2026 · Medium

Medium-severity vulnerabilities disclosed in 2026

Medium-rated CVEs published in 2026, with SEC.co remediation and prioritization guidance.

4010 published vulnerabilities · page 3 of 41

• CVE-2026-11057MEDIUM 6.5

  A flaw in the Skia graphics library used by Chrome allows attackers who have already compromised a browser's rendering engine to read sensitive data from memory by sending a specially crafted web page. The vulnerability requires two conditions: the attacker must first gain control of the renderer process (typically through a separate vulnerability), and the user must visit the malicious page. Once both are true, uninitialized memory regions become readable, potentially exposing passwords, tokens, or other sensitive information that happen to be in RAM.

• CVE-2026-11064MEDIUM 6.5

  A race condition in Google Chrome's GPU rendering engine on Android devices allows an attacker who has already compromised the renderer process to steal data from websites you're visiting. The attacker would trick you into viewing a specially crafted webpage, which exploits a timing gap in how the GPU handles memory to read sensitive information across security boundaries. This is a real but limited threat because the attacker must first gain control of Chrome's renderer—a significant prerequisite.

• CVE-2026-11067MEDIUM 6.5

  Google Chrome versions prior to 149.0.7827.53 contain a memory safety vulnerability in the Dawn graphics component that allows attackers to steal sensitive data from browser process memory. An attacker crafts a malicious webpage that, when visited, exploits the uninitialized memory access to leak information that could include cached passwords, session tokens, or other private data. The attack requires user interaction (visiting the page) but works across networks without special privileges.

• CVE-2026-11069MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the Cast feature validates user input, allowing an attacker to craft a malicious HTML page that bypasses the browser's same-origin policy. If a user visits the attacker's page, it could potentially access or modify data from other websites the user is logged into, though without stealing that data directly. This is a moderate-severity issue affecting Windows, macOS, and Linux users.

• CVE-2026-11073MEDIUM 6.5

  A use-after-free vulnerability exists in Google Chrome's WebGL rendering engine that could allow an attacker to steal sensitive data from your browser's memory. An attacker would need to trick you into visiting a malicious webpage to exploit this flaw. While the vulnerability requires user interaction to trigger, the potential exposure of process memory—which may contain cached passwords, authentication tokens, or other sensitive information—makes it a meaningful security concern. The issue affects Chrome versions prior to 149.0.7827.53.

• CVE-2026-11075MEDIUM 6.5

  A flaw in Google Chrome's V8 JavaScript engine allows an attacker to read sensitive data from a browser process's memory by tricking a user into visiting a malicious webpage. The vulnerability exists in Chrome versions before 149.0.7827.53 and requires no special privileges to exploit—only user interaction to visit a crafted page. While the attacker cannot modify data or crash the browser, they can potentially extract confidential information like passwords, session tokens, or other data resident in memory.

• CVE-2026-11078MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser's FileSystem implementation validates cross-origin requests. If an attacker compromises Chrome's renderer process—the sandboxed component that executes web content—they can craft a malicious HTML page to bypass the same-origin policy, a foundational browser security mechanism that prevents one website from accessing data or resources belonging to another. The vulnerability requires the renderer to already be compromised, meaning an attacker would need to have successfully exploited a prior vulnerability to reach this point, making it a secondary but meaningful risk in a multi-stage attack chain.

• CVE-2026-11081MEDIUM 6.5

  A flaw in how Google Chrome handles Canvas operations before version 149.0.7827.53 allows attackers to circumvent browser same-origin policy protections. An attacker can craft a malicious HTML page that, when visited by a user, breaks the security boundary that normally prevents one website from accessing data or resources belonging to another. The attack requires user interaction (visiting the page) but no special browser configuration.

• CVE-2026-11083MEDIUM 6.5

  Google Chrome's password manager contained a flaw that could allow an attacker to trick users into leaking sensitive cross-origin data through a specially crafted webpage. The vulnerability requires user interaction—such as visiting a malicious site—but poses a meaningful risk because password managers are trusted to protect sensitive credentials and related information. An attacker exploiting this could potentially access data that should remain isolated between different websites.

• CVE-2026-11084MEDIUM 6.5

  A flaw in Google Chrome's password manager allows attackers to trick users into visiting a specially crafted website that can leak sensitive data from other websites the user has visited. The vulnerability requires user interaction—specifically, the victim must click on or interact with a malicious page—but once triggered, it can expose cross-site information that should normally be protected by browser security boundaries. This affects Chrome versions before 149.0.7827.53 on Windows, macOS, and Linux systems.

• CVE-2026-11087MEDIUM 6.5

  A memory safety issue in Google Chrome's ANGLE graphics library allows an attacker who has already compromised the renderer process to steal sensitive data from other websites. The vulnerability requires user interaction (visiting a malicious web page) and affects Chrome on Windows, macOS, and Linux. The attacker gains read-only access to cross-origin data, meaning they cannot modify it or crash the browser, but confidentiality is at risk.

• CVE-2026-11089MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a memory disclosure vulnerability in its media handling code. If an attacker gains control of Chrome's renderer process—the component responsible for displaying web content—they can craft a malicious HTML page to read uninitialized data from memory, potentially exposing sensitive information like passwords, encryption keys, or other confidential data. The vulnerability requires a prior compromise of the renderer, meaning it's typically chained with another exploit to be effective in the wild.

