Vulnerabilidades de Google

CVE-2026-11174 Média · 5.3 CWE-693 04/06/2026

Inappropriate implementation in Site Isolation in Google Chrome prior to 149.0.7827.53…

Inappropriate implementation in Site Isolation in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11173 Alta · 8.8 CWE-787 04/06/2026

Out-of-bounds Write em Google Chrome

Out of bounds write in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11172 Alta · 8.8 CWE-451 04/06/2026

Incorrect security UI in Contact Picker in Google Chrome on Android prior to…

Incorrect security UI in Contact Picker in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11171 Alta · 8.8 CWE-472 04/06/2026

Integer overflow in Blink in Google Chrome prior to 149.0.7827.53 allowed a remote…

Integer overflow in Blink in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11170 Alta · 8.1 CWE-693 04/06/2026

Inappropriate implementation in Chromoting in Google Chrome on Linux prior to…

Inappropriate implementation in Chromoting in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to perform OS-level privilege escalation via malicious network traffic. (Chromium security severity: Medium)

CVE-2026-11169 Alta · 8.1 CWE-91 04/06/2026

XML Injection em Google Chrome

Inappropriate implementation in XML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted XML file. (Chromium security severity: Medium)

CVE-2026-11168 Média · 6.5 CWE-200 04/06/2026

Exposure of Sensitive Information em Google Chrome

Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11167 Crítica · 9.6 CWE-250 04/06/2026

Fuga de sandbox no WebView do Google Chrome para Android por implementação inadequada

Implementação inadequada no WebView do Google Chrome em Android anterior à 149.0.7827.53 permitiu que um atacante remoto que tivesse comprometido o processo renderizador potencialmente realizasse uma fuga do sandbox por meio de uma página HTML elaborada. (Gravidade de segurança do Chromium: Média)

CVE-2026-11166 Média · 6.8 CWE-79 04/06/2026

Cross-site Scripting (XSS) em Google Chrome

Inappropriate implementation in SVG in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11165 Crítica · 9.6 CWE-416 04/06/2026

Google Chrome no iOS: uso após liberação de memória no WebMIDI

Uso após liberação de memória (use after free) no WebMIDI do Google Chrome no iOS anterior à 149.0.7827.53 permitiu que um invasor remoto potencialmente realizasse uma fuga da sandbox por meio de uma página HTML criada para isso. (Gravidade de segurança do Chromium: Média)

CVE-2026-11164 Alta · 8.8 CWE-416 04/06/2026

Use After Free em Google Chrome

Use after free in Blink in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11163 Crítica · 9.6 CWE-416 04/06/2026

Use-after-free no componente Messages do Google Chrome para Android com possível fuga de sandbox

Use after free em Messages no Google Chrome no Android anterior à 149.0.7827.53 permitiu que um atacante remoto potencialmente realizasse uma fuga de sandbox por meio de uma página HTML especialmente criada. (Gravidade de segurança do Chromium: Média)

CVE-2026-11162 Média · 4.3 CWE-200 04/06/2026

Exposure of Sensitive Information em Google Chrome

Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11161 Média · 4.3 CWE-346 04/06/2026

Inappropriate implementation in DataTransfer in Google Chrome prior to 149.0.7827.53…

Inappropriate implementation in DataTransfer in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11160 Média · 6.5 CWE-125 04/06/2026

Out-of-bounds Read em Google Chrome

Out of bounds read in Input in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11159 Média · 4.3 CWE-457 04/06/2026

Use of Uninitialized Variable em Google Chrome

Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11158 Alta · 8.6 CWE-20 04/06/2026

Improper Input Validation em Google Chrome

Insufficient validation of untrusted input in Downloads in Google Chrome on Mac prior to 149.0.7827.53 allowed a local attacker to potentially perform a sandbox escape via a crafted AppleScript command. (Chromium security severity: Medium)

CVE-2026-11157 Média · 5.4 CWE-94 04/06/2026

Code Injection em Google Chrome

Script injection in Accessibility in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to inject arbitrary scripts or HTML (UXSS) via a crafted Chrome Extension. (Chromium security severity: Medium)

CVE-2026-11156 Média · 4.3 CWE-352 04/06/2026

Cross-Site Request Forgery (CSRF) em Google Chrome

Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11155 Média · 4.3 CWE-352 04/06/2026

Cross-Site Request Forgery (CSRF) em Google Chrome

Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11154 Alta · 7.5 CWE-416 04/06/2026

Use After Free em Google Chrome

Use after free in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11153 Crítica · 9.1 CWE-1300 04/06/2026

Vazamento de dados entre origens por canal lateral em Forms do Google Chrome

Vazamento de informações por canal lateral em Forms no Google Chrome anterior à 149.0.7827.53 permitiu que um atacante remoto vazasse dados entre origens por meio de uma página HTML elaborada. (Gravidade de segurança do Chromium: Média)

CVE-2026-11152 Crítica · 9.6 CWE-416 04/06/2026

Falha de use-after-free no Dawn do Google Chrome com possível fuga de sandbox

Problema de ciclo de vida de objeto no Dawn no Google Chrome anterior à 149.0.7827.53 permitia que um atacante remoto potencialmente realizasse uma fuga do sandbox por meio de uma página HTML criada. (Gravidade de segurança do Chromium: Média)

CVE-2026-11151 Alta · 7.5 CWE-20 04/06/2026

Improper Input Validation em Google Chrome

Insufficient validation of untrusted input in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11150 Média · 6.1 CWE-79 04/06/2026

Cross-site Scripting (XSS) em Google Chrome

Inappropriate implementation in XML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)