Threats affecting pkg:rpm/google/chrome

CVE-2026-11190 is a medium severity vulnerability in Google Chrome affecting versions prior to 149.0.7827.53. It involves insufficient policy enforcement in the Extensions component, allowing a malicious extension to bypass discretionary access controls if a user installs it. The vulnerability does not impact confidentiality but can lead to integrity violations. No known exploits are reported in the wild. A vendor advisory is available but does not explicitly confirm patch status or remediation details.

A vulnerability in Google Chrome prior to version 149.0.7827.53 allows remote attackers to inject arbitrary scripts or HTML via crafted HTML pages due to inappropriate CSS implementation. This results in a cross-site scripting (UXSS) issue with medium severity.

Insufficient policy enforcement in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

A vulnerability in Google Chrome prior to version 149.0.7827.53 allows a remote attacker to leak cross-origin data via a crafted HTML page due to inappropriate implementation in the Media component. This issue has a medium severity rating and a CVSS score of 6.5. The vulnerability does not affect availability or integrity but impacts confidentiality. No known exploits are reported in the wild. A vendor advisory link is provided but does not explicitly confirm patch availability or remediation status.

CVE-2026-11148 is a medium severity vulnerability in Google Chrome on Android prior to version 149.0.7827.53. It involves an inappropriate implementation in the Payments component that allows a local attacker to leak cross-origin data via a crafted HTML page. The vulnerability has a CVSS score of 6.5 and does not impact integrity or availability. No known exploits are reported in the wild.

Out of bounds read in Extensions in Google Chrome on Linux prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Chrome Extension. (Chromium security severity: Medium)

Inappropriate implementation in Web Share in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. (Chromium security severity: Medium)

A use-after-free vulnerability exists in the Compositing component of Google Chrome prior to version 149.0.7827.53. This flaw allows a remote attacker to execute arbitrary code within the browser's sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8. Google has published a stable channel update addressing this issue.

Insufficient validation of untrusted input in Chromoting in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted Chrome Extension. (Chromium security severity: Medium)

An out of bounds read vulnerability exists in the WebRTC component of Google Chrome versions prior to 149.0.7827.53. This flaw allows a remote attacker to potentially access sensitive information from process memory by tricking a user into visiting a crafted HTML page. The vulnerability has a medium severity rating and does not affect availability or integrity, only confidentiality.

A use-after-free vulnerability exists in the Codecs component of Google Chrome on Windows versions prior to 149.0.7827.53. This flaw could allow a remote attacker who has compromised the renderer process to potentially escape the sandbox by using a crafted HTML page. The vulnerability is rated critical with a high CVSS score of 9.6.

CVE-2026-11086 is a high-severity vulnerability in Google Chrome prior to version 149.0.7827.53. It involves insufficient validation of untrusted input in the Dawn component, allowing a remote attacker who has compromised the renderer process to execute arbitrary code within the sandbox via a crafted HTML page. The vulnerability has a CVSS score of 8.8, indicating a serious risk to confidentiality, integrity, and availability. No known exploits in the wild have been reported. The vendor has published an advisory but has not explicitly stated the remediation status in the provided data.

A vulnerability in the Password Manager component of Google Chrome prior to version 149.0.7827.53 allows a remote attacker to leak cross-origin data via a crafted HTML page. The issue is classified with medium severity and involves inappropriate implementation leading to potential data confidentiality loss without integrity or availability impact.

A vulnerability in Google Chrome's Password Manager prior to version 149.0.7827.53 allows a remote attacker to leak cross-origin data via a crafted HTML page. The issue is due to inappropriate implementation and is rated medium severity with a CVSS score of 6.5. This vulnerability does not impact integrity or availability but can lead to confidentiality loss. No known exploits are reported in the wild. The vendor advisory link is provided but does not explicitly confirm patch availability or remediation status.

Bad cast in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11075 is an out-of-bounds read vulnerability in the V8 JavaScript engine used by Google Chrome. It affects versions prior to 149.0.7827.53 and allows a remote attacker to read potentially sensitive information from process memory via a crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 6.5. No known exploits are reported in the wild. A vendor advisory is available but does not explicitly confirm patch availability or remediation status.

A use-after-free vulnerability exists in the WebRTC component of Google Chrome on Linux versions prior to 149.0.7827.53. This flaw allows a remote attacker to execute arbitrary code by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8. The issue is publicly known but there are no confirmed exploits in the wild. Google has released Chrome version 149.0.7827.53 which addresses this vulnerability.

A use-after-free vulnerability exists in the Base component of Google Chrome on Linux versions prior to 149.0.7827.53. This flaw allows a remote attacker who has compromised the renderer process to potentially access sensitive information from process memory by delivering a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8.

CVE-2026-11070 is a critical vulnerability in Google Chrome on Windows involving insufficient validation of untrusted input in the Chromoting component. This flaw allows a remote attacker who has compromised the network process to potentially escape the sandbox via malicious network traffic. The vulnerability affects versions prior to 149.0.7827.53. The CVSS score is 9.6, indicating a high severity with potential for complete confidentiality, integrity, and availability impact. No known exploits in the wild have been reported at the time of publication. Google has published an advisory but has not explicitly confirmed a patch or remediation level in the provided data.