Search: 36.9-2

An information leak vulnerability exists in the Editing component of Google Chrome versions prior to 153.0.8010.36. This flaw allows a remote attacker to obtain sensitive information by tricking a user into visiting a crafted HTML page. The vulnerability has been assigned CVE-2026-87593 and is rated with medium severity. A fix is available in Chrome version 153.0.8010.36.

Race condition in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-87489 is a memory corruption vulnerability in the V8 JavaScript engine used by Google Chrome. It affects versions prior to 153.0.8010.36 and allows a remote attacker to potentially execute arbitrary code within the sandbox via a crafted Chrome extension. The vulnerability has a high severity rating with a CVSS score of 8.8. Google has published a stable channel update addressing this issue.

Improper input validation in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy into a privileged page via crafted network traffic. (Chromium security severity: Low)

A vulnerability in Google Chrome's Updater on Windows prior to version 153.0.8010.36 allows a local attacker to execute arbitrary code outside the sandbox due to incorrect authorization. This issue has been assigned CVE-2026-87509 and is rated with a high severity score of 8.1. The vulnerability requires local access and high attack complexity, but no privileges or user interaction. A fix is available in Chrome version 153.0.8010.36.

Information leak in Transactions Platform in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

A missing authorization vulnerability in the Contacts feature of Google Chrome prior to version 153.0.8010.36 could allow a remote attacker, who has compromised the renderer process and used social engineering, to potentially access sensitive information via a crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 5.3.

A UI misrepresentation vulnerability in the CustomTabs feature of Google Chrome on Android versions prior to 153.0.8010.36 allows a remote attacker to spoof the address bar via a co-installed app. This flaw has been assigned CVE-2026-87597 and is rated as medium severity with a CVSS score of 4.8. The issue has been fixed in version 153.0.8010.36.

Race condition in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

Clickjacking in Input in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

Observable discrepancy in Select in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-87448 is a use-after-free vulnerability in the DevTools component of Google Chrome versions prior to 153.0.8010.36. This flaw allows a remote attacker to execute arbitrary code outside the browser sandbox by crafting a malicious HTML page. The vulnerability has a high CVSS score of 9.6, indicating critical severity. It affects Chrome desktop versions before 153.0.8010.36. Google has released an update to address this issue.

A vulnerability in Google Chrome prior to version 153.0.8010.36 allows a remote attacker to obtain sensitive information through an observable discrepancy in SVG rendering. The issue is classified as low severity by Chromium but has a CVSS score of 6.5, indicating a medium severity level. The vulnerability requires user interaction and does not allow modification or disruption of data or availability.

An out-of-bounds read vulnerability exists in the Tint component of Google Chrome versions prior to 153.0.8010.36. This flaw could allow a remote attacker to read memory inside the sandbox by delivering a crafted HTML page. The issue has been assigned a CVSS score of 4.3, indicating a medium severity level. Google has fixed this vulnerability in Chrome version 153.0.8010.36.

A server-side request forgery (SSRF) vulnerability exists in Google Chrome Mobile versions prior to 153.0.8010.36. This flaw allows a remote attacker, using social engineering and a crafted HTML page, to bypass system access restrictions. The vulnerability has been assigned a critical severity with a CVSS score of 9.8. The issue is fixed in version 153.0.8010.36.

Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-87519 is an incorrect authorization vulnerability in the Safe Browsing component of Google Chrome prior to version 153.0.8010.36. This flaw allows a remote attacker to bypass system access restrictions by tricking a user into visiting a crafted HTML page. The vulnerability has been assigned a medium severity with a CVSS score of 6.5. A fix is available in Chrome version 153.0.8010.36.

A low-severity incorrect authorization vulnerability in the ServiceWorker component of Google Chrome prior to version 153.0.8010.36 allows a remote attacker to bypass the web origin policy via a crafted HTML page. This issue has been fixed in Chrome version 153.0.8010.36.

A low-severity vulnerability in Google Chrome prior to version 153.0.8010.36 allowed a remote attacker to leak cross-origin data via an observable discrepancy in the Prefetch feature. This issue was fixed in version 153.0.8010.36.

Incorrect reference resolution in Storage in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)