• CVE-2026-11090MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in the ANGLE graphics library that can be exploited to leak data across website boundaries. An attacker could craft a malicious webpage that, when visited, causes Chrome to inadvertently expose sensitive information from other origins a user has open. This requires user interaction (visiting the malicious page) but does not require special privileges. The vulnerability affects Windows, macOS, and Linux systems running vulnerable Chrome versions.

• CVE-2026-11093MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser handles printing functionality that could allow an attacker who has already compromised Chrome's rendering engine to steal sensitive data from websites the user visits. The attacker would need to trick the user into visiting a malicious webpage after gaining control of the renderer process. This is a medium-severity issue because it requires an intermediate compromise and user interaction, but the potential for cross-origin data leakage makes it worth prompt attention.

• CVE-2026-11096MEDIUM 6.5

  A memory reading flaw in Chrome's WebRTC component allows attackers to trick users into visiting a malicious webpage that steals sensitive data from the browser's memory. The vulnerability requires user interaction (clicking a link or visiting a site) but needs no special privileges, making it a practical attack vector for information theft. Google patched this in Chrome version 149.0.7827.53 and later.

• CVE-2026-11097MEDIUM 6.5

  Google Chrome on Android contains a flaw in how its WebView component handles cross-origin requests, allowing an attacker to trick users into visiting a malicious webpage that leaks sensitive data from other websites the user is logged into. The vulnerability requires user interaction (clicking a link or visiting a page) but does not require the user to be an administrator or to bypass additional security measures. This affects Chrome versions before 149.0.7827.53.

• CVE-2026-11101MEDIUM 6.5

  A vulnerability in Google Chrome's Dawn graphics library allows attackers to steal sensitive data from other websites when a user visits a malicious web page. The flaw stems from uninitialized memory being used improperly, potentially exposing information the attacker shouldn't be able to access. Chrome versions before 149.0.7827.53 on Windows are affected.

• CVE-2026-11104MEDIUM 6.5

  CVE-2026-11104 is a memory information disclosure flaw in ANGLE, a graphics abstraction library used by Google Chrome. An attacker who has already compromised Chrome's renderer process can craft a malicious HTML page to read uninitialized memory and leak sensitive data. This is not a trivial attack—it requires the renderer to be compromised first—but once that foothold exists, the vulnerability can amplify the damage by exposing additional secrets from the browser process. Chrome versions before 149.0.7827.53 are vulnerable.

• CVE-2026-11105MEDIUM 6.5

  A flaw in Google Chrome's WebUI component fails to properly validate user-supplied input, allowing an attacker who has already compromised Chrome's renderer process to trick the browser into leaking sensitive data from other websites. The vulnerability requires the renderer to be compromised first, which significantly limits the attack surface. Chrome versions before 149.0.7827.53 are affected.

• CVE-2026-11106MEDIUM 6.5

  A flaw in Google Chrome's media handling allows attackers to trick users into visiting a malicious web page that can steal private data from other websites the user has visited. The vulnerability requires user interaction—someone must click a link or visit the crafted page—but once they do, an attacker can bypass Chrome's normal security boundaries that keep websites isolated from each other. This affects Chrome on Windows, macOS, and Linux systems.

• CVE-2026-11109MEDIUM 6.5

  A vulnerability in the ANGLE graphics library used by Google Chrome can leak sensitive data from websites you're viewing to an attacker. An attacker would need to trick you into visiting a specially crafted webpage, but requires no special browser extensions or user interaction beyond visiting the page. The vulnerability affects Chrome versions prior to 149.0.7827.53 on Windows, macOS, and Linux systems.

• CVE-2026-11110MEDIUM 6.5

  A flaw in Google Chrome's graphics rendering engine (ANGLE) can leak sensitive data from websites you visit to attackers. The vulnerability exists in Chrome versions before 149.0.7827.53 and requires a user to click on or interact with a malicious webpage. When exploited, it exposes confidential information that should remain isolated between different websites.

• CVE-2026-11121MEDIUM 6.5

  CVE-2026-11121 is a medium-severity vulnerability in Skia, the graphics rendering engine used by Google Chrome. The flaw involves improper validation of untrusted input that could allow an attacker who has already compromised the browser's renderer process to extract sensitive data across origin boundaries using a specially crafted web page. This is not an initial entry point into systems, but rather a post-compromise escalation vector that broadens the damage an attacker can do once inside the browser process.

• CVE-2026-11123MEDIUM 6.5

  A flaw in ANGLE (the graphics abstraction layer used by Google Chrome) allows attackers to trick users into visiting a malicious website that reads sensitive information directly from Chrome's memory. The vulnerability was patched in Chrome version 149.0.7827.53. Because it requires user interaction (clicking a link or visiting a page), it's less critical than remotely exploitable flaws, but the memory disclosure risk—potentially exposing authentication tokens, cached data, or other secrets—warrants prompt patching.

• CVE-2026-11127MEDIUM 6.5

  Google Chrome on Android contains a flaw in how it handles WebAPKs—web applications packaged as native Android apps—that could allow an attacker to trick users into believing they're visiting a legitimate website when they're actually on a spoofed domain. An attacker would need to craft a malicious WebAPK and get a user to install it, but once active, the spoofing could occur without additional user interaction beyond normal app use. This affects Chrome versions before 149.0.7827.53 on Android.

