Threat Intelligence Database

A use-after-free vulnerability exists in the V8 JavaScript engine of Google Chrome versions prior to 153.0.8010.36. This flaw allows a remote attacker, who has already compromised the renderer process, to read memory inside the sandbox by delivering a crafted HTML page. The vulnerability is rated with medium severity by Chromium security. No known exploits are reported in the wild at this time.

CVE-2026-87655 is a clickjacking vulnerability in the Downloads feature of Google Chrome versions prior to 153.0.8010.36. It allows a remote attacker to use social engineering to spoof user interface elements through a crafted HTML page. The vulnerability has been assigned a medium severity by Chromium security. A stable channel update addressing this issue is available from Google.

A buffer overflow vulnerability exists in the ANGLE component of Google Chrome on Windows platforms prior to version 153.0.8010.36. This flaw allows a remote attacker to execute arbitrary code outside the sandbox by delivering a crafted HTML page. The vulnerability is rated with high severity by Chromium security. A vendor advisory is available but does not explicitly confirm patch status or remediation details.

A UI misrepresentation vulnerability exists in Google Chrome on Windows platforms prior to version 153.0.8010.36. This flaw allows a remote attacker to spoof UI elements when the browser is in FullScreen mode via a crafted HTML page. The issue has been assigned a low severity rating by Chromium security. No CVSS score is available for this vulnerability.

CVE-2026-87651 is a high-severity vulnerability in Google Chrome prior to version 153.0.8010.36. It involves incorrect authorization in the Paint component, which allows a remote attacker to obtain cross-origin data by crafting a malicious HTML page. This flaw compromises the browser's same-origin policy, potentially exposing sensitive information across different web origins. The vulnerability is addressed in Chrome version 153.0.8010.36.

A UI misrepresentation vulnerability exists in the Downloads feature of Google Chrome versions prior to 153.0.8010.36. This flaw allows a remote attacker to use a crafted HTML page and social engineering techniques to bypass system access restrictions. The vulnerability has been assigned a medium severity by Chromium security. No CVSS score is available. A vendor advisory link is provided but does not explicitly confirm patch status or remediation details.

A use-after-free vulnerability exists in the ANGLE component of Google Chrome on Windows versions prior to 153.0.8010.36. This flaw could allow a remote attacker who has compromised the renderer process to execute arbitrary code outside the sandbox by using a crafted HTML page. The vulnerability is rated medium severity by Chromium security. No confirmed exploits in the wild have been reported. A vendor advisory is available but does not explicitly state the patch status.

CVE-2026-87644 is a medium severity vulnerability in Google Chrome on Windows prior to version 153.0.8010.36. It involves incorrect authorization in Views that could allow a remote attacker who has compromised the renderer process and used social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. This vulnerability affects Chrome versions before 153.0.8010.36. No CVSS score is provided.

An integer overflow vulnerability exists in the GPU component of Google Chrome on Android versions prior to 153.0.8010.36. This flaw could allow a remote attacker to execute arbitrary code outside the sandbox by delivering a crafted HTML page. The vulnerability is rated with medium severity by Chromium security. There is no explicit patch status provided in the available data, and no known exploits in the wild have been reported.

A vulnerability in Google Chrome's WebGL implementation prior to version 153.0.8010.36 allows a remote attacker to leak cross-origin data by using a crafted HTML page. This issue is classified with medium severity by Chromium security. There is no explicit patch status provided, but a vendor advisory references a stable channel update. No known exploits in the wild have been reported.