Search: 36.9-2

An incorrect authorization vulnerability in the Sources component of Google Chrome prior to version 153.0.8010.36 allows a remote attacker to leak sensitive information via a crafted HTML page leveraging social engineering. The issue has been fixed in version 153.0.8010.36. The vulnerability has a CVSS score of 6.5, indicating medium severity.

Use after free in Sharing in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)

A use-after-free vulnerability exists in the Passwords component of Google Chrome versions prior to 153.0.8010.36. This flaw allows a remote attacker, through social engineering and user interaction, to potentially execute arbitrary code outside the browser sandbox. The vulnerability has a critical severity rating with a CVSS score of 9.6. Google has published an advisory indicating a stable channel update addressing this issue.

A vulnerability in Google Chrome prior to version 153.0.8010.36 allows a remote attacker to bypass system access restrictions by exploiting incorrect authorization in Chrome extensions. This flaw has been assigned CVE-2026-87591 and is rated with medium severity.

CVE-2026-87455 is a use-after-free vulnerability in the Aura component of Google Chrome prior to version 153.0.8010.36. This flaw could allow a remote attacker to execute arbitrary code outside the browser sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a critical severity rating with a CVSS score of 9.6. Google has released a stable channel update to address this issue.

A type confusion vulnerability in the Rust component of Google Chrome on Windows prior to version 153.0.8010.36 allows a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. This vulnerability has a high CVSS score of 9.6 and is rated critical in severity.

CVE-2026-87470 is a critical vulnerability in Google Chrome on Mac prior to version 153.0.8010.36. It involves improper quantity validation in the Tint component, which could allow a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability.

A numeric truncation error in the Media component of Google Chrome prior to version 153.0.8010.36 could allow a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. This vulnerability has a high severity score and affects Chrome versions before 153.0.8010.36.

Use after free in Extensions in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87510 is a high-severity vulnerability in Google Chrome's FileAPI component prior to version 153.0.8010.36. It involves improper input validation that could allow a remote attacker, who has already compromised the renderer process, to execute arbitrary code outside the sandbox via a crafted HTML page. This vulnerability affects desktop versions of Chrome before 153.0.8010.36 and has a CVSS score of 8.3.

Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)

A missing authorization vulnerability in the FileSystem component of Google Chrome prior to version 153.0.8010.36 allows a remote attacker to bypass system access restrictions via a crafted HTML page, leveraging social engineering. The vulnerability has a medium severity rating.

Use after free in Browser in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87530 is a high-severity vulnerability in Google Chrome on Windows prior to version 153.0.8010.36. It involves an uncontrolled search path element in the CredentialProvider component, which allows a local attacker to execute arbitrary code outside the sandbox. The vulnerability requires local access and high attack complexity, but no privileges or user interaction. A fix is available in Chrome version 153.0.8010.36.

CVE-2026-87589 is a medium severity vulnerability in Google Chrome's SiteIsolation feature prior to version 153.0.8010.36. It allows a remote attacker who has compromised the renderer process to bypass system access restrictions by using a crafted HTML page. This flaw has been fixed in Chrome version 153.0.8010.36.

A medium severity vulnerability (CVE-2026-87594) in Google Chrome prior to version 153.0.8010.36 involves incorrect authorization in the DataTransfer component. This flaw allows a remote attacker who has compromised the renderer process to access sensitive information via a crafted HTML page. The vulnerability has a CVSS score of 5.3 and affects versions before 153.0.8010.36. Google has released a stable channel update addressing this issue.

Information leak in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87532 is a medium severity vulnerability in Google Chrome's Safebrowsing feature prior to version 153.0.8010.36. It involves improper state validation that allows a remote attacker to bypass system access restrictions via a crafted HTML page. The vulnerability does not impact confidentiality or availability but can cause integrity issues. No known exploits are reported in the wild. A vendor advisory is available but does not explicitly confirm patch status.

Information leak in Scroll in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87549 is a medium severity vulnerability in Google Chrome prior to version 153.0.8010.36. It involves incomplete cleanup in the Downloads component, which allows a remote attacker to bypass system access restrictions through a crafted HTML page leveraging social engineering. The vulnerability requires user interaction and does not impact confidentiality or availability but can cause integrity issues.