Vulnerabilidades de Google

CVE-2026-12027 Crítica · 9.6 CWE-250 11/06/2026

Google Chrome Headless: escape de sandbox por implementação inadequada

Implementação inadequada no Headless do Google Chrome anterior à versão 149.0.7827.115 permitiu que um atacante remoto que tivesse comprometido o processo renderer executasse potencialmente uma fuga da sandbox por meio de uma página HTML criada para isso. (Gravidade de segurança do Chromium: Alta)

CVE-2026-12026 Média · 6.5 CWE-125 11/06/2026

Out of bounds read in Video in Google Chrome on ChromeOS prior to 149.0.7827.115 allowed a remote...

Out of bounds read in Video in Google Chrome on ChromeOS prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

CVE-2026-12025 Média · 5.3 CWE-20 11/06/2026

Insufficient validation of untrusted input in Network in Google Chrome prior to 149.0.7827.115...

Insufficient validation of untrusted input in Network in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

CVE-2026-12024 Média · 6.5 CWE-346 11/06/2026

Insufficient policy enforcement in DevTools in Google Chrome prior to 149.0.7827.115 allowed a...

Insufficient policy enforcement in DevTools in Google Chrome prior to 149.0.7827.115 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)

CVE-2026-12023 Alta · 8.3 CWE-416 11/06/2026

Use after free in GPU in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker...

Use after free in GPU in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-12022 Alta · 8.3 CWE-362 11/06/2026

Race in Safe Browsing in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker...

Race in Safe Browsing in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)

CVE-2026-12020 Alta · 8.8 CWE-416 11/06/2026

Use after free in Autofill in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote...

Use after free in Autofill in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2026-12019 Alta · 8.3 CWE-787 11/06/2026

Heap buffer overflow in Codecs in Google Chrome on Linux and ChromeOS prior to 149.0.7827.115...

Heap buffer overflow in Codecs in Google Chrome on Linux and ChromeOS prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-12018 Alta · 8.8 CWE-269 11/06/2026

Inappropriate implementation in Mojo in Google Chrome on Windows prior to 149.0.7827.115 allowed...

Inappropriate implementation in Mojo in Google Chrome on Windows prior to 149.0.7827.115 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: High)

CVE-2026-12017 Baixa · 3.1 CWE-20 11/06/2026

Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.115 allowed a...

Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

CVE-2026-12016 Alta · 8.3 CWE-20 11/06/2026

Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.115 allowed a...

Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-12015 Média · 5.3 CWE-416 11/06/2026

Use after free in Autofill in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who...

Use after free in Autofill in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

CVE-2026-12014 Alta · 8.3 CWE-416 11/06/2026

Use after free in Cast in Google Chrome prior to 149.0.7827.115 allowed an attacker on the local...

Use after free in Cast in Google Chrome prior to 149.0.7827.115 allowed an attacker on the local network segment to potentially perform a sandbox escape via malicious network traffic. (Chromium security severity: High)

CVE-2026-12012 Alta · 8.1 CWE-416 11/06/2026

Use after free in Network in Google Chrome prior to 149.0.7827.115 allowed an attacker in a...

Use after free in Network in Google Chrome prior to 149.0.7827.115 allowed an attacker in a privileged network position to potentially exploit heap corruption via malicious network traffic. (Chromium security severity: High)

CVE-2026-12011 Alta · 8.3 CWE-416 11/06/2026

Use after free in WebMIDI in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote...

Use after free in WebMIDI in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-12010 Alta · 8.3 CWE-122 11/06/2026

Heap buffer overflow in GPU in Google Chrome on Android prior to 149.0.7827.115 allowed a remote...

Heap buffer overflow in GPU in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-12009 Alta · 8.3 CWE-20 11/06/2026

Insufficient validation of untrusted input in Accessibility in Google Chrome on Mac prior to 149...

Insufficient validation of untrusted input in Accessibility in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-12008 Alta · 8.3 CWE-416 11/06/2026

Use after free in DigitalCredentials in Google Chrome prior to 149.0.7827.115 allowed a remote...

Use after free in DigitalCredentials in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-12007 Alta · 8.8 CWE-416 11/06/2026

Use after free in Core in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote...

Use after free in Core in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-1220 Alta · 7.5 CWE-362 10/06/2026

Race Condition em Google Chrome

Race in V8 in Google Chrome prior to 144.0.7559.99 allowed a remote attacker to potentially exploit type confusion via a crafted HTML page. (Chromium security severity: High)

CVE-2026-11701 Média · 5.4 CWE-20 08/06/2026

Improper Input Validation em Google Chrome

Inappropriate implementation in Guest View in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11700 Alta · 8.3 CWE-416 08/06/2026

Use After Free em Google Chrome

Use after free in Tracing in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11699 Alta · 8.8 CWE-416 08/06/2026

Use After Free em Google Chrome

Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2026-11698 Alta · 8.8 CWE-416 08/06/2026

Use After Free em Google Chrome

Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2026-11697 Crítica · 9.6 CWE-20 08/06/2026

Google Chrome: falha de validação de entrada na UI permite fuga do sandbox (CVE-2026-11697)

Validação insuficiente de entrada não confiável na UI do Google Chrome anterior à versão 149.0.7827.103 permitiu que um atacante remoto potencialmente realizasse uma fuga do sandbox por meio de uma página HTML criada para esse fim. (Gravidade de segurança do Chromium: Alta)