By severity

High-severity vulnerabilities

CVEs rated High by CVSS, with SEC.co remediation and prioritization guidance.

1343 published vulnerabilities · page 2 of 14

• CVE-2026-11003HIGH 8.8

  Google Chrome versions before 149.0.7827.53 contain a use-after-free vulnerability in its WebRTC component that could allow an attacker to run arbitrary code within Chrome's sandbox by tricking a user into visiting a malicious web page. While the underlying flaw is rated Medium severity by Chromium, the CVSS score reflects the practical impact: network delivery with minimal user friction and full compromise of confidentiality, integrity, and availability within the sandboxed process.

• CVE-2026-11024HIGH 8.8

  A stack buffer overflow vulnerability exists in the Skia graphics library, which is used by Google Chrome. An attacker could craft a malicious HTML page that, when viewed by a user, potentially corrupts stack memory and compromises the browser process. The vulnerability requires user interaction (visiting a malicious webpage) but presents significant risk because it can lead to code execution with the privileges of the Chrome process. Google Chrome versions prior to 149.0.7827.53 are affected.

• CVE-2026-11028HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's media handling on Linux and ChromeOS. If an attacker compromises Chrome's renderer process—the sandboxed component that interprets web content—they can craft a malicious HTML page to execute arbitrary code within that sandbox. This is a post-compromise attack that escalates the damage from a renderer breach but does not grant escape from the sandbox itself.

• CVE-2026-11030HIGH 8.8

  Google Chrome versions prior to 149.0.7827.53 contain a use-after-free vulnerability in the Network component that can be triggered by malicious network traffic. An attacker who crafts and delivers hostile network packets to a user's browser could potentially corrupt the heap memory, leading to code execution with the privileges of the browser process. User interaction (such as visiting a malicious website or receiving crafted network data) is required for exploitation.

• CVE-2026-11041HIGH 8.8

  A vulnerability in Google Chrome's media handling on Windows systems allows an attacker who has already compromised Chrome's renderer process to break out of the browser's security sandbox through a specially crafted web page. This sandbox escape is the critical concern: while the attacker must first gain control of the renderer, doing so grants them access to the underlying Windows system with the privileges of the Chrome user. The vulnerability affects Chrome versions before 149.0.7827.53.

• CVE-2026-11042HIGH 8.8

  Google Chrome versions before 149.0.7827.53 contain a use-after-free flaw in its Views component that can allow attackers to corrupt browser memory. An attacker must convince a user to perform specific interactions with a malicious webpage to trigger the vulnerability, potentially leading to code execution or data theft. While Chromium rates this as medium severity, the CVSS score of 8.8 reflects the high impact if successfully exploited.

• CVE-2026-11046HIGH 8.8

  A flaw in Google Chrome's media handling allows an attacker who has already compromised the browser's renderer process to break out of the sandbox and run arbitrary code with full system privileges. The vulnerability stems from insufficient validation of untrusted input when processing media files, and requires user interaction (such as opening a crafted HTML page) to trigger. Chrome versions prior to 149.0.7827.53 are affected across Windows, macOS, and Linux systems.

• CVE-2026-11049HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's Password Manager that could allow an attacker to run malicious code within Chrome's sandbox by tricking a user into visiting a specially crafted website. The flaw affects Chrome versions before 149.0.7827.53 across Windows, macOS, and Linux. While the Chromium project rates this as medium severity, the CVSS score of 8.8 reflects the combination of network accessibility, lack of authentication requirements, and potential for high-impact code execution.

• CVE-2026-11050HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's V8 JavaScript engine that allows attackers to execute arbitrary code within the browser's sandbox by tricking users into visiting a malicious webpage. The flaw requires user interaction (clicking a link or visiting a site) but needs no special privileges to exploit. While Chromium's security team rated this as medium severity internally, the CVSS score of 8.8 reflects the high impact if successfully exploited—attackers could steal data, modify content, or crash the browser.

• CVE-2026-11054HIGH 8.8

  A use-after-free memory flaw in Chrome's WebRTC component allows an attacker to execute arbitrary code within the browser's sandbox by tricking a user into visiting a malicious webpage. The vulnerability affects Chrome versions prior to 149.0.7827.53 and impacts multiple operating systems including Windows, macOS, and Linux. Successful exploitation requires user interaction (clicking a link or visiting a site) but can lead to complete compromise of the affected browser process.

• CVE-2026-11055HIGH 8.8

  A use-after-free vulnerability in ANGLE (Google's graphics library) affects Chrome on Windows systems prior to version 149.0.7827.53. An attacker can craft a malicious webpage that, when visited, executes arbitrary code within Chrome's sandbox environment. While the Chromium team rated this as medium severity internally, the CVSS score of 8.8 reflects the practical impact: any user visiting a hostile site is at risk, no user interaction beyond clicking a link is required, and successful exploitation grants code execution.

• CVE-2026-11059HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's Blink rendering engine that allows attackers to execute arbitrary code within the browser's sandbox by tricking users into visiting a malicious website. The flaw affects Chrome versions prior to 149.0.7827.53 and requires user interaction (clicking a link or visiting a page) but poses significant risk because successful exploitation grants an attacker the ability to run code with the privileges of the Chrome process.

• CVE-2026-11060HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's media handling on Windows systems. An attacker can craft a malicious HTML page that, when visited by a user, exploits this flaw to execute arbitrary code within Chrome's sandbox. While the sandbox provides a layer of isolation, successful exploitation would still allow the attacker to run code with the privileges of the Chrome process, potentially leading to data theft, credential capture, or lateral movement to the system itself.

