Threats affecting pkg:rpm/google/chrome

Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-17920 is a use-after-free vulnerability in the V8 engine of Google Chrome versions prior to 151.0.7922.72. This flaw allows an attacker who convinces a user to install a malicious Chrome extension to execute arbitrary code within the browser's sandbox. The vulnerability has a high severity rating with a CVSS score of 8.8. A fix is available in Chrome version 151.0.7922.72.

CVE-2026-17899 is a high-severity vulnerability in Google Chrome prior to version 151.0.7922.72. It involves insufficient policy enforcement in the DevTools component, which could allow an attacker to escalate privileges by convincing a user to install a malicious Chrome extension. The vulnerability has a CVSS score of 8.8, indicating a significant impact on confidentiality, integrity, and availability. No known exploits are reported in the wild. A vendor advisory is available but does not explicitly state the patch status.

CVE-2026-17898 is a use-after-free vulnerability in the DevTools component of Google Chrome versions prior to 151.0.7922.72. This flaw allows an attacker who convinces a user to install a malicious Chrome extension to execute arbitrary code within the browser's sandbox environment. The vulnerability has a high severity rating with a CVSS score of 7.5. A fixed version, 151.0.7922.72, is available. No known exploits in the wild have been reported at this time.

A medium severity vulnerability (CVE-2026-17897) in Google Chrome prior to version 151.0.7922.72 involves an inappropriate implementation in the ORB component that allows a remote attacker to leak cross-origin data via a crafted HTML page. This vulnerability does not impact integrity or availability and requires user interaction to exploit. There are no confirmed exploits in the wild. The vendor advisory linked provides update information but does not explicitly confirm patch status.

A vulnerability in Google Chrome's WebXR implementation prior to version 151.0.7922.72 allows a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. The issue is classified as medium severity with a CVSS score of 6.5. No known exploits are reported in the wild. The vulnerability relates to information disclosure (CWE-200).

CVE-2026-17889 is a medium severity vulnerability in Google Chrome's WebXR component prior to version 151.0.7922.72. It involves an uninitialized use that allows a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability does not impact integrity or availability but can lead to confidentiality loss. No known exploits in the wild have been reported. The vendor advisory linked does not explicitly confirm patch availability or remediation status.

CVE-2026-17888 is a vulnerability in Google Chrome prior to version 151.0.7922.72 involving insufficient validation of untrusted input in the WebUI. This flaw could allow a remote attacker to potentially perform a sandbox escape via malicious network traffic. The vulnerability has a CVSS score of 7.1, indicating high severity. No known exploits in the wild have been reported. The vendor has published an advisory but has not explicitly stated the remediation level or patch availability in the provided data.

Inappropriate implementation in Headless in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

A medium severity vulnerability in Google Chrome prior to version 151.0.7922.72 allows a remote attacker to leak cross-origin data via a crafted HTML page due to inappropriate implementation in the Autofill feature. The vulnerability is identified as CVE-2026-17879 and is related to CWE-346. No known exploits are reported in the wild. The issue is addressed in Chrome version 151.0.7922.72.

CVE-2026-17877 is a high-severity vulnerability in Google Chrome on Linux prior to version 151.0.7922.72. It involves an inappropriate implementation in the Chromoting component that allows a local attacker to escalate privileges to the operating system level via malicious network traffic. The vulnerability has a CVSS score of 8.4, indicating a significant impact on confidentiality, integrity, and availability. No known exploits are reported in the wild. The vendor advisory linked does not explicitly confirm patch availability or remediation status.

Insufficient validation of untrusted input in Mobile in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to spoof the contents of the Omnibox (URL bar) via a malicious file. (Chromium security severity: Medium)

CVE-2026-17858 is a medium severity vulnerability in Google Chrome on Windows involving uninitialized use in the WebNN component. This flaw allows a remote attacker to leak cross-origin data by tricking a user into visiting a crafted HTML page. The vulnerability affects versions prior to 151.0.7922.72. No confirmed exploits in the wild have been reported. A vendor advisory is available but does not explicitly confirm patch status or remediation details.

Integer overflow in Codecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: Medium)

Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-17844 is a medium severity vulnerability in Google Chrome prior to version 151.0.7922.72. It involves insufficient validation of untrusted input in the Cast component, allowing an attacker on the local network segment to leak cross-origin data via malicious network traffic. The vulnerability does not require user interaction or privileges and impacts confidentiality only.

Incorrect security UI in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Medium)

Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-16414 is a critical vulnerability in Google Chrome's Chromecast component prior to version 150.0.7871.182. It involves insufficient validation of untrusted input, which could allow a local attacker to perform a sandbox escape via malicious network traffic. The vulnerability has a high CVSS score of 9.3, indicating severe impact on confidentiality, integrity, and availability. No confirmed exploits in the wild are reported. The vendor advisory linked does not explicitly confirm patch availability or remediation status.

CVE-2026-15905 is a use-after-free vulnerability in the Aura component of Google Chrome versions prior to 150.0.7871.128. It allows a local attacker to potentially cause heap corruption by processing a malicious file. The vulnerability is related to improper memory management and is classified as high severity.