By year

Vulnerabilities disclosed in 2026

CVEs published in 2026 with SEC.co analysis.

8541 published vulnerabilities · page 44 of 86

• CVE-2026-10937MEDIUM 6.5

  CVE-2026-10937 is a same-origin policy bypass vulnerability in Google Chrome's password handling logic. An attacker can craft a malicious HTML page that, when visited by a user, exploits an implementation flaw to circumvent Chrome's same-origin policy protections. This could allow unauthorized script execution or data access across domain boundaries, though the actual impact depends on how the flaw is chained with other browser capabilities. The vulnerability affects Chrome versions prior to 149.0.7827.53 and requires user interaction to trigger.

• CVE-2026-10938MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser handles certain HTML input that could allow an attacker to circumvent site isolation protections, but only if they have already compromised the renderer process. Site isolation is Chrome's core defense that prevents a compromised website from accessing data from other open websites. This vulnerability narrows that protection in specific scenarios.

• CVE-2026-10944MEDIUM 6.5

  A flaw in Google Chrome's autofill feature on iOS could allow an attacker to trick a user into visiting a malicious webpage that extracts sensitive information you've saved in your browser—such as payment details, addresses, or credentials—from other websites you use. The vulnerability requires user interaction (visiting the malicious page) but does not require special system permissions or unusual browser configurations to exploit.

• CVE-2026-10950MEDIUM 6.5

  Google Chrome on iOS has a flaw in how it enforces security policies for the autofill feature. An attacker can trick a user into visiting a specially crafted webpage that leaks sensitive data from other websites the user has visited or logged into. The vulnerability requires user interaction (clicking or visiting a malicious link) but doesn't require any special browser configuration or authentication bypass. It affects Chrome versions before 149.0.7827.53 on iOS devices.

• CVE-2026-10977MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in Skia (Chrome's graphics rendering engine) that could allow an attacker who has already compromised your browser's renderer process to steal data from websites you visit. The attacker would need to trick you into viewing a specially crafted webpage. This is a real but narrowly scoped risk—it requires the renderer to already be under attacker control, limiting the immediate threat from casual browsing.

• CVE-2026-10979MEDIUM 6.5

  A flaw in the ANGLE graphics library used by Google Chrome before version 149.0.7827.53 allows attackers to read memory outside intended bounds. An attacker can craft a malicious HTML page that, when visited by a user, extracts sensitive data from Chrome's process memory—such as authentication tokens, encryption keys, or other confidential information. Exploitation requires user interaction (clicking a link or visiting a site) but no special privileges.

• CVE-2026-10980MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in DevTools that allows an attacker who has already compromised the browser's rendering engine to bypass the same-origin policy—a core security boundary that prevents websites from accessing each other's data. An attacker could craft a malicious HTML page to exploit this, potentially gaining unauthorized access to sensitive information from other websites.

• CVE-2026-10981MEDIUM 6.5

  CVE-2026-10981 is a cross-origin data leak vulnerability in Google Chrome's video codec handling. An attacker who has already compromised Chrome's renderer process can craft a malicious video file to exfiltrate sensitive data from other websites the user is visiting. The vulnerability requires user interaction (opening or playing a video file) and relies on prior compromise of the rendering engine, limiting the attack surface but creating risk for users who already have malware or who visit compromised sites.

• CVE-2026-10985MEDIUM 6.5

  A flaw in Skia, the graphics rendering engine used by Google Chrome, allows attackers to read data they shouldn't have access to by crafting a malicious web page. When a user visits such a page, the browser's memory can leak information from other websites or origins, potentially exposing sensitive data. The attack requires user interaction—clicking a link or visiting a hostile site—but doesn't require any special browser permissions or configuration.

• CVE-2026-10992MEDIUM 6.5

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in how the Animation feature validates user-supplied data. An attacker can craft a malicious HTML page that, when opened in a vulnerable Chrome browser, leaks sensitive information stored in the browser's process memory. The attack requires user interaction (opening the page) but no authentication or special browser configuration.

• CVE-2026-10993MEDIUM 6.5

  A heap buffer overflow vulnerability exists in Skia, the graphics rendering engine used by Google Chrome. By visiting a specially crafted webpage, an attacker can read sensitive data from Chrome's memory without requiring any special user permissions beyond clicking the link. The vulnerability affects Chrome versions before 149.0.7827.53 and has a CVSS severity rating of Medium.

• CVE-2026-10994MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in the ANGLE graphics library that can leak sensitive data from your browser's memory. An attacker can craft a malicious webpage that, when you visit it, reads uninitialized memory and potentially extracts information like passwords, tokens, or other private data. The vulnerability requires user interaction (clicking or viewing the page) but does not require special browser permissions.

• CVE-2026-10996MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a vulnerability in how Web Workers are implemented that could allow an attacker to bypass the same-origin policy—a fundamental browser security boundary. An attacker could craft a malicious HTML page that, when visited by a user, potentially accesses or modifies content from other websites in the victim's browser session. This requires user interaction (visiting the crafted page) but does not require any special browser features to be enabled.