• CVE-2026-11068HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's WebSocket implementation that could allow an attacker to execute arbitrary code within the browser's sandbox by tricking a user into visiting a malicious webpage. The flaw affects Chrome versions before 149.0.7827.53 and impacts Windows, macOS, and Linux systems. While the underlying code defect is classified as Medium severity by the Chromium project, the CVSS score of 8.8 reflects the practical risk: an attacker needs only to convince a user to visit a crafted page, requires no special privileges, and can achieve full code execution within the sandbox boundary.

• CVE-2026-11071HIGH 8.8

  A use-after-free memory vulnerability exists in Google Chrome's Base component on Linux systems. An attacker who has already compromised Chrome's renderer process can craft a malicious web page to read sensitive data directly from the browser's memory. While the underlying flaw carries a Medium severity rating from Chromium, the CVSS score reflects the potential for information disclosure combined with the practical attack surface. Chrome version 149.0.7827.53 and later on Linux contain the fix.

• CVE-2026-11074HIGH 8.8

  A use-after-free vulnerability in Google Chrome's WebRTC component on Linux systems allows attackers to execute arbitrary code if a user visits a specially crafted webpage. The vulnerability stems from improper memory management in the WebRTC implementation, where code attempts to access memory that has already been freed. This can be exploited remotely without requiring special user privileges, though user interaction (visiting a malicious page) is necessary. The issue affects Chrome versions prior to 149.0.7827.53 on Linux.

• CVE-2026-11076HIGH 8.8

  A type confusion vulnerability in Google Chrome's CSS handling allows attackers to execute malicious code within the browser's sandbox by tricking users into visiting a specially crafted webpage. The vulnerability affects Chrome versions prior to 149.0.7827.53 and requires user interaction (clicking a link or visiting a site), but once triggered, grants the attacker code execution capabilities despite the sandbox protections that normally isolate the browser from the rest of the system.

• CVE-2026-11077HIGH 8.8

  A flaw in the Dawn graphics component of Google Chrome allows attackers to run malicious code within the browser's sandbox by tricking users into visiting a specially crafted website. The vulnerability requires user interaction (clicking a link or visiting a page) but doesn't require any special privileges. Once exploited, an attacker gains the same permissions as the Chrome process, potentially allowing them to steal data or compromise the system.

• CVE-2026-11079HIGH 8.8

  Google Chrome contains a vulnerability in its video codec handling that allows attackers to write data outside the intended memory boundaries. An attacker can exploit this by crafting a malicious video file and tricking a user into opening it, potentially allowing the attacker to execute arbitrary code, steal sensitive information, or crash the browser. This affects Chrome versions prior to 149.0.7827.53 across Windows, macOS, and Linux systems.

• CVE-2026-11080HIGH 8.8

  A use-after-free memory vulnerability exists in Google Chrome's WebView component on Android devices. An attacker can craft a malicious HTML page that, when visited by a user, triggers memory corruption in the browser's heap. This could allow the attacker to execute arbitrary code or crash the application. The vulnerability affects Chrome versions before 149.0.7827.53 on Android.

• CVE-2026-11085HIGH 8.8

  A flaw in Google Chrome's GPU processing on Android devices allows attackers to trigger an integer overflow—a mathematical error where a number exceeds its storage limit—when rendering specially crafted web pages. This overflow can lead to out-of-bounds memory access, potentially allowing attackers to read sensitive data, modify system memory, or crash the application. The vulnerability requires user interaction (visiting a malicious page) but poses significant risk because it can be triggered remotely and affects a widely-used browser on millions of Android devices.

• CVE-2026-11086HIGH 8.8

  A vulnerability in Google Chrome's Dawn graphics component allows an attacker who has already compromised the browser's renderer process to break out of the sandbox and execute arbitrary code with full system privileges. The attack requires user interaction (opening a malicious HTML page), but once triggered, it completely undermines Chrome's security architecture. Chrome versions prior to 149.0.7827.53 are affected on Windows, macOS, and Linux systems.

• CVE-2026-11091HIGH 8.8

  A flaw in Google Chrome's graphics rendering engine (Dawn) allows attackers to trick users into visiting malicious web pages that can read sensitive data, modify files, or crash the browser. The vulnerability requires user interaction—specifically clicking a link or visiting a crafted website—but once triggered, it bypasses Chrome's memory protections. This affects Chrome versions before 149.0.7827.53 across Windows, macOS, and Linux.

• CVE-2026-11092HIGH 8.8

  A flaw in Google Chrome's developer tools (DevTools) fails to properly enforce security policies, allowing an attacker to escalate privileges if they can trick a user into installing a malicious browser extension. The vulnerability affects Chrome versions before 149.0.7827.53 across Windows, macOS, and Linux. While the attacker needs user interaction (installing the extension), the resulting privilege escalation grants them high-impact access to the browser process and potentially sensitive data.

• CVE-2026-11102HIGH 8.8

  Google Chrome versions before 149.0.7827.53 contain a flaw in how Isolated Web Apps are implemented that could allow an attacker to run malicious code inside Chrome's sandbox. The vulnerability requires user interaction—such as opening a malicious file—but does not require any special privileges. Once triggered, an attacker gains the ability to read sensitive data, modify information, or disrupt availability within the sandbox context.

