Threats affecting pkg:rpm/google/chrome

CVE-2026-11069 is a medium severity vulnerability in Google Chrome prior to version 149.0.7827.53. It involves insufficient validation of untrusted input in the Cast component, which allows a remote attacker to bypass the same origin policy via a crafted HTML page. This vulnerability can lead to integrity impact but does not affect confidentiality or availability.

CVE-2026-11064 is a medium severity vulnerability in Google Chrome on Android prior to version 149.0.7827.53. It involves a race condition in the GPU component that allows a remote attacker, who has already compromised the renderer process, to leak cross-origin data via a crafted HTML page. This vulnerability does not affect integrity or availability but impacts confidentiality by exposing sensitive data across origins.

CVE-2026-11063 is a critical vulnerability in Google Chrome on Windows prior to version 149.0.7827.53. It involves insufficient validation of untrusted input in the WebNN component, which could allow a remote attacker who has compromised the renderer process to potentially escape the sandbox via a crafted HTML page. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability.

CVE-2026-11061 is a type confusion vulnerability in the ANGLE component of Google Chrome versions prior to 149.0.7827.53. This vulnerability allows a remote attacker to potentially perform a sandbox escape by crafting a malicious HTML page. The vulnerability has a high CVSS score of 9.6, indicating critical severity. No known exploits are reported in the wild at this time.

CVE-2026-11055 is a use-after-free vulnerability in the ANGLE component of Google Chrome on Windows. It affects versions prior to 149.0.7827.53 and allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The vulnerability has a high severity with a CVSS score of 8.8. No known exploits in the wild have been reported. A vendor advisory is available but does not explicitly confirm patch status.

CVE-2026-11054 is a use-after-free vulnerability in the WebRTC component of Google Chrome prior to version 149.0.7827.53. This flaw allows a remote attacker to execute arbitrary code within the sandbox by delivering a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8.

An out-of-bounds read vulnerability exists in the ANGLE component of Google Chrome on Linux versions prior to 149.0.7827.53. This flaw allows a remote attacker to potentially access sensitive information from process memory by delivering a crafted HTML page. The vulnerability has a medium severity rating and does not impact integrity or availability.

A use-after-free vulnerability exists in the V8 JavaScript engine of Google Chrome prior to version 149.0.7827.53. This flaw allows a remote attacker to execute arbitrary code within the sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8. Google has released Chrome version 149.0.7827.53 to address this issue.

A vulnerability in Google Chrome prior to version 149.0.7827.53 allows a malicious extension to bypass the same origin policy. This occurs due to an inappropriate implementation in Chrome Extensions. The issue has a medium severity rating and requires user interaction to exploit, specifically convincing a user to install a crafted malicious extension.

CVE-2026-11047 is a critical vulnerability in Google Chrome on Windows prior to version 149.0.7827.53. It involves insufficient validation of untrusted input in the Base component, which could allow a remote attacker who has compromised the renderer process to potentially escape the sandbox via a crafted HTML page. This vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability.

CVE-2026-11045 is a medium severity vulnerability in Google Chrome prior to version 149.0.7827.53 involving insufficient validation of untrusted input in the GPU component. This flaw allows a remote attacker who has compromised the renderer process to potentially access sensitive information from process memory by using a crafted HTML page. The vulnerability does not affect integrity or availability but impacts confidentiality. No known exploits are reported in the wild. A vendor advisory link is provided but does not explicitly confirm patch availability or remediation status.

CVE-2026-11039 is a medium severity vulnerability in Google Chrome's Skia component prior to version 149.0.7827.53. It involves uninitialized use that allows a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability affects Chrome versions before 149.0.7827.53 and does not impact integrity or availability. No known exploits are reported in the wild.

A vulnerability in Google Chrome prior to version 149.0.7827.53 allows a remote attacker to bypass the same origin policy via a crafted HTML page due to an inappropriate implementation in the DOM. This issue is classified with medium severity and has a CVSS score of 6.5. The vulnerability impacts the integrity of web content isolation but does not affect confidentiality or availability directly.

CVE-2026-11035 is a vulnerability in Google Chrome on Android prior to version 149.0.7827.53 involving insufficient validation of untrusted input in the Custom Tabs feature. This flaw allows a local attacker to escalate privileges by leveraging a crafted XML file. The vulnerability has a high severity rating with a CVSS score of 7.3. No explicit patch or remediation level is confirmed in the provided data, but a vendor advisory link is available for further details.

CVE-2026-11026 is a medium severity vulnerability in Google Chrome prior to version 149.0.7827.53. It involves insufficient policy enforcement in the Extensions component, allowing a malicious extension to bypass navigation restrictions if a user is tricked into installing it. The vulnerability does not affect confidentiality or availability but impacts integrity by enabling unauthorized actions through extensions.

Inappropriate implementation in Payments in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

A use-after-free vulnerability exists in the Fonts component of Google Chrome on Linux versions prior to 149.0.7827.53. This flaw allows a remote attacker to execute arbitrary code within the browser's sandbox by delivering a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8.

An out of bounds read vulnerability exists in the Media component of Google Chrome versions prior to 149.0.7827.53. This flaw allows an attacker on the local network segment to cause an out of bounds memory read via malicious network traffic. The issue has a medium severity rating and a CVSS score of 4. A vendor advisory link is provided but does not explicitly confirm patch availability.

CVE-2026-10984 is a medium severity vulnerability in Google Chrome on Android prior to version 149.0.7827.53. It involves an inappropriate implementation in the Accessibility feature that allows a remote attacker to perform UI spoofing via a crafted HTML page. This vulnerability does not impact confidentiality but can affect integrity and availability. There is no explicit patch or remediation level confirmed from the vendor advisory. No known exploits are reported in the wild.

CVE-2026-10976 is a vulnerability in Google Chrome prior to version 149.0.7827.53 involving uninitialized use in the Dawn component. This flaw allows a remote attacker to potentially access sensitive information from process memory by delivering a crafted HTML page. The vulnerability has a CVSS score of 6.5, indicating medium severity. There is no explicit vendor advisory stating a patch or fix, but the affected versions are prior to 149.0.7827.53.