Google Software and search
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in any Google product.
RSS Feeds for Google security vulnerabilities
Create a CVE RSS feed including security vulnerabilities found in Google products with stack.watch. Just hit watch, then grab your custom RSS feed url.
Products by Google Sorted by Most Security Vulnerabilities since 2018
Recent Google Security Advisories
| Advisory | Title | Published |
|---|---|---|
| 2026-10-14 | Chrome Releases: Stable Channel Update for Desktop (version 155.0.8059.79) | October 14, 2026 |
| 2026-10-14 | Chrome Releases: Chrome for Android Update (version 155) | October 14, 2026 |
| 2026-10-13 | Chrome Releases: Chrome Stable for iOS Update (version 156) | October 13, 2026 |
| 2026-10-11 | Chrome Releases: Stable Channel Update for ChromeOS / ChromeOS Flex | October 11, 2026 |
| 2026-10-07 | Chrome Releases: Chrome for Android Update (version 155) | October 7, 2026 |
| 2026-10-06 | Chrome Releases: Chrome Stable for iOS Update (version 155) | October 6, 2026 |
| 2026-10-06 | Chrome Releases: Stable Channel Update for Desktop (version 155.0.8059.39) | October 6, 2026 |
| 2026-10-02 | Chrome Releases: October 2026 | October 2, 2026 |
| 2026-10-02 | Chrome Releases: Chrome Stable for iOS Update (version 155) | October 2, 2026 |
| 2026-10-02 | Chrome Releases: Chrome for Android Update (version 154) | October 2, 2026 |
Known Exploited Google Vulnerabilities
The following Google vulnerabilities have recently been marked by CISA as Known to be Exploited by threat actors.
| Title | Description | Added |
|---|---|---|
| Google Pixel Improper Authorization Vulnerability |
Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges. CVE-2026-58704 |
September 16, 2026 |
| Google Chromium V8 Out of Bounds Write Vulnerability |
Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2026-87491 |
September 9, 2026 |
| Google Chromium V8 Type Confusion Vulnerability |
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2026-85046 |
September 4, 2026 |
| Google Chromium V8 Out-of-Bounds Read and Write Vulnerability |
Google Chromium V8 out-of-bounds read and write vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2026-11645 Exploit Probability: 2.2% |
June 9, 2026 |
| Google Dawn Use-After-Free Vulnerability |
Google Dawn contains an use-after-free vulnerability that could allow a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. This vulnerability could affect multiple Chromium-based products including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2026-5281 Exploit Probability: 5.5% |
April 1, 2026 |
| Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerabi |
Google Chromium V8 contains an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2026-3910 Exploit Probability: 2.0% |
March 13, 2026 |
| Google Skia Out-of-Bounds Write Vulnerability |
Google Skia contains an out-of-bounds write vulnerability that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products. CVE-2026-3909 Exploit Probability: 1.6% |
March 13, 2026 |
| Google Chromium CSS Use-After-Free Vulnerability |
Google Chromium CSS contains a use-after-free vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2026-2441 Exploit Probability: 22.0% |
February 17, 2026 |
| Google Chromium Out of Bounds Memory Access Vulnerability |
Google Chromium contains an out of bounds memory access vulnerability in ANGLE that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2025-14174 Exploit Probability: 22.3% |
December 12, 2025 |
| Google Chromium V8 Type Confusion Vulnerability |
Google Chromium V8 contains a type confusion vulnerability that allows for heap corruption. CVE-2025-13223 Exploit Probability: 5.0% |
November 19, 2025 |
| Google Chromium V8 Type Confusion Vulnerability |
Google Chromium contains a type confusion vulnerability in the V8 JavaScript and WebAssembly engine. CVE-2025-10585 Exploit Probability: 5.4% |
September 23, 2025 |
| Google Chromium ANGLE and GPU Improper Input Validation Vulnerability |
Google Chromium contains an improper input validation vulnerability in ANGLE and GPU. This vulnerability could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2025-6558 Exploit Probability: 9.6% |
July 22, 2025 |
| Google Chromium V8 Type Confusion Vulnerability |
Google Chromium V8 contains a type confusion vulnerability that could allow a remote attacker to perform arbitrary read/write via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2025-6554 Exploit Probability: 12.6% |
