Google Chrome vulnerabilities

CVE-2026-11108 [HIGH] CWE-269 CVE-2026-11108: Inappropriate implementation in NFC in Google Chrome on Android prior to 149.0.7827.53 allowed a rem Inappropriate implementation in NFC in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-7903 [HIGH] CWE-472 CVE-2026-7903: Integer overflow in ANGLE in Google Chrome on Mac,Windows prior to 148.0.7778.96 allowed a remote at Integer overflow in ANGLE in Google Chrome on Mac,Windows prior to 148.0.7778.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2026-10019 [HIGH] CWE-472 CVE-2026-10019: Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to leak Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11092 [HIGH] CWE-602 CVE-2026-11092: Insufficient policy enforcement in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attac Insufficient policy enforcement in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to perform privilege escalation via a crafted Chrome Extension. (Chromium security severity: Medium)

CVE-2026-10961 [HIGH] CWE-416 CVE-2026-10961: Use after free in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote att Use after free in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-9893 [HIGH] CWE-416 CVE-2026-9893: Use after free in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had co Use after free in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVE-2010-0647 [CRITICAL] CWE-94 CVE-2010-0647: WebKit before r53525, as used in Google Chrome before 4.0.249.89, allows remote attackers to execute WebKit before r53525, as used in Google Chrome before 4.0.249.89, allows remote attackers to execute arbitrary code in the Chrome sandbox via a malformed RUBY element, as demonstrated by a > sequence.

CVE-2026-76046 [HIGH] CWE-122 CVE-2026-76046: Buffer overflow in ANGLE in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote att Buffer overflow in ANGLE in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-7353 [HIGH] CWE-122 CVE-2026-7353: Heap buffer overflow in Skia in Google Chrome prior to 147.0.7727.138 allowed a remote attacker who Heap buffer overflow in Skia in Google Chrome prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-10898 [HIGH] CWE-121 CVE-2026-10898: Stack buffer overflow in GPU in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who h Stack buffer overflow in GPU in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-19138 [HIGH] CWE-122 CVE-2026-19138: Heap buffer overflow in CrashReporting in Google Chrome prior to 151.0.7922.109 allowed a remote att Heap buffer overflow in CrashReporting in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-19177 [HIGH] CWE-20 CVE-2026-19177: Insufficient validation of untrusted input in UI in Google Chrome prior to 151.0.7922.109 allowed a Insufficient validation of untrusted input in UI in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-17660 [HIGH] CWE-20 CVE-2026-17660: Insufficient validation of untrusted input in Network in Google Chrome prior to 151.0.7922.72 allowe Insufficient validation of untrusted input in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-15122 [HIGH] CWE-20 CVE-2026-15122: Insufficient validation of untrusted input in Codecs in Google Chrome on Windows prior to 150.0.7871 Insufficient validation of untrusted input in Codecs in Google Chrome on Windows prior to 150.0.7871.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-10949 [HIGH] CWE-122 CVE-2026-10949: Heap buffer overflow in Video in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who Heap buffer overflow in Video in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-6361 [HIGH] CWE-122 CVE-2026-6361: Heap buffer overflow in PDFium in Google Chrome on Windows prior to 147.0.7727.101 allowed a remote Heap buffer overflow in PDFium in Google Chrome on Windows prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: High)

CVE-2026-10911 [HIGH] CWE-20 CVE-2026-10911: Insufficient validation of untrusted input in Media in Google Chrome prior to 149.0.7827.53 allowed Insufficient validation of untrusted input in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-10917 [HIGH] CWE-20 CVE-2026-10917: Insufficient validation of untrusted input in Media in Google Chrome prior to 149.0.7827.53 allowed Insufficient validation of untrusted input in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-19172 [HIGH] CWE-416 CVE-2026-19172: Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had c Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-19163 [HIGH] CWE-416 CVE-2026-19163: Use after free in Media in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacke Use after free in Media in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)