Google vulnerabilities

CVE-2026-87553 High · 8.3 CWE-20 Sep 8, 2026

Improper Input Validation in Google Chrome

Improper input validation in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87552 Medium · 5.5 CWE-862 Sep 8, 2026

Missing Authorization in Google Chrome

Missing authorization in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010.36 allowed a local attacker to obtain sensitive information via a co-installed app. (Chromium security severity: High)

CVE-2026-87551 Medium · 4.3 CWE-295 Sep 8, 2026

Improper Certificate Validation in Google Chrome

Improper certificate validation in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: Low)

CVE-2026-87550 Medium · 4.3 CWE-116 Sep 8, 2026

Improper Encoding or Escaping of Output in Google Chrome

Improper encoding or escaping of output in CSS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87549 Medium · 6.5 CWE-459 Sep 8, 2026

Incomplete cleanup in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote…

Incomplete cleanup in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87548 Medium · 4.3 CWE-754 Sep 8, 2026

Improper Check for Unusual or Exceptional Conditions in Google Chrome

Improper state validation in Installer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87547 Critical · 9.6 CWE-706 Sep 8, 2026

Use of Incorrectly-Resolved Name or Reference in Google Chrome

Incorrect reference resolution in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87546 Medium · 4.3 CWE-704 Sep 8, 2026

Incorrect type conversion or cast in Safebrowsing in Google Chrome on on Mac prior to…

Incorrect type conversion or cast in Safebrowsing in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted file. (Chromium security severity: Low)

CVE-2026-87545 Medium · 6.5 CWE-200 Sep 8, 2026

Exposure of Sensitive Information in Google Chrome

Information leak in Mobile in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-87544 Critical · 9.8 CWE-863 Sep 8, 2026

Incorrect Authorization in Google Chrome

Incorrect authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-87543 Medium · 4.3 CWE-862 Sep 8, 2026

Missing Authorization in Google Chrome

Missing authorization in Core in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-87542 High · 8.8 CWE-416 Sep 8, 2026

Use After Free in Google Chrome

Use after free in Input in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-87541 Medium · 6.5 CWE-200 Sep 8, 2026

Exposure of Sensitive Information in Google Chrome

Information leak in Navigation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87540 Medium · 5.4 CWE-863 Sep 8, 2026

Incorrect Authorization in Google Chrome

Incorrect authorization in Isolated in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87539 Low · 3.1 CWE-203 Sep 8, 2026

Observable Discrepancy in Google Chrome

Observable discrepancy in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87538 Medium · 4.2 CWE-1021 Sep 8, 2026

Clickjacking in Google Chrome

Clickjacking in Input in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-87537 High · 8.1 CWE-862 Sep 8, 2026

Missing Authorization in Google Chrome

Missing authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)

CVE-2026-87536 High · 8.8 CWE-416 Sep 8, 2026

Use After Free in Google Chrome

Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-87535 Medium · 6.5 CWE-221 Sep 8, 2026

Information loss or omission in Safebrowsing in Google Chrome on on Mac prior to…

Information loss or omission in Safebrowsing in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87534 Critical · 9.8 CWE-862 Sep 8, 2026

Missing Authorization in Google Chrome

Missing authorization in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium)

CVE-2026-87533 High · 8.1 CWE-416 Sep 8, 2026

Use After Free in Google Chrome

Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Medium)

CVE-2026-87532 Medium · 6.5 CWE-754 Sep 8, 2026

Improper Check for Unusual or Exceptional Conditions in Google Chrome

Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87531 Low · 3.1 CWE-200 Sep 8, 2026

Exposure of Sensitive Information in Google Chrome

Information leak in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87530 High · 8.1 CWE-427 Sep 8, 2026

Uncontrolled Search Path Element in Google Chrome

Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Medium)

CVE-2026-87529 Critical · 9.6 CWE-197 Sep 8, 2026

Numeric truncation error in Media in Google Chrome prior to 153.0.8010.36 allowed a…

Numeric truncation error in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)