Google Chrome vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Google Chrome: 3751 record(s), with affected versions and fixes.cpe:2.3:a:google:chrome
CVE-2026-87515
Medium · 6.5
CWE-863 Sep 8, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-87514
High · 8.1
CWE-416 Sep 8, 2026
Use After Free in Google Chrome
Use after free in Views in Google Chrome prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)
CVE-2026-87513
Medium · 6.5
CWE-862 Sep 8, 2026
Missing Authorization in Google Chrome
Missing authorization in ControlledFrame in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-87512
Critical · 9.6
CWE-416 Sep 8, 2026
Use After Free in Google Chrome
Use after free in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-87511
Medium · 4.3
CWE-862 Sep 8, 2026
Missing Authorization in Google Chrome
Missing authorization in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Low)
CVE-2026-87510
High · 8.3
CWE-20 Sep 8, 2026
Improper Input Validation in Google Chrome
Improper input validation in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-87509
High · 8.1
CWE-863 Sep 8, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Low)
CVE-2026-87508
Medium · 4.3
CWE-863 Sep 8, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-87507
Medium · 5.4
CWE-451 Sep 8, 2026
UI misrepresentation in Downloads in Google Chrome prior to 153.0.8010.36 allowed a…
UI misrepresentation in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-87506
High · 8.3
CWE-250 Sep 8, 2026
Execution with Unnecessary Privileges in Google Chrome
Privilege elevation in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-87505
High · 8.1
CWE-863 Sep 8, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. (Chromium security severity: Medium)
CVE-2026-87504
Critical · 9.6
CWE-416 Sep 8, 2026
Use After Free in Google Chrome
Use after free in Core in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)
CVE-2026-87503
Medium · 6.5
CWE-841 Sep 8, 2026
Inappropriate implementation in Downloads in Google Chrome on on Android prior to…
Inappropriate implementation in Downloads in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-87502
Medium · 4.2
CWE-441 Sep 8, 2026
Confused deputy in Fullscreen in Google Chrome prior to 153.0.8010.36 allowed a remote…
Confused deputy in Fullscreen in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-87501
Medium · 5.4
CWE-451 Sep 8, 2026
UI misrepresentation in Passwords in Google Chrome prior to 153.0.8010.36 allowed a…
UI misrepresentation in Passwords in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-87500
Critical · 9.6
CWE-129 Sep 8, 2026
Improper validation of array index in ANGLE in Google Chrome prior to 153.0.8010.36…
Improper validation of array index in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-87499
High · 8.1
CWE-863 Sep 8, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)
CVE-2026-87498
Low · 3.1
CWE-862 Sep 8, 2026
Missing Authorization in Google Chrome
Missing authorization in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
CVE-2026-87497
Medium · 4.3
CWE-908 Sep 8, 2026
Use of Uninitialized Resource in Google Chrome
Uninitialized resource in Codecs in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-87496
Medium · 5.4
CWE-451 Sep 8, 2026
UI misrepresentation in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote…
UI misrepresentation in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-87495
Medium · 4.3
CWE-200 Sep 8, 2026
Exposure of Sensitive Information in Google Chrome
Information leak in Scroll in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-87494
Critical · 9.6
CWE-416 Sep 8, 2026
Use After Free in Google Chrome
Use after free in Browser in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-87493
Medium · 6.5
CWE-862 Sep 8, 2026
Missing Authorization in Google Chrome
Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-87492
Critical · 9.6
CWE-863 Sep 8, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-87490
Medium · 6.5
CWE-200 Sep 8, 2026
Exposure of Sensitive Information in Google Chrome
Information leak in Transactions Platform in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)