Search: 20.chromium

An incorrect authorization vulnerability in the Sources component of Google Chrome prior to version 153.0.8010.36 allows a remote attacker to leak sensitive information by tricking a user into visiting a crafted HTML page. The issue is classified with low severity by Chromium security. No CVSS score or patch information is provided in the available data.

A cross-site scripting (XSS) vulnerability exists in the SanitizerAPI component of Google Chrome versions prior to 153.0.8010.36. This flaw allows a remote attacker to bypass the web origin policy by crafting a malicious HTML page. The vulnerability is classified with medium severity by Chromium security. No CVSS score or patch information is currently provided.

Incorrect authorization in DeviceBoundSessionCredentials in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via crafted network traffic. (Chromium security severity: Medium)

A missing authorization vulnerability in the DOM of Google Chrome versions prior to 153.0.8010.36 could allow a remote attacker to potentially leak sensitive information by crafting a malicious HTML page. The vulnerability is classified with low severity by the Chromium security team. No CVSS score or detailed impact information is provided. There is no indication of known exploits in the wild. No patch or remediation details are available in the provided data.

A UI misrepresentation vulnerability exists in the Payments component of Google Chrome versions prior to 153.0.8010.36. This flaw allows a remote attacker to spoof UI elements by crafting a malicious HTML page. The issue is classified under CWE-451 and has been assigned CVE-2026-87635. The Chromium project rates the severity of this vulnerability as Medium. There is no CVSS score available, and no known exploits in the wild have been reported. No explicit patch or remediation information is provided in the available data.

A missing authorization vulnerability in the Federated Credential Management (FedCM) feature of Google Chrome versions prior to 153.0.8010.36 allows a remote attacker to bypass the web origin policy by using a crafted HTML page. This issue is classified with medium severity by Chromium security. No CVSS score or patch information is currently provided.

A UI misrepresentation vulnerability exists in the Passwords component of Google Chrome on Android versions prior to 153.0.8010.36. This flaw allows a remote attacker who has compromised the renderer process to spoof UI elements by crafting a malicious HTML page. The vulnerability is classified with low severity by Chromium security. No CVSS score or known exploits in the wild have been reported.

A vulnerability in Google Chrome's WebGL implementation prior to version 153.0.8010.36 allows a remote attacker to leak cross-origin data by exploiting an uninitialized resource. This issue could be triggered via a crafted HTML page. The Chromium project has assigned a medium severity level to this security flaw.

Out of bounds read in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

UI misrepresentation in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

A race condition vulnerability in the Browser component of Google Chrome versions prior to 153.0.8010.36 allows a remote attacker to bypass system access restrictions by delivering a crafted HTML page. The vulnerability is rated medium severity by Chromium security. No public exploits or patches are currently known.

An incorrect authorization vulnerability exists in the ServiceWorker component of Google Chrome versions prior to 153.0.8010.36. This flaw allows a remote attacker who has already compromised the renderer process to bypass the web origin policy by using a crafted HTML page. The Chromium security team has rated the severity of this issue as low.

A vulnerability in Google Chrome prior to version 153.0.8010.36 allows remote attackers to spoof user interface elements by exploiting improper input validation in interstitial pages. This flaw could enable attackers to craft HTML pages that mislead users by displaying deceptive UI components. The issue is classified with medium severity by Chromium security.

Incorrect authorization in Omnibox in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Medium)

An observable discrepancy in the Prefetch feature of Google Chrome versions prior to 153.0.8010.36 could allow a remote attacker to leak cross-origin data via a crafted HTML page. The issue is classified with low severity by Chromium security. No exploit in the wild has been reported, and no patch information is provided in the available data.

A race condition vulnerability exists in the Payments component of Google Chrome versions prior to 153.0.8010.36. This flaw allows a remote attacker, using social engineering techniques and a crafted HTML page, to spoof user interface elements. The Chromium security team has rated this vulnerability as medium severity. No CVSS score or known exploits in the wild have been reported. No explicit affected versions were provided beyond the version fixed in 153.0.8010.36.

An out-of-bounds read vulnerability exists in the ANGLE component of Google Chrome on Windows versions prior to 153.0.8010.36. This flaw could allow a remote attacker to read memory outside the sandbox by crafting a malicious HTML page. The Chromium project has assigned this issue a low security severity rating.

A missing authorization vulnerability in the FileSystem component of Google Chrome prior to version 153.0.8010.36 allows a remote attacker who has compromised the renderer process to access cross-origin data via a crafted HTML page. This vulnerability is classified with medium severity by Chromium security. No CVSS score or patch information is currently available.

Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

Improper certificate validation in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: Low)