• CVE-2026-10997MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how it enforces policies on extensions. An attacker could craft a malicious extension that, if installed by a user, would be able to bypass access controls that should normally restrict what the extension can do. This is a user-assisted attack—the victim must actively install the extension—but once installed, the extension gains unintended capabilities.

• CVE-2026-10999MEDIUM 6.5

  An integer overflow vulnerability exists in ANGLE (a graphics abstraction layer) within Google Chrome on Windows. Before version 149.0.7827.53, this flaw could allow an attacker who already controls the Chrome renderer process to read sensitive data from memory by tricking a user into viewing a specially crafted webpage. The vulnerability requires user interaction (clicking a link or visiting a malicious site) but does not allow the attacker to modify data or crash the browser.

• CVE-2026-11001MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in the Payments feature that allows attackers to create a fake user interface through a specially crafted webpage. To exploit this, an attacker would need to trick a user into performing specific interactions—such as clicks or gestures—on the malicious page. The attack does not steal data or crash the browser, but instead deceives the user by making the browser display content that appears to come from a trusted source, when it actually originates from the attacker. This is a medium-severity issue that depends on user interaction to succeed.

• CVE-2026-11006MEDIUM 6.5

  A memory safety flaw in Google Chrome's Dawn graphics component (used for GPU rendering) allows attackers to read sensitive data from a user's memory by tricking them into visiting a specially crafted webpage. The vulnerability does not enable code execution or system crashes, but confidentiality is at risk. Chrome versions prior to 149.0.7827.53 are affected.

• CVE-2026-11007MEDIUM 6.5

  A flaw in Google Chrome's WebView on Android allows an attacker who has already compromised Chrome's renderer process to steal sensitive data from other websites. The vulnerability stems from inadequate validation of user-supplied input, making it possible for an attacker to craft a malicious webpage that leaks cross-origin information—data that should remain isolated between websites. While the attacker must first gain control of the renderer process, the subsequent data leakage requires only that a user visit a crafted page, making this a meaningful risk in multi-stage attack chains.

• CVE-2026-11008MEDIUM 6.5

  A flaw in Google Chrome's web app installation feature fails to properly validate user input, allowing an attacker who has already compromised Chrome's renderer process to extract sensitive data from other websites through a malicious webpage. The attacker would need to trick a user into visiting a crafted HTML page, but once the renderer is compromised, the vulnerability creates a pathway to leak cross-origin information that should remain isolated.

• CVE-2026-11013MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser validates user-supplied input within its networking code. An attacker who has already compromised Chrome's renderer process—the sandboxed component that executes web content—can craft a malicious HTML page to leak sensitive data from the renderer's memory. This is a post-compromise attack vector; the attacker must first gain code execution in the renderer sandbox, but once there, they can extract information that should remain private.

• CVE-2026-11014MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a vulnerability where insufficient policy enforcement in the extension system allows a malicious extension to circumvent Site Isolation—Chrome's security boundary that prevents one website from accessing another's data. An attacker must first convince a user to install the malicious extension, but once installed, the extension can read or modify data across websites that the user visits, potentially exposing sensitive information.

• CVE-2026-11016MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw where insufficient validation of network input allows a remote attacker who has already compromised the browser's renderer process to bypass the same-origin policy. An attacker could craft a malicious HTML page to force the compromised renderer to access resources or data from a different origin, violating the security boundary that normally prevents cross-origin access. This requires initial renderer process compromise—the attacker cannot trigger the vulnerability from an unauthenticated network position alone.

• CVE-2026-11017MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the Link Preview feature handles navigation restrictions. If an attacker first compromises Chrome's renderer process—the component that displays web content—they can craft a malicious HTML page to bypass restrictions that normally prevent unauthorized navigation. The vulnerability requires prior renderer compromise, limiting its immediate attack surface, but it does allow an attacker with that foothold to navigate to restricted locations without proper authorization.

• CVE-2026-11018MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser enforces navigation policies. An attacker can craft a malicious HTML page that, when visited, tricks Chrome into allowing navigation to restricted destinations that should normally be blocked. The vulnerability requires user interaction—a person must visit the hostile page—but no special privileges are needed on the attacker's side. The core risk is integrity: an attacker can redirect you to unwanted sites, potentially enabling phishing, malware distribution, or social engineering attacks.

• CVE-2026-11019MEDIUM 6.5

  A vulnerability in Google Chrome's payments implementation on Android allows an attacker who has already compromised the browser's rendering engine to trick users into believing they are interacting with a legitimate website when they are actually on a fraudulent one. The attacker would craft a deceptive HTML page that spoofs the domain name displayed to the user, potentially leading to credential theft, payment fraud, or other social engineering attacks. This requires an initial compromise of the renderer process, which limits the immediate exposure but represents a serious escalation risk once that initial foothold is established.

