Google Software and search
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in any Google product.
RSS Feeds for Google security vulnerabilities
Create a CVE RSS feed including security vulnerabilities found in Google products with stack.watch. Just hit watch, then grab your custom RSS feed url.
Products by Google Sorted by Most Security Vulnerabilities since 2018
Recent Google Security Advisories
| Advisory | Title | Published |
|---|---|---|
| 2026-11-11 | Chrome Releases: Stable Channel Update for Desktop (version 157.0.8103.50) | November 11, 2026 |
| 2026-11-11 | Chrome Releases: Chrome for Android Update (version 157) | November 11, 2026 |
| 2026-11-11 | Chrome Releases: Chrome Stable for iOS Update (version 158) | November 11, 2026 |
| 2026-11-06 | Chrome Releases: Chrome for Android Update (version 157) | November 6, 2026 |
| 2026-11-05 | Chrome Releases: November 2026 | November 5, 2026 |
| 2026-11-05 | Chrome Releases: Chrome for Android Update (version 157) | November 5, 2026 |
| 2026-11-03 | Chrome Releases: Stable Channel Update for Desktop (version 157) | November 3, 2026 |
| 2026-11-01 | Android Security Bulletin—November 2026 | November 1, 2026 |
| 2026-10-31 | Chrome Releases: Chrome for Android Update (version 156) | October 31, 2026 |
| 2026-10-31 | Chrome Releases: Stable Channel Update for Desktop (version 156.0.8078.79) | October 31, 2026 |
Known Exploited Google Vulnerabilities
The following Google vulnerabilities have recently been marked by CISA as Known to be Exploited by threat actors.
| Title | Description | Added |
|---|---|---|
| Google Chromium Use-After-Free Vulnerability |
Google Chromium contains a use-after-free vulnerability in the XML component that could allow a remote attacker to execute arbitrary code inside the sandbox via a specially crafted webpage. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2026-125350 |
November 10, 2026 |
| Google Brotli Unchecked Return Value Vulnerability |
Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. CVE-2026-111497 |
October 27, 2026 |
| Google Pixel Improper Authorization Vulnerability |
Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges. CVE-2026-58704 |
September 16, 2026 |
| Google Chromium V8 Out of Bounds Write Vulnerability |
Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2026-87491 |
September 9, 2026 |
| Google Chromium V8 Type Confusion Vulnerability |
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2026-85046 |
September 4, 2026 |
| Google Chromium V8 Out-of-Bounds Read and Write Vulnerability |
Google Chromium V8 out-of-bounds read and write vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2026-11645 Exploit Probability: 2.2% |
June 9, 2026 |
| Google Dawn Use-After-Free Vulnerability |
Google Dawn contains an use-after-free vulnerability that could allow a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. This vulnerability could affect multiple Chromium-based products including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2026-5281 Exploit Probability: 5.5% |
April 1, 2026 |
| Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerabi |
Google Chromium V8 contains an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2026-3910 Exploit Probability: 2.0% |
March 13, 2026 |
| Google Skia Out-of-Bounds Write Vulnerability |
Google Skia contains an out-of-bounds write vulnerability that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products. CVE-2026-3909 Exploit Probability: 1.6% |
March 13, 2026 |
| Google Chromium CSS Use-After-Free Vulnerability |
Google Chromium CSS contains a use-after-free vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2026-2441 Exploit Probability: 22.0% |
February 17, 2026 |
| Google Chromium Out of Bounds Memory Access Vulnerability |
Google Chromium contains an out of bounds memory access vulnerability in ANGLE that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2025-14174 Exploit Probability: 55.3% |
December 12, 2025 |
| Google Chromium V8 Type Confusion Vulnerability |
Google Chromium V8 contains a type confusion vulnerability that allows for heap corruption. CVE-2025-13223 Exploit Probability: 4.9% |
November 19, 2025 |
| Google Chromium V8 Type Confusion Vulnerability |
Google Chromium contains a type confusion vulnerability in the V8 JavaScript and WebAssembly engine. CVE-2025-10585 Exploit Probability: 9.0% |
September 23, 2025 |
| Google Chromium ANGLE and GPU Improper Input Validation Vulnerability |
Google Chromium contains an improper input validation vulnerability in ANGLE and GPU. This vulnerability could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2025-6558 Exploit Probability: 9.6% |
July 22, 2025 |
| Google Chromium V8 Type Confusion Vulnerability |
Google Chromium V8 contains a type confusion vulnerability that could allow a remote attacker to perform arbitrary read/write via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2025-6554 Exploit Probability: 12.6% |