• CVE-2026-11128MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in the Web Share feature that allows attackers to steal data from other websites. The vulnerability requires tricking a user into clicking or interacting with elements on a malicious webpage. Once triggered, an attacker can access information from cross-origin sources—essentially reading data they shouldn't have access to. This is a client-side issue affecting individual users rather than servers, and the bar for exploitation is user interaction on a crafted page.

• CVE-2026-11129MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser handles extensions that could allow an attacker to steal sensitive data from websites you visit. An attacker would need to trick you into visiting a malicious webpage, but if successful, they could read information from other sites you have open—potentially including login credentials, private messages, or financial data. This is a medium-severity issue that affects Chrome on Windows, macOS, and Linux.

• CVE-2026-11132MEDIUM 6.5

  A flaw in Chrome's Paint component allows attackers to bypass the same-origin policy—a fundamental browser security boundary—by tricking users into visiting a malicious webpage. The vulnerability affects Chrome versions before 149.0.7827.53. While an attacker cannot steal data directly through this weakness, they can modify or inject content in ways the browser should have blocked, potentially enabling follow-up attacks that compromise user sessions or inject malware. The flaw requires user interaction (visiting a crafted page) but is otherwise straightforward to exploit.

• CVE-2026-11133MEDIUM 6.5

  A vulnerability in Google Chrome's Paint feature allows attackers to bypass the same-origin policy—a critical browser security boundary—through a specially crafted web page. An attacker could trick a user into visiting a malicious site and potentially access or modify content from another origin without permission. The vulnerability requires user interaction (clicking a link or visiting a page) but does not require special privileges. Chrome versions before 149.0.7827.53 are affected.

• CVE-2026-11134MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the Media component handles certain HTML content. An attacker can craft a malicious webpage that, when visited by a user, leaks sensitive data that should be restricted to one website (cross-origin data) to an attacker-controlled site. The vulnerability requires user interaction—the victim must visit the crafted page—but no special browser configuration or user privileges are needed. This is a confidentiality risk, not a data destruction or service disruption issue.

• CVE-2026-11135MEDIUM 6.5

  Google Chrome's Autofill feature fails to properly enforce security policies, allowing attackers to trick users into bypassing security controls through specially crafted web pages. An attacker cannot steal data directly, but can manipulate what gets filled into form fields—potentially leading users to submit sensitive information to the wrong destination or trigger unintended actions. The vulnerability requires user interaction (clicking or interacting with the page) and affects Chrome versions before 149.0.7827.53.

• CVE-2026-11137MEDIUM 6.5

  CVE-2026-11137 is a memory disclosure vulnerability in ANGLE, the graphics abstraction layer used by Google Chrome. A remote attacker can trick a user into visiting a specially crafted webpage that reads uninitialized memory from the Chrome process, potentially exposing sensitive data like passwords, tokens, or other information temporarily stored in RAM. The attack requires user interaction (clicking a link or visiting a malicious site) but no special privileges. This affects Chrome versions prior to 149.0.7827.53 across Windows, macOS, and Linux.

• CVE-2026-11138MEDIUM 6.5

  A memory initialization flaw in Google Chrome's ANGLE graphics component allows attackers to expose sensitive data across different websites when users visit a malicious webpage. An attacker would need to craft a specially designed HTML page and trick a user into viewing it; the vulnerability itself requires no special browser configuration and affects all major operating systems where Chrome runs.

• CVE-2026-11139MEDIUM 6.5

  A flaw in Google Chrome's Paint implementation allows attackers to steal sensitive information from one website and expose it to another. An attacker can craft a specially designed web page that, when visited by a user, exploits this vulnerability to read data across security boundaries that browsers normally enforce. The vulnerability affects Chrome versions before 149.0.7827.53 and requires user interaction—the victim must visit the malicious page—but does not require special permissions or system access.

• CVE-2026-11140MEDIUM 6.5

  A memory reading vulnerability in Google Chrome's Chromecast feature allows an attacker who has already compromised the browser's renderer process to steal sensitive data from the browser's memory by serving a specially crafted web page. The vulnerability requires the attacker to have control of the renderer—the component that displays websites—but once achieved, they can extract information without needing special privileges or modifying the page's normal function.

• CVE-2026-11141MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in the audio subsystem that can leak sensitive data from memory. An attacker who has already compromised the renderer process—the component that executes web content—can craft a malicious HTML page to read uninitialized memory and extract potentially confidential information. This requires an existing foothold in the renderer, making it a secondary-stage exploitation technique rather than a direct entry vector.

• CVE-2026-11142MEDIUM 6.5

  A flaw in Google Chrome's Paint feature prior to version 149.0.7827.53 allows attackers to bypass the browser's same-origin policy through a maliciously crafted webpage. An attacker could trick a user into visiting their page and potentially access or manipulate content that should be isolated from other websites. The vulnerability requires user interaction but poses a meaningful integrity risk to web security boundaries.

• CVE-2026-11143MEDIUM 6.5

  Google Chrome on Linux contains an out-of-bounds memory read vulnerability affecting versions prior to 149.0.7827.53. The flaw resides in Chrome's extension handling mechanism and allows a malicious extension—installed by a user—to read sensitive data directly from the browser's process memory. An attacker would need to trick a user into installing the malicious extension, but once installed, the extension can harvest information like passwords, session tokens, or other in-memory secrets without triggering additional user interaction.

