Search: 20.chromium

Integer overflow in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Input in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Workers in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Use after free in Internals in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Out of bounds read in WebGL in Google Chrome on on Android prior to 153.0.8010.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.

A critical vulnerability (CVE-2026-51990) in Tencent's Sogou Input Method for Windows has been exploited by the Chinese threat group UNC3569 to achieve system-level code execution via a crafted URL. The flaw involves unvalidated command-line argument injection, unrestricted URL navigation, and an outdated Chromium browser engine with disabled sandboxing. The exploit enables deployment of the GrayRabbit backdoor, which provides extensive remote control capabilities. Tencent released a patch in version 16.3.0.3498 that addresses the URL parameter validation but did not update the underlying Chromium configuration. The vulnerability has been actively exploited in the wild.

A critical remote code execution vulnerability (CVE-2026-51990) in Tencent's Sogou Input Method for Windows is actively exploited by the UNC3569 threat group to deploy the GrayRabbit backdoor malware. The attack chain abuses a custom URI handler, an unrestricted URL navigation in an embedded Chromium webview, and a known flaw in an outdated Chromium 80 engine running without sandboxing. Tencent released a patch in version 16.3.0.3498 that validates URL arguments and restricts navigation to approved domains, but the underlying Chromium engine remains outdated and unsandboxed.

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.

The BlueMoon exploit kit is a modular tool used by multiple cyber-espionage groups to chain zero-day vulnerabilities in Microsoft Windows and Google Chrome. It combines two Chromium-based browser flaws allowing remote code execution and sandbox escape with a Windows kernel local privilege escalation. Observed since August 2026, BlueMoon has been deployed by Chinese state-sponsored actors targeting NGOs, aerospace, defense, and manufacturing sectors. The kit exploits delays in Chrome stable releases to weaponize recent Chromium fixes. It executes payloads by elevating Chrome renderer privileges and injecting commands to download and run malware loaders.

A UI misrepresentation vulnerability exists in the FullScreen mode of Google Chrome on Windows versions prior to 153.0.8010.36. This flaw allows a remote attacker to spoof UI elements by crafting a malicious HTML page. The issue is classified with low severity by Chromium security. No known exploits are reported in the wild, and no patch information is provided in the source data.

A use-after-free vulnerability exists in the V8 JavaScript engine of Google Chrome versions prior to 153.0.8010.36. This vulnerability allows a remote attacker who has already compromised the renderer process to read memory within the sandbox by delivering a crafted HTML page. The issue is classified as medium severity by Chromium security. There are no known exploits in the wild and no explicit patch information provided in the source data.

An incorrect authorization vulnerability exists in the PushAPI component of Google Chrome versions prior to 153.0.8010.36. This flaw allows a remote attacker who has already compromised the renderer process to bypass the web origin policy by using a crafted HTML page. The vulnerability is classified with medium severity by Chromium security. No patch information is provided in the available data.

A vulnerability in the Paint component of Google Chrome prior to version 153.0.8010.36 allows a remote attacker to bypass authorization controls and obtain cross-origin data via a crafted HTML page. This issue is classified as an incorrect authorization flaw (CWE-863) and has been assigned CVE-2026-87651. The vulnerability is considered high severity by the Chromium security team. No CVSS score or detailed vendor advisory is currently available, and no known exploits are reported in the wild.

An information leak vulnerability exists in Google Chrome extensions prior to version 153.0.8010.36. This flaw allows a remote attacker, using social engineering techniques, to obtain cross-origin data through a specially crafted Chrome extension. The vulnerability is classified with medium severity by Chromium security. No CVSS score or patch information is currently provided.

An integer overflow vulnerability exists in the WebRTC component of Google Chrome versions prior to 153.0.8010.36. This flaw allows a remote attacker to read memory inside the browser's sandbox by delivering a specially crafted HTML page. The vulnerability is classified with medium severity by Chromium security. No information about patches or exploits in the wild is currently available.

Interpretation conflict in Safebrowsing in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted file. (Chromium security severity: Low)