July 2, 2025 |
| Google Chromium V8 Out-of-Bounds Read and Write Vulnerability |
Google Chromium V8 contains an out-of-bounds read and write vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2025-5419 Exploit Probability: 7.5% |
June 5, 2025 |
| Google Chromium Loader Insufficient Policy Enforcement Vulnerability |
Google Chromium contains an insufficient policy enforcement vulnerability that allows a remote attacker to leak cross-origin data via a crafted HTML page. CVE-2025-4664 Exploit Probability: 5.4% |
May 15, 2025 |
| Google Chromium Mojo Sandbox Escape Vulnerability |
Google Chromium Mojo on Windows contains a sandbox escape vulnerability caused by a logic error, which results from an incorrect handle being provided in unspecified circumstances. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2025-2783 Exploit Probability: 9.2% |
March 27, 2025 |
| Google Chromium V8 Inappropriate Implementation Vulnerability |
Google Chromium V8 contains an inappropriate implementation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2024-7965 Exploit Probability: 18.5% |
August 28, 2024 |
| Google Chromium V8 Type Confusion Vulnerability |
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2024-7971 Exploit Probability: 21.0% |
August 26, 2024 |
The vulnerability CVE-2025-14174: Google Chromium Out of Bounds Memory Access Vulnerability is in the top 1% of the currently known exploitable vulnerabilities. 7 known exploited Google vulnerabilities are in the top 5% (95th percentile or greater) of the EPSS exploit probability rankings.
Top 10 Riskiest Google Vulnerabilities
Based on the current exploit probability, these Google vulnerabilities are on CISA's Known Exploited vulnerabilities list (KEV) and are ranked by the current EPSS exploit probability.
| Rank | CVE | EPSS | Vulnerability |
|---|---|---|---|
| 1 | CVE-2023-4863 | 100.0% | Google Chromium Heap-Based Buffer Overflow Vulnerability |
| 2 | CVE-2018-17463 | 84.6% | Google Chromium V8 Remote Code Execution Vulnerability |
| 3 | CVE-2021-21224 | 84.2% | Chromium V8 JavaScript Engine Remote Code Execution Vulnerability |
| 4 | CVE-2020-6418 | 78.8% | Chromium V8 Type Confusion Vulnerability |
| 5 | CVE-2021-21220 | 70.4% | Chromium V8 Input Validation Vulnerability |
| 6 | CVE-2021-30551 | 64.7% | Chromium V8 Type Confusion Vulnerability |
| 7 | CVE-2020-15999 | 63.9% | Google Chrome FreeType Memory Corruption |
| 8 | CVE-2021-30632 | 63.2% | Google Chrome Out-of-bounds write |
| 9 | CVE-2019-5786 | 61.1% | Google Chrome Use-After-Free Vulnerability |
| 10 | CVE-2018-6065 | 60.3% | Google Chromium V8 Integer Overflow Vulnerability |
By the Year
In 2026 there have been 4714 vulnerabilities in Google with an average score of 7.2 out of ten. Last year, in 2025 Google had 730 security vulnerabilities published. That is, 3984 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.06.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 4714 | 7.19 |
| 2025 | 730 | 7.13 |
| 2024 | 1125 | 7.29 |
| 2023 | 1564 | 6.66 |
| 2022 | 1592 | 6.85 |
| 2021 | 1166 | 7.11 |
| 2020 | 1033 | 6.88 |
| 2019 | 858 | 7.33 |
| 2018 | 571 | 7.43 |
It may take a day or so for new Google vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Google Security Vulnerabilities
| CVE | Date | Vulnerability | Products |
|---|---|---|---|
| CVE-2026-95404 | Nov 10, 2026 |
In multiple locations, there is a possible way to modify coprocessor instruction and data memoryIn multiple locations, there is a possible way to modify coprocessor instruction and data memory from non-secure software due to an insecure default value. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-95399 | Nov 10, 2026 |
In multiple functions of face_status.hIn multiple functions of face_status.h, there is a possible way to modify verified biometric enrollment data in shared memory due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-59632 | Nov 10, 2026 |
In RespondReceivedMessage of MtsMessageController.cpp, there is a possible way to trigger memory exhaustionIn RespondReceivedMessage of MtsMessageController.cpp, there is a possible way to trigger memory exhaustion via an undrained message queue due to a type confusion. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-59623 | Nov 10, 2026 |
In CompareTelUris of SipAddress.cppIn CompareTelUris of SipAddress.cpp, there is a possible way to trigger an unhandled out of range exception and process crash due to an incorrect bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-59613 | Nov 10, 2026 |
In multiple locationsIn multiple locations, there is a possible way to trigger an out of bounds read and temporary denial of service due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-59611 | Nov 10, 2026 |
