Vulnerabilidades de Google

CVE-2026-11047 Crítica · 9.6 CWE-20 04/06/2026

Google Chrome no Windows: fuga de sandbox no componente Base

Implementação inadequada em Base no Google Chrome para Windows anterior à versão 149.0.7827.53 permitiu que um atacante remoto que tivesse comprometido o processo de renderização potencialmente realizasse uma fuga do sandbox por meio de uma página HTML criada para isso. (Gravidade de segurança do Chromium: Média)

CVE-2026-11046 Alta · 8.8 CWE-20 04/06/2026

Improper Input Validation em Google Chrome

Insufficient validation of untrusted input in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11045 Média · 6.5 CWE-20 04/06/2026

Improper Input Validation em Google Chrome

Insufficient validation of untrusted input in GPU in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11044 Média · 6.5 CWE-472 04/06/2026

Integer overflow in ANGLE in Google Chrome on Mac prior to 149.0.7827.53 allowed a…

Integer overflow in ANGLE in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11043 Crítica · 9.6 CWE-787 04/06/2026

Escrita fora dos limites no ANGLE do Google Chrome para Mac com possível escape de sandbox

Escrita fora dos limites no ANGLE do Google Chrome para Mac anterior a 149.0.7827.53 permitiu que um atacante remoto que tivesse comprometido o processo renderer potencialmente realizasse um escape do sandbox por meio de uma página HTML criada. (Gravidade de segurança do Chromium: Média)

CVE-2026-11042 Alta · 8.8 CWE-416 04/06/2026

Use After Free em Google Chrome

Use after free in Views in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11041 Alta · 8.8 CWE-20 04/06/2026

Improper Input Validation em Google Chrome

Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11040 Alta · 8.3 CWE-416 04/06/2026

Use After Free em Google Chrome

Use after free in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11039 Média · 6.5 CWE-457 04/06/2026

Use of Uninitialized Variable em Google Chrome

Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11038 Média · 6.5 CWE-20 04/06/2026

Improper Input Validation em Google Chrome

Insufficient policy enforcement in Subresource Integrity in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass content security policy via malicious network traffic. (Chromium security severity: Medium)

CVE-2026-11037 Crítica · 9.6 CWE-787 04/06/2026

Escrita fora dos limites em Codecs do Google Chrome (CVE-2026-11037)

Escrita fora dos limites em Codecs no Google Chrome anterior à versão 149.0.7827.53 permitia que um atacante remoto potencialmente realizasse uma fuga do sandbox por meio de um arquivo de vídeo criado com essa finalidade. (Severidade de segurança do Chromium: Média)

CVE-2026-11036 Média · 6.5 CWE-346 04/06/2026

Inappropriate implementation in DOM in Google Chrome prior to 149.0.7827.53 allowed a…

Inappropriate implementation in DOM in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11035 Alta · 7.3 CWE-20 04/06/2026

Improper Input Validation em Google Chrome

Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to perform privilege escalation via a crafted XML file. (Chromium security severity: Medium)

CVE-2026-11034 Média · 6.1 CWE-20 04/06/2026

Improper Input Validation em Google Chrome

Insufficient validation of untrusted input in Tab Group Sync in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via malicious network traffic. (Chromium security severity: Medium)

CVE-2026-11033 Média · 6.5 CWE-457 04/06/2026

Use of Uninitialized Variable em Google Chrome

Uninitialized Use in WebML in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11032 Média · 6.5 CWE-346 04/06/2026

Inappropriate implementation in Password Manager in Google Chrome prior to 149.0.7827.53…

Inappropriate implementation in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11031 Média · 4.3 CWE-20 04/06/2026

Improper Input Validation em Google Chrome

Insufficient validation of untrusted input in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via malicious network traffic. (Chromium security severity: Medium)

CVE-2026-11030 Alta · 8.8 CWE-416 04/06/2026

Use After Free em Google Chrome

Use after free in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via malicious network traffic. (Chromium security severity: Medium)

CVE-2026-11029 Crítica · 9.6 CWE-20 04/06/2026

Google Chrome para Android: falha de validação de entrada no arrastar e soltar permite escape de sandbox

Validação insuficiente de entrada não confiável em Arrastar e Soltar (Drag and Drop) no Google Chrome para Android anterior à 149.0.7827.53 permitiu que um atacante remoto que tivesse comprometido o processo de renderização potencialmente realizasse um escape de sandbox por meio de uma página HTML criada para esse fim. (Gravidade de segurança do Chromium: Média)

CVE-2026-11028 Alta · 8.8 CWE-416 04/06/2026

Use After Free em Google Chrome

Use after free in Media in Google Chrome on Linux and ChromeOS prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11027 Média · 6.5 CWE-20 04/06/2026

Improper Input Validation em Google Chrome

Insufficient validation of untrusted input in Glic in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11026 Média · 6.5 CWE-284 04/06/2026

Improper Access Control em Google Chrome

Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. (Chromium security severity: Medium)

CVE-2026-11025 Média · 6.5 CWE-602 04/06/2026

Insufficient policy enforcement in Navigation in Google Chrome on Android prior to…

Insufficient policy enforcement in Navigation in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11024 Alta · 8.8 CWE-121 04/06/2026

Stack-based Buffer Overflow em Google Chrome

Stack buffer overflow in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit stack corruption via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11023 Média · 6.5 CWE-20 04/06/2026

Improper Input Validation em Google Chrome

Inappropriate implementation in WebAppInstalls in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)