Vulnerabilidades do Google Chrome

CVE-2026-11153 Crítica · 9.1 CWE-1300 04/06/2026

Vazamento de dados entre origens por canal lateral em Forms do Google Chrome

Vazamento de informações por canal lateral em Forms no Google Chrome anterior à 149.0.7827.53 permitiu que um atacante remoto vazasse dados entre origens por meio de uma página HTML elaborada. (Gravidade de segurança do Chromium: Média)

CVE-2026-11152 Crítica · 9.6 CWE-416 04/06/2026

Falha de use-after-free no Dawn do Google Chrome com possível fuga de sandbox

Problema de ciclo de vida de objeto no Dawn no Google Chrome anterior à 149.0.7827.53 permitia que um atacante remoto potencialmente realizasse uma fuga do sandbox por meio de uma página HTML criada. (Gravidade de segurança do Chromium: Média)

CVE-2026-11151 Alta · 7.5 CWE-20 04/06/2026

Improper Input Validation em Google Chrome

Insufficient validation of untrusted input in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11150 Média · 6.1 CWE-79 04/06/2026

Cross-site Scripting (XSS) em Google Chrome

Inappropriate implementation in XML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11149 Alta · 7.5 CWE-20 04/06/2026

Improper Input Validation em Google Chrome

Insufficient validation of untrusted input in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11148 Média · 6.5 CWE-352 04/06/2026

Cross-Site Request Forgery (CSRF) em Google Chrome

Inappropriate implementation in Payments in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11147 Alta · 8.8 CWE-416 04/06/2026

Use After Free em Google Chrome

Use after free in WebML in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11146 Crítica · 9.6 CWE-20 04/06/2026

Google Chrome Chromoting: validação imprópria de entrada com possível fuga de sandbox

Validação insuficiente de entrada não confiável no Chromoting do Google Chrome anterior a 149.0.7827.53 permitiu que um atacante remoto que tivesse comprometido o processo renderer potencialmente realizasse uma fuga do sandbox por meio de uma página HTML criada para esse fim. (Gravidade de segurança do Chromium: Média)

CVE-2026-11145 Média · 5.3 CWE-362 04/06/2026

Race Condition em Google Chrome

Race in Geolocation in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11144 Alta · 8.8 CWE-416 04/06/2026

Use After Free em Google Chrome

Use after free in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted video file. (Chromium security severity: Medium)

CVE-2026-11143 Média · 6.5 CWE-122 04/06/2026

Heap-based Buffer Overflow em Google Chrome

Out of bounds read in Extensions in Google Chrome on Linux prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Chrome Extension. (Chromium security severity: Medium)

CVE-2026-11142 Média · 6.5 CWE-639 04/06/2026

Authorization Bypass Through User-Controlled Key (IDOR) em Google Chrome

Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11141 Média · 6.5 CWE-457 04/06/2026

Use of Uninitialized Variable em Google Chrome

Uninitialized Use in Audio in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11140 Média · 6.5 CWE-20 04/06/2026

Improper Input Validation em Google Chrome

Out of bounds read in Chromecast in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11139 Média · 6.5 CWE-352 04/06/2026

Cross-Site Request Forgery (CSRF) em Google Chrome

Inappropriate implementation in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11138 Média · 6.5 CWE-457 04/06/2026

Use of Uninitialized Variable em Google Chrome

Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11137 Média · 6.5 CWE-457 04/06/2026

Use of Uninitialized Variable em Google Chrome

Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11136 Alta · 8.8 CWE-416 04/06/2026

Use After Free em Google Chrome

Use after free in Canvas in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11135 Média · 6.5 CWE-284 04/06/2026

Improper Access Control em Google Chrome

Insufficient policy enforcement in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11134 Média · 6.5 CWE-352 04/06/2026

Cross-Site Request Forgery (CSRF) em Google Chrome

Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11133 Média · 6.5 CWE-346 04/06/2026

Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed…

Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11132 Média · 6.5 CWE-346 04/06/2026

Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed…

Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11131 Crítica · 9.6 CWE-416 04/06/2026

Use-after-free no Autofill do Google Chrome para Android com risco de fuga do sandbox

Use after free no Autofill do Google Chrome para Android anterior a 149.0.7827.53 permitiu que um atacante remoto que tivesse comprometido o processo renderizador potencialmente realizasse uma fuga do sandbox por meio de uma pagina HTML elaborada. (Severidade de seguranca do Chromium: Media)

CVE-2026-11130 Alta · 8.8 CWE-416 04/06/2026

Use After Free em Google Chrome

Use after free in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11129 Média · 6.5 CWE-352 04/06/2026

Cross-Site Request Forgery (CSRF) em Google Chrome

Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)