Google vulnerabilities

CVE-2026-87457 High · 8.1 CWE-367 Sep 8, 2026

TOCTOU Race Condition in Google Chrome

Race condition in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Medium)

CVE-2026-87456 Low · 3.4 CWE-908 Sep 8, 2026

Use of Uninitialized Resource in Google Chrome

Uninitialized resource in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87455 Critical · 9.6 CWE-416 Sep 8, 2026

Use After Free in Google Chrome

Use after free in Aura in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87454 Medium · 6.5 CWE-200 Sep 8, 2026

Exposure of Sensitive Information in Google Chrome

Information leak in Enterprise in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87453 Medium · 5.3 CWE-441 Sep 8, 2026

Confused deputy in BackgroundFetch in Google Chrome prior to 153.0.8010.36 allowed a…

Confused deputy in BackgroundFetch in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87452 Low · 3.1 CWE-863 Sep 8, 2026

Incorrect Authorization in Google Chrome

Incorrect authorization in GPU in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87451 Low · 3.1 CWE-200 Sep 8, 2026

Exposure of Sensitive Information in Google Chrome

Information leak in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87450 High · 7.5 CWE-863 Sep 8, 2026

Incorrect Authorization in Google Chrome

Incorrect authorization in Permissions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Medium)

CVE-2026-87449 Medium · 4.3 CWE-352 Sep 8, 2026

Cross-Site Request Forgery (CSRF) in Google Chrome

Cross-site request forgery in DeviceBoundSessionCredentials in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87448 Critical · 9.6 CWE-416 Sep 8, 2026

Use After Free in Google Chrome

Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-87447 Medium · 6.5 CWE-863 Sep 8, 2026

Incorrect Authorization in Google Chrome

Incorrect authorization in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: High)

CVE-2026-87446 Medium · 6.5 CWE-459 Sep 8, 2026

Incomplete cleanup in Extensions in Google Chrome prior to 153.0.8010.36 allowed a…

Incomplete cleanup in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)

CVE-2026-87445 Medium · 5.4 CWE-451 Sep 8, 2026

UI misrepresentation in Session in Google Chrome prior to 153.0.8010.36 allowed a remote…

UI misrepresentation in Session in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87444 High · 8.8 CWE-119 Sep 8, 2026

Buffer Errors (Improper Restriction of Operations within Memory Bounds) in Google Chrome

Memory corruption in Codecs in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-87443 Medium · 6.5 CWE-862 Sep 8, 2026

Missing Authorization in Google Chrome

Missing authorization in Actor in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87442 Low · 3.1 CWE-441 Sep 8, 2026

Confused deputy in Prerender in Google Chrome prior to 153.0.8010.36 allowed a remote…

Confused deputy in Prerender in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87441 Medium · 6.5 CWE-862 Sep 8, 2026

Missing Authorization in Google Chrome

Missing authorization in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)

CVE-2026-87440 High · 8.8 CWE-125 Sep 8, 2026

Out-of-bounds Read in Google Chrome

Out of bounds read in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-87439 Medium · 5.3 CWE-200 Sep 8, 2026

Exposure of Sensitive Information in Google Chrome

Information leak in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87438 Critical · 9.6 CWE-787 Sep 8, 2026

Out-of-bounds Write in Google Chrome

Out of bounds write in WebGL in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-87437 Medium · 6.5 CWE-200 Sep 8, 2026

Exposure of Sensitive Information in Google Chrome

Information leak in Frames in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-87436 Medium · 6.5 CWE-459 Sep 8, 2026

Incomplete cleanup in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote…

Incomplete cleanup in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Medium)

CVE-2026-87435 Medium · 5.3 CWE-200 Sep 8, 2026

Exposure of Sensitive Information in Google Chrome

Information leak in ControlledFrame in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87434 Low · 3.1 CWE-862 Sep 8, 2026

Missing Authorization in Google Chrome

Missing authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87433 High · 8.8 CWE-367 Sep 8, 2026

TOCTOU Race Condition in Google Chrome

Race condition in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)