• CVE-2026-11020MEDIUM 6.5

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in how the browser handles extensions that process XML files. An attacker can craft a malicious XML file that, when processed by a vulnerable extension, leaks sensitive data from other websites the user has visited. The vulnerability requires user interaction—specifically, the user must open or interact with the malicious file—but does not require the attacker to have special privileges or bypass additional security controls. This is a cross-origin data leak, meaning information intended to be isolated between websites can be extracted by an attacker.

• CVE-2026-11022MEDIUM 6.5

  CVE-2026-11022 is a same-origin policy bypass vulnerability in Google Chrome's DevTools that requires an attacker to have already compromised the renderer process. An attacker could then use a specially crafted HTML page to escape origin restrictions, potentially accessing or modifying data from other websites in the same browser session. This is not a remote code execution vector but rather a privilege escalation within an already-compromised rendering context.

• CVE-2026-11023MEDIUM 6.5

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in how the browser handles web app installation that allows an attacker who has already compromised the browser's renderer process to bypass the same-origin policy. This means a specially crafted web page could be used to access or modify content from other websites in ways the browser is supposed to prevent. The attacker needs prior renderer compromise, limiting the immediate threat to users, but the bypass itself is reliable once that initial foothold exists.

• CVE-2026-11025MEDIUM 6.5

  Google Chrome on Android contains a flaw in how it enforces content security policies (CSP) during navigation. An attacker can craft a malicious HTML page that, when visited by a user, bypasses the browser's CSP protections. This allows the attacker to inject or execute unintended content within a page that should be restricted. The vulnerability requires user interaction (visiting a malicious site) and affects Chrome versions before 149.0.7827.53 on Android devices.

• CVE-2026-11026MEDIUM 6.5

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in how extensions are handled that allows an attacker to bypass built-in navigation restrictions. The vulnerability requires social engineering—an attacker must trick a user into installing a malicious Chrome extension. Once installed, the extension can circumvent the browser's navigation safeguards, potentially redirecting users to unintended destinations or enabling other attack chains. This is classified as a Medium severity issue by Chromium's security team.

• CVE-2026-11027MEDIUM 6.5

  A vulnerability in Google Chrome's Glic component fails to properly validate untrusted input, allowing an attacker who has already compromised Chrome's renderer process to extract sensitive data across website boundaries using a specially crafted webpage. The attacker needs initial renderer process compromise but then gains the ability to read data from sites the user visits, bypassing normal browser security boundaries.

• CVE-2026-11032MEDIUM 6.5

  Google Chrome's Password Manager contained a flaw that could allow an attacker to trick users into visiting a malicious webpage and leak sensitive data from other websites the user visits. The vulnerability requires user interaction—visiting a crafted HTML page—but once triggered, could expose cross-origin information that should remain isolated between websites. This affects Chrome on Windows, macOS, and Linux systems.

• CVE-2026-11033MEDIUM 6.5

  A memory initialization flaw in Chrome's WebML component on macOS allows attackers to steal sensitive data. When a user visits a malicious webpage, the browser may leak uninitialized memory contents—potentially exposing passwords, tokens, or other private information—without requiring any special user interaction beyond loading the page. The issue affects Chrome versions before 149.0.7827.53 on Apple's macOS.

• CVE-2026-11036MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a DOM implementation flaw that allows attackers to circumvent the same-origin policy—a fundamental browser security boundary. An attacker could craft a malicious HTML page that, when visited, tricks the browser into allowing cross-origin requests or data access that should normally be blocked. This requires user interaction (clicking a link, visiting a site) but does not require any special privileges. While the attack does not expose sensitive data directly, it enables unauthorized modification of web content or session state, potentially leading to account compromise or malware injection.

• CVE-2026-11038MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how Subresource Integrity (SRI) policies are enforced, allowing attackers to bypass Content Security Policy (CSP) protections through crafted network traffic. An attacker would need to trick a user into visiting a malicious webpage to exploit this vulnerability. The issue is classified as medium severity because it enables content injection attacks but does not directly compromise confidentiality or system availability.

• CVE-2026-11039MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in Skia (the graphics rendering engine) that could allow an attacker to trick users into visiting a malicious webpage and leak sensitive data from other websites the user has open. The vulnerability requires user interaction—clicking or visiting a link—but does not require any special system privileges. Once triggered, an attacker could read private information from cross-origin sources, such as data from other tabs or windows.

• CVE-2026-11044MEDIUM 6.5

  A memory access bug in Chrome's graphics engine (ANGLE) allows an attacker to steal sensitive data from your browser's memory. The attacker simply needs to trick you into visiting a malicious webpage—no special privileges or software manipulation required. This affects Mac users running Chrome versions before 149.0.7827.53. The vulnerability is classified as medium severity because while an attacker can read data from memory, they cannot crash your browser or modify files.

• CVE-2026-11045MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in GPU input validation that can leak sensitive data from memory. An attacker who has already compromised Chrome's renderer process can craft a malicious HTML page to read protected information. This is a stepping-stone attack—it requires prior renderer compromise but can extract valuable secrets afterward.