• CVE-2026-11108HIGH 8.8

  A flaw in how Google Chrome handles NFC (Near Field Communication) on Android devices allows an attacker to trick a user into visiting a malicious website, which can then escape the browser sandbox and gain elevated privileges on the device. The vulnerability requires user interaction—specifically clicking a link or visiting a page—but does not require the attacker to be network-adjacent or have special system access. Once exploited, an attacker gains the same privileges as the Chrome browser process, potentially enabling access to sensitive data or further system compromise.

• CVE-2026-11116HIGH 8.8

  Google Chrome contains a use-after-free memory vulnerability in its Chromoting remote desktop feature that can be triggered by malicious network traffic. An attacker can send specially crafted packets to a targeted user, leading to arbitrary code execution on the victim's machine. The vulnerability requires user interaction—specifically, the user must be engaged in an active Chromoting session—but once triggered, it grants the attacker the same privileges as the Chrome process.

• CVE-2026-11117HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's Views component on Windows systems. An attacker can exploit this flaw by crafting a malicious HTML page that, when visited by a user, allows remote code execution on the victim's machine. The vulnerability affects Chrome versions prior to 149.0.7827.53 and requires user interaction (visiting a malicious site), but once triggered, grants the attacker full system compromise capabilities.

• CVE-2026-11118HIGH 8.8

  A memory safety vulnerability exists in Google Chrome's WebRTC implementation that could allow attackers to run malicious code within the browser's sandbox. The flaw stems from a use-after-free condition—where the browser continues using memory that has already been freed—which can be triggered by visiting a specially crafted webpage. No special permissions or user interaction beyond clicking a link or viewing a page are required, making this a significant remote code execution risk despite being contained within the sandbox.

• CVE-2026-11124HIGH 8.8

  A memory handling flaw in Chrome's Skia graphics library allows attackers to trigger heap corruption by serving a specially crafted webpage. The vulnerability requires user interaction (visiting a malicious page) but needs no special privileges and works across all major operating systems where Chrome runs. An attacker could achieve code execution with full system access—reading files, modifying data, installing malware, or pivoting to other systems.

• CVE-2026-11125HIGH 8.8

  A use-after-free memory flaw in Google Chrome's compositing system allows attackers to run arbitrary code within Chrome's sandbox by tricking users into visiting a malicious webpage. The vulnerability affects Chrome versions before 149.0.7827.53 across Windows, macOS, and Linux. While contained by the sandbox, successful exploitation could grant an attacker the same privileges as the Chrome process, potentially compromising sensitive browser data and operations.

• CVE-2026-11130HIGH 8.8

  A use-after-free vulnerability in Google Chrome's media handling allows attackers to run malicious code within Chrome's sandbox by tricking users into visiting a specially crafted website. While the underlying Chromium project rates this as Medium severity, the CVSS score of 8.8 reflects the practical risk: it requires user interaction (clicking a link or visiting a site), but once triggered, it can lead to full compromise of the Chrome process, potentially exposing sensitive data or enabling further attacks on the underlying system.

• CVE-2026-11136HIGH 8.8

  Google Chrome versions prior to 149.0.7827.53 contain a use-after-free vulnerability in the Canvas component that allows attackers to execute arbitrary code within the browser sandbox. An attacker can exploit this flaw by crafting a malicious HTML page that, when visited by a user, triggers memory corruption and leads to code execution. The vulnerability requires user interaction (visiting a webpage) but needs no special privileges to trigger.

• CVE-2026-11144HIGH 8.8

  A use-after-free memory flaw in Google Chrome's media handling allows an attacker to execute malicious code within Chrome's sandbox by tricking a user into opening a specially crafted video file. While sandboxed, successful exploitation could still grant an attacker significant control over the affected browser process and potentially access to sensitive user data.

• CVE-2026-11147HIGH 8.8

  A use-after-free vulnerability exists in Chrome's WebML (Web Machine Learning) component on Windows. An attacker can craft a malicious HTML page that, when visited by a user, triggers code execution within Chrome's sandbox. Although the sandbox contains the damage, the vulnerability allows an attacker to breach browser process isolation and execute arbitrary code with the privileges of the Chrome renderer process.

• CVE-2026-11164HIGH 8.8

  A use-after-free vulnerability exists in Blink, Google Chrome's rendering engine, affecting versions prior to 149.0.7827.53. An attacker can craft a malicious HTML page that, when visited by a user, exploits this memory safety flaw to execute arbitrary code within the Chrome sandbox. While sandboxed, successful exploitation grants an attacker code execution capabilities on the victim's machine, potentially enabling further compromise.

• CVE-2026-11171HIGH 8.8

  A flaw in Blink, the rendering engine behind Google Chrome, allows attackers to trigger an integer overflow by sending a specially crafted web page. If a user visits a malicious site, the attacker can run malicious code within Chrome's sandbox. While the sandbox limits damage, this vulnerability bypasses a critical security boundary and is rated HIGH severity.

• CVE-2026-11172HIGH 8.8

  A UI spoofing flaw in Chrome's Contact Picker on Android allows attackers to trick users via specially crafted web pages. When a user attempts to select a contact, a malicious site can mask its true identity or intentions by manipulating the security UI elements that normally help users understand what app or service is asking for contact information. This deceives users into granting access to their contacts under false pretenses.

