Threats affecting pkg:deb/google/chrome

Insufficient validation of untrusted input in ReadingMode in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to bypass site Isolation via a crafted HTML page. (Chromium security severity: High)

Use after free in HID in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

Inappropriate implementation in MHTML in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)

Inappropriate implementation in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low)

Insufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low)

CVE-2026-7992 is a high-severity vulnerability in Google Chrome on Linux and ChromeOS prior to version 148.0.7778.96. It involves insufficient validation of untrusted input in the user interface, which could allow a remote attacker to execute arbitrary code if a user performs specific UI gestures on a crafted HTML page. The vulnerability requires user interaction and affects confidentiality, integrity, and availability. There is no explicit vendor advisory stating a patch or fix status, but the affected version is prior to 148.0.7778.96, implying that updating to this version or later addresses the issue.

CVE-2026-7984 is a use-after-free vulnerability in the ReadingMode component of Google Chrome versions prior to 148.0.7778.96. This flaw allows a remote attacker who has already compromised the renderer process to execute arbitrary code within the sandbox by using a specially crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8. There are no known exploits in the wild at the time of publication. The vendor advisory linked does not explicitly confirm patch availability or remediation status.

CVE-2026-7978 is a high-severity vulnerability in Google Chrome on Mac, prior to version 148.0.7778.96. It involves an inappropriate implementation in the Companion component that allows a remote attacker to escalate privileges to the OS level via malicious network traffic. The vulnerability has a CVSS score of 8.1, indicating a significant risk. No known exploits are reported in the wild. The vendor advisory linked does not explicitly confirm patch availability or remediation status at this time.

CVE-2026-7973 is an integer overflow vulnerability in the Dawn component of Google Chrome on Windows versions prior to 148.0.7778.96. This flaw could allow a remote attacker to potentially escape the browser sandbox by using a specially crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8. There are no known exploits in the wild at this time. The vendor advisory linked does not explicitly confirm the patch status or remediation details.

Insufficient validation of untrusted input in CORS in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-7963 is a high-severity vulnerability in Google Chrome's ServiceWorker implementation prior to version 148.0.7778.96. It allows a remote attacker who has already compromised the renderer process to potentially escape the sandbox by using a crafted HTML page. This vulnerability could lead to full compromise of the affected system. No known exploits are reported in the wild at this time. The vendor advisory linked does not explicitly confirm the availability of a patch or remediation status.

Insufficient validation of untrusted input in Permissions in Google Chrome prior to 148.0.7778.96 allowed an attacker on the local network segment to leak cross-origin data via malicious network traffic. (Chromium security severity: Medium)

Insufficient validation of untrusted input in COOP in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

Insufficient validation of untrusted input in Persistent Cache in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

Out of bounds read in WebCodecs in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform an out of bounds memory read via a crafted video file. (Chromium security severity: Medium)

Insufficient data validation in InterestGroups in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-7898 is a use-after-free vulnerability in the Chromoting component of Google Chrome on Linux versions prior to 148.0.7778.96. This flaw allows a remote attacker to execute arbitrary code by sending malicious network traffic. The vulnerability has a high severity with a CVSS score of 8.8, indicating significant potential impact on confidentiality, integrity, and availability. There are no known exploits in the wild at the time of this report. The vendor advisory linked does not explicitly confirm the availability of a patch or remediation status.

Insufficient validation of untrusted input in Feedback in Google Chrome prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Use after free in WebMIDI in Google Chrome prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-7351 is a race condition vulnerability in the MHTML component of Google Chrome versions prior to 147.0.7727.138. It allows an attacker who convinces a user to install a malicious Chrome extension to leak cross-origin data. The vulnerability has a low CVSS score of 3.1 and is classified as low severity. There is no explicit vendor advisory stating a patch or fix status in the provided data, but the affected version is prior to 147.0.7727.