Threats affecting pkg:rpm/google/chrome

Incorrect authorization in GPU in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87479 is a high-severity vulnerability in Google Chrome prior to version 153.0.8010.36. It involves insufficient policy enforcement in Chrome Extensions, which could allow a remote attacker who has compromised the renderer process and used social engineering to execute arbitrary code outside the sandbox via a crafted HTML page.

A missing authorization vulnerability in the Omnibox component of Google Chrome prior to version 153.0.8010.36 allows a remote attacker to bypass system access restrictions and access privileged pages via a crafted HTML page. The vulnerability requires user interaction through social engineering and has been rated medium severity.

Missing authorization in Actor in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87582 is a high severity confused deputy vulnerability in Google Chrome's DataTransfer component prior to version 153.0.8010.36. It allows a remote attacker who has compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. The vulnerability affects Chrome versions before 153.0.8010.36. A fix is available as indicated by the vendor advisory.

A missing authorization vulnerability in Google Chrome Extensions prior to version 153.0.8010.36 allows a remote attacker who has compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network traffic. This vulnerability has a high severity rating with a CVSS score of 8.1. A fix is available in version 153.0.8010.36.

CVE-2026-87547 is a critical vulnerability in Google Chrome prior to version 153.0.8010.36 involving incorrect reference resolution in the FileSystem component. It allows a remote attacker, through social engineering and a crafted HTML page, to potentially execute arbitrary code outside the browser sandbox. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability. Google has published an advisory with a stable channel update addressing this issue.

CVE-2026-87553 is a high severity vulnerability in Google Chrome's SiteIsolation feature prior to version 153.0.8010.36. It involves improper input validation that could allow a remote attacker who has compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. This vulnerability affects desktop versions of Chrome before 153.0.8010.36 and has a CVSS score of 8.3.

Uninitialized resource in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Missing authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

Observable discrepancy in Autofill in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

Use after free in Web Authentication in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Out of bounds read in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-87447 is a vulnerability in Google Chrome prior to version 153.0.8010.36 involving incorrect authorization in the Network component. This flaw allows a remote attacker, using social engineering and a crafted Chrome extension, to bypass the web origin policy. The vulnerability has a medium severity rating with a CVSS score of 6.5. It affects versions before 153.0.8010.36. A vendor advisory is available from Google, but explicit patch details are not provided in the input data.

CVE-2026-87438 is a critical out-of-bounds write vulnerability in the WebGL component of Google Chrome on Android. It affects versions prior to 153.0.8010.36 and allows a remote attacker to execute arbitrary code outside the browser sandbox via a crafted HTML page. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability.

CVE-2026-76023 is a high-severity vulnerability in Google Chrome affecting versions prior to 151.0.7922.173. It involves improper resource control in the Linux Toolkit Theming component, allowing a remote attacker who has compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page.

CVE-2026-76019 is a high severity vulnerability in Google Chrome prior to version 151.0.7922.173. It involves incorrect authorization in the Workers component, allowing a remote attacker who has compromised the renderer process and used social engineering to bypass the web origin policy via a crafted HTML page.

CVE-2026-76042 is a vulnerability in Google Chrome prior to version 151.0.7922.169 involving the use of an uninitialized GPU resource. This flaw could allow a remote attacker who has compromised the renderer process to read memory outside the sandbox by using a specially crafted HTML page. The issue has a low CVSS score of 3.1 and is rated low severity by Chromium security. A fix is available as indicated by the vendor advisory.

A critical buffer overflow vulnerability exists in the WebGL component of Google Chrome versions prior to 151.0.7922.169. This flaw allows a remote attacker to execute arbitrary code outside the browser sandbox by delivering a specially crafted HTML page. The vulnerability has a high CVSS score of 8.8, indicating significant potential impact on confidentiality, integrity, and availability.