Threats affecting pkg:rpm/google/chrome

Use after free in Dawn in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Inappropriate implementation in MediaCapture in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

Out of bounds read in Skia in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

Out of bounds read in Dawn in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

A use-after-free vulnerability exists in the Views component of Google Chrome on Windows versions prior to 149.0.7827.103. This flaw could allow a remote attacker who has already compromised the renderer process to potentially escape the sandbox by using a specially crafted HTML page. The vulnerability is rated with high severity and has a CVSS score of 8.3.

CVE-2026-11660 is a high-severity vulnerability in Google Chrome prior to version 149.0.7827.103. It involves insufficient validation of untrusted input on the New Tab Page, which could allow a remote attacker who has compromised the renderer process to potentially escape the sandbox via a crafted HTML page. The vulnerability has a CVSS score of 8.3, indicating a significant impact on confidentiality, integrity, and availability.

CVE-2026-11658 is a vulnerability in Google Chrome prior to version 149.0.7827.103 involving insufficient validation of untrusted input in Extensions. This flaw allows a remote attacker who has compromised the renderer process to bypass site isolation using a crafted HTML page. The vulnerability has a CVSS score of 6.5 and is rated medium severity.

Use after free in ServiceWorker in Google Chrome prior to 149.0.7827.103 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension. (Chromium security severity: High)

A use-after-free vulnerability exists in the CameraCapture component of Google Chrome on Mac systems prior to version 149.0.7827.103. This flaw could allow a remote attacker to potentially escape the browser sandbox by crafting a malicious HTML page. The vulnerability has a critical severity rating with a CVSS score of 9.6.

Use after free in Extensions in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Use after free in Network in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in ViewTransitions in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-11645 is a high severity vulnerability in Google Chrome's V8 engine that allows out of bounds read and write operations. This flaw affects Chrome versions prior to 149.0.7827.103 and enables a remote attacker to execute arbitrary code within the browser's sandbox via a crafted HTML page. The vulnerability is related to memory safety issues classified under CWE-125 and CWE-787.

Use after free in Views in Google Chrome on Linux prior to 149.0.7827.103 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Critical)

CVE-2026-11308 is a vulnerability in Google Chrome prior to version 149.0.7827.53 involving an inappropriate implementation in the Extensions system. This flaw allows an attacker who convinces a user to install a malicious extension to perform privilege escalation via a crafted Chrome Extension. The vulnerability has a medium severity rating with a CVSS score of 6.3. No known exploits are reported in the wild. The vendor advisory does not explicitly confirm patch availability but references a stable channel update.

A use-after-free vulnerability exists in the PDFium component of Google Chrome prior to version 149.0.7827.53. This flaw allows a remote attacker to execute arbitrary code within the sandbox by using a specially crafted PDF file. The vulnerability has a high severity rating with a CVSS score of 8.8. Google has released an update in Chrome version 149.0.7827.53 to address this issue.

CVE-2026-11300 is a medium severity vulnerability in Google Chrome prior to version 149.0.7827.53. It involves an inappropriate implementation in the Permissions feature that allows a remote attacker to perform UI spoofing via a crafted HTML page. This vulnerability does not impact confidentiality or availability but can mislead users by presenting deceptive user interface elements.

CVE-2026-11298 is a vulnerability in Google Chrome for iOS prior to version 149.0.7827.53 where improper policy enforcement allows a remote attacker to bypass the same origin policy via a crafted HTML page. This issue is classified with medium severity and has a CVSS score of 4.3. No known exploits are reported in the wild. The vulnerability relates to insufficient policy enforcement (CWE-346).

CVE-2026-11297 is a vulnerability in Google Chrome on Android prior to version 149.0.7827.53 involving insufficient validation of untrusted input in Reader Mode. This flaw allows a local attacker to bypass navigation restrictions by using a malicious file. The vulnerability has a high severity rating with a CVSS score of 7.7. No confirmed exploits in the wild have been reported. The vendor advisory linked does not explicitly confirm patch availability or remediation status.

Inappropriate implementation in ImageCapture in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low)