Vulnerabilidades do Google Chrome

CVE-2026-11001 Média · 6.5 CWE-290 04/06/2026

Authentication Bypass by Spoofing em Google Chrome

Inappropriate implementation in Payments in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11000 Alta · 8.8 CWE-416 04/06/2026

Use After Free em Google Chrome

Use after free in Fonts in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-10999 Média · 6.5 CWE-190 04/06/2026

Integer Overflow or Wraparound em Google Chrome

Integer overflow in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-10998 Média · 4.0 CWE-125 04/06/2026

Out-of-bounds Read em Google Chrome

Out of bounds read in Media in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment to perform an out of bounds memory read via malicious network traffic. (Chromium security severity: Medium)

CVE-2026-10997 Média · 6.5 CWE-732 04/06/2026

Incorrect Permission Assignment for Critical Resource em Google Chrome

Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to bypass discretionary access control via a crafted Chrome Extension. (Chromium security severity: Medium)

CVE-2026-10996 Média · 6.5 CWE-346 04/06/2026

Inappropriate implementation in Workers in Google Chrome prior to 149.0.7827.53 allowed…

Inappropriate implementation in Workers in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-10995 Alta · 8.8 CWE-122 04/06/2026

Heap-based Buffer Overflow em Google Chrome

Heap buffer overflow in TabStrip in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-10994 Média · 6.5 CWE-457 04/06/2026

Use of Uninitialized Variable em Google Chrome

Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-10993 Média · 6.5 CWE-122 04/06/2026

Heap-based Buffer Overflow em Google Chrome

Heap buffer overflow in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-10992 Média · 6.5 CWE-20 04/06/2026

Improper Input Validation em Google Chrome

Insufficient data validation in Animation in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-10991 Alta · 8.8 CWE-416 04/06/2026

Use After Free em Google Chrome

Use after free in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-10990 Crítica · 9.6 CWE-416 04/06/2026

Google Chrome Glic: use-after-free com possível fuga do sandbox

Use after free no Glic no Google Chrome anterior à 149.0.7827.53 permitiu que um atacante remoto que tivesse comprometido o processo renderer potencialmente realizasse uma fuga do sandbox por meio de uma página HTML criada para esse fim. (Severidade de segurança do Chromium: Média)

CVE-2026-10989 Alta · 8.8 CWE-122 04/06/2026

Heap-based Buffer Overflow em Google Chrome

Inappropriate implementation in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2026-10988 Alta · 8.8 CWE-416 04/06/2026

Use After Free em Google Chrome

Use after free in Views in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-10987 Alta · 8.8 CWE-472 04/06/2026

Integer overflow in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker…

Integer overflow in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-10986 Alta · 8.8 CWE-472 04/06/2026

Integer overflow in Media in Google Chrome prior to 149.0.7827.53 allowed a remote…

Integer overflow in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a malicious file. (Chromium security severity: High)

CVE-2026-10985 Média · 6.5 CWE-125 04/06/2026

Out-of-bounds Read em Google Chrome

Out of bounds read in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

CVE-2026-10984 Média · 5.4 CWE-451 04/06/2026

Inappropriate implementation in Accessibility in Google Chrome on Android prior to…

Inappropriate implementation in Accessibility in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: High)

CVE-2026-10983 Crítica · 9.6 CWE-20 04/06/2026

Google Chrome: fuga de sandbox por validação insuficiente de entrada no Dawn (CVE-2026-10983)

Validação insuficiente de entrada não confiável em Dawn no Google Chrome anterior à versão 149.0.7827.53 permitiu que um atacante remoto potencialmente realizasse uma fuga de sandbox por meio de uma página HTML elaborada especialmente. (Gravidade de segurança do Chromium: Alta)

CVE-2026-10982 Alta · 8.8 CWE-416 04/06/2026

Use After Free em Google Chrome

Use after free in WebXR in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-10981 Média · 6.5 CWE-20 04/06/2026

Improper Input Validation em Google Chrome

Insufficient validation of untrusted input in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted video file. (Chromium security severity: High)

CVE-2026-10980 Média · 6.5 CWE-20 04/06/2026

Improper Input Validation em Google Chrome

Insufficient validation of untrusted input in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)

CVE-2026-10979 Média · 6.5 CWE-125 04/06/2026

Out-of-bounds Read em Google Chrome

Out of bounds read in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

CVE-2026-10978 Alta · 8.8 CWE-416 04/06/2026

Use After Free em Google Chrome

Use after free in Chromoting in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: High)

CVE-2026-10977 Média · 6.5 CWE-457 04/06/2026

Use of Uninitialized Variable em Google Chrome

Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)