July 2, 2025 |
| Google Chromium V8 Out-of-Bounds Read and Write Vulnerability |
Google Chromium V8 contains an out-of-bounds read and write vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2025-5419 Exploit Probability: 7.8% |
June 5, 2025 |
| Google Chromium Loader Insufficient Policy Enforcement Vulnerability |
Google Chromium contains an insufficient policy enforcement vulnerability that allows a remote attacker to leak cross-origin data via a crafted HTML page. CVE-2025-4664 Exploit Probability: 5.6% |
May 15, 2025 |
| Google Chromium Mojo Sandbox Escape Vulnerability |
Google Chromium Mojo on Windows contains a sandbox escape vulnerability caused by a logic error, which results from an incorrect handle being provided in unspecified circumstances. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2025-2783 Exploit Probability: 9.2% |
March 27, 2025 |
| Google Chromium V8 Inappropriate Implementation Vulnerability |
Google Chromium V8 contains an inappropriate implementation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2024-7965 Exploit Probability: 18.5% |
August 28, 2024 |
| Google Chromium V8 Type Confusion Vulnerability |
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2024-7971 Exploit Probability: 21.1% |
August 26, 2024 |
| Google Chromium V8 Type Confusion Vulnerability |
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2024-5274 Exploit Probability: 7.5% |
May 28, 2024 |
| Google Chromium V8 Type Confusion Vulnerability |
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. CVE-2024-4947 Exploit Probability: 15.2% |
May 20, 2024 |
8 known exploited Google vulnerabilities are in the top 5% (95th percentile or greater) of the EPSS exploit probability rankings.
Top 10 Riskiest Google Vulnerabilities
Based on the current exploit probability, these Google vulnerabilities are on CISA's Known Exploited vulnerabilities list (KEV) and are ranked by the current EPSS exploit probability.
| Rank | CVE | EPSS | Vulnerability |
|---|---|---|---|
| 1 | CVE-2023-4863 | 100.0% | Google Chromium Heap-Based Buffer Overflow Vulnerability |
| 2 | CVE-2018-17463 | 84.6% | Google Chromium V8 Remote Code Execution Vulnerability |
| 3 | CVE-2021-21224 | 84.2% | Chromium V8 JavaScript Engine Remote Code Execution Vulnerability |
| 4 | CVE-2020-6418 | 78.8% | Chromium V8 Type Confusion Vulnerability |
| 5 | CVE-2021-21220 | 70.4% | Chromium V8 Input Validation Vulnerability |
| 6 | CVE-2021-30551 | 64.7% | Chromium V8 Type Confusion Vulnerability |
| 7 | CVE-2020-15999 | 63.9% | Google Chrome FreeType Memory Corruption |
| 8 | CVE-2021-30632 | 63.2% | Google Chrome Out-of-bounds write |
| 9 | CVE-2019-5786 | 61.1% | Google Chrome Use-After-Free Vulnerability |
| 10 | CVE-2018-6065 | 60.3% | Google Chromium V8 Integer Overflow Vulnerability |
By the Year
In 2026 there have been 3575 vulnerabilities in Google with an average score of 7.0 out of ten. Last year, in 2025 Google had 720 security vulnerabilities published. That is, 2855 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.13
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 3575 | 7.04 |
| 2025 | 720 | 7.17 |
| 2024 | 1125 | 7.29 |
| 2023 | 1564 | 6.66 |
| 2022 | 1592 | 6.85 |
| 2021 | 1166 | 7.11 |
| 2020 | 1033 | 6.88 |
| 2019 | 858 | 7.33 |
| 2018 | 571 | 7.43 |
It may take a day or so for new Google vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Google Security Vulnerabilities
| CVE | Date | Vulnerability | Products |
|---|---|---|---|
| CVE-2026-85298 | Oct 14, 2026 |
Privilege Escalation via AuthConfig in Google Cloud App IntegrationAn Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration versions prior to 2026-08-27 allows an authenticated user to escalate privileges and impersonate a service account in the project. This vulnerability was patched on 27 August 2026, and no customer action is needed. |
|
| CVE-2026-95702 | Oct 09, 2026 |
Use-after-free in Google gVisor VFS before 20260831.0 (double-free MemoryFile)Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard container privileges to achieve code execution in the host sentry process by double-freeing the backing MemoryFile from an in-sandbox overlay filesystem. The sentry process remains confined by host-level Linux seccomp and namespace boundaries. |
Gvisor
|
| CVE-2026-56952 | Oct 06, 2026 |
Android platform_msg_handler_init LPE via missing permission checkIn platform_msg_handler_init of default_msg_handlers.c, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-56936 | Oct 06, 2026 |
