Threats affecting pkg:deb/google/chrome

Out of bounds read in GPU in Google Chrome on Android prior to 147.0.7727.117 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Out of bounds read in Skia in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted file. (Chromium security severity: Medium)

Insufficient policy enforcement in CORS in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

CVE-2026-5918 is a medium severity vulnerability in Google Chrome prior to version 147.0.7727.55. It involves an inappropriate implementation in the Navigation component that allows a remote attacker who has already compromised the renderer process to leak cross-origin data via a crafted HTML page. The vulnerability does not allow integrity or availability impacts, only limited confidentiality impact. There are no known exploits in the wild. The vendor advisory linked does not explicitly confirm patch availability or remediation status.

Insufficient policy enforcement in DevTools in Google Chrome prior to 147.0.7727.55 allowed an attacker who convinced a user to install a malicious extension to bypass enterprise host restrictions for cookie modification via a crafted Chrome Extension. (Chromium security severity: Low)

Insufficient policy enforcement in PWAs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to install a PWA without user consent via a crafted HTML page. (Chromium security severity: Medium)

Insufficient validation of untrusted input in ANGLE in Google Chrome on Mac prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

Use after free in PrivateAI in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

Heap buffer overflow in WebAudio in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

CVE-2026-5291 is a medium severity vulnerability in Google Chrome's WebGL implementation prior to version 146.0.7680.178. It allows a remote attacker to obtain potentially sensitive information from process memory by tricking a user into visiting a crafted HTML page. The vulnerability does not allow modification or disruption of data, only information disclosure. There are no known exploits in the wild. No explicit patch link is provided, so patch status is not confirmed.

CVE-2026-5285 is a use-after-free vulnerability in the WebGL component of Google Chrome versions prior to 146.0.7680.178. This flaw allows a remote attacker to execute arbitrary code within the browser's sandbox by delivering a specially crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8, indicating significant potential impact on confidentiality, integrity, and availability. There are no known exploits in the wild at the time of this report. A fixed version, 146.0.

CVE-2026-5282 is a high-severity vulnerability in Google Chrome's WebCodecs component prior to version 146.0.7680.178. It allows a remote attacker to perform an out of bounds memory read by crafting a malicious HTML page. This vulnerability can lead to information disclosure and potentially impact the availability of the browser. The issue is categorized as CWE-125 (Out-of-bounds Read).

CVE-2026-4673 is a high-severity heap buffer overflow vulnerability in the WebAudio component of Google Chrome versions prior to 146.0.7680.165. This flaw allows a remote attacker to execute an out-of-bounds memory write by delivering a crafted HTML page, potentially leading to arbitrary code execution. Exploitation requires user interaction, such as visiting a malicious webpage, but no prior authentication is needed. The vulnerability impacts confidentiality, integrity, and availability of affected systems. Although no known exploits are currently in the wild, the high CVSS score of 8.8 indicates significant risk. Organizations using vulnerable Chrome versions should prioritize patching to prevent exploitation.

Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

Insufficient policy enforcement in Extensions in Google Chrome prior to 146.0.7680.71 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Medium)

CVE-2026-3927 is a medium-severity vulnerability in Google Chrome's Picture-in-Picture (PiP) feature prior to version 146.0.7680.71. It allows a remote attacker to perform UI spoofing by crafting a malicious HTML page that misleads users about the security state of the browser interface. The flaw does not impact confidentiality or availability but can affect integrity by tricking users into believing they are interacting with legitimate UI elements. Exploitation requires user interaction to trigger the spoofed UI. No known exploits are currently in the wild. The vulnerability is addressed in Chrome version 146.0.

Inappropriate implementation in DevTools in Google Chrome prior to 145.0.7632.116 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via DevTools. (Chromium security severity: High)

Type Confusion in V8 in Google Chrome prior to 144.0.7559.132 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Inappropriate implementation in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-0628 is a high-severity vulnerability in Google Chrome prior to version 143.0.7499.192. It involves insufficient policy enforcement in the WebView tag, allowing an attacker to trick a user into installing a malicious Chrome extension. This extension can inject scripts or HTML into privileged pages, potentially compromising confidentiality, integrity, and availability. Exploitation requires user interaction but no privileges or authentication. No known exploits exist in the wild. The vulnerability has a CVSS score of 8.8, indicating significant risk.