• CVE-2026-11048MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a vulnerability in how extensions are handled that could allow a malicious extension to bypass the same-origin policy—a core browser security feature that prevents websites from accessing data across different origins. An attacker would need to trick a user into installing a malicious extension, but once installed, the extension could potentially access or modify content on websites that it shouldn't normally be able to reach. This is a medium-severity issue that affects Chrome on Windows, macOS, and Linux.

• CVE-2026-11051MEDIUM 6.5

  A memory reading flaw exists in the ANGLE graphics component of Google Chrome on Linux systems prior to version 149.0.7827.53. An attacker can craft a malicious webpage that, when visited, reads data from Chrome's process memory—potentially exposing sensitive information like credentials, cryptographic keys, or other in-memory secrets. The vulnerability requires user interaction (clicking or viewing a link) but does not allow the attacker to modify data or crash the browser.

• CVE-2026-11057MEDIUM 6.5

  A flaw in the Skia graphics library used by Chrome allows attackers who have already compromised a browser's rendering engine to read sensitive data from memory by sending a specially crafted web page. The vulnerability requires two conditions: the attacker must first gain control of the renderer process (typically through a separate vulnerability), and the user must visit the malicious page. Once both are true, uninitialized memory regions become readable, potentially exposing passwords, tokens, or other sensitive information that happen to be in RAM.

• CVE-2026-11064MEDIUM 6.5

  A race condition in Google Chrome's GPU rendering engine on Android devices allows an attacker who has already compromised the renderer process to steal data from websites you're visiting. The attacker would trick you into viewing a specially crafted webpage, which exploits a timing gap in how the GPU handles memory to read sensitive information across security boundaries. This is a real but limited threat because the attacker must first gain control of Chrome's renderer—a significant prerequisite.

• CVE-2026-11067MEDIUM 6.5

  Google Chrome versions prior to 149.0.7827.53 contain a memory safety vulnerability in the Dawn graphics component that allows attackers to steal sensitive data from browser process memory. An attacker crafts a malicious webpage that, when visited, exploits the uninitialized memory access to leak information that could include cached passwords, session tokens, or other private data. The attack requires user interaction (visiting the page) but works across networks without special privileges.

• CVE-2026-11069MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the Cast feature validates user input, allowing an attacker to craft a malicious HTML page that bypasses the browser's same-origin policy. If a user visits the attacker's page, it could potentially access or modify data from other websites the user is logged into, though without stealing that data directly. This is a moderate-severity issue affecting Windows, macOS, and Linux users.

• CVE-2026-11073MEDIUM 6.5

  A use-after-free vulnerability exists in Google Chrome's WebGL rendering engine that could allow an attacker to steal sensitive data from your browser's memory. An attacker would need to trick you into visiting a malicious webpage to exploit this flaw. While the vulnerability requires user interaction to trigger, the potential exposure of process memory—which may contain cached passwords, authentication tokens, or other sensitive information—makes it a meaningful security concern. The issue affects Chrome versions prior to 149.0.7827.53.

• CVE-2026-11075MEDIUM 6.5

  A flaw in Google Chrome's V8 JavaScript engine allows an attacker to read sensitive data from a browser process's memory by tricking a user into visiting a malicious webpage. The vulnerability exists in Chrome versions before 149.0.7827.53 and requires no special privileges to exploit—only user interaction to visit a crafted page. While the attacker cannot modify data or crash the browser, they can potentially extract confidential information like passwords, session tokens, or other data resident in memory.

• CVE-2026-11078MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser's FileSystem implementation validates cross-origin requests. If an attacker compromises Chrome's renderer process—the sandboxed component that executes web content—they can craft a malicious HTML page to bypass the same-origin policy, a foundational browser security mechanism that prevents one website from accessing data or resources belonging to another. The vulnerability requires the renderer to already be compromised, meaning an attacker would need to have successfully exploited a prior vulnerability to reach this point, making it a secondary but meaningful risk in a multi-stage attack chain.

• CVE-2026-11081MEDIUM 6.5

  A flaw in how Google Chrome handles Canvas operations before version 149.0.7827.53 allows attackers to circumvent browser same-origin policy protections. An attacker can craft a malicious HTML page that, when visited by a user, breaks the security boundary that normally prevents one website from accessing data or resources belonging to another. The attack requires user interaction (visiting the page) but no special browser configuration.

• CVE-2026-11083MEDIUM 6.5

  Google Chrome's password manager contained a flaw that could allow an attacker to trick users into leaking sensitive cross-origin data through a specially crafted webpage. The vulnerability requires user interaction—such as visiting a malicious site—but poses a meaningful risk because password managers are trusted to protect sensitive credentials and related information. An attacker exploiting this could potentially access data that should remain isolated between different websites.

• CVE-2026-11084MEDIUM 6.5

  A flaw in Google Chrome's password manager allows attackers to trick users into visiting a specially crafted website that can leak sensitive data from other websites the user has visited. The vulnerability requires user interaction—specifically, the victim must click on or interact with a malicious page—but once triggered, it can expose cross-site information that should normally be protected by browser security boundaries. This affects Chrome versions before 149.0.7827.53 on Windows, macOS, and Linux systems.

