Google vulnerabilities

CVE-2026-84327 Medium · 6.5 CWE-863 Sep 1, 2026

Incorrect Authorization in Google Chrome

Incorrect authorization in Autofill in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-84326 High · 8.8 CWE-908 Sep 1, 2026

Use of Uninitialized Resource in Google Chrome

Uninitialized resource in V8 in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-84325 Critical · 9.8 CWE-20 Sep 1, 2026

Improper Input Validation in Google Chrome

Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a co-installed app. (Chromium security severity: High)

CVE-2026-84324 Critical · 9.0 CWE-416 Sep 1, 2026

Use After Free in Google Chrome

Use after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)

CVE-2026-84323 Medium · 5.3 CWE-862 Sep 1, 2026

Missing Authorization in Google Chrome

Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-82072 High · 8.8 CWE-125 Aug 27, 2026

Out-of-bounds Read in Google Chrome

Out of bounds read in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-75062 Critical · 9.2 CWE-95 Aug 26, 2026

Eval Injection in google/langfun via default lf.query protocol

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in the default lf.query Python protocol in Google langfun versions prior to 0.1.2 allows remote unauthenticated attackers to execute arbitrary Python code in the context of the host application via crafted prompt inputs that cause the model to generate executable Python expressions evaluated without a sandbox.

CVE-2026-79293 Medium · 6.5 CWE-200 Aug 25, 2026

Exposure of Sensitive Information in Google Chrome

Information leak in Animation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-79292 High · 8.3 CWE-190 Aug 25, 2026

Integer Overflow or Wraparound in Google Chrome

Integer overflow in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-79291 Medium · 6.5 CWE-200 Aug 25, 2026

Exposure of Sensitive Information in Google Chrome

Information leak in CSS in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-79290 Critical · 9.6 CWE-416 Aug 25, 2026

Use After Free in Google Chrome

Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-79289 Low · 3.1 CWE-664 Aug 25, 2026

Improper control of a resource through its lifetime in Workers in Google Chrome prior to…

Improper control of a resource through its lifetime in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-79288 Medium · 6.5 CWE-20 Aug 25, 2026

Improper Input Validation in Google Chrome

Improper input validation in Autofill in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)

CVE-2026-79287 Medium · 5.3 CWE-203 Aug 25, 2026

Observable Discrepancy in Google Chrome

Observable discrepancy in Forms in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-79286 High · 7.4 CWE-862 Aug 25, 2026

Missing Authorization in Google Chrome

Missing authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a co-installed app. (Chromium security severity: Medium)

CVE-2026-79285 Medium · 6.5 CWE-908 Aug 25, 2026

Use of Uninitialized Resource in Google Chrome

Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-79284 Medium · 4.3 CWE-451 Aug 25, 2026

UI misrepresentation in Core in Google Chrome on on Mac prior to 152.0.7977.65 allowed a…

UI misrepresentation in Core in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-79283 Medium · 5.4 CWE-451 Aug 25, 2026

UI misrepresentation in Geometry in Google Chrome prior to 152.0.7977.65 allowed a…

UI misrepresentation in Geometry in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-79282 Critical · 9.6 CWE-416 Aug 25, 2026

Use After Free in Google Chrome

Use after free in ANGLE in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-79276 Medium · 4.3 CWE-269 Aug 25, 2026

Improper Privilege Management in Google Chrome

Improper privilege management in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-79275 Critical · 9.6 CWE-416 Aug 25, 2026

Use After Free in Google Chrome

Use after free in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-79274 Medium · 4.3 CWE-200 Aug 25, 2026

Exposure of Sensitive Information in Google Chrome

Information leak in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

CVE-2026-79273 Medium · 4.3 CWE-706 Aug 25, 2026

Use of Incorrectly-Resolved Name or Reference in Google Chrome

Incorrect reference resolution in WebView in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-79272 Low · 3.1 CWE-20 Aug 25, 2026

Improper Input Validation in Google Chrome

Improper input validation in FindInPage in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-79271 Medium · 6.5 CWE-200 Aug 25, 2026

Exposure of Sensitive Information in Google Chrome

Information leak in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)