CVE-2026-11288 is a vulnerability in Google Chrome prior to version 149.0.7827.53 involving insufficient policy enforcement in CSS. This flaw allows a remote attacker to leak cross-origin data by crafting a malicious HTML page. The vulnerability has a CVSS score of 6.5, indicating medium severity, with confidentiality impact but no integrity or availability impact. There are no known exploits in the wild. The vendor advisory linked does not explicitly confirm a patch or remediation status.
CVE-2026-11287 is a vulnerability in Google Chrome on Android prior to version 149.0.7827.53 involving insufficient policy enforcement in navigation. This flaw allows a remote attacker who has compromised the renderer process to bypass navigation restrictions using a crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 6.5. No known exploits are reported in the wild. There is no explicit vendor advisory confirming a patch or remediation status at this time.
CVE-2026-11286 is a vulnerability in Google Chrome's Wallet component prior to version 149.0.7827.53. It involves insufficient validation of untrusted input, which allows a remote attacker who has compromised the renderer process to perform UI spoofing via a crafted HTML page. The vulnerability is rated medium severity with a CVSS score of 4.3. No known exploits are reported in the wild. No explicit patch or remediation level is provided in the available data.
CVE-2026-11284 is a side-channel information leakage vulnerability in Google Chrome's PerformanceAPIs prior to version 149.0.7827.53. This flaw allows a remote attacker to leak cross-origin data by using a crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 6.5. No official remediation level or patch link is explicitly provided in the data, but a vendor advisory is available. There are no known exploits in the wild at this time.
CVE-2026-11283 is a vulnerability in Google Chrome on Mac that involves insufficient validation of untrusted input in the Shortcuts feature. This flaw allows a remote attacker to bypass navigation restrictions by using a malicious file. The vulnerability affects versions prior to 149.0.7827.53 and is rated with a medium severity score of 6.5. No known exploits are reported in the wild, and no explicit patch information is provided in the vendor advisory link.
A policy enforcement bypass vulnerability exists in the sandbox of Google Chrome on Linux versions prior to 149.0.7827.53. This flaw could allow a remote attacker to escape the sandbox by delivering a crafted HTML page. The vulnerability is rated critical with a high CVSS score of 9.6. No known exploits in the wild have been reported. A vendor advisory is available but does not explicitly confirm patch status or remediation details.
CVE-2026-11273 is a vulnerability in Google Chrome's Omnibox prior to version 149.0.7827.53. It involves insufficient validation of untrusted input, allowing a remote attacker to inject arbitrary scripts or HTML (UXSS) if a user performs specific UI gestures on a crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 6.1. No confirmed exploits in the wild have been reported. A vendor advisory is available but does not explicitly confirm patch availability or remediation status.
A vulnerability in Google Chrome on Android prior to version 149.0.7827.53 allows a remote attacker to leak cross-origin data via a crafted HTML page due to inappropriate UI implementation. The issue has a medium severity rating with a CVSS score of 6.5. No known exploits are reported in the wild. The vulnerability relates to CWE-352 (Cross-Site Request Forgery).
CVE-2026-11267 is a vulnerability in Google Chrome prior to version 149.0.7827.53 involving insufficient policy enforcement in browser extensions. This flaw allows an attacker who convinces a user to install a malicious extension to bypass the content security policy. The vulnerability has a medium severity rating with a CVSS score of 4.3. No known exploits are reported in the wild. A vendor advisory link is provided but does not explicitly confirm patch availability or remediation status.
CVE-2026-11265 is a vulnerability in Google Chrome's Autofill feature prior to version 149.0.7827.53. It allows a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 7.5. There is no explicit vendor advisory confirming a patch or fix at this time.
CVE-2026-11255 is a vulnerability in Google Chrome's Storage Access API prior to version 149.0.7827.53. It involves insufficient validation of untrusted input, which could allow a remote attacker who has compromised the renderer process to leak cross-origin data via a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 7.5. No official patch or remediation level is explicitly stated in the provided data, and no known exploits are reported in the wild.
A race condition vulnerability in the Permissions implementation of Google Chrome prior to version 149.0.7827.53 allows a remote attacker to leak cross-origin data via a crafted HTML page. The issue has a CVSS score of 4.3, indicating medium severity, and does not impact integrity or availability. No known exploits are reported in the wild.
CVE-2026-11251 is a low-severity vulnerability in Google Chrome's Password Manager prior to version 149.0.7827.53. It involves insufficient policy enforcement that allows a remote attacker who has compromised the renderer process to bypass discretionary access control via a crafted HTML page. The vulnerability does not impact confidentiality, integrity, or availability beyond this bypass. There are no known exploits in the wild. No explicit patch or remediation level is stated in the vendor advisory.
CVE-2026-11250 is a vulnerability in Google Chrome's DevTools prior to version 149.0.7827.53. It allows a remote attacker who has compromised the renderer process to access potentially sensitive information from process memory via a crafted HTML page. The vulnerability is related to an inappropriate implementation and is categorized under CWE-416 (Use After Free).
CVE-2026-11240 is a low-severity vulnerability in Google Chrome prior to version 149.0.7827.53. It involves insufficient validation of untrusted input in the Loader component, which could allow a remote attacker who has compromised the renderer process to bypass site isolation using a crafted HTML page. The vulnerability does not impact confidentiality, integrity, or availability beyond this bypass. No known exploits are reported in the wild. A vendor advisory is available but does not explicitly confirm a patch or remediation status.
A vulnerability in Google Chrome's Web Bluetooth feature prior to version 149.0.7827.53 allows insufficient policy enforcement. This flaw could enable a remote attacker who has compromised the renderer process to potentially escape the sandbox via a crafted HTML page. The vulnerability is rated with a high severity CVSS score of 8.3. No explicit patch or remediation level is stated in the provided data, and no known exploits are reported in the wild.
CVE-2026-11235 is a high-severity vulnerability in Google Chrome prior to version 149.0.7827.53 involving insufficient policy enforcement in the Compositing component. This flaw allows a remote attacker who has compromised the renderer process to execute arbitrary code within the sandbox via a crafted HTML page. The vulnerability has a CVSS score of 8.8, indicating a significant impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported. The vendor advisory linked does not explicitly confirm patch availability or remediation status.
CVE-2026-11234 is a vulnerability in Google Chrome's FoldableAPIs prior to version 149.0.7827.53. It allows a remote attacker who has compromised the renderer process to bypass site isolation by using a crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 4.3. No known exploits are reported in the wild. The vendor advisory does not explicitly confirm a patch or remediation status.
A use-after-free vulnerability exists in the Chromoting component of Google Chrome on Linux versions prior to 149.0.7827.53. This flaw allows a remote attacker to execute arbitrary code via malicious network traffic. The vulnerability has a high severity rating with a CVSS score of 8.1. There is no explicit vendor advisory stating a patch or fix status, but the affected versions are those before 149.0.7827.53.
CVE-2026-11220 is a medium severity vulnerability in Google Chrome prior to version 149.0.7827.53. It involves insufficient validation of untrusted input in the navigation component, which could allow a remote attacker who has compromised the renderer process to bypass site isolation using a crafted HTML page. This vulnerability does not impact confidentiality but can lead to integrity issues. No known exploits are reported in the wild. A vendor advisory is available but does not explicitly confirm patch status or remediation details.