• CVE-2026-11087MEDIUM 6.5

  A memory safety issue in Google Chrome's ANGLE graphics library allows an attacker who has already compromised the renderer process to steal sensitive data from other websites. The vulnerability requires user interaction (visiting a malicious web page) and affects Chrome on Windows, macOS, and Linux. The attacker gains read-only access to cross-origin data, meaning they cannot modify it or crash the browser, but confidentiality is at risk.

• CVE-2026-11089MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a memory disclosure vulnerability in its media handling code. If an attacker gains control of Chrome's renderer process—the component responsible for displaying web content—they can craft a malicious HTML page to read uninitialized data from memory, potentially exposing sensitive information like passwords, encryption keys, or other confidential data. The vulnerability requires a prior compromise of the renderer, meaning it's typically chained with another exploit to be effective in the wild.

• CVE-2026-11090MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in the ANGLE graphics library that can be exploited to leak data across website boundaries. An attacker could craft a malicious webpage that, when visited, causes Chrome to inadvertently expose sensitive information from other origins a user has open. This requires user interaction (visiting the malicious page) but does not require special privileges. The vulnerability affects Windows, macOS, and Linux systems running vulnerable Chrome versions.

• CVE-2026-11093MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser handles printing functionality that could allow an attacker who has already compromised Chrome's rendering engine to steal sensitive data from websites the user visits. The attacker would need to trick the user into visiting a malicious webpage after gaining control of the renderer process. This is a medium-severity issue because it requires an intermediate compromise and user interaction, but the potential for cross-origin data leakage makes it worth prompt attention.

• CVE-2026-11096MEDIUM 6.5

  A memory reading flaw in Chrome's WebRTC component allows attackers to trick users into visiting a malicious webpage that steals sensitive data from the browser's memory. The vulnerability requires user interaction (clicking a link or visiting a site) but needs no special privileges, making it a practical attack vector for information theft. Google patched this in Chrome version 149.0.7827.53 and later.

• CVE-2026-11097MEDIUM 6.5

  Google Chrome on Android contains a flaw in how its WebView component handles cross-origin requests, allowing an attacker to trick users into visiting a malicious webpage that leaks sensitive data from other websites the user is logged into. The vulnerability requires user interaction (clicking a link or visiting a page) but does not require the user to be an administrator or to bypass additional security measures. This affects Chrome versions before 149.0.7827.53.

• CVE-2026-11101MEDIUM 6.5

  A vulnerability in Google Chrome's Dawn graphics library allows attackers to steal sensitive data from other websites when a user visits a malicious web page. The flaw stems from uninitialized memory being used improperly, potentially exposing information the attacker shouldn't be able to access. Chrome versions before 149.0.7827.53 on Windows are affected.

• CVE-2026-11104MEDIUM 6.5

  CVE-2026-11104 is a memory information disclosure flaw in ANGLE, a graphics abstraction library used by Google Chrome. An attacker who has already compromised Chrome's renderer process can craft a malicious HTML page to read uninitialized memory and leak sensitive data. This is not a trivial attack—it requires the renderer to be compromised first—but once that foothold exists, the vulnerability can amplify the damage by exposing additional secrets from the browser process. Chrome versions before 149.0.7827.53 are vulnerable.

• CVE-2026-11105MEDIUM 6.5

  A flaw in Google Chrome's WebUI component fails to properly validate user-supplied input, allowing an attacker who has already compromised Chrome's renderer process to trick the browser into leaking sensitive data from other websites. The vulnerability requires the renderer to be compromised first, which significantly limits the attack surface. Chrome versions before 149.0.7827.53 are affected.

• CVE-2026-11106MEDIUM 6.5

  A flaw in Google Chrome's media handling allows attackers to trick users into visiting a malicious web page that can steal private data from other websites the user has visited. The vulnerability requires user interaction—someone must click a link or visit the crafted page—but once they do, an attacker can bypass Chrome's normal security boundaries that keep websites isolated from each other. This affects Chrome on Windows, macOS, and Linux systems.

• CVE-2026-11109MEDIUM 6.5

  A vulnerability in the ANGLE graphics library used by Google Chrome can leak sensitive data from websites you're viewing to an attacker. An attacker would need to trick you into visiting a specially crafted webpage, but requires no special browser extensions or user interaction beyond visiting the page. The vulnerability affects Chrome versions prior to 149.0.7827.53 on Windows, macOS, and Linux systems.

• CVE-2026-11110MEDIUM 6.5

  A flaw in Google Chrome's graphics rendering engine (ANGLE) can leak sensitive data from websites you visit to attackers. The vulnerability exists in Chrome versions before 149.0.7827.53 and requires a user to click on or interact with a malicious webpage. When exploited, it exposes confidential information that should remain isolated between different websites.

• CVE-2026-11121MEDIUM 6.5

  CVE-2026-11121 is a medium-severity vulnerability in Skia, the graphics rendering engine used by Google Chrome. The flaw involves improper validation of untrusted input that could allow an attacker who has already compromised the browser's renderer process to extract sensitive data across origin boundaries using a specially crafted web page. This is not an initial entry point into systems, but rather a post-compromise escalation vector that broadens the damage an attacker can do once inside the browser process.

• CVE-2026-11123MEDIUM 6.5

  A flaw in ANGLE (the graphics abstraction layer used by Google Chrome) allows attackers to trick users into visiting a malicious website that reads sensitive information directly from Chrome's memory. The vulnerability was patched in Chrome version 149.0.7827.53. Because it requires user interaction (clicking a link or visiting a page), it's less critical than remotely exploitable flaws, but the memory disclosure risk—potentially exposing authentication tokens, cached data, or other secrets—warrants prompt patching.

• CVE-2026-11127MEDIUM 6.5

  Google Chrome on Android contains a flaw in how it handles WebAPKs—web applications packaged as native Android apps—that could allow an attacker to trick users into believing they're visiting a legitimate website when they're actually on a spoofed domain. An attacker would need to craft a malicious WebAPK and get a user to install it, but once active, the spoofing could occur without additional user interaction beyond normal app use. This affects Chrome versions before 149.0.7827.53 on Android.

• CVE-2026-11128MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in the Web Share feature that allows attackers to steal data from other websites. The vulnerability requires tricking a user into clicking or interacting with elements on a malicious webpage. Once triggered, an attacker can access information from cross-origin sources—essentially reading data they shouldn't have access to. This is a client-side issue affecting individual users rather than servers, and the bar for exploitation is user interaction on a crafted page.

• CVE-2026-11129MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser handles extensions that could allow an attacker to steal sensitive data from websites you visit. An attacker would need to trick you into visiting a malicious webpage, but if successful, they could read information from other sites you have open—potentially including login credentials, private messages, or financial data. This is a medium-severity issue that affects Chrome on Windows, macOS, and Linux.

• CVE-2026-11132MEDIUM 6.5

  A flaw in Chrome's Paint component allows attackers to bypass the same-origin policy—a fundamental browser security boundary—by tricking users into visiting a malicious webpage. The vulnerability affects Chrome versions before 149.0.7827.53. While an attacker cannot steal data directly through this weakness, they can modify or inject content in ways the browser should have blocked, potentially enabling follow-up attacks that compromise user sessions or inject malware. The flaw requires user interaction (visiting a crafted page) but is otherwise straightforward to exploit.

• CVE-2026-11133MEDIUM 6.5

  A vulnerability in Google Chrome's Paint feature allows attackers to bypass the same-origin policy—a critical browser security boundary—through a specially crafted web page. An attacker could trick a user into visiting a malicious site and potentially access or modify content from another origin without permission. The vulnerability requires user interaction (clicking a link or visiting a page) but does not require special privileges. Chrome versions before 149.0.7827.53 are affected.

• CVE-2026-11134MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the Media component handles certain HTML content. An attacker can craft a malicious webpage that, when visited by a user, leaks sensitive data that should be restricted to one website (cross-origin data) to an attacker-controlled site. The vulnerability requires user interaction—the victim must visit the crafted page—but no special browser configuration or user privileges are needed. This is a confidentiality risk, not a data destruction or service disruption issue.

• CVE-2026-11135MEDIUM 6.5

  Google Chrome's Autofill feature fails to properly enforce security policies, allowing attackers to trick users into bypassing security controls through specially crafted web pages. An attacker cannot steal data directly, but can manipulate what gets filled into form fields—potentially leading users to submit sensitive information to the wrong destination or trigger unintended actions. The vulnerability requires user interaction (clicking or interacting with the page) and affects Chrome versions before 149.0.7827.53.

• CVE-2026-11137MEDIUM 6.5

  CVE-2026-11137 is a memory disclosure vulnerability in ANGLE, the graphics abstraction layer used by Google Chrome. A remote attacker can trick a user into visiting a specially crafted webpage that reads uninitialized memory from the Chrome process, potentially exposing sensitive data like passwords, tokens, or other information temporarily stored in RAM. The attack requires user interaction (clicking a link or visiting a malicious site) but no special privileges. This affects Chrome versions prior to 149.0.7827.53 across Windows, macOS, and Linux.

• CVE-2026-11138MEDIUM 6.5

  A memory initialization flaw in Google Chrome's ANGLE graphics component allows attackers to expose sensitive data across different websites when users visit a malicious webpage. An attacker would need to craft a specially designed HTML page and trick a user into viewing it; the vulnerability itself requires no special browser configuration and affects all major operating systems where Chrome runs.

• CVE-2026-11139MEDIUM 6.5

  A flaw in Google Chrome's Paint implementation allows attackers to steal sensitive information from one website and expose it to another. An attacker can craft a specially designed web page that, when visited by a user, exploits this vulnerability to read data across security boundaries that browsers normally enforce. The vulnerability affects Chrome versions before 149.0.7827.53 and requires user interaction—the victim must visit the malicious page—but does not require special permissions or system access.

• CVE-2026-11140MEDIUM 6.5

  A memory reading vulnerability in Google Chrome's Chromecast feature allows an attacker who has already compromised the browser's renderer process to steal sensitive data from the browser's memory by serving a specially crafted web page. The vulnerability requires the attacker to have control of the renderer—the component that displays websites—but once achieved, they can extract information without needing special privileges or modifying the page's normal function.

• CVE-2026-11141MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in the audio subsystem that can leak sensitive data from memory. An attacker who has already compromised the renderer process—the component that executes web content—can craft a malicious HTML page to read uninitialized memory and extract potentially confidential information. This requires an existing foothold in the renderer, making it a secondary-stage exploitation technique rather than a direct entry vector.

• CVE-2026-11142MEDIUM 6.5

  A flaw in Google Chrome's Paint feature prior to version 149.0.7827.53 allows attackers to bypass the browser's same-origin policy through a maliciously crafted webpage. An attacker could trick a user into visiting their page and potentially access or manipulate content that should be isolated from other websites. The vulnerability requires user interaction but poses a meaningful integrity risk to web security boundaries.

• CVE-2026-11143MEDIUM 6.5

  Google Chrome on Linux contains an out-of-bounds memory read vulnerability affecting versions prior to 149.0.7827.53. The flaw resides in Chrome's extension handling mechanism and allows a malicious extension—installed by a user—to read sensitive data directly from the browser's process memory. An attacker would need to trick a user into installing the malicious extension, but once installed, the extension can harvest information like passwords, session tokens, or other in-memory secrets without triggering additional user interaction.

• CVE-2026-11148MEDIUM 6.5

  A vulnerability in Google Chrome's payment processing on Android allows a malicious website to steal sensitive information from other websites you've visited or logged into. An attacker would need you to visit their crafted webpage, but requires no special system access. The issue stems from improper handling of cross-origin security boundaries in the Payments API implementation.

• CVE-2026-11160MEDIUM 6.5

  Google Chrome on Linux versions before 149.0.7827.53 contains a memory reading flaw in its input handling. An attacker can trick a user into visiting a specially crafted webpage, causing Chrome to leak sensitive data from the browser process's memory—such as cached passwords, session tokens, or other confidential information. The vulnerability requires user interaction (clicking a link or visiting a site) but no special privileges, and affects only Linux systems.

• CVE-2026-11168MEDIUM 6.5

  A vulnerability in Google Chrome's extension system allows an attacker who has already compromised the browser's renderer process to extract sensitive data from memory using a specially crafted webpage. The vulnerability requires the attacker to have control over the renderer process first, which limits the immediate attack surface but poses significant risk if combined with other exploits. The issue stems from improper implementation in how extensions interact with the rendering engine.

• CVE-2026-11176MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser handles media content that could allow an attacker to trick a user into visiting a malicious webpage and steal sensitive data from other websites the user is logged into. The attacker cannot exploit this remotely without user interaction—the victim must visit the crafted page—but once there, the browser's media handling could be bypassed to reveal cross-origin information that should remain private.

• CVE-2026-11180MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how SVG (Scalable Vector Graphics) content is handled that could allow an attacker to steal data from other websites. An attacker would need to trick a user into visiting a malicious webpage, but does not require any special browser plugins or user permissions beyond normal browsing. The vulnerability affects Chrome on Windows, macOS, and Linux.

• CVE-2026-11182MEDIUM 6.5

  Google Chrome contains a vulnerability in how it processes SVG (Scalable Vector Graphics) content that could allow an attacker to steal sensitive data from websites you visit. An attacker would need to trick you into visiting a malicious webpage, but if successful, they could potentially read information that should be protected between different websites—such as authentication tokens, account details, or other private data. The vulnerability affects Chrome versions before 149.0.7827.53.

• CVE-2026-11183MEDIUM 6.5

  CVE-2026-11183 is a memory safety vulnerability in Google Chrome's GWP-ASan security feature that allows an attacker with local access to read sensitive data from the browser's memory by tricking a user into opening a malicious file. While the flaw requires user interaction and doesn't allow remote code execution, it can expose confidential information such as cached credentials, session tokens, or other sensitive data held in process memory.

• CVE-2026-11189MEDIUM 6.5

  A flaw in Google Chrome's developer tools allowed attackers to bypass navigation restrictions through malicious browser extensions. If a user installed a crafted extension, an attacker could manipulate Chrome's navigation controls to reach restricted pages or resources. The vulnerability requires user action—specifically, convincing someone to install the malicious extension—but once installed, no additional user interaction is needed for the bypass itself.

• CVE-2026-11190MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how it handles browser extensions. An attacker could create a malicious extension that, if installed by a user, bypasses Chrome's access control protections. This means the extension could perform actions it should not be permitted to do—such as accessing restricted resources or modifying system behavior—without proper authorization checks. The attack requires user action to install the extension, but once installed, the damage is contained to what the extension itself can access rather than affecting the entire system.

• CVE-2026-11193MEDIUM 6.5

  Google Chrome's Password Manager contained a flaw that failed to properly enforce access controls, allowing an attacker to bypass security restrictions through a malicious webpage. An attacker could craft a specially designed HTML page that, when visited by a user, circumvents the protections meant to prevent unauthorized access to password management features. This requires user interaction—the victim must visit the attacker's page—but no special privileges are needed on the attacker's side. The vulnerability does not lead to data theft or system crashes, but rather prevents the password manager from properly enforcing who can access its functions.

• CVE-2026-11194MEDIUM 6.5

  A vulnerability in Google Chrome's network implementation could allow an attacker to trick users into visiting a specially crafted webpage that leaks sensitive data from other websites the user is logged into. The attack requires user interaction (clicking or visiting the malicious page) but does not require special browser configuration or user privileges. While the confidentiality impact is high, the vulnerability does not allow attackers to modify data or disable services.

• CVE-2026-11195MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how the browser handles MHTML (MIME Encapsulation of Aggregate HTML Documents) content. An attacker can craft a malicious web page that, when visited by a user who performs specific interactions with the page (such as clicking or other UI gestures), leaks sensitive data from websites the user has visited in other browser tabs or windows. The vulnerability requires user interaction to trigger and does not allow attackers to modify data or crash the browser, but it does enable unauthorized access to cross-origin information that should remain private.

• CVE-2026-11196MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a type confusion bug in XML processing that allows an attacker to craft a malicious XML file. When a user opens this file in Chrome, the vulnerability can leak sensitive data from the browser's memory without requiring special user permissions or network-level access. The flaw affects Windows, macOS, and Linux users. While the attack requires user interaction (opening a file), the potential exposure of process memory makes this a notable security concern for organizations where users handle untrusted documents.

• CVE-2026-11197MEDIUM 6.5

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in how Worker threads enforce same-origin policy. An attacker who has already compromised your browser's rendering engine can craft a malicious webpage to trick the Worker into allowing cross-origin requests it should block. This is a post-compromise scenario—the attacker must first gain control of the renderer process—but once inside, they can escalate their privileges by accessing data from other websites.

• CVE-2026-11200MEDIUM 6.5

  A flaw in Google Chrome's WebRTC implementation allows attackers to steal private data from other websites through a malicious HTML page. An attacker would need to trick a user into visiting their crafted webpage while Chrome is running, but no special technical privileges are required. The vulnerability affects Chrome versions before 149.0.7827.53 across Windows, macOS, and Linux.

• CVE-2026-11203MEDIUM 6.5

  Google Chrome on macOS has a flaw in how it handles GPU-related processes that could allow an attacker to steal sensitive data from websites you visit. The vulnerability requires user interaction—you would need to visit a malicious or compromised website—but once there, an attacker could potentially access information from other sites you have open in the browser. Google has patched this in Chrome version 149.0.7827.53 and later.

• CVE-2026-11204MEDIUM 6.5

  A flaw in Google Chrome's sign-in implementation on iOS allows an attacker to bypass navigation restrictions by directing a user to a specially crafted webpage. The vulnerability requires user interaction—specifically visiting a malicious page—but does not require elevated permissions. While the attacker cannot read sensitive data or crash the application, they can manipulate the browser's navigation behavior in ways the user did not intend.

• CVE-2026-11206MEDIUM 6.5

  A vulnerability in Google Chrome's Service Worker implementation allows attackers to access sensitive data from websites you visit, even data that should be restricted to specific origins. An attacker can craft a malicious web page that, when visited, exploits insufficient policy checks to leak cross-origin information. This requires user interaction—you must visit the attacker's page—but once there, the browser's protections are bypassed without additional warnings or user awareness.

• CVE-2026-11208MEDIUM 6.5

  A use-after-free vulnerability exists in the codec handling components of Google Chrome versions prior to 149.0.7827.53. An attacker can craft a malicious HTML page that, when visited by a user, exploits this memory safety flaw to read sensitive data directly from the browser process's memory. The vulnerability requires user interaction (visiting a malicious site) but does not require any special privileges to exploit.

• CVE-2026-11209MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how it handles password data that could allow an attacker who has already compromised Chrome's renderer process to read sensitive information from memory using a specially crafted webpage. The vulnerability requires that the attacker first gain control of the renderer process—a significant precondition—but once achieved, could expose data stored in process memory without modifying or disabling system functions.

• CVE-2026-11210MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in Safe Browsing that allows attackers to bypass access controls when a user opens a specially crafted RAR archive file. An attacker would need to trick a user into opening a malicious RAR file, but once they do, the browser's safety mechanisms fail to properly restrict what the file can access. This is a moderate-severity issue that affects Chrome on Windows, macOS, and Linux.

• CVE-2026-11214MEDIUM 6.5

  A flaw in Google Chrome for iOS allows attackers to trick users into visiting a malicious website that can leak data from other websites the user has open in their browser. The attacker needs the victim to interact with the malicious page (such as clicking a link), but no special technical skills or authentication are required on the attacker's side. This is a cross-origin data leak vulnerability affecting Chrome on iPhones and iPads running iOS.