Out-of-Bounds Write in Wacom HID Driver Enables Physical Privilege EscalationIn wacom_hid_set_device_mode of wacom_sys.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-56906 | Oct 06, 2026 |
UAF in eventpoll.c allows local privilege escalationIn ep_free of eventpoll.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-55330 | Oct 06, 2026 |
Android Bluetooth UAF RCE via bluetooth_ccc.ccIn BluetoothCccHandlerCallbackImpl of bluetooth_ccc.cc, there is a possible use-after-free due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-55307 | Oct 06, 2026 |
HWCrypto KDN Local Info Disclosure via Prot Logic ErrorIn kdn_set_sysregs_prot of hwcrypto-kdn.c, there is a possible information disclosure due to a logic error in the code. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-0198 | Oct 06, 2026 |
Android gem_msg.c Permission Bypass (CVE-2026-0198)In is_pd_allowed of gem_msg.c, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-28648 | Oct 05, 2026 |
Android Settings Permission Bypass Confused Deputy Local Priv EscalationIn Settings, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-28647 | Oct 05, 2026 |
Android DeviceAdminApps PrivEsc via Permission BypassIn updateState of DeviceAdminAppsPreferenceController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-28641 | Oct 05, 2026 |
Android Local Escalation via Permission Bypass in ApplicationActionButtonsPrefIn shouldDisableUninstallButton of ApplicationActionButtonsPreferenceController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-28640 | Oct 05, 2026 |
Android Credential Storage Improper Input Permission BypassIn checkCallerIsCertInstallerOrSelfInProfile of CredentialStorageActivity.java, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-28625 | Oct 05, 2026 |
Android Permission Bypass: Local Priv Escalation (CVE-2026-28625)In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-58880 | Oct 05, 2026 |
Android btif_rc Race Condition Enables Local PrivEscIn handle_app_val_response of btif_rc.cc, there is a possible way to achieve code execution due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-58865 | Oct 05, 2026 |
Android Telephony PduParser DoS via Missing Bounds CheckIn multiple functions of PduParser.java, there is a possible persistent denial of service due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-58859 | Oct 05, 2026 |
Android: Potential DoS via Uncaught Exception, Enables Local Priv EscalationIn multiple places, there is a possible denial of service due to an uncaught exception. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-58856 | Oct 05, 2026 |
Android Camera3StreamSplitter OOB Read in Camera3StreamSplitter.cppIn returnOutputBufferLocked of DeprecatedCamera3StreamSplitter.cpp, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-58854 | Oct 05, 2026 |
Android OS Memory Corruption via Type Confusion Enables Local Priv EscalationIn multiple locations, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-58841 | Oct 05, 2026 |
Android VirtualAudio Controller Local Priv Esc via Permission BypassIn multiple functions of VirtualAudioControllerTest.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-58835 | Oct 05, 2026 |
Android BT Service Heap Buffer Overflow in cfg2propIn cfg2prop of btif_storage.cc, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-58834 | Oct 05, 2026 |
Android DPMService DoS via Input ValidationIn setPermissionGrantState of DevicePolicyManagerService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-58815 | Oct 05, 2026 |
Android OOB Write in System Library Enables Local Priv EscalationIn multiple locations, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-55286 | Oct 05, 2026 |
Android stpropnci OOB Write Enables Local Priv EscalationIn stpropnci_process of stpropnci.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-55280 | Oct 05, 2026 |
Android OOB Write in uninitialized data, remote privilege escalationIn multiple locations, there is a possible out-of-bounds write due to uninitialized data. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-55270 | Oct 05, 2026 |
Android dialInternal Confused Deputy PrivEscIn dialInternal in multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-55269 | Oct 05, 2026 |
Local Priv Escalation via Buffer Overflow in Android snoop_loggerIn FilterCapturedPacket of snoop_logger.cc, there is a possible memory safety issue due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-55266 | Oct 05, 2026 |
