Threats affecting pkg:rpm/google/chrome

Insufficient validation of untrusted input in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension. (Chromium security severity: Medium)

A vulnerability in the Blink rendering engine of Google Chrome prior to version 151.0.7922.72 allows a remote attacker to bypass the same origin policy via a crafted HTML page. This issue is classified with medium severity and affects the integrity of web content isolation. The vulnerability does not impact confidentiality or availability directly. No known exploits are reported in the wild. No explicit patch information is provided in the available data.

Insufficient validation of untrusted input in WebSockets in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

Insufficient validation of untrusted input in Payments in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

Insufficient validation of untrusted input in PDF in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

Use after free in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

Insufficient policy enforcement in Prefetch in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

CVE-2026-18008 is a vulnerability in Google Chrome prior to version 151.0.7922.72 involving an inappropriate implementation in the Settings UI. This flaw allows a remote attacker to perform UI spoofing via malicious network traffic. The vulnerability has a low severity rating from Chromium security and a CVSS score of 4.3, indicating medium severity. No known exploits are reported in the wild. The vendor advisory does not explicitly state the availability of a patch or remediation level, but the affected versions are prior to 151.0.7922.72.

CVE-2026-17983 is a vulnerability in Google Chrome's Global Media Controls prior to version 151.0.7922.72 that allows remote attackers to perform UI spoofing via a crafted HTML page. The issue is classified as low severity by Chromium but has a CVSS score of 4.3, indicating medium severity. This vulnerability could mislead users by displaying deceptive user interface elements. There are no known exploits in the wild. The vendor has published an advisory but has not explicitly stated the patch or remediation status in the provided data.

CVE-2026-17973 is a medium severity vulnerability in Google Chrome on Mac platforms prior to version 151.0.7922.72. It involves an inappropriate implementation in the Views component that allows a local attacker to obtain potentially sensitive information from process memory by using a crafted HTML page. The vulnerability does not affect integrity or availability but impacts confidentiality. No official patch or remediation level is explicitly stated in the provided data, though a vendor advisory link is available for further details.

CVE-2026-17970 is a vulnerability in Google Chrome prior to version 151.0.7922.72 involving insufficient validation of untrusted input in the Passwords component. This flaw allows an attacker in a privileged network position to perform UI spoofing via malicious network traffic. The vulnerability has a CVSS score of 4.3, indicating medium severity. No known exploits are reported in the wild. A vendor advisory is available but does not explicitly state the patch status.

A vulnerability in Google Chrome's password management prior to version 151.0.7922.72 allows a remote attacker to execute arbitrary code within a sandbox via a crafted HTML page. The issue is classified with high severity and carries a CVSS score of 8.8. No explicit patch availability or remediation level is stated in the provided data, but a vendor advisory link is given for further details.

CVE-2026-17966 is a medium severity vulnerability in Google Chrome on Mac systems prior to version 151.0.7922.72. It involves an inappropriate implementation in the Views component that allows a local attacker to access potentially sensitive information from process memory via a crafted HTML page. The vulnerability does not require user interaction or privileges and impacts confidentiality without affecting integrity or availability.

CVE-2026-17964 is a vulnerability in Google Chrome on Android versions prior to 151.0.7922.72. It involves an incorrect security user interface that allows a remote attacker to perform domain spoofing via a crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 4.3. No known exploits are reported in the wild. The issue is related to CWE-451 (Incorrect Security UI).

A policy bypass vulnerability in the MHTML component of Google Chrome prior to version 151.0.7922.72 allows a remote attacker to leak cross-origin data by crafting a malicious MHTML page. The vulnerability is rated as medium severity with a CVSS score of 4.3. There are no known exploits in the wild. The vendor advisory linked suggests an update to Chrome 151.0.7922.72 to address this issue.

CVE-2026-17936 is a vulnerability in Google Chrome's DevTools prior to version 151.0.7922.72. It allows a remote attacker to bypass navigation restrictions by convincing a user to perform specific UI gestures on a crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 6.5. No official patch or remediation level is explicitly stated in the provided data, but a vendor advisory link is available for further details.

CVE-2026-17934 is a vulnerability in Google Chrome's DevTools prior to version 151.0.7922.72. It involves insufficient validation of untrusted input, which allows a remote attacker to bypass navigation restrictions via a crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 4.3. There are no known exploits in the wild. The vendor has published an advisory but does not explicitly state the patch or remediation status in the provided data.

CVE-2026-17931 is a vulnerability in Google Chrome's DevTools prior to version 151.0.7922.72. It allows a remote attacker to bypass navigation restrictions by using a crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 6.5. No known exploits are reported in the wild. The issue relates to an inappropriate implementation classified under CWE-693.

CVE-2026-17928 is a medium severity vulnerability in Google Chrome prior to version 151.0.7922.72. It involves an inappropriate implementation in the DataTransfer API that allows a remote attacker to leak cross-origin data via a crafted HTML page. This vulnerability does not impact integrity or availability but can lead to unauthorized disclosure of information across origins.

CVE-2026-17927 is a vulnerability in Google Chrome's DevTools prior to version 151.0.7922.72. It involves insufficient policy enforcement that could allow an attacker to leak cross-origin data by convincing a user to install a malicious Chrome extension. The vulnerability has a medium severity rating with a CVSS score of 4.3. No known exploits are reported in the wild. A fixed version, 151.0.7922.72, is indicated, but explicit patch status is not confirmed in the vendor advisory.