SB2026071603 - Multiple vulnerabilities in Microsoft Edge

Description

This security bulletin contains information about 473 vulnerabilities.

1) Untrusted Pointer Dereference (CVE-ID: CVE-2026-58596)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to elevate privileges.

The vulnerability exists due to untrusted pointer dereference in Microsoft Edge (Chromium-based) when rendering attacker-controlled web content. A remote attacker can host a specially crafted website and convince a user to visit it to escalate privileges.

Successful exploitation requires the user to visit the attacker-controlled webpage and perform two tap gestures that cause autofill to activate.

2) Race condition (CVE-ID: CVE-2026-55945)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to a race condition in Microsoft Edge (Chromium-based) when using shared resources with improper synchronization. A local user can trigger concurrent execution to disclose sensitive information.

Successful exploitation requires crafting deceptive or invisible form elements and the user performing two sequential taps. Disclosed information may include file content, and the impact may extend beyond the vulnerable component's security scope.

3) Heap-based buffer overflow (CVE-ID: CVE-2026-56645)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in Microsoft Edge (Chromium-based) when rendering crafted web content. A remote attacker can trick the victim into visiting a specially crafted website or opening a specially crafted URL to execute arbitrary code.

User interaction is required for exploitation.

4) Type Confusion (CVE-ID: CVE-2026-57975)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to type confusion in Microsoft Edge (Chromium-based) when processing crafted web content. A remote attacker can create a malicious webpage and induce the user to perform two tap gestures to execute arbitrary code.

User interaction is required, and successful exploitation depends on the victim visiting an attacker-controlled webpage and triggering autofill through two sequential taps.

5) Improper Authorization (CVE-ID: CVE-2026-57983)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass a security feature.

The vulnerability exists due to improper authorization in Microsoft Edge (Chromium-based) when rendering a specially crafted website. A remote attacker can host malicious content and trick a user into visiting it to bypass a security feature.

Successful exploitation requires deceptive or invisible form elements and two sequential taps by the user. An exploited vulnerability can affect resources beyond the security scope managed by the vulnerable component.

6) Use-after-free (CVE-ID: CVE-2026-57984)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Microsoft Edge (Chromium-based) when processing crafted web content. A remote attacker can host a specially crafted website and convince a user to visit it to execute arbitrary code.

User interaction is required, and exploitation requires the user to perform two sequential tap gestures that activate autofill.

7) Input validation error (CVE-ID: CVE-2026-57985)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper input validation in Microsoft Edge (Chromium-based) when rendering attacker-controlled web content. A remote attacker can host a specially crafted website and convince a user to visit it to execute arbitrary code.

User interaction is required, and exploitation may involve the user visiting an attacker-controlled webpage and performing gestures that activate autofill.

8) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-57987)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform spoofing.

The vulnerability exists due to server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) when rendering attacker-controlled web content. A remote attacker can host a specially crafted website and convince a user to visit it to perform spoofing.

User interaction is required. The user must visit the attacker-controlled webpage and perform two tap gestures that cause autofill to activate.

9) Path traversal (CVE-ID: CVE-2026-57988)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute code.

The vulnerability exists due to path traversal in Microsoft Edge (Chromium-based) when processing a specially crafted webpage or file. A remote attacker can host specially crafted content and convince a user to open it to execute code.

User interaction is required to visit the attacker-controlled webpage and perform the gestures that activate autofill, or to open a specially crafted file.

10) Use-after-free (CVE-ID: CVE-2026-57992)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Microsoft Edge (Chromium-based) when processing crafted web content. A remote attacker can host a specially crafted website and convince a user to visit it to execute arbitrary code.

User interaction is required, and successful exploitation requires the user to perform two sequential tap gestures that activate autofill.

11) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-57993)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N]

The vulnerability allows a remote attacker to perform spoofing.

The vulnerability exists due to server-side request forgery in Microsoft Edge (Chromium-based) when rendering an attacker-controlled webpage. A remote attacker can host a specially crafted website and convince a user to visit it to perform spoofing.

User interaction is required, and the user must visit the attacker-controlled webpage and perform two tap gestures that activate autofill.

12) Input validation error (CVE-ID: CVE-2026-14428)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input in Dawn in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and execute arbitrary code on the system.

13) Input validation error (CVE-ID: CVE-2026-14382)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input in ANGLE in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and execute arbitrary code on the system.

14) Spoofing attack (CVE-ID: CVE-2026-14126)

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to insufficient validation of user-supplied input in UI in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and spoof web page content.

15) Improperly implemented security check for standard (CVE-ID: CVE-2026-14114)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in WebAppInstalls in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

16) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-14096)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to an object lifecycle issue in Input in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage and crash the browser.