• CVE-2026-11148MEDIUM 6.5

  A vulnerability in Google Chrome's payment processing on Android allows a malicious website to steal sensitive information from other websites you've visited or logged into. An attacker would need you to visit their crafted webpage, but requires no special system access. The issue stems from improper handling of cross-origin security boundaries in the Payments API implementation.

• CVE-2026-11160MEDIUM 6.5

  Google Chrome on Linux versions before 149.0.7827.53 contains a memory reading flaw in its input handling. An attacker can trick a user into visiting a specially crafted webpage, causing Chrome to leak sensitive data from the browser process's memory—such as cached passwords, session tokens, or other confidential information. The vulnerability requires user interaction (clicking a link or visiting a site) but no special privileges, and affects only Linux systems.

• CVE-2026-11168MEDIUM 6.5

  A vulnerability in Google Chrome's extension system allows an attacker who has already compromised the browser's renderer process to extract sensitive data from memory using a specially crafted webpage. The vulnerability requires the attacker to have control over the renderer process first, which limits the immediate attack surface but poses significant risk if combined with other exploits. The issue stems from improper implementation in how extensions interact with the rendering engine.

• CVE-2026-11176MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser handles media content that could allow an attacker to trick a user into visiting a malicious webpage and steal sensitive data from other websites the user is logged into. The attacker cannot exploit this remotely without user interaction—the victim must visit the crafted page—but once there, the browser's media handling could be bypassed to reveal cross-origin information that should remain private.

• CVE-2026-11180MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how SVG (Scalable Vector Graphics) content is handled that could allow an attacker to steal data from other websites. An attacker would need to trick a user into visiting a malicious webpage, but does not require any special browser plugins or user permissions beyond normal browsing. The vulnerability affects Chrome on Windows, macOS, and Linux.

• CVE-2026-11182MEDIUM 6.5

  Google Chrome contains a vulnerability in how it processes SVG (Scalable Vector Graphics) content that could allow an attacker to steal sensitive data from websites you visit. An attacker would need to trick you into visiting a malicious webpage, but if successful, they could potentially read information that should be protected between different websites—such as authentication tokens, account details, or other private data. The vulnerability affects Chrome versions before 149.0.7827.53.

• CVE-2026-11183MEDIUM 6.5

  CVE-2026-11183 is a memory safety vulnerability in Google Chrome's GWP-ASan security feature that allows an attacker with local access to read sensitive data from the browser's memory by tricking a user into opening a malicious file. While the flaw requires user interaction and doesn't allow remote code execution, it can expose confidential information such as cached credentials, session tokens, or other sensitive data held in process memory.

• CVE-2026-11189MEDIUM 6.5

  A flaw in Google Chrome's developer tools allowed attackers to bypass navigation restrictions through malicious browser extensions. If a user installed a crafted extension, an attacker could manipulate Chrome's navigation controls to reach restricted pages or resources. The vulnerability requires user action—specifically, convincing someone to install the malicious extension—but once installed, no additional user interaction is needed for the bypass itself.

• CVE-2026-11190MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how it handles browser extensions. An attacker could create a malicious extension that, if installed by a user, bypasses Chrome's access control protections. This means the extension could perform actions it should not be permitted to do—such as accessing restricted resources or modifying system behavior—without proper authorization checks. The attack requires user action to install the extension, but once installed, the damage is contained to what the extension itself can access rather than affecting the entire system.

• CVE-2026-11193MEDIUM 6.5

  Google Chrome's Password Manager contained a flaw that failed to properly enforce access controls, allowing an attacker to bypass security restrictions through a malicious webpage. An attacker could craft a specially designed HTML page that, when visited by a user, circumvents the protections meant to prevent unauthorized access to password management features. This requires user interaction—the victim must visit the attacker's page—but no special privileges are needed on the attacker's side. The vulnerability does not lead to data theft or system crashes, but rather prevents the password manager from properly enforcing who can access its functions.

• CVE-2026-11194MEDIUM 6.5

  A vulnerability in Google Chrome's network implementation could allow an attacker to trick users into visiting a specially crafted webpage that leaks sensitive data from other websites the user is logged into. The attack requires user interaction (clicking or visiting the malicious page) but does not require special browser configuration or user privileges. While the confidentiality impact is high, the vulnerability does not allow attackers to modify data or disable services.

• CVE-2026-11195MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser handles MHTML (MIME Encapsulation of Aggregate HTML Documents) content. An attacker can craft a malicious web page that, when visited by a user who performs specific interactions with the page (such as clicking or other UI gestures), leaks sensitive data from websites the user has visited in other browser tabs or windows. The vulnerability requires user interaction to trigger and does not allow attackers to modify data or crash the browser, but it does enable unauthorized access to cross-origin information that should remain private.

• CVE-2026-11196MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a type confusion bug in XML processing that allows an attacker to craft a malicious XML file. When a user opens this file in Chrome, the vulnerability can leak sensitive data from the browser's memory without requiring special user permissions or network-level access. The flaw affects Windows, macOS, and Linux users. While the attack requires user interaction (opening a file), the potential exposure of process memory makes this a notable security concern for organizations where users handle untrusted documents.

