Threats affecting pkg:deb/google/chrome

An incorrect authorization vulnerability in the Isolated feature of Google Chrome prior to version 153.0.8010.36 allows a remote attacker to bypass the web origin policy and access a privileged page via a crafted HTML page. This vulnerability has been assigned CVE-2026-87577 and is rated with medium severity by Chromium security. No patch information is currently available.

An information leak vulnerability exists in the Cross-Origin Resource Sharing (CORS) implementation in Google Chrome versions prior to 153.0.8010.36. This flaw allows a remote attacker who has already compromised the renderer process to obtain cross-origin data by using a crafted HTML page. The vulnerability is rated with medium severity by Chromium security. No specific affected versions or patch information is provided in the input data.

A missing authorization vulnerability in the DevTools component of Google Chrome versions prior to 153.0.8010.36 allows a remote attacker to obtain cross-origin data via a crafted Chrome extension. The vulnerability is classified as low severity by Chromium security, with no known exploits in the wild and no CVSS score assigned. The vendor advisory status and patch availability are not confirmed.

An observable discrepancy in navigation behavior in Google Chrome versions prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data by using a crafted HTML page. This vulnerability is classified with medium severity by Chromium security. No CVSS score or detailed exploit information is available. There is no explicit patch information provided in the source data.

An incomplete cleanup vulnerability in Google Chrome extensions prior to version 153.0.8010.36 allows a remote attacker to bypass system access restrictions via a crafted extension leveraging social engineering. The issue has a medium severity rating and does not impact confidentiality or availability but can impact integrity.

Incorrect authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Low)

Race condition in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Incorrect authorization in FileHandling in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

Observable discrepancy in Select in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

A vulnerability in Google Chrome prior to version 153.0.8010.36 allows a remote attacker to obtain sensitive information through an observable discrepancy in SVG rendering. The issue is classified as low severity by Chromium but has a CVSS score of 6.5, indicating a medium severity level. The vulnerability requires user interaction and does not allow modification or disruption of data or availability.

Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-87623 is a medium severity vulnerability in Google Chrome prior to version 153.0.8010.36. It involves an observable discrepancy in the Document Object Model (DOM) that could be exploited by a remote attacker using social engineering via a crafted HTML page to obtain sensitive information. The vulnerability does not allow integrity or availability impacts but can lead to confidentiality breaches.

CVE-2026-87468 is a medium severity vulnerability in Google Chrome prior to version 153.0.8010.36. It involves incorrect authorization in the Isolated feature, allowing a remote attacker to bypass site isolation by using a crafted HTML page. This flaw could lead to integrity impacts but does not affect confidentiality or availability.

A missing authorization vulnerability in the FileSystem component of Google Chrome prior to version 153.0.8010.36 allows a remote attacker to bypass system access restrictions via a crafted HTML page, leveraging social engineering. The vulnerability has a medium severity rating.

A missing authorization vulnerability in Google Chrome extensions prior to version 153.0.8010.36 allows a remote attacker to obtain sensitive information by using a crafted Chrome extension. The vulnerability has been assigned CVE-2026-87431 and is rated with a high severity CVSS score of 7.5. This issue affects Chrome versions before 153.0.8010.36. Google has released an update to address this vulnerability.

UI misrepresentation in Geometry in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

A medium severity vulnerability (CVE-2026-87594) in Google Chrome prior to version 153.0.8010.36 involves incorrect authorization in the DataTransfer component. This flaw allows a remote attacker who has compromised the renderer process to access sensitive information via a crafted HTML page. The vulnerability has a CVSS score of 5.3 and affects versions before 153.0.8010.36. Google has released a stable channel update addressing this issue.

CVE-2026-87532 is a medium severity vulnerability in Google Chrome's Safebrowsing feature prior to version 153.0.8010.36. It involves improper state validation that allows a remote attacker to bypass system access restrictions via a crafted HTML page. The vulnerability does not impact confidentiality or availability but can cause integrity issues. No known exploits are reported in the wild. A vendor advisory is available but does not explicitly confirm patch status.

CVE-2026-87549 is a medium severity vulnerability in Google Chrome prior to version 153.0.8010.36. It involves incomplete cleanup in the Downloads component, which allows a remote attacker to bypass system access restrictions through a crafted HTML page leveraging social engineering. The vulnerability requires user interaction and does not impact confidentiality or availability but can cause integrity issues.

UI misrepresentation in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)