OOBW in libufdt qsort (Android) local privilege escalationIn qsort of libufdt_sysdeps_vendor.c, there is a possible out-of-bounds write due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-55265 | Oct 05, 2026 |
Android PduParser.java OOB Read Remote DoSIn multiple functions of PduParser.java, there is a possible out of bounds read due to a missing bounds check. This could lead to a remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-49937 | Oct 05, 2026 |
Android MessageQueueBase.h OOB Read Enables Local Priv EscalationIn multiple functions of MessageQueueBase.h, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-49933 | Oct 05, 2026 |
Android Bluetooth Privileged Process Control-Flow Hijack via Uninitialized PointerIn handle_le_monitor_device_event of msft.cc, there is a possible control-flow hijack in the privileged bluetooth process due to an uninitialized pointer dereference. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-49885 | Oct 05, 2026 |
Android NFC rw_t4t OOB Write via Integer OverflowIn rw_t4t_update_file of rw_t4t.cc, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-49880 | Oct 05, 2026 |
Android OOB Write in nfa_nfcee_act.cc for Priv EscIn multiple functions of nfa_nfcee_act.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-49878 | Oct 05, 2026 |
Android wpa_supplicant OOB Write in robust_av.c Enables RCEIn wpas_handle_robust_av_scs_recv_action of robust_av.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote code execution with System execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-45524 | Oct 05, 2026 |
Android WifiPermissionsUtil Sandbox Escape - Priv EscalationIn isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-28667 | Oct 05, 2026 |
Android OOB Read in rw_t5t.cc Leads to Local Info DisclosureIn multiple functions of rw_t5t.cc, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-95305 | Sep 29, 2026 |
Google Chrome Chromoting UI Spoofing before 154.0.8037.57UI misrepresentation in Chromoting in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-95340 | Sep 29, 2026 |
Chrome <154.0.8037.57: PIP Auth Bypass Web Origin Policy (CVE-2026-95340)Incorrect authorization in PictureInPicture in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-95364 | Sep 29, 2026 |
Google Chrome <154.0.8037.57 Passwords Input Validation SpoofImproper input validation in Passwords in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-95328 | Sep 29, 2026 |
Google Chrome Android <154.0.8037.57: Confused Deputy via Coinstalled AppConfused deputy in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-95316 | Sep 29, 2026 |
Local Mem Read via Unchecked Return Value in Chrome <154.0.8037.57Unchecked return value in Performance in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially read memory via a local program. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-95380 | Sep 29, 2026 |
Type Confusion in V8 of Chrome v<154.0.8037.57: RCE via HTMLType confusion in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-95342 | Sep 29, 2026 |
Missing Auth in Chrome V8 <154.0.8037.57 Allowing Remote Web Origin BypassMissing authorization in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-95288 | Sep 29, 2026 |
UI Spoof via Crafted HTML in Chrome iOS <154.0.8037.57UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-95296 | Sep 29, 2026 |
Chrome Core Mac auth flaw before 154.0.8037.57 cross-origin data leakMissing authorization in Core in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-95361 | Sep 29, 2026 |
Confused Deputy in DevTools (Chrome <154.0.8037.57)Confused deputy in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-95326 | Sep 29, 2026 |
Google Chrome 154.0.8037.57 Bluetooth cleanup flaw bypasses restrictionsIncomplete cleanup in Bluetooth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-95319 | Sep 29, 2026 |
Chrome <154.0.8037.57: UAF in Printing, remote code exec riskUse after free in Printing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-95309 | Sep 29, 2026 |
Google Chrome Mobile iOS <154.0.8037.57 UI Spoofing via Crafted HTMLUI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-95385 | Sep 29, 2026 |
Chrome Windows <154.0.8037.57 PlatformIntegration Bypass via Crafted HTMLInappropriate implementation in PlatformIntegration in Google Chrome on on Windows prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-95352 | Sep 29, 2026 |
DevTools Auth Bypass in Chrome <154.0.8037.57 via ExtensionIncorrect authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low) |
Chrome
|