• CVE-2026-11197MEDIUM 6.5

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in how Worker threads enforce same-origin policy. An attacker who has already compromised your browser's rendering engine can craft a malicious webpage to trick the Worker into allowing cross-origin requests it should block. This is a post-compromise scenario—the attacker must first gain control of the renderer process—but once inside, they can escalate their privileges by accessing data from other websites.

• CVE-2026-11200MEDIUM 6.5

  A flaw in Google Chrome's WebRTC implementation allows attackers to steal private data from other websites through a malicious HTML page. An attacker would need to trick a user into visiting their crafted webpage while Chrome is running, but no special technical privileges are required. The vulnerability affects Chrome versions before 149.0.7827.53 across Windows, macOS, and Linux.

• CVE-2026-11203MEDIUM 6.5

  Google Chrome on macOS has a flaw in how it handles GPU-related processes that could allow an attacker to steal sensitive data from websites you visit. The vulnerability requires user interaction—you would need to visit a malicious or compromised website—but once there, an attacker could potentially access information from other sites you have open in the browser. Google has patched this in Chrome version 149.0.7827.53 and later.

• CVE-2026-11204MEDIUM 6.5

  A flaw in Google Chrome's sign-in implementation on iOS allows an attacker to bypass navigation restrictions by directing a user to a specially crafted webpage. The vulnerability requires user interaction—specifically visiting a malicious page—but does not require elevated permissions. While the attacker cannot read sensitive data or crash the application, they can manipulate the browser's navigation behavior in ways the user did not intend.

• CVE-2026-11206MEDIUM 6.5

  A vulnerability in Google Chrome's Service Worker implementation allows attackers to access sensitive data from websites you visit, even data that should be restricted to specific origins. An attacker can craft a malicious web page that, when visited, exploits insufficient policy checks to leak cross-origin information. This requires user interaction—you must visit the attacker's page—but once there, the browser's protections are bypassed without additional warnings or user awareness.

• CVE-2026-11208MEDIUM 6.5

  A use-after-free vulnerability exists in the codec handling components of Google Chrome versions prior to 149.0.7827.53. An attacker can craft a malicious HTML page that, when visited by a user, exploits this memory safety flaw to read sensitive data directly from the browser process's memory. The vulnerability requires user interaction (visiting a malicious site) but does not require any special privileges to exploit.

• CVE-2026-11209MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how it handles password data that could allow an attacker who has already compromised Chrome's renderer process to read sensitive information from memory using a specially crafted webpage. The vulnerability requires that the attacker first gain control of the renderer process—a significant precondition—but once achieved, could expose data stored in process memory without modifying or disabling system functions.

• CVE-2026-11210MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in Safe Browsing that allows attackers to bypass access controls when a user opens a specially crafted RAR archive file. An attacker would need to trick a user into opening a malicious RAR file, but once they do, the browser's safety mechanisms fail to properly restrict what the file can access. This is a moderate-severity issue that affects Chrome on Windows, macOS, and Linux.

• CVE-2026-11214MEDIUM 6.5

  A flaw in Google Chrome for iOS allows attackers to trick users into visiting a malicious website that can leak data from other websites the user has open in their browser. The attacker needs the victim to interact with the malicious page (such as clicking a link), but no special technical skills or authentication are required on the attacker's side. This is a cross-origin data leak vulnerability affecting Chrome on iPhones and iPads running iOS.

• CVE-2026-11215MEDIUM 6.5

  A flaw in how Google Chrome handles domain names on Android devices allows attackers to trick users into visiting fake websites that appear legitimate. By crafting a specially formatted domain name, an attacker can make Chrome display a spoofed address bar, convincing users they're on a trusted site when they're actually on a malicious one. The vulnerability requires user interaction—the victim must visit a link or be socially engineered—but poses a direct threat to credential theft and phishing campaigns.

• CVE-2026-11217MEDIUM 6.5

  CVE-2026-11217 is a medium-severity flaw in Google Chrome's Fenced Frames feature that could allow an attacker who has already compromised a renderer process to circumvent Chrome's site isolation security boundary. Site isolation is a core defense that prevents malicious websites from accessing data from other sites in your browser. A remote attacker would need to trick a user into visiting a specially crafted webpage while the renderer has already been compromised, creating a two-stage attack scenario. Google has rated this as low severity on the Chromium scale, though the CVSS score reflects the integrity impact of bypassing site isolation.

• CVE-2026-11220MEDIUM 6.5

  A flaw in Google Chrome's navigation handling prior to version 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to bypass the browser's site isolation protection using a specially crafted HTML page. Site isolation is a critical Chrome security boundary designed to prevent malicious websites from accessing data from other sites. This vulnerability requires the attacker to have already gained code execution in the renderer process, making it a secondary or chained attack rather than a direct entry point.

• CVE-2026-11222MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser's tab strip displays security information to users. An attacker can craft a malicious webpage that tricks the browser's security UI, making it appear as though the user is visiting a legitimate website when they are actually on a attacker-controlled domain. This is a user-interface spoofing vulnerability that relies on tricking the visual indicators users depend on to verify they're on the correct website.

