Google vulnerabilities

CVE-2025-22426 High · 7.8 CWE-284 Jun 1, 2026

Improper Access Control in Google Android

In many functions of ComputerEngine.java, there is a possible way to access URIs across users due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-22424 High · 7.8 CWE-20 Jun 1, 2026

Improper Input Validation in Google Android

In multiple locations, there is a possible way to reveal images across users due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

CVE-2026-0072 High · 7.8 CWE-285 Jun 1, 2026

Improper Authorization in Google Android Xr

In addInputMethodListener of com.android.server.inputmethod.InputMethodManagerService, there is a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-9999 High · 8.8 CWE-269 May 28, 2026

Improper Privilege Management in Google Chrome

Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-9998 High · 8.3 CWE-472 May 28, 2026

Integer overflow in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote…

Integer overflow in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-9997 High · 8.3 CWE-416 May 28, 2026

Use After Free in Google Chrome

Use after free in Input in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-9996 Medium · 6.5 CWE-125 May 28, 2026

Out-of-bounds Read in Google Chrome

Out of bounds read in WebRTC in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

CVE-2026-9995 High · 8.8 CWE-416 May 28, 2026

Use After Free in Google Chrome

Use after free in WebXR in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-9994 High · 8.3 CWE-416 May 28, 2026

Use After Free in Google Chrome

Use after free in Core in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-9993 High · 8.3 CWE-416 May 28, 2026

Use After Free in Google Chrome

Use after free in Views in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted PDF file. (Chromium security severity: High)

CVE-2026-9992 High · 8.8 CWE-416 May 28, 2026

Use After Free in Google Chrome

Use after free in Network in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-9991 Low · 3.1 CWE-200 May 28, 2026

Exposure of Sensitive Information in Google Chrome

Inappropriate implementation in Media in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

CVE-2026-9990 High · 7.5 CWE-416 May 28, 2026

Use After Free in Google Chrome

Use after free in WebAppInstalls in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2026-9989 Medium · 6.3 CWE-346 May 28, 2026

Inappropriate implementation in Media in Google Chrome prior to 148.0.7778.216 allowed a…

Inappropriate implementation in Media in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to bypass same origin policy via a crafted video file. (Chromium security severity: High)

CVE-2026-9988 High · 8.3 CWE-416 May 28, 2026

Use After Free in Google Chrome

Use after free in WebRTC in Google Chrome on Linux prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-9987 High · 7.8 CWE-20 May 28, 2026

Improper Input Validation in Google Chrome

Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 148.0.7778.216 allowed a local attacker to execute arbitrary code via a malicious file. (Chromium security severity: High)

CVE-2026-9986 Medium · 4.2 CWE-20 May 28, 2026

Improper Input Validation in Google Chrome

Insufficient validation of untrusted input in OptimizationGuide in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: High)

CVE-2026-9985 Medium · 5.3 CWE-20 May 28, 2026

Improper Input Validation in Google Chrome

Insufficient validation of untrusted input in Media in Google Chrome on ChromeOS prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

CVE-2026-9984 High · 8.8 CWE-416 May 28, 2026

Use After Free in Google Chrome

Use after free in UI in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

CVE-2026-9983 High · 8.8 CWE-843 May 28, 2026

Type Confusion in Google Chrome

Type Confusion in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-9982 High · 8.3 CWE-20 May 28, 2026

Improper Input Validation in Google Chrome

Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-9981 Medium · 6.5 CWE-200 May 28, 2026

Exposure of Sensitive Information in Google Chrome

Inappropriate implementation in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

CVE-2026-9980 Medium · 5.0 CWE-20 May 28, 2026

Improper Input Validation in Google Chrome

Insufficient validation of untrusted input in Printing in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

CVE-2026-9979 Medium · 5.0 CWE-20 May 28, 2026

Improper Input Validation in Google Chrome

Insufficient validation of untrusted input in Input in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

CVE-2026-9978 High · 8.8 CWE-416 May 28, 2026

Use After Free in Google Chrome

Use after free in Glic in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)