Google Chrome vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Google Chrome: 3803 record(s), with affected versions and fixes.cpe:2.3:a:google:chrome
CVE-2026-87467
High · 8.1
CWE-362 Sep 8, 2026
Race Condition in Google Chrome
Race condition in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)
CVE-2026-87466
Medium · 4.3
CWE-863 Sep 8, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in Workers in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-87465
Medium · 4.2
CWE-863 Sep 8, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-87464
Critical · 9.6
CWE-416 Sep 8, 2026
Use After Free in Google Chrome
Use after free in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-87463
Medium · 4.8
CWE-863 Sep 8, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in Certificate in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to potentially spoof address bar via crafted network traffic. (Chromium security severity: Low)
CVE-2026-87462
Medium · 5.4
CWE-451 Sep 8, 2026
UI misrepresentation in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote…
UI misrepresentation in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-87461
Medium · 4.3
CWE-200 Sep 8, 2026
Exposure of Sensitive Information in Google Chrome
Information leak in Core in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted Chrome extension. (Chromium security severity: Low)
CVE-2026-87460
High · 8.8
CWE-416 Sep 8, 2026
Use After Free in Google Chrome
Use after free in Platform in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-87459
Medium · 6.5
CWE-203 Sep 8, 2026
Observable Discrepancy in Google Chrome
Observable discrepancy in Select in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-87458
Medium · 5.4
CWE-451 Sep 8, 2026
UI misrepresentation in Geometry in Google Chrome prior to 153.0.8010.36 allowed a…
UI misrepresentation in Geometry in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-87457
High · 8.1
CWE-367 Sep 8, 2026
TOCTOU Race Condition in Google Chrome
Race condition in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Medium)
CVE-2026-87456
Low · 3.4
CWE-908 Sep 8, 2026
Use of Uninitialized Resource in Google Chrome
Uninitialized resource in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-87455
Critical · 9.6
CWE-416 Sep 8, 2026
Use After Free in Google Chrome
Use after free in Aura in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-87454
Medium · 6.5
CWE-200 Sep 8, 2026
Exposure of Sensitive Information in Google Chrome
Information leak in Enterprise in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-87453
Medium · 5.3
CWE-441 Sep 8, 2026
Confused deputy in BackgroundFetch in Google Chrome prior to 153.0.8010.36 allowed a…
Confused deputy in BackgroundFetch in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-87452
Low · 3.1
CWE-863 Sep 8, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in GPU in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-87451
Low · 3.1
CWE-200 Sep 8, 2026
Exposure of Sensitive Information in Google Chrome
Information leak in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-87450
High · 7.5
CWE-863 Sep 8, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in Permissions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Medium)
CVE-2026-87449
Medium · 4.3
CWE-352 Sep 8, 2026
Cross-Site Request Forgery (CSRF) in Google Chrome
Cross-site request forgery in DeviceBoundSessionCredentials in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-87448
Critical · 9.6
CWE-416 Sep 8, 2026
Use After Free in Google Chrome
Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-87447
Medium · 6.5
CWE-863 Sep 8, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: High)
CVE-2026-87446
Medium · 6.5
CWE-459 Sep 8, 2026
Incomplete cleanup in Extensions in Google Chrome prior to 153.0.8010.36 allowed a…
Incomplete cleanup in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)
CVE-2026-87445
Medium · 5.4
CWE-451 Sep 8, 2026
UI misrepresentation in Session in Google Chrome prior to 153.0.8010.36 allowed a remote…
UI misrepresentation in Session in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-87444
High · 8.8
CWE-119 Sep 8, 2026
Buffer Errors (Improper Restriction of Operations within Memory Bounds) in Google Chrome
Memory corruption in Codecs in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-87443
Medium · 6.5
CWE-862 Sep 8, 2026
Missing Authorization in Google Chrome
Missing authorization in Actor in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)