17) Use-after-free (CVE-ID: CVE-2026-14005)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within Omnibox in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

18) Spoofing attack (CVE-ID: CVE-2026-13997)

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to insufficient validation of user-supplied input in Extensions in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and spoof web page content.

19) Input validation error (CVE-ID: CVE-2026-13995)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in Autofill in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

20) Improperly implemented security check for standard (CVE-ID: CVE-2026-13994)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Credential Management in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

21) Spoofing attack (CVE-ID: CVE-2026-13987)

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to insufficient validation of user-supplied input in Mobile in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and spoof web page content.

22) Use of uninitialized resource (CVE-ID: CVE-2026-13969)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to usage of uninitialized resources in UI in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger uninitialized usage of resources and bypass implemented security mechanisms.

23) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-13964)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in WebView in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

24) Input validation error (CVE-ID: CVE-2026-13955)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in CustomTabs in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

25) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-13949)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in Payments in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

26) Use of uninitialized resource (CVE-ID: CVE-2026-13943)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to usage of uninitialized resources in CSS in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger uninitialized usage of resources and bypass implemented security mechanisms.

27) Input validation error (CVE-ID: CVE-2026-13939)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in WebShare in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

28) Improperly implemented security check for standard (CVE-ID: CVE-2026-13936)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Passwords in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

29) Improperly implemented security check for standard (CVE-ID: CVE-2026-13932)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Sharing in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

30) Input validation error (CVE-ID: CVE-2026-13929)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in DevTools in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

31) Input validation error (CVE-ID: CVE-2026-13927)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in UI in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

32) Input validation error (CVE-ID: CVE-2026-13926)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in Network in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

33) Input validation error (CVE-ID: CVE-2026-13924)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in WebView in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

34) Use of uninitialized resource (CVE-ID: CVE-2026-13923)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to usage of uninitialized resources in GPU in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger uninitialized usage of resources and bypass implemented security mechanisms.

35) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-13910)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in WebXR in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

36) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-13887)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in NFC in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

37) Use-after-free (CVE-ID: CVE-2026-13885)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within Skia in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

38) Input validation error (CVE-ID: CVE-2026-13872)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in WebAppInstalls in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

39) Use-after-free (CVE-ID: CVE-2026-13870)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within WebView in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

40) Improperly implemented security check for standard (CVE-ID: CVE-2026-13868)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Network in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

41) Input validation error (CVE-ID: CVE-2026-13866)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in Input in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

42) Input validation error (CVE-ID: CVE-2026-13863)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in CustomTabs in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

43) Input validation error (CVE-ID: CVE-2026-13856)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in Speech in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

44) Input validation error (CVE-ID: CVE-2026-13852)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input in WebAppInstalls in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and execute arbitrary code on the system.

45) Input validation error (CVE-ID: CVE-2026-13851)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input in WebAppInstalls in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and execute arbitrary code on the system.

46) Improperly implemented security check for standard (CVE-ID: CVE-2026-13826)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to incorrect implementation in Autofill in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and compromise the system.

47) Use of uninitialized resource (CVE-ID: CVE-2026-13825)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to usage of uninitialized resources in Dawn in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger uninitialized usage of resources and compromise the affected system.

48) Improperly implemented security check for standard (CVE-ID: CVE-2026-13822)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to incorrect implementation in Extensions in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and compromise the system.

49) Input validation error (CVE-ID: CVE-2026-13816)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input in File Input in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and execute arbitrary code on the system.

50) Use-after-free (CVE-ID: CVE-2026-13788)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Fullscreen component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

51) Input validation error (CVE-ID: CVE-2026-14137)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to crash the browser.

The vulnerability exists due to a improper input validation in Chrome for iOS in Google Chrome. A remote attacker can trick the victim to perform certain actions in browser and crash it.

52) Spoofing attack (CVE-ID: CVE-2026-14136)

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to insufficient validation of user-supplied input in Chrome for iOS in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and spoof web page content.

53) Input validation error (CVE-ID: CVE-2026-14128)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in Chrome for iOS in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

54) Spoofing attack (CVE-ID: CVE-2026-14123)

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to insufficient validation of user-supplied input in Chrome for iOS in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and spoof web page content.

55) Use-after-free (CVE-ID: CVE-2026-14099)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to use-after-free error in Chrome for iOS in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

56) Protection mechanism failure (CVE-ID: CVE-2026-14075)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to improperly imposed security restrictions in Chrome for iOS. A remote attacker can trick the victim to visit a specially crafted webpage and bypass implemented policy.