• CVE-2026-11173HIGH 8.8

  A memory writing vulnerability in Google Chrome's V8 JavaScript engine (used to execute web code) allows a specially crafted webpage to trigger an out-of-bounds write operation. An attacker who has already compromised the browser's rendering process can exploit this flaw to break out of the sandbox and run arbitrary code with the privileges of the Chrome process. This requires an attacker to first gain control of the renderer, making it a post-compromise escalation vector rather than a direct entry point.

• CVE-2026-11175HIGH 8.8

  Google Chrome on Android contains a flaw in how it displays security-related UI elements within the Messages feature. An attacker can craft a malicious webpage that tricks users into thinking they're interacting with legitimate Chrome security dialogs or warnings, when they're actually seeing fake ones controlled by the attacker. This UI spoofing attack requires user interaction—the victim must visit the malicious page—but once they do, the attacker can deceive them into taking actions they wouldn't normally take, such as entering credentials or approving permissions.

• CVE-2026-11177HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's Omnibox (the combined address and search bar). An attacker can craft a malicious HTML page that, when a user performs specific interactions with the Omnibox, triggers memory corruption. Successful exploitation requires user interaction—the attacker cannot silently compromise a machine, but if a targeted user visits a crafted page and engages with the address bar in a particular way, the attacker could potentially execute arbitrary code with the privileges of the Chrome process.

• CVE-2026-11179HIGH 8.8

  Google Chrome versions before 149.0.7827.53 contain a flaw in the Object Request Broker (ORB) feature that allows attackers to bypass site isolation—a critical Chrome security boundary that prevents websites from accessing each other's data. An attacker can exploit this by hosting a malicious HTML page that, when visited by a user, breaks through site isolation and gains unauthorized access to sensitive information from other open tabs or windows. The vulnerability requires user interaction (visiting the crafted page) but demands no special privileges, making it a practical concern for any Chrome user.

• CVE-2026-11188HIGH 8.8

  A use-after-free vulnerability in Chrome's USB handling on Android devices allows an attacker to escape the browser's security sandbox by tricking a user into visiting a specially crafted webpage. Once the sandbox is bypassed, the attacker could gain elevated privileges on the device. The vulnerability affects Chrome versions prior to 149.0.7827.53 on Android.

• CVE-2026-11191HIGH 8.8

  A memory safety flaw in Chrome's ANGLE graphics library allows attackers to access memory beyond intended boundaries when a user visits a malicious webpage. An attacker can craft HTML that exploits this out-of-bounds read or write to leak sensitive data, crash the browser, or execute code with the privileges of the Chrome process. The vulnerability affects Chrome versions prior to 149.0.7827.53 across Windows, macOS, and Linux.

• CVE-2026-11201HIGH 8.8

  Google Chrome versions prior to 149.0.7827.53 contain a use-after-free vulnerability in the ServiceWorker component that allows arbitrary code execution. The vulnerability requires an attacker to convince a user to install a malicious Chrome extension, after which the attacker can exploit memory handling flaws to run code with the privileges of the browser. This is not a vulnerability in the browser itself that users encounter passively—it requires social engineering to trick a user into voluntarily installing a compromised extension.

• CVE-2026-11202HIGH 8.8

  Google Chrome on iOS versions before 149.0.7827.53 contain a sandbox escape vulnerability triggered by viewing a malicious webpage. An attacker can craft a specially designed HTML page that, when opened in Chrome on an iPhone, could break out of the browser's security sandbox and gain access to the underlying operating system. This means an attacker could potentially read files, install malware, or take control of the device without requiring any special user permissions beyond clicking a link or visiting a website.

• CVE-2026-11211HIGH 8.8

  A flaw in Google Chrome's V8 JavaScript engine allows attackers to run malicious code with limited privileges inside Chrome's sandbox by tricking users into visiting a specially crafted website. While the malicious code runs in a restricted environment, the sandbox breach itself represents a significant security boundary violation that could be chained with other exploits to gain fuller system control.

• CVE-2026-11230HIGH 8.8

  Google Chrome versions prior to 149.0.7827.53 contain a use-after-free vulnerability in the Extensions subsystem that could allow an attacker to execute arbitrary code within Chrome's sandbox. An attacker would need to trick a user into visiting a malicious HTML page. While Chromium initially categorized this as low severity, the CVSS score reflects the real-world impact: complete compromise of confidentiality, integrity, and availability within the sandboxed context.

• CVE-2026-11235HIGH 8.8

  Google Chrome versions prior to 149.0.7827.53 contain a sandbox escape vulnerability in the compositing system. An attacker who successfully compromises Chrome's renderer process (the sandboxed component responsible for rendering web content) can exploit insufficient policy enforcement to execute arbitrary code with elevated privileges, bypassing the sandbox entirely. The attack requires a crafted HTML page and user interaction, making it a post-compromise threat rather than a direct entry point. While Chromium rated this Low severity, the CVSS score of 8.8 reflects the critical nature of sandbox escapes, which transform a contained renderer compromise into full system code execution.

• CVE-2026-11248HIGH 8.8

  CVE-2026-11248 is a bypass vulnerability in Google Lens, a feature within Chrome that allows users to perform visual searches. An attacker can craft a malicious webpage that, when visited by a user, circumvents Chrome's navigation security controls. This means a user could be redirected to an unintended destination or prevented from safely navigating away. The vulnerability requires user interaction—the user must visit the attacker's page—but once there, the attack happens automatically. Google has patched this in Chrome 149.0.7827.53 and later.