In multiple locations, there is a possible way to trigger a temporary denial of serviceIn multiple locations, there is a possible way to trigger a temporary denial of service via an integer overflow trap due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-59603 | Nov 10, 2026 |
In RespondReceivedMessage of MtsMessageController.cppIn RespondReceivedMessage of MtsMessageController.cpp, there is a possible way to trigger a double free and process abort during message retry handling due to a use after free. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-59595 | Nov 10, 2026 |
In DecodeHeaderComponent of SipStack.cpp, there is a possible way to trigger stack exhaustionIn DecodeHeaderComponent of SipStack.cpp, there is a possible way to trigger stack exhaustion via unbounded mutual recursion due to a resource exhaustion. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-59585 | Nov 10, 2026 |
In SetDisplayName of RegInfoContact.cpp, there is a possible denial of service due to a missing null checkIn SetDisplayName of RegInfoContact.cpp, there is a possible denial of service due to a missing null check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-59582 | Nov 10, 2026 |
In StartTimer of UcePublishManager.cppIn StartTimer of UcePublishManager.cpp, there is a possible way to trigger a process abort during timer calculation due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-58813 | Nov 10, 2026 |
In mmap of mman.c, there is a possible way to trigger an out of bounds read and writeIn mmap of mman.c, there is a possible way to trigger an out of bounds read and write via mapping size truncation due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-58809 | Nov 10, 2026 |
In smmu_domain_config_s1 of arm-smmu-v3.c, there is a possible OOB Write due to a missing bounds checkIn smmu_domain_config_s1 of arm-smmu-v3.c, there is a possible OOB Write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-58807 | Nov 10, 2026 |
In Retry_MtsMessageInPending of MtsMessageController.cpp, there is a possible way to trigger memory exhaustionIn Retry_MtsMessageInPending of MtsMessageController.cpp, there is a possible way to trigger memory exhaustion via leaked message objects due to a logic error. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-58789 | Nov 10, 2026 |
In s_gen_tile_param of multiple filesIn s_gen_tile_param of multiple files, there is a possible way to trigger an out of bounds write in tile parameter arrays due to an incorrect bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-58785 | Nov 10, 2026 |
In update_user_consent of main.rs, there is a possible elevation of privilege due to uninitialized dataIn update_user_consent of main.rs, there is a possible elevation of privilege due to uninitialized data. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-58781 | Nov 10, 2026 |
In HostLinkBase::chreIpiHandler of host_link.cc, there is a possible out-of-bounds write due to a missing bounds checkIn HostLinkBase::chreIpiHandler of host_link.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-58778 | Nov 10, 2026 |
In multiple locations, there is a possible use-after-free due to a race conditionIn multiple locations, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-58729 | Nov 10, 2026 |
In multiple files, there is a possible out-of-bounds write due to a missing bounds checkIn multiple files, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-58696 | Nov 10, 2026 |
In multiple locations, there is a possible out-of-bounds write due to a heap buffer overflowIn multiple locations, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-57013 | Nov 10, 2026 |
In access_control_enable of multiple files, there is a possible way to release secure coprocessors from resetIn access_control_enable of multiple files, there is a possible way to release secure coprocessors from reset via unclaimed firewall registers due to an insecure default value. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-56949 | Nov 10, 2026 |
In multiple locationsIn multiple locations, there is a possible way to modify authenticated coprocessor firmware in shared memory before loading due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-56911 | Nov 10, 2026 |
In handle_fips_hmac_req of hwcrypto_proxy.c, there is a possible heap buffer overflow due to missing bounds checkIn handle_fips_hmac_req of hwcrypto_proxy.c, there is a possible heap buffer overflow due to missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-56884 | Nov 10, 2026 |
In ac_set_ns_ipa_tbl of plat_trusty.c, there is a possible way to corrupt stream table entry configurationsIn ac_set_ns_ipa_tbl of plat_trusty.c, there is a possible way to corrupt stream table entry configurations via unvalidated parameters due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-55346 | Nov 10, 2026 |
In km_read_data_response of keymaster.cIn km_read_data_response of keymaster.c, there is a possible way to trigger an out of bounds write on the heap due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-55297 | Nov 10, 2026 |