57) Use-after-free (CVE-ID: CVE-2026-14067)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to use-after-free error in Chrome for iOS in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

58) Input validation error (CVE-ID: CVE-2026-14066)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to crash the browser.

The vulnerability exists due to a improper input validation in Chrome for iOS in Google Chrome. A remote attacker can trick the victim to perform certain actions in browser and crash it.

59) Spoofing attack (CVE-ID: CVE-2026-14028)

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to insufficient validation of user-supplied input in Chrome for iOS in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and spoof web page content.

60) Input validation error (CVE-ID: CVE-2026-13991)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in Chrome for iOS in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

61) Spoofing attack (CVE-ID: CVE-2026-13983)

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to insufficient validation of user-supplied input in Chrome for iOS in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and spoof web page content.

62) Improperly implemented security check for standard (CVE-ID: CVE-2026-13981)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Chrome for iOS in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

63) Spoofing attack (CVE-ID: CVE-2026-13980)

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to insufficient validation of user-supplied input in Chrome for iOS in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and spoof web page content.

64) Improperly implemented security check for standard (CVE-ID: CVE-2026-13946)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in ScriptInjections in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

65) Use-after-free (CVE-ID: CVE-2026-13918)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within Chrome for iOS in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

66) Input validation error (CVE-ID: CVE-2026-13917)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in Chrome for iOS in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

67) Improperly implemented security check for standard (CVE-ID: CVE-2026-13916)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Chrome for iOS in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

68) Use-after-free (CVE-ID: CVE-2026-13915)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within Chrome for iOS in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

69) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-13913)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in Autofill in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

70) Spoofing attack (CVE-ID: CVE-2026-13912)

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to insufficient validation of user-supplied input in Safe Browsing in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and spoof web page content.

71) Input validation error (CVE-ID: CVE-2026-13908)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in Omnibox in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

72) Improperly implemented security check for standard (CVE-ID: CVE-2026-13907)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in iOSWeb in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

73) Spoofing attack (CVE-ID: CVE-2026-13905)

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to insufficient validation of user-supplied input in Chrome for iOS in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and spoof web page content.

74) Spoofing attack (CVE-ID: CVE-2026-13904)

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to insufficient validation of user-supplied input in Safe Browsing in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and spoof web page content.

75) Improperly implemented security check for standard (CVE-ID: CVE-2026-13902)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Chrome for iOS in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

76) Improperly implemented security check for standard (CVE-ID: CVE-2026-13892)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Chrome for iOS in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

77) Input validation error (CVE-ID: CVE-2026-13889)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in WebAuthentication in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

78) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-13862)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in Web Authentication (Passkeys & Security Keys) in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

79) Input validation error (CVE-ID: CVE-2026-13850)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input in Chrome for iOS in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and execute arbitrary code on the system.

80) Input validation error (CVE-ID: CVE-2026-13847)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input in Chrome for iOS in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and execute arbitrary code on the system.

81) Input validation error (CVE-ID: CVE-2026-13843)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input in Chrome for iOS in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and execute arbitrary code on the system.

82) Spoofing attack (CVE-ID: CVE-2026-13842)

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

CVSSv4: 8.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to insufficient validation of user-supplied input in Chrome for iOS in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and spoof web page content.

83) Input validation error (CVE-ID: CVE-2026-13813)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input in Chrome for iOS in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and execute arbitrary code on the system.

84) Input validation error (CVE-ID: CVE-2026-13812)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input in Chrome for iOS in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and execute arbitrary code on the system.

85) Cryptographic issues (CVE-ID: CVE-2026-13809)

CWE-ID: CWE-310 - Cryptographic Issues

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to side-channel information leak in Safe Browsing. eported by Google on 2026-04-19[TBD][504600482] High CVE-2026-13810: Inappropriate implementation in Input. Chrome High. A remote attacker can create a specially crafted web page, trick the victim into opening it and gain access to sensitive information.

86) Input validation error (CVE-ID: CVE-2026-13808)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation when processing HTML content in Chrome for iOS. Chrome High. A remote attacker can trick the victim to open a specially crafted web page and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

87) Use-after-free (CVE-ID: CVE-2026-13807)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Import component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

88) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-13795)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in Chrome for iOS in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and compromise the affected system.

89) Input validation error (CVE-ID: CVE-2026-13777)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input in iOSWeb in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and execute arbitrary code on the system.

90) Use-after-free (CVE-ID: CVE-2026-14424)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Dawn component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

91) Out-of-bounds write (CVE-ID: CVE-2026-14422)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in Tint. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger out-of-bounds write and execute arbitrary code on the target system.

