Google vulnerabilities

CVE-2026-95382 Medium · 6.5 CWE-20 Sep 29, 2026

Improper Input Validation in Google Chrome

Improper input validation in Auth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-95381 High · 8.3 CWE-20 Sep 29, 2026

Improper Input Validation in Google Chrome

Improper input validation in Printing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-95380 High · 8.8 CWE-843 Sep 29, 2026

Type Confusion in Google Chrome

Type confusion in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-95376 High · 8.0 CWE-610 Sep 29, 2026

Externally controlled reference in DevTools in Google Chrome prior to 154.0.8037.57…

Externally controlled reference in DevTools in Google Chrome prior to 154.0.8037.57 allowed an adjacent attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium)

CVE-2026-95375 Medium · 6.3 CWE-863 Sep 29, 2026

Incorrect Authorization in Google Chrome

Incorrect authorization in BrowserTag in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-95374 Medium · 6.5 CWE-863 Sep 29, 2026

Incorrect Authorization in Google Chrome

Incorrect authorization in Network in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-95373 High · 8.8 CWE-416 Sep 29, 2026

Use After Free in Google Chrome

Use after free in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-95372 High · 8.3 CWE-416 Sep 29, 2026

Use After Free in Google Chrome

Use after free in Chromecast in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-95371 Medium · 5.4 CWE-862 Sep 29, 2026

Missing Authorization in Google Chrome

Missing authorization in Views in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-95370 Medium · 5.4 CWE-841 Sep 29, 2026

Inappropriate implementation in NFC in Google Chrome prior to 154.0.8037.57 allowed a…

Inappropriate implementation in NFC in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-95369 High · 8.8 CWE-841 Sep 29, 2026

Inappropriate implementation in XML in Google Chrome prior to 154.0.8037.57 allowed a…

Inappropriate implementation in XML in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-95368 Medium · 4.3 CWE-863 Sep 29, 2026

Incorrect Authorization in Google Chrome

Incorrect authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-95367 Medium · 5.3 CWE-200 Sep 29, 2026

Exposure of Sensitive Information in Google Chrome

Information leak in DataTransfer in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-95366 Medium · 6.5 CWE-672 Sep 29, 2026

Use of released resource in Core in Google Chrome prior to 154.0.8037.57 allowed a…

Use of released resource in Core in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-95365 High · 8.8 CWE-843 Sep 29, 2026

Type Confusion in Google Chrome

Type confusion in IndexedDB in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-95364 Medium · 5.4 CWE-20 Sep 29, 2026

Improper Input Validation in Google Chrome

Improper input validation in Passwords in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-95363 Medium · 5.4 CWE-451 Sep 29, 2026

UI misrepresentation in FileSystem in Google Chrome prior to 154.0.8037.57 allowed a…

UI misrepresentation in FileSystem in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-95362 High · 8.8 CWE-352 Sep 29, 2026

Cross-Site Request Forgery (CSRF) in Google Chrome

Cross-site request forgery in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-95361 Medium · 4.3 CWE-441 Sep 29, 2026

Confused deputy in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote…

Confused deputy in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-95360 Medium · 5.3 CWE-367 Sep 29, 2026

TOCTOU Race Condition in Google Chrome

Race condition in Editing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-95359 Low · 3.4 CWE-908 Sep 29, 2026

Use of Uninitialized Resource in Google Chrome

Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-95358 Medium · 4.4 CWE-863 Sep 29, 2026

Incorrect Authorization in Google Chrome

Incorrect authorization in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker to bypass system access restrictions into a privileged page via a co-installed app. (Chromium security severity: Medium)

CVE-2026-95357 Critical · 9.6 CWE-787 Sep 29, 2026

Out-of-bounds Write in Google Chrome

Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-95356 Critical · 9.6 CWE-416 Sep 29, 2026

Use After Free in Google Chrome

Use after free in WindowDialog in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-95355 High · 8.3 CWE-863 Sep 29, 2026

Incorrect Authorization in Google Chrome

Incorrect authorization in Navigation in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)