• CVE-2026-11262HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's TabStrip component that allows attackers to execute arbitrary code on a victim's machine. The flaw requires user interaction—specifically, visiting a malicious webpage—but once triggered, grants full code execution privileges. Chrome versions prior to 149.0.7827.53 are affected. Despite Chromium's internal severity rating of 'Low', the CVSS 3.1 score reflects the real-world impact: remote code execution with no authentication needed, complete compromise of confidentiality, integrity, and availability.

• CVE-2026-11272HIGH 8.8

  A flaw in Google Chrome's Reading List feature on iOS allows attackers to trick users into performing specific actions (like tapping or swiping) that trigger a privilege escalation attack. An attacker would need to craft a malicious webpage and convince the user to interact with it in a particular way. Once exploited, the attacker gains elevated permissions on the device, potentially compromising sensitive data or device functionality.

• CVE-2026-11279HIGH 8.8

  Google Chrome versions prior to 149.0.7827.53 contain an out-of-bounds read vulnerability in the DevTools component that allows an attacker to execute arbitrary code within the Chrome sandbox. An attacker would need to trick a user into visiting a crafted HTML page, but would not need any special privileges or system access. While Chromium's internal severity assessment is Low, the CVSS 3.1 score of 8.8 reflects the high severity due to the potential for code execution within a restricted sandbox environment.

• CVE-2026-11295HIGH 8.8

  A vulnerability in Google Chrome's WebView on Android allows attackers to escalate their privileges by tricking users into visiting a specially crafted webpage. WebView is the component that renders web content within Android apps, so this affects not just Chrome but any app built on this framework. An attacker needs user interaction (clicking or viewing the malicious page), but once triggered, the vulnerability grants them elevated system permissions—a significant breach of the Android security model.

• CVE-2026-11301HIGH 8.8

  A vulnerability in Google Chrome's LiveCaption feature allows attackers to access memory outside safe boundaries by sending specially crafted network traffic. While Chrome assigned this a low severity rating internally, the vulnerability can lead to information disclosure, data corruption, or system crashes depending on what memory region is accessed. The attack requires user interaction—the user must be running a vulnerable Chrome version and receive the malicious traffic—but no special privileges are needed from the attacker's perspective.

• CVE-2026-11303HIGH 8.8

  A use-after-free vulnerability in PDFium, the PDF rendering engine embedded in Google Chrome, allows attackers to execute arbitrary code within Chrome's sandbox by tricking users into opening a specially crafted PDF file. While the vulnerability requires user interaction (opening a malicious PDF), the impact is severe: an attacker gains code execution inside the sandboxed Chrome process, potentially leading to data theft, system compromise, or further exploitation. The vulnerability affects Chrome versions prior to 149.0.7827.53 across Windows, macOS, and Linux platforms.

• CVE-2026-11304HIGH 8.8

  A use-after-free flaw in PDFium, the PDF rendering engine used by Google Chrome, allows attackers to corrupt heap memory when a user opens a specially crafted PDF file. An attacker could exploit this to potentially execute arbitrary code or crash the browser. The vulnerability requires user interaction (opening a malicious PDF) but is otherwise straightforward to exploit remotely.

• CVE-2026-11305HIGH 8.8

  A use-after-free flaw in PDFium, the PDF rendering engine embedded in Google Chrome, allows attackers to execute arbitrary code within Chrome's sandbox by tricking users into opening a malicious PDF file. The vulnerability affects Chrome versions prior to 149.0.7827.53 across Windows, macOS, and Linux. While Chromium assigned this a Low security severity rating, the CVSS score of 8.8 reflects the practical risk: a remote attacker needs only a crafted PDF and user interaction to achieve code execution with high impact on confidentiality, integrity, and availability.

• CVE-2026-11306HIGH 8.8

  A memory safety bug in Google Chrome's PDF rendering engine (PDFium) allows attackers to run malicious code within Chrome's sandbox by sending a victim a specially crafted PDF file. The attacker needs the user to open the PDF—there's no way to trigger this remotely without interaction. While the Chromium team rated the issue as Low severity internally, the actual impact is significant: an attacker gains arbitrary code execution within the browser sandbox, potentially stealing data or performing other malicious actions. This affects Chrome on Windows, macOS, and Linux.

• CVE-2026-11307HIGH 8.8

  A use-after-free memory bug in PDFium—the PDF rendering library bundled with Google Chrome—allows attackers to run arbitrary code within Chrome's sandbox by sending a malicious PDF file. The vulnerability requires user interaction (opening the PDF) but can fully compromise a victim's browser process, stealing data or installing malware. While Google rated this as low severity internally, the CVSS score of 8.8 reflects the serious consequences: an attacker gains code execution with high impact to confidentiality, integrity, and availability.

• CVE-2026-11413HIGH 8.8

  A stack-based buffer overflow vulnerability exists in JingDong JD Cloud Box AX6600 running firmware version 4.5.3.r4546. An authenticated attacker can send a specially crafted request to the set_macfilter function in the device's web RPC service to overflow the stack and potentially execute arbitrary code. The vulnerability is remotely exploitable and exploit code has already been publicly disclosed, making it a concrete risk for organizations using this router model.

• CVE-2026-11419HIGH 8.8

  Altium Enterprise Server contains a flaw in how it validates file paths when users upload images. An authenticated attacker can bypass the normal storage location restrictions and write files anywhere on the server's filesystem. This primitive can be weaponized to inject malicious code, take over the service, or crash it entirely. Cloud-hosted Altium 365 deployments are not vulnerable because the vulnerable upload endpoint is not exposed in that architecture.