92) Out-of-bounds write (CVE-ID: CVE-2026-14397)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in ANGLE. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger out-of-bounds write and execute arbitrary code on the target system.

93) Out-of-bounds read (CVE-ID: CVE-2026-14396)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the ANGLE component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger an out-of-bounds read error and gain access to sensitive information.

94) Out-of-bounds read (CVE-ID: CVE-2026-14386)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the ANGLE component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger an out-of-bounds read error and gain access to sensitive information.

95) Heap-based buffer overflow (CVE-ID: CVE-2026-14385)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in ANGLE. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

96) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-14101)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in Sandbox in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

97) Spoofing attack (CVE-ID: CVE-2026-13998)

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to insufficient validation of user-supplied input in File Input in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and spoof web page content.

98) Improperly implemented security check for standard (CVE-ID: CVE-2026-13992)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in UI in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

99) Out-of-bounds read (CVE-ID: CVE-2026-13975)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the ANGLE component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger an out-of-bounds read error and gain access to sensitive information.

100) Integer overflow (CVE-ID: CVE-2026-13974)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to a integer overflow in Safe Browsing in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage and crash the browser.

101) Improperly implemented security check for standard (CVE-ID: CVE-2026-13944)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in DataTransfer in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

102) Improperly implemented security check for standard (CVE-ID: CVE-2026-13914)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Passwords in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

103) Use-after-free (CVE-ID: CVE-2026-13880)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within USB in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

104) Use-after-free (CVE-ID: CVE-2026-13878)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within Bluetooth in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

105) Use-after-free (CVE-ID: CVE-2026-13846)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the USB component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

106) Use of uninitialized resource (CVE-ID: CVE-2026-13833)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to usage of uninitialized resources in ANGLE in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger uninitialized usage of resources and compromise the affected system.

107) Use-after-free (CVE-ID: CVE-2026-13827)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Updater component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

108) Out-of-bounds read (CVE-ID: CVE-2026-13819)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the ANGLE component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger an out-of-bounds read error and gain access to sensitive information.

109) Use-after-free (CVE-ID: CVE-2026-13805)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the GFX component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

110) Use-after-free (CVE-ID: CVE-2026-13792)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Touchbar component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

111) Input validation error (CVE-ID: CVE-2026-13791)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input in Downloads in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and execute arbitrary code on the system.

112) Use-after-free (CVE-ID: CVE-2026-13785)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Bluetooth component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

113) Use-after-free (CVE-ID: CVE-2026-13778)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the WebUSB component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

114) Use of uninitialized resource (CVE-ID: CVE-2026-14421)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to usage of uninitialized resources in Dawn in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger uninitialized usage of resources and bypass implemented security mechanisms.

115) Input validation error (CVE-ID: CVE-2026-14401)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input in ANGLE in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and execute arbitrary code on the system.

116) Out-of-bounds read (CVE-ID: CVE-2026-14388)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the ANGLE component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger an out-of-bounds read error and gain access to sensitive information.

117) Use-after-free (CVE-ID: CVE-2026-14432)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within V8 in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

118) Type Confusion (CVE-ID: CVE-2026-14431)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error within the V8 component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

119) Integer overflow (CVE-ID: CVE-2026-14430)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in V8 component in Google Chrome. A remote attacker can trick the victim to open a specially crafted web page, trigger an integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

120) Input validation error (CVE-ID: CVE-2026-14429)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input in Skia in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and execute arbitrary code on the system.

121) Heap-based buffer overflow (CVE-ID: CVE-2026-14427)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in Skia. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

122) Use-after-free (CVE-ID: CVE-2026-14426)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the V8 component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

123) Use-after-free (CVE-ID: CVE-2026-14425)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the ANGLE component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

124) Type Confusion (CVE-ID: CVE-2026-14423)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error within the Tint component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

125) Out-of-bounds write (CVE-ID: CVE-2026-14420)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in Dawn. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger out-of-bounds write and execute arbitrary code on the target system.

126) Use-after-free (CVE-ID: CVE-2026-14419)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Skia component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

127) Use of uninitialized resource (CVE-ID: CVE-2026-14418)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to usage of uninitialized resources in ANGLE in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger uninitialized usage of resources and compromise the affected system.

128) Use-after-free (CVE-ID: CVE-2026-14417)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Dawn component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

129) Out-of-bounds read (CVE-ID: CVE-2026-14416)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to a boundary condition within the Dawn component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger an out-of-bounds read error and crash the browser.

130) Improperly implemented security check for standard (CVE-ID: CVE-2026-14415)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in V8 in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

131) Input validation error (CVE-ID: CVE-2026-14414)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in Skia in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

132) Use of uninitialized resource (CVE-ID: CVE-2026-14413)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to usage of uninitialized resources in ANGLE in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger uninitialized usage of resources and compromise the affected system.