• CVE-2026-11223MEDIUM 6.5

  A vulnerability in Google Chrome allows an attacker who has already compromised the browser's renderer process to bypass the same-origin policy—a fundamental security boundary that prevents malicious websites from accessing data belonging to other sites. The attacker would craft a specially designed HTML page to exploit insufficient input validation in Chrome's network handling. This requires the renderer process to be compromised first, making it a secondary attack that compounds an existing breach rather than a standalone entry point.

• CVE-2026-11225MEDIUM 6.5

  Google Chrome before version 149.0.7827.53 contains a flaw that allows attackers to perform domain spoofing—making a malicious website appear to come from a trusted domain. An attacker would need to trick a user into visiting a crafted link, but once clicked, the browser's address bar or other visual indicators could misrepresent the true origin of the site. This affects Chrome on Windows, macOS, and Linux.

• CVE-2026-11226MEDIUM 6.5

  A vulnerability in Google Chrome's PreviewTab feature on Android allows attackers to bypass the browser's same-origin policy—a core security boundary that prevents websites from accessing data belonging to other websites. An attacker would need to craft a malicious HTML page and convince a user to perform specific touch gestures (like swiping or tapping) to trigger the bypass. While the underlying Chromium issue is rated Low severity, the CVSS score reflects the real-world impact: an attacker could alter or exfiltrate data from other websites the user is visiting, though not eavesdrop on encrypted traffic or crash the device.

• CVE-2026-11227MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how it displays security information in tab hover cards—the small popup that appears when you hover over a browser tab. An attacker can craft a deceptive domain name that, when displayed in this hover card, makes it appear to be a legitimate website you trust. This is a domain spoofing attack: the user sees what looks like one domain but is actually visiting a different one. The vulnerability requires user interaction (hovering over the tab and being deceived) but could help an attacker trick users into thinking they're on a safe site when they're not.

• CVE-2026-11258MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser handles file system access permissions. An attacker can craft a malicious webpage that, when visited, tricks users into performing specific clicks or gestures that bypass the browser's normal access controls. This allows the attacker to gain unauthorized access to files on the user's computer that would normally be protected. The vulnerability requires user interaction and social engineering to exploit, but once triggered, could expose sensitive files.

• CVE-2026-11263MEDIUM 6.5

  A flaw in Google Chrome's WebAuthentication implementation on Android before version 149.0.7827.53 could allow an attacker who has already compromised Chrome's rendering engine to steal sensitive data from websites across different origins. The attacker would need to trick a user into visiting a malicious webpage, but the underlying issue stems from insufficient enforcement of security policies that should prevent cross-origin data leakage. This is a moderate-severity issue because it requires a prior compromise of the renderer process, limiting the attack surface to scenarios where other vulnerabilities or system weaknesses have already been exploited.

• CVE-2026-11268MEDIUM 6.5

  A vulnerability in Google Chrome's ANGLE graphics library on Windows allows an attacker to steal sensitive data from websites you visit. The flaw stems from uninitialized memory being used during graphics processing, which can leak information across security boundaries. An attacker would need to trick you into visiting a malicious webpage to exploit this—the vulnerability cannot be triggered remotely without user interaction. Chrome version 149.0.7827.53 and later patch this issue.

• CVE-2026-11270MEDIUM 6.5

  Google Chrome on Android versions before 149.0.7827.53 contain a UI implementation flaw that allows attackers to trick users into visiting specially crafted web pages, potentially exposing sensitive data from other websites the user has visited or is logged into. The vulnerability requires user interaction (clicking a link or visiting a malicious page) but poses a meaningful confidentiality risk by circumventing the browser's cross-origin protections.

• CVE-2026-11271MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in password handling that could allow an attacker to trick users into revealing data from other websites. The vulnerability requires the attacker to craft a malicious webpage and convince the user to interact with it in a specific way—there is no automatic exploitation. The risk is confined to information disclosure; attackers cannot modify data or disrupt service. While the underlying Chromium project rates this as low severity, the CVSS score reflects the relatively low barrier to user interaction and the potential for cross-origin data leakage.

• CVE-2026-11275MEDIUM 6.5

  A flaw in how Google Chrome on Android displays page information allows an attacker who has already compromised Chrome's rendering engine to bypass navigation security controls. An attacker would need to trick a user into viewing a specially crafted webpage after gaining control of the browser's internal processes. The vulnerability is rated Medium severity because while it requires significant pre-existing compromise, it enables attackers to circumvent protections that prevent unauthorized navigation to restricted pages.

• CVE-2026-11278MEDIUM 6.5

  Google Chrome on Android contains a flaw in how it handles CustomTabs—a feature that allows apps to open web content in a customized browser interface. An attacker can craft a malicious HTML page that, when opened by a user, leaks data intended to be protected across different websites. This is a local attack requiring user interaction (clicking or opening the page), but the confidentiality impact is significant because sensitive information from one origin could be exposed to another.

• CVE-2026-11283MEDIUM 6.5

  Google Chrome on macOS contains a flaw in how it validates input when processing Shortcuts—a macOS feature that allows automation of tasks across applications. An attacker can craft a malicious file that, when opened by a user, bypasses Chrome's navigation restrictions, potentially redirecting the user to unintended web destinations. This requires user interaction (opening the file) but does not require special system privileges or network complexity. The vulnerability was patched in Chrome version 149.0.7827.53.

