Vulnerabilidades de Google

CVE-2026-11149 Alta · 7.5 CWE-20 04/06/2026

Improper Input Validation em Google Chrome

Insufficient validation of untrusted input in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11148 Média · 6.5 CWE-352 04/06/2026

Cross-Site Request Forgery (CSRF) em Google Chrome

Inappropriate implementation in Payments in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11147 Alta · 8.8 CWE-416 04/06/2026

Use After Free em Google Chrome

Use after free in WebML in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11146 Crítica · 9.6 CWE-20 04/06/2026

Google Chrome Chromoting: validação imprópria de entrada com possível fuga de sandbox

Validação insuficiente de entrada não confiável no Chromoting do Google Chrome anterior a 149.0.7827.53 permitiu que um atacante remoto que tivesse comprometido o processo renderer potencialmente realizasse uma fuga do sandbox por meio de uma página HTML criada para esse fim. (Gravidade de segurança do Chromium: Média)

CVE-2026-11145 Média · 5.3 CWE-362 04/06/2026

Race Condition em Google Chrome

Race in Geolocation in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11144 Alta · 8.8 CWE-416 04/06/2026

Use After Free em Google Chrome

Use after free in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted video file. (Chromium security severity: Medium)

CVE-2026-11143 Média · 6.5 CWE-122 04/06/2026

Heap-based Buffer Overflow em Google Chrome

Out of bounds read in Extensions in Google Chrome on Linux prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Chrome Extension. (Chromium security severity: Medium)

CVE-2026-11142 Média · 6.5 CWE-639 04/06/2026

Authorization Bypass Through User-Controlled Key (IDOR) em Google Chrome

Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11141 Média · 6.5 CWE-457 04/06/2026

Use of Uninitialized Variable em Google Chrome

Uninitialized Use in Audio in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11140 Média · 6.5 CWE-20 04/06/2026

Improper Input Validation em Google Chrome

Out of bounds read in Chromecast in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11139 Média · 6.5 CWE-352 04/06/2026

Cross-Site Request Forgery (CSRF) em Google Chrome

Inappropriate implementation in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11138 Média · 6.5 CWE-457 04/06/2026

Use of Uninitialized Variable em Google Chrome

Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11137 Média · 6.5 CWE-457 04/06/2026

Use of Uninitialized Variable em Google Chrome

Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11136 Alta · 8.8 CWE-416 04/06/2026

Use After Free em Google Chrome

Use after free in Canvas in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11135 Média · 6.5 CWE-284 04/06/2026

Improper Access Control em Google Chrome

Insufficient policy enforcement in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11134 Média · 6.5 CWE-352 04/06/2026

Cross-Site Request Forgery (CSRF) em Google Chrome

Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11133 Média · 6.5 CWE-346 04/06/2026

Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed…

Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11132 Média · 6.5 CWE-346 04/06/2026

Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed…

Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11131 Crítica · 9.6 CWE-416 04/06/2026

Use-after-free no Autofill do Google Chrome para Android com risco de fuga do sandbox

Use after free no Autofill do Google Chrome para Android anterior a 149.0.7827.53 permitiu que um atacante remoto que tivesse comprometido o processo renderizador potencialmente realizasse uma fuga do sandbox por meio de uma pagina HTML elaborada. (Severidade de seguranca do Chromium: Media)

CVE-2026-11130 Alta · 8.8 CWE-416 04/06/2026

Use After Free em Google Chrome

Use after free in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11129 Média · 6.5 CWE-352 04/06/2026

Cross-Site Request Forgery (CSRF) em Google Chrome

Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11128 Média · 6.5 CWE-20 04/06/2026

Improper Input Validation em Google Chrome

Inappropriate implementation in Web Share in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11127 Média · 6.5 CWE-358 04/06/2026

Inappropriate implementation in WebAPKs in Google Chrome on Android prior to…

Inappropriate implementation in WebAPKs in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via a crafted WebAPK. (Chromium security severity: Medium)

CVE-2026-11126 Média · 4.3 CWE-20 04/06/2026

Improper Input Validation em Google Chrome

Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. (Chromium security severity: Medium)

CVE-2026-11125 Alta · 8.8 CWE-416 04/06/2026

Use After Free em Google Chrome

Use after free in Compositing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)