133) Input validation error (CVE-ID: CVE-2026-14412)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input in ANGLE in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and execute arbitrary code on the system.

134) Input validation error (CVE-ID: CVE-2026-14411)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input in ANGLE in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and execute arbitrary code on the system.

135) Improperly implemented security check for standard (CVE-ID: CVE-2026-14410)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Skia in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

136) Improperly implemented security check for standard (CVE-ID: CVE-2026-14409)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in V8 in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

137) Use of uninitialized resource (CVE-ID: CVE-2026-14408)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to usage of uninitialized resources in Dawn in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger uninitialized usage of resources and bypass implemented security mechanisms.

138) Improperly implemented security check for standard (CVE-ID: CVE-2026-14407)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in V8 in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

139) Out-of-bounds read (CVE-ID: CVE-2026-14406)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the V8 component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger an out-of-bounds read error and gain access to sensitive information.

140) Use of uninitialized resource (CVE-ID: CVE-2026-14405)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to usage of uninitialized resources in V8 in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

141) Improperly implemented security check for standard (CVE-ID: CVE-2026-14404)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in PDFium in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

142) Use-after-free (CVE-ID: CVE-2026-14403)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to use-after-free error in V8 in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

143) Use of uninitialized resource (CVE-ID: CVE-2026-14402)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to usage of uninitialized resources in ANGLE in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger uninitialized usage of resources and compromise the affected system.

144) Out-of-bounds write (CVE-ID: CVE-2026-14400)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in ANGLE. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger out-of-bounds write and execute arbitrary code on the target system.

145) Use of uninitialized resource (CVE-ID: CVE-2026-14399)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to usage of uninitialized resources in Dawn in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger uninitialized usage of resources and bypass implemented security mechanisms.

146) Use-after-free (CVE-ID: CVE-2026-14398)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the ANGLE component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

147) Out-of-bounds write (CVE-ID: CVE-2026-14395)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to a boundary error when processing untrusted HTML content in V8. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger out-of-bounds write and crash the browser.

148) Use-after-free (CVE-ID: CVE-2026-14394)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to use-after-free error in V8 in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

149) Use-after-free (CVE-ID: CVE-2026-14393)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within V8 in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

150) Out-of-bounds write (CVE-ID: CVE-2026-14392)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in Tint. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger out-of-bounds write and execute arbitrary code on the target system.

151) Integer overflow (CVE-ID: CVE-2026-14391)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to a integer overflow in ANGLE in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage and crash the browser.

152) Use-after-free (CVE-ID: CVE-2026-14390)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the ANGLE component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

153) Deserialization of untrusted data (CVE-ID: CVE-2026-58281)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data. A remote attacker can trick the victim into opening a specially crafted web page and execute arbitrary code on the target system.

154) Improperly implemented security check for standard (CVE-ID: CVE-2026-13874)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in DataTransfer in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

155) Improperly implemented security check for standard (CVE-ID: CVE-2026-13953)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in SplitView in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

156) Improperly implemented security check for standard (CVE-ID: CVE-2026-14142)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Extensions in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

157) Input validation error (CVE-ID: CVE-2026-14131)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to crash the browser.

The vulnerability exists due to a improper input validation in WebAppInstalls in Google Chrome. A remote attacker can trick the victim to perform certain actions in browser and crash it.

158) Input validation error (CVE-ID: CVE-2026-14020)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in WebXR in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

159) Heap-based buffer overflow (CVE-ID: CVE-2026-13798)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in Chromecast. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

160) Input validation error (CVE-ID: CVE-2026-13797)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input in Chromecast in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and execute arbitrary code on the system.

161) Improperly implemented security check for standard (CVE-ID: CVE-2026-13952)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in PerformanceAPIs in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

162) Spoofing attack (CVE-ID: CVE-2026-14130)

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to insufficient validation of user-supplied input in Omnibox in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and spoof web page content.

163) Improperly implemented security check for standard (CVE-ID: CVE-2026-14019)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Passwords in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

164) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-14073)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in WebXR in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

165) Out-of-bounds read (CVE-ID: CVE-2026-13873)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to crash the browser.

The vulnerability exists due to a boundary condition within the Layout component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger an out-of-bounds read error and crash the browser.

166) Improper access control (CVE-ID: CVE-2026-13951)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to improper access restrictions in USB. A remote attacker can create a specially crafted web page, trick the victim into visiting it, bypass implemented security restrictions and gain unauthorized access to sensitive information.

