Google Chrome vulnerabilities

CVE-2026-7996 [MEDIUM] CWE-20 CVE-2026-7996: Insufficient validation of untrusted input in SSL in Google Chrome prior to 148.0.7778.96 allowed a Insufficient validation of untrusted input in SSL in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-14139 [MEDIUM] CWE-451 CVE-2026-14139: Inappropriate implementation in TabStrip in Google Chrome prior to 150.0.7871.47 allowed a remote at Inappropriate implementation in TabStrip in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-8564 [MEDIUM] CWE-451 CVE-2026-8564: Incorrect security UI in Downloads in Google Chrome on Android and Mac prior to 148.0.7778.168 allow Incorrect security UI in Downloads in Google Chrome on Android and Mac prior to 148.0.7778.168 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-14026 [MEDIUM] CWE-451 CVE-2026-14026: Incorrect security UI in SplitView in Google Chrome prior to 150.0.7871.47 allowed a remote attacker Incorrect security UI in SplitView in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

CVE-2025-12446 [MEDIUM] CWE-451 CVE-2025-12446: Incorrect security UI in SplitView in Google Chrome prior to 142.0.7444.59 allowed a remote attacker Incorrect security UI in SplitView in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted domain name. (Chromium security severity: Low)

CVE-2026-13993 [MEDIUM] CWE-451 CVE-2026-13993: Incorrect security UI in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote att Incorrect security UI in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform domain spoofing via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-13997 [MEDIUM] CWE-451 CVE-2026-13997: Incorrect security UI in Extensions in Google Chrome on Android prior to 150.0.7871.47 allowed a rem Incorrect security UI in Extensions in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-13998 [MEDIUM] CWE-451 CVE-2026-13998: Incorrect security UI in File Input in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote Incorrect security UI in File Input in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-14129 [MEDIUM] CWE-451 CVE-2026-14129: Inappropriate implementation in PreviewTab in Google Chrome on Android prior to 150.0.7871.47 allowe Inappropriate implementation in PreviewTab in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-14133 [MEDIUM] CWE-362 CVE-2026-14133: Race in History Embeddings in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perf Race in History Embeddings in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-13024 [MEDIUM] CWE-20 CVE-2026-13024: Insufficient validation of untrusted input in Navigation in Google Chrome prior to 149.0.7827.197 al Insufficient validation of untrusted input in Navigation in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

CVE-2026-8584 [MEDIUM] CWE-451 CVE-2026-8584: Inappropriate implementation in Views in Google Chrome on iOS prior to 148.0.7778.168 allowed a remo Inappropriate implementation in Views in Google Chrome on iOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-14144 [MEDIUM] CWE-451 CVE-2026-14144: Incorrect security UI in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who Incorrect security UI in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

CVE-2010-4576 [MEDIUM] CWE-476 CVE-2010-4576: browser/worker_host/message_port_dispatcher.cc in Google Chrome before 8.0.552.224 and Chrome OS bef browser/worker_host/message_port_dispatcher.cc in Google Chrome before 8.0.552.224 and Chrome OS before 8.0.552.343 does not properly handle certain postMessage calls, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted JavaScript code that creates a web worker.

CVE-2010-1664 [MEDIUM] CWE-119 CVE-2010-1664: Google Chrome before 4.1.249.1064 does not properly handle HTML5 media, which allows remote attacker Google Chrome before 4.1.249.1064 does not properly handle HTML5 media, which allows remote attackers to cause a denial of service (memory corruption) and possibly have unspecified other impact via unknown vectors.

CVE-2011-3111 [MEDIUM] CWE-119 CVE-2011-3111: Google V8, as used in Google Chrome before 19.0.1084.52, allows remote attackers to cause a denial o Google V8, as used in Google Chrome before 19.0.1084.52, allows remote attackers to cause a denial of service (invalid read operation) via unspecified vectors.

CVE-2012-5123 [MEDIUM] CWE-119 CVE-2012-5123: Skia, as used in Google Chrome before 23.0.1271.64, allows remote attackers to cause a denial of ser Skia, as used in Google Chrome before 23.0.1271.64, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

CVE-2011-3085 [MEDIUM] CWE-119 CVE-2011-3085: The Autofill feature in Google Chrome before 19.0.1084.46 does not properly restrict field values, w The Autofill feature in Google Chrome before 19.0.1084.46 does not properly restrict field values, which allows remote attackers to cause a denial of service (UI corruption) and possibly conduct spoofing attacks via vectors involving long values.

CVE-2011-2864 [MEDIUM] CWE-125 CVE-2011-2864: Google Chrome before 14.0.835.163 does not properly handle Tibetan characters, which allows remote a Google Chrome before 14.0.835.163 does not properly handle Tibetan characters, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

CVE-2011-2851 [MEDIUM] CWE-125 CVE-2011-2851: Google Chrome before 14.0.835.163 does not properly handle video, which allows remote attackers to c Google Chrome before 14.0.835.163 does not properly handle video, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.