Google vulnerabilities

CVE-2026-91727 High · 8.1 CWE-706 Sep 15, 2026

Use of Incorrectly-Resolved Name or Reference in Google Chrome

Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a local attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)

CVE-2026-91726 Medium · 4.7 CWE-125 Sep 15, 2026

Out-of-bounds Read in Google Chrome

Out of bounds read in WebGL in Google Chrome on on Android prior to 153.0.8010.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-91725 Medium · 5.3 CWE-203 Sep 15, 2026

Observable Discrepancy in Google Chrome

Observable discrepancy in CSS in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-91724 High · 8.3 CWE-416 Sep 15, 2026

Use After Free in Google Chrome

Use after free in Input in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-91723 Low · 3.1 CWE-362 Sep 15, 2026

Race Condition in Google Chrome

Race condition in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-91722 High · 8.8 CWE-416 Sep 15, 2026

Use After Free in Google Chrome

Use after free in Input in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-91721 High · 8.8 CWE-416 Sep 15, 2026

Use After Free in Google Chrome

Use after free in Internals in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-91720 Medium · 4.7 CWE-908 Sep 15, 2026

Use of Uninitialized Resource in Google Chrome

Uninitialized resource in ANGLE in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-91719 High · 8.1 CWE-94 Sep 15, 2026

Code Injection in Google Chrome

Code injection in XML in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-91718 Critical · 9.6 CWE-416 Sep 15, 2026

Use After Free in Google Chrome

Use after free in Core in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-91717 Medium · 5.1 CWE-862 Sep 15, 2026

Missing Authorization in Google Chrome

Missing authorization in Android in Google Chrome on on Android prior to 153.0.8010.47 allowed a local attacker to obtain sensitive information via a co-installed app. (Chromium security severity: High)

CVE-2026-91716 Critical · 9.6 CWE-416 Sep 15, 2026

Use After Free in Google Chrome

Use after free in Auth in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-91715 High · 8.8 CWE-843 Sep 15, 2026

Type Confusion in Google Chrome

Type confusion in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-91714 Medium · 5.3 CWE-203 Sep 15, 2026

Observable Discrepancy in Google Chrome

Observable discrepancy in Fonts in Google Chrome prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-91713 Medium · 4.2 CWE-862 Sep 15, 2026

Missing Authorization in Google Chrome

Missing authorization in Browser in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-91712 High · 8.3 CWE-367 Sep 15, 2026

TOCTOU Race Condition in Google Chrome

Race condition in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-91711 High · 8.8 CWE-787 Sep 15, 2026

Out-of-bounds Write in Google Chrome

Out of bounds write in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-91710 Critical · 9.6 CWE-416 Sep 15, 2026

Use After Free in Google Chrome

Use after free in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-91709 High · 8.8 CWE-843 Sep 15, 2026

Type Confusion in Google Chrome

Type confusion in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-91708 Low · 3.1 CWE-367 Sep 15, 2026

TOCTOU Race Condition in Google Chrome

Race condition in Network in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

CVE-2026-58773 Medium · 6.7 CWE-787 Sep 15, 2026

Out-of-bounds Write in Google Android

In link_load_gnss_image of link_device.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-58767 Medium · 6.7 CWE-693 Sep 15, 2026

In multiple functions of arm-smmu-v3.c, there is a possible escalation of privilege due…

In multiple functions of arm-smmu-v3.c, there is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-58766 High · 7.8 CWE-693 Sep 15, 2026

In multiple functions of arm-smmu-v3.c, there is a possible escalation of privilege due…

In multiple functions of arm-smmu-v3.c, there is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-58765 Medium · 6.7 CWE-693 Sep 15, 2026

In GPU, there is a possible permission bypass due to a logic error in the code. This…

In GPU, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-58755 Medium · 6.7 CWE-693 Sep 15, 2026

In smmu_install_nested_ste of arm-smmu-v3.c, there is a possible escalation of privilege…

In smmu_install_nested_ste of arm-smmu-v3.c, there is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.