• CVE-2026-11498HIGH 8.8

  Tenda wireless routers (models HG7, HG9, and HG10) contain a critical flaw in their web-based management interface. An authenticated attacker can send a specially crafted request to the VoIP settings page that overwrites memory on the router, leading to complete compromise of the device. The vulnerability requires a valid login but can be exploited over the network without user interaction. Once exploited, an attacker gains full control over the router's functions, including potential interception of network traffic and manipulation of connected devices.

• CVE-2026-11503HIGH 8.8

  Tenda's CX12L router model 16.03.53.12 contains a critical flaw in its Wi-Fi configuration interface that allows authenticated attackers to crash the device or execute arbitrary code by sending specially crafted requests with oversized network names (SSIDs). The vulnerability exists in the fast_setting_wifi_set function and has been publicly disclosed, increasing the risk of active exploitation.

• CVE-2026-11504HIGH 8.8

  A stack-based buffer overflow vulnerability exists in Tenda CX12L routers running firmware version 16.03.53.12. The flaw is in the Wi-Fi scheduling feature and can be exploited by authenticated users to corrupt memory and potentially execute arbitrary code. An attacker with valid login credentials can send specially crafted scheduling parameters that overflow a buffer, compromising the router's confidentiality, integrity, and availability. Public exploit code has emerged, increasing active risk.

• CVE-2026-11517HIGH 8.8

  A buffer overflow vulnerability exists in UTT HiPER 2610G network devices running firmware version 3.0.0-171107 and earlier. An authenticated user can send a specially crafted request to the DNS filter configuration page that overwrites memory and crashes the device or potentially executes malicious code. The flaw has been publicly disclosed, meaning attackers have visibility into exploitation techniques.

• CVE-2026-11522HIGH 8.8

  Tenda W20E routers running firmware version 15.11.0.6 contain a stack-based buffer overflow vulnerability in the port mirroring configuration feature. An attacker with valid network access can send a specially crafted request to the router's web interface that causes a buffer overflow when processing the portMirrorMirroredPorts parameter. This flaw allows remote code execution with full system privileges, potentially giving attackers complete control over the router and any network traffic passing through it. Public exploit code is now available, elevating the practical risk.

• CVE-2026-11523HIGH 8.8

  A stack-based buffer overflow vulnerability has been discovered in Tenda W20E firmware version 15.11.0.6. An authenticated attacker can manipulate the 'gotoUrl' parameter in the web management interface's portal authentication function to overflow a stack buffer, potentially gaining full control of the device. Public exploits for this vulnerability are available, elevating the risk of active exploitation.

• CVE-2026-11524HIGH 8.8

  A stack-based buffer overflow vulnerability exists in Tenda W20E version 15.11.0.6, specifically in the web management interface's WiFi filter rule modification function. An authenticated attacker can exploit this by sending a specially crafted request with an oversized remark parameter, allowing them to overwrite stack memory and potentially execute arbitrary code on the device. The vulnerability requires valid credentials but no user interaction, making it a practical post-authentication attack vector for network administrators or compromised accounts.

• CVE-2026-11528HIGH 8.8

  A stack-based buffer overflow vulnerability affects Tenda AC18 running firmware version 15.03.05.05. An attacker with valid login credentials can send a specially crafted request to the web management interface's reboot status endpoint, causing a buffer overflow that could lead to arbitrary code execution on the device. The vulnerability has been publicly disclosed and exploit code is available, increasing the practical risk.

• CVE-2026-11553HIGH 8.8

  Tenda HG7, HG9, and HG10 routers contain a dangerous flaw in their web interface that allows an authenticated attacker to crash the device or take control of it by sending a specially crafted request. The vulnerability resides in how the router processes user input for a specific configuration parameter, failing to properly validate the length of data before storing it in memory. An attacker with login credentials can exploit this remotely without any user interaction.

• CVE-2026-11556HIGH 8.8

  Tenda F451 wireless routers running firmware versions 1.0.0.7 or 1.0.0.9 contain a command injection vulnerability in their web management interface. An authenticated attacker can craft malicious input to the MAC address field in the WriteFacMac function, allowing them to execute arbitrary operating system commands on the device. The vulnerability requires login credentials but poses a serious risk because successful exploitation grants full control over the router, potentially compromising all network traffic and devices connected to it.

• CVE-2026-11557HIGH 8.8

  A stack-based buffer overflow vulnerability has been discovered in Tenda F451 wireless router firmware versions 1.0.0.7 and 1.0.0.9. An authenticated attacker can exploit this flaw by manipulating the 'page' parameter in the Natlimit web management interface to overflow the stack memory, potentially allowing them to execute arbitrary code or crash the device. Public exploit code is available, elevating the practical risk. The vulnerability requires valid login credentials but no user interaction, making it exploitable in environments where network access and authentication are possible.

• CVE-2026-11572HIGH 8.8

  Degit, a popular tool for cloning Git repositories, contains a command injection vulnerability that allows attackers to run arbitrary system commands on machines using vulnerable versions. The flaw exists because the application doesn't properly validate repository names before passing them to shell commands. An attacker only needs to trick a user into cloning from a malicious repository URL to gain code execution with the privileges of the process running degit.

