Search: 20.chromium

Information leak in Core in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)

Improper input validation in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy into a privileged page via crafted network traffic. (Chromium security severity: Low)

Information leak in Core in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted Chrome extension. (Chromium security severity: Low)

Incorrect authorization in FileHandling in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

Information leak in Transactions Platform in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

Race condition in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Clickjacking in Input in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

Incorrect type conversion or cast in Safebrowsing in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted file. (Chromium security severity: Low)

Incorrect authorization in Certificate in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to potentially spoof address bar via crafted network traffic. (Chromium security severity: Low)

Observable discrepancy in Select in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

A confused deputy vulnerability in the Fullscreen feature of Google Chrome prior to version 153.0.8010.36 allows a remote attacker who has compromised the renderer process to spoof UI elements via a crafted HTML page using social engineering techniques. The vulnerability has a low security severity rating by Chromium and a CVSS score of 4.2 (medium severity).

A vulnerability in Google Chrome prior to version 153.0.8010.36 allows a remote attacker to obtain sensitive information through an observable discrepancy in SVG rendering. The issue is classified as low severity by Chromium but has a CVSS score of 6.5, indicating a medium severity level. The vulnerability requires user interaction and does not allow modification or disruption of data or availability.

Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-87568 is an improper input validation vulnerability in Chromium used by Google Chrome versions prior to 153.0.8010.36. It allows a remote attacker who has compromised the renderer process to spoof UI elements via crafted network traffic. The vulnerability has a medium severity rating with a CVSS score of 4.8. A fix is available in Chrome version 153.0.8010.36.

A missing authorization vulnerability in Google Chrome's core prior to version 153.0.8010.36 allows a remote attacker who has compromised the renderer process to bypass site isolation using a crafted HTML page. The issue has a low security severity rating from Chromium and a CVSS score of 4.3, indicating medium severity.

A vulnerability in Google Chrome's Web Authentication prior to version 153.0.8010.36 allows a remote attacker to bypass the web origin policy via a crafted Chrome extension. The issue is classified as incorrect authorization with a low security severity by Chromium. The vulnerability has been fixed in version 153.0.8010.36.

Incorrect reference resolution in Storage in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Use after free in WebPackaging in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Use after free in Sharing in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)