Search: 36.9-2

UI misrepresentation in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

A UI misrepresentation vulnerability in the Downloads component of Google Chrome prior to version 153.0.8010.36 allows a remote attacker to bypass system access restrictions via a crafted HTML page using social engineering techniques. This issue has been assigned a medium severity rating and is fixed in version 153.0.8010.36.

A UI misrepresentation vulnerability in Google Chrome prior to version 153.0.8010.36 allows a remote attacker to spoof UI elements via a crafted HTML page, potentially misleading users through social engineering. This issue has been assigned a medium severity rating by Chromium security.

CVE-2026-87599 is a medium severity vulnerability in Google Chrome prior to version 153.0.8010.36. It involves improper input validation in the Interstitials component, which could allow a remote attacker to spoof user interface elements by crafting a malicious HTML page. This flaw has been fixed in Chrome version 153.0.8010.36.

CVE-2026-87548 is a medium severity vulnerability in Google Chrome prior to version 153.0.8010.36. It involves improper state validation in the Chrome Installer that could allow a remote attacker to bypass system access restrictions via a crafted HTML page. The vulnerability does not impact confidentiality or availability but may allow limited integrity impact. A fix is available in Chrome version 153.0.8010.36.

A vulnerability in Google Chrome prior to version 153.0.8010.36 allows a remote attacker to obtain cross-origin data through an observable discrepancy in the Network panel. This issue has been assigned a low severity rating and has been fixed in version 153.0.8010.36.

CVE-2026-87479 is a high-severity vulnerability in Google Chrome prior to version 153.0.8010.36. It involves insufficient policy enforcement in Chrome Extensions, which could allow a remote attacker who has compromised the renderer process and used social engineering to execute arbitrary code outside the sandbox via a crafted HTML page.

A buffer overflow vulnerability exists in the WebRTC component of Google Chrome versions prior to 153.0.8010.36. This flaw allows a remote attacker to execute arbitrary code within the sandbox by crafting a malicious HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8.

Uninitialized resource in Codecs in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

A vulnerability in Google Chrome on iOS prior to version 153.0.8010.36 allows cleartext transmission of sensitive data during HttpsUpgrades. This flaw could enable a remote attacker to leak sensitive information via crafted network traffic. The issue has a medium severity rating and a CVSS score of 5.9.

An improper input validation vulnerability in the Passwords component of Google Chrome prior to version 153.0.8010.36 could allow a remote attacker to potentially leak sensitive information via crafted network traffic. The issue is classified with medium severity and has been fixed in version 153.0.8010.36.

Cross-site request forgery in DeviceBoundSessionCredentials in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87582 is a high severity confused deputy vulnerability in Google Chrome's DataTransfer component prior to version 153.0.8010.36. It allows a remote attacker who has compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. The vulnerability affects Chrome versions before 153.0.8010.36. A fix is available as indicated by the vendor advisory.

CVE-2026-87547 is a critical vulnerability in Google Chrome prior to version 153.0.8010.36 involving incorrect reference resolution in the FileSystem component. It allows a remote attacker, through social engineering and a crafted HTML page, to potentially execute arbitrary code outside the browser sandbox. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability. Google has published an advisory with a stable channel update addressing this issue.

Type confusion in XML in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87487 is a missing authorization vulnerability in the FileSystem component of Google Chrome prior to version 153.0.8010.36. It allows a remote attacker who has compromised the renderer process and used social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.3.

Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87504 is a use-after-free vulnerability in the Core component of Google Chrome prior to version 153.0.8010.36. This flaw allows a remote attacker, through social engineering and a crafted Chrome extension, to execute arbitrary code outside the browser sandbox. The vulnerability has a high CVSS score of 9.6, indicating critical severity. It affects versions before 153.0.8010.36. Google has published an advisory indicating a stable channel update addressing this issue.

CVE-2026-87474 is a use-after-free vulnerability in the Payments component of Google Chrome versions prior to 153.0.8010.36. This flaw could allow a remote attacker to execute arbitrary code outside the browser sandbox via a crafted HTML page. The vulnerability has a high severity rating and a CVSS score of 9.6, indicating critical impact on confidentiality, integrity, and availability.

CVE-2026-87536 is a use-after-free vulnerability in the V8 JavaScript engine of Google Chrome prior to version 153.0.8010.36. This flaw allows a remote attacker to execute arbitrary code within the browser sandbox by crafting a malicious HTML page. The vulnerability is rated high severity with a CVSS score of 8.8. Google has released an update to address this issue.