Google vulnerabilities

CVE-2026-87528 Critical · 9.6 CWE-843 Sep 8, 2026

Type Confusion in Google Chrome

Type confusion in Rust in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87527 Critical · 9.6 CWE-122 Sep 8, 2026

Heap-based Buffer Overflow in Google Chrome

Buffer overflow in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-87526 Critical · 9.6 CWE-416 Sep 8, 2026

Use After Free in Google Chrome

Use after free in Passwords in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via UI Interaction. (Chromium security severity: Medium)

CVE-2026-87525 Low · 2.7 CWE-125 Sep 8, 2026

Out-of-bounds Read in Google Chrome

Out of bounds read in Chromoting in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to read memory outside the sandbox via a local program. (Chromium security severity: High)

CVE-2026-87524 High · 8.3 CWE-416 Sep 8, 2026

Use After Free in Google Chrome

Use after free in Core in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-87523 Medium · 5.3 CWE-367 Sep 8, 2026

TOCTOU Race Condition in Google Chrome

Race condition in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-87522 Medium · 6.5 CWE-862 Sep 8, 2026

Missing Authorization in Google Chrome

Missing authorization in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to potentially bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)

CVE-2026-87521 Low · 3.1 CWE-200 Sep 8, 2026

Exposure of Sensitive Information in Google Chrome

Information leak in WebMCP in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87520 Critical · 9.6 CWE-416 Sep 8, 2026

Use After Free in Google Chrome

Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-87519 Medium · 6.5 CWE-863 Sep 8, 2026

Incorrect Authorization in Google Chrome

Incorrect authorization in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-87518 Medium · 5.3 CWE-203 Sep 8, 2026

Observable Discrepancy in Google Chrome

Observable discrepancy in Safebrowsing in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87517 Low · 3.1 CWE-367 Sep 8, 2026

TOCTOU Race Condition in Google Chrome

Race condition in Mobile in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)

CVE-2026-87516 Medium · 4.3 CWE-203 Sep 8, 2026

Observable Discrepancy in Google Chrome

Observable discrepancy in Navigation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87515 Medium · 6.5 CWE-863 Sep 8, 2026

Incorrect Authorization in Google Chrome

Incorrect authorization in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87514 High · 8.1 CWE-416 Sep 8, 2026

Use After Free in Google Chrome

Use after free in Views in Google Chrome prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)

CVE-2026-87513 Medium · 6.5 CWE-862 Sep 8, 2026

Missing Authorization in Google Chrome

Missing authorization in ControlledFrame in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87512 Critical · 9.6 CWE-416 Sep 8, 2026

Use After Free in Google Chrome

Use after free in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-87511 Medium · 4.3 CWE-862 Sep 8, 2026

Missing Authorization in Google Chrome

Missing authorization in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Low)

CVE-2026-87510 High · 8.3 CWE-20 Sep 8, 2026

Improper Input Validation in Google Chrome

Improper input validation in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87509 High · 8.1 CWE-863 Sep 8, 2026

Incorrect Authorization in Google Chrome

Incorrect authorization in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Low)

CVE-2026-87508 Medium · 4.3 CWE-863 Sep 8, 2026

Incorrect Authorization in Google Chrome

Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87507 Medium · 5.4 CWE-451 Sep 8, 2026

UI misrepresentation in Downloads in Google Chrome prior to 153.0.8010.36 allowed a…

UI misrepresentation in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87506 High · 8.3 CWE-250 Sep 8, 2026

Execution with Unnecessary Privileges in Google Chrome

Privilege elevation in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87505 High · 8.1 CWE-863 Sep 8, 2026

Incorrect Authorization in Google Chrome

Incorrect authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. (Chromium security severity: Medium)

CVE-2026-87504 Critical · 9.6 CWE-416 Sep 8, 2026

Use After Free in Google Chrome

Use after free in Core in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)