• CVE-2026-11616HIGH 8.8

  The Events Calendar for GeoDirectory WordPress plugin contains a privilege escalation flaw that allows authenticated users with Subscriber-level permissions to become Administrator. An attacker can manipulate input fields in a specific AJAX handler to inject WordPress capability data directly into their user profile, granting them full admin rights. This affects versions up to 2.3.28 and requires only valid WordPress account credentials to exploit.

• CVE-2026-11629HIGH 8.8

  A use-after-free vulnerability in Google Chrome's Ozone component allows attackers to crash the browser or corrupt its memory by tricking users into visiting a specially crafted webpage. The attacker needs the victim to click a link or visit a malicious site—no special privileges are required. Chrome versions before 149.0.7827.103 are affected.

• CVE-2026-11630HIGH 8.8

  Google Chrome versions prior to 149.0.7827.103 contain a use-after-free vulnerability in its file input handling. An attacker can craft a malicious HTML page that, when visited by a user, triggers improper memory management in Chrome's file handling code. This allows the attacker to corrupt memory on the victim's computer, potentially leading to arbitrary code execution. The vulnerability requires user interaction (visiting a malicious webpage) but affects users across Windows, macOS, and Linux systems.

• CVE-2026-11633HIGH 8.8

  Google Chrome on macOS contains a use-after-free vulnerability in its Bluetooth handling code. This flaw allows a remote attacker to execute arbitrary code on a victim's machine if that person connects to or interacts with a malicious Bluetooth peripheral while using an unpatched version of Chrome. The vulnerability affects Chrome versions prior to 149.0.7827.103 on Mac systems.

• CVE-2026-11637HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's Views component on macOS that allows attackers to execute arbitrary code on a victim's machine. The flaw is triggered when a user visits a specially crafted webpage, requiring no special privileges or complex setup. Google has classified this as a critical severity issue in the underlying Chromium project. This vulnerability affects Chrome versions prior to 149.0.7827.103 on macOS systems.

• CVE-2026-11646HIGH 8.8

  A use-after-free flaw in Google Chrome's ViewTransitions feature allows attackers to run arbitrary code within Chrome's sandbox by tricking users into visiting a malicious website. The vulnerability exists in Chrome versions before 149.0.7827.103 and requires user interaction—specifically clicking or otherwise engaging with a crafted HTML page. While the code runs in a sandboxed environment (limiting direct system access), it still represents a significant threat because sandbox escapes are a known attack progression.

• CVE-2026-11648HIGH 8.8

  A use-after-free memory flaw exists in Google Chrome's full-screen functionality on Windows. An attacker can craft a malicious web page that, when visited, exploits this flaw to corrupt the browser's memory heap. This could allow the attacker to execute arbitrary code on the victim's machine with the same privileges as the user running Chrome. The vulnerability requires user interaction (clicking or navigating to the malicious page) but no special privileges or complex setup.

• CVE-2026-11649HIGH 8.8

  Google Chrome versions before 149.0.7827.103 contain a use-after-free vulnerability in the V8 JavaScript engine that allows attackers to execute arbitrary code within the Chrome sandbox by serving a malicious HTML page. The flaw requires user interaction (clicking a link or visiting a site) but does not require special privileges. While the sandbox limits the immediate blast radius, successful exploitation could grant an attacker control over the browser process and access to user data like credentials, session tokens, and browsing history.

• CVE-2026-11650HIGH 8.8

  A use-after-free flaw in Google Chrome's V8 JavaScript engine allows attackers to execute arbitrary code within the browser's sandbox by tricking users into visiting a malicious website. The vulnerability affects Chrome versions before 149.0.7827.103 and requires user interaction (clicking a link or visiting a page). While the code runs in a sandboxed environment, successful exploitation could allow attackers to break out of the sandbox or pivot to other browser features, making this a serious but not trivial attack vector.

• CVE-2026-11657HIGH 8.8

  Google Chrome on macOS contains a use-after-free memory flaw in its Payments feature that allows an attacker to run malicious code on a user's machine. The vulnerability is triggered when a user visits a specially crafted website, making it relatively easy to exploit in the wild. Chrome versions before 149.0.7827.103 on macOS are affected. This is a remote code execution risk that requires user interaction (clicking a link or visiting a site) but no special privileges.

• CVE-2026-11662HIGH 8.8

  A type confusion vulnerability in Google Chrome's bindings mechanism allows attackers to execute arbitrary code within the Chrome sandbox by serving a specially crafted HTML page. The flaw affects Chrome versions before 149.0.7827.103 and requires user interaction (visiting a malicious page) to trigger. While sandboxed, successful exploitation could lead to complete compromise of the affected Chrome process, including data theft and system-level attacks if combined with additional vulnerabilities.

• CVE-2026-11664HIGH 8.8

  A use-after-free vulnerability exists in Google Chrome's Payments component that could allow an attacker to corrupt browser memory and potentially execute arbitrary code. An attacker would need to trick a user into visiting a malicious website to trigger the flaw. The issue affects Chrome versions prior to 149.0.7827.103 and is considered high-severity by Google's security team.

• CVE-2026-11670HIGH 8.8

  A use-after-free vulnerability in Google Chrome's PDF renderer allows attackers to run malicious code within the browser's sandbox by crafting a specially designed PDF file. The attack requires user interaction—specifically, opening a malicious PDF—but once triggered, it can lead to complete compromise of the affected browser process. This affects Chrome versions prior to 149.0.7827.103 across Windows, macOS, and Linux systems.