• CVE-2026-11284MEDIUM 6.5

  Google Chrome versions prior to 149.0.7827.53 contain a side-channel vulnerability in the Performance APIs that allows an attacker to extract sensitive data across website boundaries. An attacker can craft a malicious webpage that, when visited by a user, leaks information from other websites the user is viewing or has visited. This works because certain performance measurement features can infer timing details that reveal cross-origin data, even though browsers are designed to isolate websites from each other.

• CVE-2026-11287MEDIUM 6.5

  A vulnerability in Google Chrome on Android allows an attacker who has already compromised the browser's renderer process to bypass navigation controls and direct users to unintended destinations using specially crafted web pages. The attacker must first gain control of the renderer process—a significant prerequisite—but once achieved, can manipulate where the browser navigates without proper restrictions. This affects Chrome versions prior to 149.0.7827.53.

• CVE-2026-11288MEDIUM 6.5

  A vulnerability in Google Chrome's CSS handling allows an attacker to leak data from websites you visit to a different origin through a malicious webpage. The flaw stems from insufficient enforcement of browser security policies that normally prevent one website from accessing information from another. An attacker would need to trick you into visiting their crafted page while you're logged into or actively using other sites, but no special browser configuration or advanced user interaction is required beyond a standard click. This is a medium-severity issue affecting multiple operating systems through Chrome.

• CVE-2026-11289MEDIUM 6.5

  A side-channel vulnerability in Google Chrome's Paint component allows attackers to leak sensitive cross-origin data through a specially crafted web page. An attacker would need to trick a user into visiting a malicious website, but once there, the vulnerability could expose information from other websites the user has open—a serious privacy breach. The issue affects Chrome versions before 149.0.7827.53 across Windows, macOS, and Linux.

• CVE-2026-11299MEDIUM 6.5

  A flaw in how Google Chrome handles font data can lead to information disclosure when a user visits a malicious webpage. An attacker can craft a specially designed HTML page that exploits an integer overflow vulnerability in Chrome's font processing code, potentially allowing them to read sensitive data from the browser's memory. The vulnerability affects Chrome versions before 149.0.7827.53 and requires user interaction (visiting the malicious site) to trigger.

• CVE-2026-11322MEDIUM 6.5

  Hermes WebUI versions before 0.51.221 have a path traversal flaw that lets authenticated users read files outside the intended workspace directory. By crafting symlinks that point to sensitive data, attackers can access SSH keys, cloud credentials, and application tokens that the server process can reach. The vulnerability requires an existing user account but poses a meaningful risk to credential and secret exposure.

• CVE-2026-11367MEDIUM 6.5

  The PixMagix – WordPress Image Editor plugin contains a directory traversal vulnerability that allows authenticated users with author-level permissions to write malicious files anywhere on the server. When users upload or manipulate images through the plugin, an attacker can inject path traversal sequences (like '../../') into image parameters to escape the intended upload folder and place files in sensitive locations. This is particularly concerning because author-level access is granted by default after plugin activation, making exploitation straightforward for any author-role user on an affected WordPress site.

• CVE-2026-11442MEDIUM 6.5

  Allegra contains a directory traversal vulnerability in its report export function that allows authenticated users to read files outside their intended access scope. An attacker with valid credentials can manipulate the file path parameter to traverse the directory structure and access sensitive information stored on the server, including files belonging to the application service account. This requires authentication but poses a meaningful information disclosure risk.

• CVE-2026-11611MEDIUM 6.5

  A memory leak vulnerability exists in 389 Directory Server's Content Synchronization (sync) feature. When an authenticated user initiates a sync request but stops reading the server's responses without properly closing the connection, the server accumulates data in memory indefinitely, eventually consuming all available resources and crashing the service. The vulnerability also introduces race conditions that can trigger crashes during normal connection cleanup or server shutdown.

• CVE-2026-11653MEDIUM 6.5

  Google Chrome versions before 149.0.7827.103 contain a flaw in how browser extensions are implemented that could allow an attacker to bypass site isolation—Chrome's core security mechanism that prevents websites from accessing each other's data. The attack requires two conditions: the attacker must first compromise Chrome's renderer process (the component that executes web pages), and then serve a specially crafted HTML page to the victim. While the technical barrier is high, successful exploitation would let malicious code access data across site boundaries, violating the security boundary that normally isolates sensitive information from different origins.

• CVE-2026-11658MEDIUM 6.5

  A vulnerability in Google Chrome's extension validation system allows an attacker who has already compromised Chrome's renderer process to bypass site isolation—a critical security boundary that prevents malicious websites from accessing data across different sites. The flaw stems from insufficient checking of untrusted input in the Extensions subsystem. An attacker would need to trick a user into visiting a specially crafted HTML page while the renderer is already compromised, making this a secondary attack that compounds an existing breach rather than a standalone entry point.

• CVE-2026-11820MEDIUM 6.5

  A vulnerability in Ansible's community.general collection allows API credentials for Vonage/Nexmo SMS services to leak into logs and monitoring systems. The nexmo module sends authentication credentials as part of URL query parameters in HTTP GET requests, where they end up in web server logs, proxy logs, HTTP headers, and network traffic captures. Even though Ansible marks these credentials with a 'no_log' flag to prevent them from appearing in Ansible output, the underlying HTTP calls still expose them. An attacker who gains access to any of these logging or monitoring points can retrieve the full API credentials and compromise the victim's Vonage/Nexmo account.

