Tagged “cve.org”
CVEs tagged cve.org, newest first.
48066 CVEsRSS
CVE-2026-113238High· 8.8Information loss in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page
Information loss in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113137Medium· 6.5Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension
Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Medium)
CVE-2026-113060High· 8.8UI misrepresentation in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed an adjacent attacker leveraging social engineering to spoof UI elements via a malicious peripheral
UI misrepresentation in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed an adjacent attacker leveraging social engineering to spoof UI elements via a malicious peripheral. (Chromium security severity: Medium)
CVE-2026-113194High· 8.8Improper input validation in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page
Improper input validation in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113189Critical· 9.6Improper input validation in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page
Improper input validation in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113115High· 8.8Race condition in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page
Race condition in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium s…
CVE-2026-113045Medium· 6.5⚖ disputedOut of bounds read in Offline in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page
Out of bounds read in Offline in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113307High· 8.8UI misrepresentation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted Chrome extension
UI misrepresentation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Medium)
CVE-2026-113071High· 8.8Use of insufficiently random values in Notifications in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page
Use of insufficiently random values in Notifications in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113009High· 8.8PoCUI misrepresentation in WindowControlsOverlay in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to potentially spoof UI elements via a crafted HTML page
UI misrepresentation in WindowControlsOverlay in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to potentially spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113278High· 8.8UI misrepresentation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension
UI misrepresentation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Medium)
CVE-2026-113190High· 8.8Confused deputy in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page
Confused deputy in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-112992Critical· 9.6Observable discrepancy in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page
Observable discrepancy in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113261Critical· 9.6Improper input validation in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page
Improper input validation in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113218High· 8.8Race condition in DataTransfer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page
Race condition in DataTransfer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page. (Chromium securi…
CVE-2026-113172High· 8.8Missing authorization in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page
Missing authorization in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-112995High· 8.8PoCObservable discrepancy in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted HTML page
Observable discrepancy in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113332High· 8.8Uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page
Uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113262High· 8.8Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension
Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Medium)
CVE-2026-113149High· 8.8UI misrepresentation in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted HTML page
UI misrepresentation in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113206High· 8.8UI misrepresentation in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page
UI misrepresentation in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113185High· 8.8Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted Chrome extension
Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Medium)
CVE-2026-113171Critical· 9.6UI misrepresentation in Prompts in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveraging social engineering to spoof UI elements via a co-installed app
UI misrepresentation in Prompts in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveraging social engineering to spoof UI elements via a co-installed app. (Chromium security severity: Medium)
CVE-2026-113328Critical· 9.6Improper resource exposure in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page
Improper resource exposure in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113276High· 8.8Missing authorization in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page
Missing authorization in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113195High· 8.8Improper input validation in Downloads in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page
Improper input validation in Downloads in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113042High· 8.8Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension
Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)
CVE-2026-113255High· 8.8Use after free in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page
Use after free in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113243High· 8.8Information leak in DOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted HTML page
Information leak in DOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-113076High· 8.8Race condition in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page
Race condition in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)