Search: 36.9-2

Use after free in Payments in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-87499 is a high severity vulnerability in Google Chrome prior to version 153.0.8010.36. It involves incorrect authorization in the Network component that allows a remote attacker who has compromised the renderer process to bypass site isolation using a crafted HTML page. This flaw was fixed in Chrome version 153.0.8010.36.

A missing authorization vulnerability in the WebUI component of Google Chrome prior to version 153.0.8010.36 allows a remote attacker who has compromised the renderer process to bypass the web origin policy via a crafted HTML page. This issue has been fixed in version 153.0.8010.36.

Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in WebPackaging in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Injection in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-87500 is a critical vulnerability in Google Chrome prior to version 153.0.8010.36 involving improper validation of an array index in the ANGLE component. This flaw allows a remote attacker to potentially execute arbitrary code outside the browser sandbox by delivering a crafted HTML page. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability. Google has published an advisory indicating a stable channel update that addresses this issue.

Use after free in Web Authentication in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-87596 is an out-of-bounds read vulnerability in the ANGLE component of Google Chrome prior to version 153.0.8010.36. This flaw allows a remote attacker to read memory outside the sandbox by delivering a crafted HTML page. The vulnerability has been assigned a medium severity rating with a CVSS score of 4.3. A fix is available in Chrome version 153.0.8010.36.

Out of bounds read in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-87520 is a use-after-free vulnerability in the Dawn component of Google Chrome on Android versions prior to 153.0.8010.36. This flaw allows a remote attacker to execute arbitrary code outside the browser sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a critical severity with a CVSS score of 9.6. Google has published an advisory indicating a stable channel update addressing this issue.

CVE-2026-87492 is a critical vulnerability in Google Chrome prior to version 153.0.8010.36 involving incorrect authorization in DevTools. This flaw could allow a remote attacker to execute arbitrary code outside the browser sandbox by using a crafted HTML page. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability. A fix is available in Chrome version 153.0.8010.36.

Race condition in Chromoting in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)

A missing authorization vulnerability in Google Chrome prior to version 153.0.8010.36 allows a remote attacker to bypass system access restrictions via a crafted HTML page leveraging social engineering. This issue affects the Views component and has been assigned a high severity rating with a CVSS score of 8.8. The vulnerability is fixed in Chrome version 153.0.8010.36.

A use-after-free vulnerability exists in the Core component of Google Chrome on Windows versions prior to 153.0.8010.36. This flaw could allow a remote attacker who has compromised the renderer process to execute arbitrary code outside the sandbox by crafting a malicious HTML page. The vulnerability has a high severity rating with a CVSS score of 8.3.

Use after free in Views in Google Chrome prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via UI Interaction. (Chromium security severity: High)

Double free in PDFium in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)

A use-after-free vulnerability exists in the ANGLE component of Google Chrome on Windows versions prior to 153.0.8010.36. This flaw allows a remote attacker to execute arbitrary code outside the browser sandbox by tricking a user into visiting a crafted HTML page. The vulnerability is rated critical with a CVSS score of 9.6.

A critical buffer overflow vulnerability exists in the WebGL component of Google Chrome versions prior to 153.0.8010.36. This flaw allows a remote attacker to execute arbitrary code outside the browser sandbox by delivering a specially crafted HTML page. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported. Google has released an update to address this issue.

CVE-2026-87438 is a critical out-of-bounds write vulnerability in the WebGL component of Google Chrome on Android. It affects versions prior to 153.0.8010.36 and allows a remote attacker to execute arbitrary code outside the browser sandbox via a crafted HTML page. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability.