Search: 36.9-2

An incorrect authorization vulnerability in the Isolated feature of Google Chrome prior to version 153.0.8010.36 allows a remote attacker to bypass the web origin policy and access a privileged page via a crafted HTML page. This vulnerability has been assigned CVE-2026-87577 and is rated with medium severity by Chromium security. No patch information is currently available.

Incorrect authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)

An out-of-bounds read vulnerability exists in the Tint component of Google Chrome versions prior to 153.0.8010.36. This flaw could allow a remote attacker to potentially read memory inside the sandbox by delivering a crafted HTML page. The Chromium project has assigned this issue a low security severity rating.

An out of bounds read vulnerability in the ANGLE component of Google Chrome prior to version 153.0.8010.36 allows a remote attacker to read memory outside the sandbox by delivering a crafted HTML page. This vulnerability is classified as high severity by Chromium security. No CVSS score or patch information is currently provided.

An input validation vulnerability in the Network component of Google Chrome prior to version 153.0.8010.36 allows a remote attacker to bypass the web origin policy using a crafted HTML page. This vulnerability is classified with medium severity by Chromium. No CVSS score or exploit in the wild has been reported. No patch information is currently available.

Incorrect authorization in WebAppInstalls in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

An uninitialized resource vulnerability in the GPU component of Google Chrome on Android versions prior to 153.0.8010.36 allows a remote attacker who has compromised the renderer process to read memory outside the sandbox. The vulnerability is rated medium severity by the Chromium security team.

An improper certificate validation vulnerability exists in the Loader component of Google Chrome versions prior to 153.0.8010.36. This vulnerability allows a remote attacker, through social engineering and crafted network traffic, to bypass the web origin policy. The Chromium project classifies this issue as having low security severity.

A UI misrepresentation vulnerability exists in CustomTabs in Google Chrome on Android versions prior to 153.0.8010.36. This flaw allows a remote attacker to spoof the address bar via a co-installed app, potentially misleading users about the website they are visiting. The Chromium project rates this issue as having low security severity.

A medium severity vulnerability (CVE-2026-87590) exists in Google Chrome versions prior to 153.0.8010.36 due to improper input validation in the Passwords component. This flaw could allow a remote attacker to potentially leak sensitive information by sending crafted network traffic. The vulnerability does not require user interaction or privileges to exploit and affects confidentiality but not integrity or availability.

An incorrect authorization vulnerability in the ServiceWorker component of Google Chrome versions prior to 153.0.8010.36 allows a remote attacker to bypass the web origin policy using a crafted HTML page. The vulnerability is classified with low severity by Chromium security. No CVSS score or known exploits in the wild have been reported. No explicit affected versions or patch information is provided in the source data.

An incorrect authorization vulnerability exists in the SiteIsolation feature of Google Chrome versions prior to 153.0.8010.36. This flaw allows a remote attacker who has already compromised the renderer process to bypass system access restrictions by leveraging a crafted HTML page. The vulnerability is rated medium severity by Chromium security. There are no known exploits reported in the wild and no CVSS score is available.

An improper input validation vulnerability exists in the Safebrowsing component of Google Chrome on Android versions prior to 153.0.8010.36. This flaw allows a remote attacker to bypass system access restrictions by leveraging social engineering and a crafted HTML page. The vulnerability is rated medium severity by Chromium security. No known exploits are reported in the wild, and no official patch information is provided.

A UI misrepresentation vulnerability in the UrlFormatting component of Google Chrome versions prior to 153.0.8010.36 allows a remote attacker to spoof the address bar by using a crafted domain name. This vulnerability could be exploited through social engineering to deceive users about the actual URL they are visiting. The Chromium security team has rated this issue as medium severity. No CVSS score or patch information is currently available.

A low severity information leak vulnerability exists in the Passwords component of Google Chrome on Android versions prior to 153.0.8010.36. This flaw allows a remote attacker to leak sensitive information by crafting a malicious HTML page. No CVSS score is provided, and no known exploits are reported in the wild. The vulnerability is identified as CWE-200, indicating exposure of sensitive information. No explicit patch or remediation details are provided in the available data.

A vulnerability in Google Chrome prior to version 153.0.8010.36 allows a remote attacker to leak sensitive information by exploiting an observable discrepancy in the browser's layout engine via a crafted HTML page. The issue is classified with medium severity by Chromium security. No known exploits are reported in the wild, and no patch information is currently available.

Missing authorization in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

A UI misrepresentation vulnerability exists in Google Chrome versions prior to 153.0.8010.36. This flaw allows a remote attacker to use social engineering techniques to spoof UI elements by crafting malicious HTML pages. The vulnerability is classified with medium severity by Chromium security. No CVSS score or exploit in the wild is currently reported.

Missing authorization in LocalNetworkAccess in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

A vulnerability in Google Chrome on Mac prior to version 153.0.8010.36 involves incorrect reference resolution in the Accessibility component. This flaw could allow a remote attacker to potentially spoof user interface elements by crafting a malicious HTML page. The issue is categorized with medium severity by Chromium security. No known exploits are reported in the wild, and no official patch information is provided in the available data.