167) Spoofing attack (CVE-ID: CVE-2026-14129)

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to insufficient validation of user-supplied input in PreviewTab in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and spoof web page content.

168) Spoofing attack (CVE-ID: CVE-2026-14072)

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to insufficient validation of user-supplied input in SplitView in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and spoof web page content.

169) Use-after-free (CVE-ID: CVE-2026-14018)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within Updater in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

170) Input validation error (CVE-ID: CVE-2026-13871)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in GuestView in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

171) Input validation error (CVE-ID: CVE-2026-14116)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to crash the browser.

The vulnerability exists due to a improper input validation in DevTools in Google Chrome. A remote attacker can trick the victim to perform certain actions in browser and crash it.

172) Integer overflow (CVE-ID: CVE-2026-13796)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in Chromecast component in Google Chrome. A remote attacker can trick the victim to open a specially crafted web page, trigger an integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

173) Input validation error (CVE-ID: CVE-2026-13794)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input in WebAppInstalls in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and execute arbitrary code on the system.

174) Use-after-free (CVE-ID: CVE-2026-13869)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within Device in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

175) Use of uninitialized resource (CVE-ID: CVE-2026-13950)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to usage of uninitialized resources in GPU in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger uninitialized usage of resources and bypass implemented security mechanisms.

176) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-14105)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in Speech in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

177) Improperly implemented security check for standard (CVE-ID: CVE-2026-14127)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Printing in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

178) Improperly implemented security check for standard (CVE-ID: CVE-2026-14017)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Navigation in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

179) Use of uninitialized resource (CVE-ID: CVE-2026-14125)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to usage of uninitialized resources in ANGLE in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

180) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-13793)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in SVG in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and compromise the affected system.

181) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-14092)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in Privacy in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

182) Use of uninitialized resource (CVE-ID: CVE-2026-14070)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to usage of uninitialized resources in WebNN in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

183) Cryptographic issues (CVE-ID: CVE-2026-13790)

CWE-ID: CWE-310 - Cryptographic Issues

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to side-channel information leak in Scroll. Chrome High. A remote attacker can create a specially crafted web page, trick the victim into opening it and gain access to sensitive information.

184) Input validation error (CVE-ID: CVE-2026-13865)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in Enterprise in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

185) Use of uninitialized resource (CVE-ID: CVE-2026-13947)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to usage of uninitialized resources in XR in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger uninitialized usage of resources and bypass implemented security mechanisms.

186) Race condition (CVE-ID: CVE-2026-14082)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to improper input validation in Storage in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage and bypass implemented security restrictions.

187) Improperly implemented security check for standard (CVE-ID: CVE-2026-14124)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in CredentialProvider in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

188) Integer overflow (CVE-ID: CVE-2026-14069)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to crash the browser.

The vulnerability exists due to a integer overflow in WebNN in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage and crash the browser.

189) Improperly implemented security check for standard (CVE-ID: CVE-2026-14015)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in WebRTC in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

190) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-13945)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in Extensions in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

191) Input validation error (CVE-ID: CVE-2026-14122)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to crash the browser.

The vulnerability exists due to a improper input validation in WebAppInstalls in Google Chrome. A remote attacker can trick the victim to perform certain actions in browser and crash it.

192) Improperly implemented security check for standard (CVE-ID: CVE-2026-14014)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Paint in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

193) Improperly implemented security check for standard (CVE-ID: CVE-2026-14068)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Omnibox in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

194) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-13864)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in WebHID in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

195) Input validation error (CVE-ID: CVE-2026-13942)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in Video Capture in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

196) Cryptographic issues (CVE-ID: CVE-2026-14071)

CWE-ID: CWE-310 - Cryptographic Issues

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to side-channel information leak in WebAudio. Chrome Low. A remote attacker can create a specially crafted web page, trick the victim into opening it and gain access to sensitive information.

197) Use-after-free (CVE-ID: CVE-2026-14121)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to use-after-free error in Chromoting in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

198) Input validation error (CVE-ID: CVE-2026-14065)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to crash the browser.

The vulnerability exists due to a improper input validation in PageInfo in Google Chrome. A remote attacker can trick the victim to perform certain actions in browser and crash it.

199) Improperly implemented security check for standard (CVE-ID: CVE-2026-14013)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in SVG in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

200) Use-after-free (CVE-ID: CVE-2026-13787)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Chromoting component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

201) Use-after-free (CVE-ID: CVE-2026-13861)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within Core in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

202) Improperly implemented security check for standard (CVE-ID: CVE-2026-13941)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in SiteSettings in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

203) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-14059)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in Related-Website-Sets in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

204) Use-after-free (CVE-ID: CVE-2026-14064)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to use-after-free error in PageInfo in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

205) Use-after-free (CVE-ID: CVE-2026-13786)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Ozone component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

206) Spoofing attack (CVE-ID: CVE-2026-13860)

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to insufficient validation of user-supplied input in Autofill in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and spoof web page content.

