Google Chrome vulnerabilities

CVE-2026-87479 [HIGH] CWE-807 CVE-2026-87479: Insufficient policy enforcement in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remo Insufficient policy enforcement in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87480 [HIGH] CWE-416 CVE-2026-87480: Use after free in Printing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had Use after free in Printing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-85048 [HIGH] CWE-416 CVE-2026-85048: Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-84349 [HIGH] CWE-416 CVE-2026-84349: Use after free in Browser in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had Use after free in Browser in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-78952 [HIGH] CWE-787 CVE-2026-78952: Out of bounds write in Crashpad in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remo Out of bounds write in Crashpad in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-79224 [HIGH] CWE-416 CVE-2026-79224: Use after free in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who h Use after free in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-78983 [HIGH] CWE-416 CVE-2026-78983: Use after free in Views in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had co Use after free in Views in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-79054 [HIGH] CWE-416 CVE-2026-79054: Use after free in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who h Use after free in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-95322 [HIGH] CWE-787 CVE-2026-95322: Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote at Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-106194 [HIGH] CWE-862 CVE-2026-106194: Missing authorization in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote att Missing authorization in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-106233 [HIGH] CWE-416 CVE-2026-106233: Use after free in Metrics in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had Use after free in Metrics in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-87487 [HIGH] CWE-862 CVE-2026-87487: Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacke Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87644 [HIGH] CWE-863 CVE-2026-87644: Incorrect authorization in Views in Google Chrome on on Windows prior to 153.0.8010.36 allowed a rem Incorrect authorization in Views in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87582 [HIGH] CWE-441 CVE-2026-87582: Confused deputy in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker wh Confused deputy in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-84335 [HIGH] CWE-863 CVE-2026-84335: Incorrect authorization in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacke Incorrect authorization in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-78911 [HIGH] CWE-863 CVE-2026-78911: Incorrect authorization in USB in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who Incorrect authorization in USB in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-78999 [HIGH] CWE-269 CVE-2026-78999: Improper privilege management in Navigation in Google Chrome prior to 152.0.7977.65 allowed a remote Improper privilege management in Navigation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-106228 [HIGH] CWE-441 CVE-2026-106228: Confused deputy in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who Confused deputy in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-91724 [HIGH] CWE-416 CVE-2026-91724: Use after free in Input in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had co Use after free in Input in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-106293 [HIGH] CWE-843 CVE-2026-106293: Type confusion in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had co Type confusion in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)