• CVE-2026-11673HIGH 8.8

  A use-after-free vulnerability in Google Chrome's InterestGroups feature allows attackers to execute arbitrary code within the browser's sandbox by tricking users into visiting a malicious webpage. The vulnerability affects Chrome versions prior to 149.0.7827.103 and can be exploited without requiring user privileges beyond normal web browsing.

• CVE-2026-11674HIGH 8.8

  A use-after-free flaw in Google Chrome's Guest View feature allows attackers to run malicious code within the browser sandbox by tricking users into visiting a specially crafted webpage. While the exploit runs in a sandboxed environment, a successful attack could still compromise sensitive data or enable further system compromise. The vulnerability affects Chrome versions before 149.0.7827.103 and requires user interaction to trigger.

• CVE-2026-11680HIGH 8.8

  Google Chrome contains a use-after-free vulnerability in its Media component that could allow an attacker to run malicious code within Chrome's sandbox by tricking a user into visiting a specially crafted website. The flaw affects Windows systems running Chrome versions prior to 149.0.7827.103. While the exploit requires user interaction (clicking a link or visiting a site), the potential impact is severe: an attacker could steal sensitive data, modify files, or cause denial of service, all while operating within Chrome's restricted sandbox environment.

• CVE-2026-11681HIGH 8.8

  A use-after-free vulnerability exists in the Ozone display layer of Google Chrome on Linux systems. An attacker can craft a malicious HTML page that, when visited by a user, triggers improper memory management and causes heap corruption. This can lead to a crash or arbitrary code execution on the victim's machine. The vulnerability requires user interaction (clicking a link or visiting a site) but does not require any special browser configuration or elevated privileges.

• CVE-2026-11683HIGH 8.8

  Google Chrome contains a use-after-free vulnerability in its WebCodecs component that allows remote attackers to execute arbitrary code within the browser sandbox. An attacker would need to trick a user into visiting a specially crafted webpage to trigger the flaw. Once exploited, the attacker gains code execution privileges within Chrome's sandbox environment, which limits but does not eliminate the potential for system compromise depending on sandbox escape possibilities.

• CVE-2026-11687HIGH 8.8

  A memory safety flaw in Google Chrome's graphics rendering engine (Dawn) on macOS allows attackers to corrupt memory on a victim's computer by tricking them into visiting a malicious website. The vulnerability exists in Chrome versions before 149.0.7827.103 and can lead to complete compromise of the affected system.

• CVE-2026-11688HIGH 8.8

  Google Chrome versions prior to 149.0.7827.103 contain a flaw in how the browser handles SVG (Scalable Vector Graphics) content. An attacker can craft a malicious HTML page that, when visited by a user, executes arbitrary code within Chrome's sandbox environment. While the sandbox is designed to limit damage, this vulnerability allows an attacker to breach that boundary, potentially compromising user data and system integrity.

• CVE-2026-11698HIGH 8.8

  Google Chrome on macOS contains a use-after-free vulnerability in its Bluetooth handling code that allows attackers to corrupt heap memory when a victim visits a malicious website. The vulnerability affects Chrome versions before 149.0.7827.103 and requires user interaction (clicking a link or visiting a site) but does not require special privileges. Successful exploitation can lead to data theft, system compromise, or application crash.

• CVE-2026-11699HIGH 8.8

  A use-after-free vulnerability exists in the Bluetooth component of Google Chrome on macOS. An attacker can craft a malicious webpage that, when visited by a user, exploits this flaw to corrupt the browser's memory and potentially execute arbitrary code. The vulnerability requires user interaction (visiting a link or webpage) but does not require the victim to have any special privileges. Google has assigned it high severity and has released a patch in Chrome version 149.0.7827.103.

• CVE-2026-1784HIGH 8.8

  A flaw in OpenShift's Route resource allows users with low-level cluster access to inject malicious HAProxy configuration through the spec.path field. Because validation of this field is insufficient, an attacker can bypass intended restrictions and alter how traffic is routed, potentially redirecting requests or exposing sensitive data. This is a local privilege escalation risk requiring existing cluster access but delivering high-impact consequences.

• CVE-2026-1829HIGH 8.8

  The Content Visibility for Divi Builder plugin for WordPress contains a critical flaw that allows attackers with basic WordPress user access to run arbitrary code on affected servers. The vulnerability exists in how the plugin processes a specific shortcode parameter without proper validation, creating a direct path to server compromise. Any WordPress installation using this plugin up to version 4.02 is at risk if it has users with Contributor access or higher privileges.

• CVE-2026-21837HIGH 8.8

  HCL Digital Experience contains an OS command injection flaw in its Digital Asset Management API that allows authenticated attackers to run arbitrary commands on the underlying system. Because the API typically executes with application-level privileges, successful exploitation could grant an attacker a foothold to pivot deeper into your infrastructure or exfiltrate sensitive data. This is a post-authentication vulnerability, meaning an attacker needs valid credentials to exploit it.

• CVE-2026-22054HIGH 8.8

  NetApp Active IQ Config Advisor version 6.7.3 contains hard-coded credentials embedded in the application code. An attacker with valid login credentials—even with minimal user privileges—can exploit these hard-coded credentials to perform AutoSupport operations without authorization. AutoSupport is a critical diagnostic and support feature that transmits sensitive system configuration and performance data to NetApp; unauthorized use could lead to data exfiltration, system misconfiguration, or support channel manipulation.