207) Cryptographic issues (CVE-ID: CVE-2026-14012)

CWE-ID: CWE-310 - Cryptographic Issues

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to side-channel information leak in CSS. Chrome Medium. A remote attacker can create a specially crafted web page, trick the victim into opening it and gain access to sensitive information.

208) Improperly implemented security check for standard (CVE-ID: CVE-2026-14120)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in DevTools in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

209) Improperly implemented security check for standard (CVE-ID: CVE-2026-14049)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in GPU in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

210) Use-after-free (CVE-ID: CVE-2026-13784)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Views component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

211) Improperly implemented security check for standard (CVE-ID: CVE-2026-13859)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in ANGLE in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

212) Use of uninitialized resource (CVE-ID: CVE-2026-13940)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to usage of uninitialized resources in Cast in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger uninitialized usage of resources and bypass implemented security mechanisms.

213) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-14039)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in GetUserMedia in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

214) Type Confusion (CVE-ID: CVE-2026-14119)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a type confusion error within the Bluetooth component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a type confusion error and crash the browser.

215) Out-of-bounds read (CVE-ID: CVE-2026-14063)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to crash the browser.

The vulnerability exists due to a boundary condition within the Chromecast component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger an out-of-bounds read error and crash the browser.

216) Out-of-bounds read (CVE-ID: CVE-2026-14011)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the SurfaceCapture component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger an out-of-bounds read error and gain access to sensitive information.

217) Out-of-bounds read (CVE-ID: CVE-2026-13858)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the FFmpeg component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger an out-of-bounds read error and gain access to sensitive information.

218) Integer overflow (CVE-ID: CVE-2026-13938)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to a integer overflow in Fonts in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage and crash the browser.

219) Use-after-free (CVE-ID: CVE-2026-14027)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to use-after-free error in SignIn in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

220) Improperly implemented security check for standard (CVE-ID: CVE-2026-14062)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Views in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

221) Input validation error (CVE-ID: CVE-2026-14118)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in DevTools in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

222) Use of uninitialized resource (CVE-ID: CVE-2026-14010)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to usage of uninitialized resources in Codecs in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger uninitialized usage of resources and bypass implemented security mechanisms.

223) Use-after-free (CVE-ID: CVE-2026-13783)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Views component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

224) Improperly implemented security check for standard (CVE-ID: CVE-2026-13857)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Geometry in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

225) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-13937)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in Passwords in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

226) Input validation error (CVE-ID: CVE-2026-14117)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to crash the browser.

The vulnerability exists due to a improper input validation in DevTools in Google Chrome. A remote attacker can trick the victim to perform certain actions in browser and crash it.

227) Improperly implemented security check for standard (CVE-ID: CVE-2026-14061)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Dawn in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

228) Input validation error (CVE-ID: CVE-2026-14009)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in Passwords in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

229) Use-after-free (CVE-ID: CVE-2026-13782)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Browser component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

230) Cryptographic issues (CVE-ID: CVE-2026-13935)

CWE-ID: CWE-310 - Cryptographic Issues

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to side-channel information leak in ComputePressure. Chrome Medium. A remote attacker can create a specially crafted web page, trick the victim into opening it and gain access to sensitive information.

231) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-14016)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in SVG in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

232) Input validation error (CVE-ID: CVE-2026-14060)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to crash the browser.

The vulnerability exists due to a improper input validation in Chromoting in Google Chrome. A remote attacker can trick the victim to perform certain actions in browser and crash it.

233) Input validation error (CVE-ID: CVE-2026-13781)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input in Skia in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and execute arbitrary code on the system.

234) Use-after-free (CVE-ID: CVE-2026-13855)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Ozone component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

235) Input validation error (CVE-ID: CVE-2026-13934)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in Dawn in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

236) Use-after-free (CVE-ID: CVE-2026-14006)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within Navigation in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

237) Use of uninitialized resource (CVE-ID: CVE-2026-14008)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to usage of uninitialized resources in WebXR in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger uninitialized usage of resources and bypass implemented security mechanisms.

238) Input validation error (CVE-ID: CVE-2026-13780)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input in ANGLE in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and execute arbitrary code on the system.

239) Use-after-free (CVE-ID: CVE-2026-13854)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Ozone component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

240) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-13989)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in PageInfo in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

241) Input validation error (CVE-ID: CVE-2026-14115)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to crash the browser.

