Google Chrome vulnerabilities

CVE-2026-7900 [HIGH] CWE-122 CVE-2026-7900: Heap buffer overflow in ANGLE in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who Heap buffer overflow in ANGLE in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-9877 [HIGH] CWE-416 CVE-2026-9877: Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had c Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-11635 [HIGH] CWE-416 CVE-2026-11635: Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacke Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-11631 [HIGH] CWE-416 CVE-2026-11631: Use after free in Aura in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker Use after free in Aura in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-9949 [HIGH] CWE-416 CVE-2026-9949: Use after free in Core in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker Use after free in Core in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-9937 [HIGH] CWE-416 CVE-2026-9937: Use after free in UI in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker w Use after free in UI in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-9932 [HIGH] CWE-416 CVE-2026-9932: Use after free in ANGLE in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacke Use after free in ANGLE in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-15774 [HIGH] CWE-416 CVE-2026-15774: Use after free in Skia in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who had co Use after free in Skia in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-9966 [HIGH] CWE-472 CVE-2026-9966: Integer overflow in XML in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacke Integer overflow in XML in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-9905 [HIGH] CWE-416 CVE-2026-9905: Use after free in Accessibility in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote Use after free in Accessibility in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-9890 [HIGH] CWE-416 CVE-2026-9890: Use after free in XR in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker w Use after free in XR in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-8515 [HIGH] CWE-416 CVE-2026-8515: Use after free in HID in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinc Use after free in HID in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-8542 [HIGH] CWE-416 CVE-2026-8542: Use after free in Core in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker Use after free in Core in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-8514 [HIGH] CWE-416 CVE-2026-8514: Use after free in Aura in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had co Use after free in Aura in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-8512 [HIGH] CWE-416 CVE-2026-8512: Use after free in FileSystem in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who Use after free in FileSystem in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-7970 [HIGH] CWE-416 CVE-2026-7970: Use after free in TopChrome in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who ha Use after free in TopChrome in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-7917 [HIGH] CWE-416 CVE-2026-7917: Use after free in Fullscreen in Google Chrome on Windows prior to 148.0.7778.96 allowed a remote att Use after free in Fullscreen in Google Chrome on Windows prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-7911 [HIGH] CWE-416 CVE-2026-7911: Use after free in Aura in Google Chrome on Windows prior to 148.0.7778.96 allowed a remote attacker Use after free in Aura in Google Chrome on Windows prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-7985 [HIGH] CWE-416 CVE-2026-7985: Use after free in GPU in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had comp Use after free in GPU in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-7975 [HIGH] CWE-416 CVE-2026-7975: Use after free in DevTools in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had Use after free in DevTools in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)