-11105MEDIUM 6.5

  A flaw in Google Chrome's WebUI component fails to properly validate user-supplied input, allowing an attacker who has already compromised Chrome's renderer process to trick the browser into leaking sensitive data from other websites. The vulnerability requires the renderer to be compromised first, which significantly limits the attack surface. Chrome versions before 149.0.7827.53 are affected.

• CVE-2026-11106MEDIUM 6.5

  A flaw in Google Chrome's media handling allows attackers to trick users into visiting a malicious web page that can steal private data from other websites the user has visited. The vulnerability requires user interaction—someone must click a link or visit the crafted page—but once they do, an attacker can bypass Chrome's normal security boundaries that keep websites isolated from each other. This affects Chrome on Windows, macOS, and Linux systems.

• CVE-2026-11109MEDIUM 6.5

  A vulnerability in the ANGLE graphics library used by Google Chrome can leak sensitive data from websites you're viewing to an attacker. An attacker would need to trick you into visiting a specially crafted webpage, but requires no special browser extensions or user interaction beyond visiting the page. The vulnerability affects Chrome versions prior to 149.0.7827.53 on Windows, macOS, and Linux systems.

• CVE-2026-11110MEDIUM 6.5

  A flaw in Google Chrome's graphics rendering engine (ANGLE) can leak sensitive data from websites you visit to attackers. The vulnerability exists in Chrome versions before 149.0.7827.53 and requires a user to click on or interact with a malicious webpage. When exploited, it exposes confidential information that should remain isolated between different websites.

• CVE-2026-11121MEDIUM 6.5

  CVE-2026-11121 is a medium-severity vulnerability in Skia, the graphics rendering engine used by Google Chrome. The flaw involves improper validation of untrusted input that could allow an attacker who has already compromised the browser's renderer process to extract sensitive data across origin boundaries using a specially crafted web page. This is not an initial entry point into systems, but rather a post-compromise escalation vector that broadens the damage an attacker can do once inside the browser process.

• CVE-2026-11123MEDIUM 6.5

  A flaw in ANGLE (the graphics abstraction layer used by Google Chrome) allows attackers to trick users into visiting a malicious website that reads sensitive information directly from Chrome's memory. The vulnerability was patched in Chrome version 149.0.7827.53. Because it requires user interaction (clicking a link or visiting a page), it's less critical than remotely exploitable flaws, but the memory disclosure risk—potentially exposing authentication tokens, cached data, or other secrets—warrants prompt patching.

• CVE-2026-11128MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in the Web Share feature that allows attackers to steal data from other websites. The vulnerability requires tricking a user into clicking or interacting with elements on a malicious webpage. Once triggered, an attacker can access information from cross-origin sources—essentially reading data they shouldn't have access to. This is a client-side issue affecting individual users rather than servers, and the bar for exploitation is user interaction on a crafted page.

• CVE-2026-11129MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser handles extensions that could allow an attacker to steal sensitive data from websites you visit. An attacker would need to trick you into visiting a malicious webpage, but if successful, they could read information from other sites you have open—potentially including login credentials, private messages, or financial data. This is a medium-severity issue that affects Chrome on Windows, macOS, and Linux.

• CVE-2026-11132MEDIUM 6.5

  A flaw in Chrome's Paint component allows attackers to bypass the same-origin policy—a fundamental browser security boundary—by tricking users into visiting a malicious webpage. The vulnerability affects Chrome versions before 149.0.7827.53. While an attacker cannot steal data directly through this weakness, they can modify or inject content in ways the browser should have blocked, potentially enabling follow-up attacks that compromise user sessions or inject malware. The flaw requires user interaction (visiting a crafted page) but is otherwise straightforward to exploit.