In handle_chan_msg of tipc_virtio_dev.c, there is a possible way to bypass memory tag access controlsIn handle_chan_msg of tipc_virtio_dev.c, there is a possible way to bypass memory tag access controls via concurrent shared memory modification due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-125342 | Nov 10, 2026 |
Uninitialized resource in GPU in Google Chrome prior to 157.0.8103.50Uninitialized resource in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Chrome
|
| CVE-2026-125344 | Nov 10, 2026 |
Type confusion in V8 in Google Chrome prior to 157.0.8103.50Type confusion in V8 in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Chrome
|
| CVE-2026-125346 | Nov 10, 2026 |
Use after free in XML in Google Chrome prior to 157.0.8103.50Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Chrome
|
| CVE-2026-125349 | Nov 10, 2026 |
Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.50Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.50 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
Chrome
|
| CVE-2026-125350 | Nov 10, 2026 |
Use after free in XML in Google Chrome prior to 157.0.8103.50Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Chrome
|
| CVE-2026-125343 | Nov 10, 2026 |
Buffer overflow in Compositing in Google Chrome prior to 157.0.8103.50Buffer overflow in Compositing in Google Chrome prior to 157.0.8103.50 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Chrome
|
| CVE-2026-125345 | Nov 10, 2026 |
Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.50Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Chrome
|
| CVE-2026-125347 | Nov 10, 2026 |
Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.50Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.50 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Chrome
|
| CVE-2026-125348 | Nov 10, 2026 |
Out of bounds write in GPU in Google Chrome prior to 157.0.8103.50Out of bounds write in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) |
Chrome
|
| CVE-2026-80335 | Nov 04, 2026 |
Unisoc bootloader ODW in firmware update OOB due to global offset reset failureMemory Corruption when processing firmware update data in Download mode due to a missing bounds check. |
Android
|
| CVE-2026-79405 | Nov 04, 2026 |
Unisoc Modem Firmware PUCCH Config Input Validation Remote DoSTransient DOS when processing a malformed NR RRC configuration message due to improper input validation. |
Android
|
| CVE-2026-120930 | Nov 03, 2026 |
Google Chrome <156.0.8078.47: Blink Unauthorized Origin Policy BypassIncorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) |
Chrome
|
| CVE-2026-120931 | Nov 03, 2026 |
Google Chrome Android <156.0.8078.47: OOB Write in WebGL Exposes RCEOut of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) |
Chrome
|
| CVE-2026-121141 | Nov 03, 2026 |
Google Chrome <157.0.8103.38 Editing Input Validation BypassImproper input validation in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-121169 | Nov 03, 2026 |
Chrome DevTools Missing Auth (157.0.8103.38) Bypass Web Origin via ExtensionMissing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-121195 | Nov 03, 2026 |
Google Chrome <157.0.8103.38: TrustedTypes Auth Bypass via Crafted HTMLIncorrect authorization in TrustedTypes in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-121064 | Nov 03, 2026 |
Chrome Performance Improper Input Validation (<=157.0.8103.38)Improper input validation in Performance in Google Chrome prior to 157.0.8103.38 allowed a local attacker to potentially execute arbitrary code inside the sandbox via a local program. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-121041 | Nov 03, 2026 |
Missing Auth in Chrome 157.0.8103.38 Input, allows info leakMissing authorization in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-121093 | Nov 03, 2026 |
OOB Read in Chrome Animation before v157.0.8103.38Out of bounds read in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-121142 | Nov 03, 2026 |
Google Chrome <157.0.8103.38: Network Auth Bypass via ExtensionIncorrect authorization in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-121069 | Nov 03, 2026 |
Chrome Before 157.0.8103.38 UAF in Track Enables Remote Code ExecUse after free in Track in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-121230 | Nov 03, 2026 |
Chrome ANGLE Race Condition <157.0.8103.38 Remote Code ExecRace condition in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-121232 | Nov 03, 2026 |
Google Chrome <157.0.8103.38: Incorrect Auth in Core (Co-installed App)Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-121175 | Nov 03, 2026 |
ORB Resource Exposure Bypass Site Isolation in Chrome <157.0.8103.38Improper resource exposure in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-121054 | Nov 03, 2026 |
Google Chrome <157.0.8103.38 XML State Validation BypassImproper state validation in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|