Google vulnerabilities

CVE-2026-5887 Medium · 4.3 CWE-20 Apr 8, 2026

Improper Input Validation in Google Chrome

Insufficient validation of untrusted input in Downloads in Google Chrome on Windows prior to 147.0.7727.55 allowed a remote attacker to bypass download restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-5886 Medium · 5.3 CWE-125 Apr 8, 2026

Out-of-bounds Read in Google Chrome

Out of bounds read in WebAudio in Google Chrome on Mac prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-5885 Medium · 6.5 CWE-20 Apr 8, 2026

Improper Input Validation in Google Chrome

Insufficient validation of untrusted input in WebML in Google Chrome on Windows prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-5884 High · 8.8 CWE-20 Apr 8, 2026

Improper Input Validation in Google Chrome

Insufficient validation of untrusted input in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-5883 High · 8.8 CWE-416 Apr 8, 2026

Use After Free in Google Chrome

Use after free in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-5882 Medium · 4.3 CWE-451 Apr 8, 2026

Incorrect security UI in Fullscreen in Google Chrome prior to 147.0.7727.55 allowed a…

Incorrect security UI in Fullscreen in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-5881 Medium · 6.5 CWE-284 Apr 8, 2026

Improper Access Control in Google Chrome

Policy bypass in LocalNetworkAccess in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-5880 Medium · 4.3 CWE-451 Apr 8, 2026

Insufficient policy enforcement in browser UI in Google Chrome prior to 147.0.7727.55…

Insufficient policy enforcement in browser UI in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-5879 High · 8.8 CWE-20 Apr 8, 2026

Improper Input Validation in Google Chrome

Insufficient validation of untrusted input in ANGLE in Google Chrome on Mac prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-5878 Medium · 4.3 CWE-451 Apr 8, 2026

Incorrect security UI in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote…

Incorrect security UI in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-5877 High · 8.8 CWE-416 Apr 8, 2026

Use After Free in Google Chrome

Use after free in Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-5876 Medium · 6.5 CWE-1300 Apr 8, 2026

Side-channel information leakage in Navigation in Google Chrome prior to 147.0.7727.55…

Side-channel information leakage in Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-5875 Medium · 4.3 CWE-639 Apr 8, 2026

Authorization Bypass Through User-Controlled Key (IDOR) in Google Chrome

Policy bypass in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-5874 Critical · 9.6 CWE-416 Apr 8, 2026

Google Chrome PrivateAI Use-After-Free Enabling Sandbox Escape

Use after free in PrivateAI in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-5873 High · 8.8 CWE-125 Apr 8, 2026

Out-of-bounds Read in Google Chrome

Out of bounds read and write in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-5872 High · 8.8 CWE-416 Apr 8, 2026

Use After Free in Google Chrome

Use after free in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-5871 High · 8.8 CWE-843 Apr 8, 2026

Type Confusion in Google Chrome

Type Confusion in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-5870 High · 8.8 CWE-190 Apr 8, 2026

Integer Overflow or Wraparound in Google Chrome

Integer overflow in Skia in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-5869 Medium · 4.3 CWE-122 Apr 8, 2026

Heap-based Buffer Overflow in Google Chrome

Heap buffer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

CVE-2026-5868 High · 8.8 CWE-122 Apr 8, 2026

Heap-based Buffer Overflow in Google Chrome

Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-5867 Medium · 4.3 CWE-122 Apr 8, 2026

Heap-based Buffer Overflow in Google Chrome

Heap buffer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

CVE-2026-5866 High · 8.8 CWE-416 Apr 8, 2026

Use After Free in Google Chrome

Use after free in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-5865 High · 8.8 CWE-843 Apr 8, 2026

Type Confusion in Google Chrome

Type Confusion in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-5864 Medium · 4.3 CWE-122 Apr 8, 2026

Heap-based Buffer Overflow in Google Chrome

Heap buffer overflow in WebAudio in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

CVE-2026-5863 High · 8.8 CWE-284 Apr 8, 2026

Improper Access Control in Google Chrome

Inappropriate implementation in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)