• CVE-2026-11852MEDIUM 6.5

  Debusine, a tool used to build and maintain Debian-based Linux distributions, contains a permission-checking flaw in its artifact management system. When users or services create or delete relationships between artifacts (the packaged components that make up a distribution), the system fails to verify whether the requester has authorization to perform those actions. An attacker who can see an artifact can manipulate its relationships without proper permission checks, potentially corrupting the integrity of a distribution build or exposing sensitive artifacts to unauthorized access.

• CVE-2026-11853MEDIUM 6.5

  Debusine, a tool for building and maintaining Debian-based Linux distributions, contains a vulnerability in how it parses Debian package manifest files (.dsc and .changes files). These manifests list the files that make up a software package. An attacker can craft malicious manifest files that trick Debusine's parser into creating symbolic links (shortcuts) pointing anywhere on the system. If exploited during the "mergeuploads" task, this could allow an attacker to overwrite files that the Debusine worker process has permission to access, potentially compromising the integrity of package builds or the system itself.

• CVE-2026-11884MEDIUM 6.5

  A flaw in 389 Directory Server allows an attacker with administrative privileges—or someone controlling a replication server—to crash the service by creating directory object definitions with unusually long inheritance fields. The underlying issue is that the server calculates buffer space without accounting for the full size of these fields, leading to memory corruption when data is written. This is a remnant of an earlier incomplete patch attempt.

• CVE-2026-11906MEDIUM 6.5

  IBM Db2 contains a vulnerability that allows authenticated users to crash the database by submitting specially crafted queries involving XMLTable-derived columns. An attacker with valid database credentials can trigger a denial of service condition, making the database unavailable to legitimate users. This requires authentication, so it is not exploitable by anonymous attackers, but it represents a risk from insider threats or compromised accounts.

• CVE-2026-11965MEDIUM 6.5

  A flaw in the User Registration & Membership WordPress plugin before version 5.2.0 allows anyone to sign up for a paid membership subscription without actually paying for it. After self-registering through the plugin's open registration feature, attackers can activate any paid plan and immediately access restricted content—bypassing the payment requirement entirely.

• CVE-2026-11988MEDIUM 6.5

  A flaw in the LearnPress WordPress LMS plugin (versions up to 4.3.9.1) allows authenticated users with basic subscriber access or higher to view course enrollment progress and completion data of instructor and administrator accounts. An attacker with a regular user account can directly request information about any teacher or admin's course activities without proper authorization. This does not affect access to other regular subscriber accounts, which remain protected. The vulnerability requires the attacker to already have login credentials.

• CVE-2026-11989MEDIUM 6.5

  The Bit integrations plugin for WordPress, widely used for form integrations with WooCommerce and CRM systems, contains a Server-Side Request Forgery (SSRF) flaw that allows unauthenticated attackers to send web requests from your WordPress server to internal or external systems. An attacker can exploit this by submitting forms that trigger attachment uploads mapped to product images, galleries, or contact fields—common configurations for e-commerce and CRM integrations. This could expose sensitive internal services or allow tampering with data on systems the WordPress server can reach.

• CVE-2026-12024MEDIUM 6.5

  A flaw in Google Chrome's Developer Tools (DevTools) allows attackers to bypass the same-origin policy—a fundamental browser security boundary that prevents one website from accessing another's data. An attacker crafting a malicious HTML page could trick a user into visiting it, potentially gaining unauthorized access to sensitive information from other sites the user is logged into. The vulnerability affects Chrome versions before 149.0.7827.115 across Windows, macOS, and Linux.

• CVE-2026-12026MEDIUM 6.5

  A memory-reading vulnerability exists in Chrome's video processing component on ChromeOS. An attacker who successfully compromises the browser's renderer process can craft a malicious web page to read sensitive information stored in the browser's memory—such as passwords, authentication tokens, or other user data—and exfiltrate it. The vulnerability requires the attacker to already control the renderer process, which limits the attack surface but remains a serious concern when combined with other browser exploits.

• CVE-2026-12060MEDIUM 6.5

  Heptabase, a note-taking and knowledge management application, contains a vulnerability that allows attackers to trick users into visiting malicious webpages within the app itself. Through social engineering—such as phishing links or deceptive invitations—an attacker can manipulate a victim into loading a webpage that requests access to the device's camera and microphone. Because the application exposes dangerous methods without proper safeguards, these permissions can be granted without requiring authentication, potentially giving attackers unauthorized access to recording capabilities.

• CVE-2026-12079MEDIUM 6.5

  The Dokan Pro WordPress plugin contains a SQL injection vulnerability in how it processes the 'orderby' parameter. An authenticated user with basic Subscriber permissions can craft requests to inject SQL commands and potentially access sensitive database information. This requires an account on the WordPress site; the vulnerability does not affect unauthenticated visitors.

• CVE-2026-12085MEDIUM 6.5

  IBM's UrbanCode Deploy and DevOps Deploy products contain a vulnerability that allows authenticated users to access sensitive configuration data and secrets through API responses. An attacker with valid credentials could extract this information and use it to mount further attacks on the system. The issue affects specific versions of both products and requires authentication, limiting immediate exposure but creating meaningful risk for organizations using these deployment tools.