The vulnerability exists due to a improper input validation in Cast in Google Chrome. A remote attacker can trick the victim to perform certain actions in browser and crash it.

242) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-14007)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in PermissionsPolicy in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

243) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-13933)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in Passwords in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

244) Use-after-free (CVE-ID: CVE-2026-13779)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Chromoting component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

245) Use-after-free (CVE-ID: CVE-2026-13853)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Journeys component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

246) Protection mechanism failure (CVE-ID: CVE-2026-14058)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to improperly imposed security restrictions in Parser. A remote attacker can trick the victim to visit a specially crafted webpage and bypass implemented policy.

247) Input validation error (CVE-ID: CVE-2026-13849)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input in Chromoting in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and execute arbitrary code on the system.

248) Improperly implemented security check for standard (CVE-ID: CVE-2026-13931)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Media in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

249) Improperly implemented security check for standard (CVE-ID: CVE-2026-13973)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in UI in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

250) Improperly implemented security check for standard (CVE-ID: CVE-2026-14004)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in CSS in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

251) Use-after-free (CVE-ID: CVE-2026-14113)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to use-after-free error in Updater in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

252) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-14057)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in FedCM in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

253) Type Confusion (CVE-ID: CVE-2026-13776)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error within the Dawn component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

254) Use-after-free (CVE-ID: CVE-2026-13848)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Forms component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

255) Input validation error (CVE-ID: CVE-2026-13961)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in DevTools in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

256) Improperly implemented security check for standard (CVE-ID: CVE-2026-14112)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Enterprise in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

257) Input validation error (CVE-ID: CVE-2026-14056)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to crash the browser.

The vulnerability exists due to a improper input validation in Media in Google Chrome. A remote attacker can trick the victim to perform certain actions in browser and crash it.

258) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-14003)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in Extensions in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

259) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-13948)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in Extensions in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

260) Input validation error (CVE-ID: CVE-2026-14055)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to crash the browser.

The vulnerability exists due to a improper input validation in Device Trust in Google Chrome. A remote attacker can trick the victim to perform certain actions in browser and crash it.

261) Use-after-free (CVE-ID: CVE-2026-14111)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to use-after-free error in WebProtect in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

262) Use-after-free (CVE-ID: CVE-2026-13775)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the GPU component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

263) Input validation error (CVE-ID: CVE-2026-13928)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in Enterprise in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

264) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-13930)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in Actor in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

265) Improperly implemented security check for standard (CVE-ID: CVE-2026-14110)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in DarkMode in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

266) Improperly implemented security check for standard (CVE-ID: CVE-2026-14002)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Geolocation in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

267) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-14054)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in Network in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

268) Use-after-free (CVE-ID: CVE-2026-13844)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Updater component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

269) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-13903)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in Bluetooth in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

270) Improperly implemented security check for standard (CVE-ID: CVE-2026-13925)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Downloads in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

271) Improperly implemented security check for standard (CVE-ID: CVE-2026-14001)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Network in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

272) Integer overflow (CVE-ID: CVE-2026-13841)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in Skia component in Google Chrome. A remote attacker can trick the victim to open a specially crafted web page, trigger an integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

273) Cryptographic issues (CVE-ID: CVE-2026-13922)

CWE-ID: CWE-310 - Cryptographic Issues

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to side-channel information leak in Paint. Chrome Medium. A remote attacker can create a specially crafted web page, trick the victim into opening it and gain access to sensitive information.

274) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-14109)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in Mojo in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

275) Improperly implemented security check for standard (CVE-ID: CVE-2026-14000)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in XML in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

276) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-14053)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in Extensions in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

277) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-13840)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in Canvas in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and compromise the affected system.

278) Type Confusion (CVE-ID: CVE-2026-13883)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a type confusion error within the ANGLE component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a type confusion error and gain access to sensitive information.

279) Input validation error (CVE-ID: CVE-2026-13921)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in DeviceBoundSessionCredentials in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

280) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-14052)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in FileSystem in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

281) Improperly implemented security check for standard (CVE-ID: CVE-2026-13999)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Extensions in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

282) Use-after-free (CVE-ID: CVE-2026-14108)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to use-after-free error in PDFium in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

283) Improperly implemented security check for standard (CVE-ID: CVE-2026-13867)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Geolocation in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

284) Use of uninitialized resource (CVE-ID: CVE-2026-14051)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to usage of uninitialized resources in GamepadAPI in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

285) Use-after-free (CVE-ID: CVE-2026-14107)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to use-after-free error in Scheduling in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

286) Improperly implemented security check for standard (CVE-ID: CVE-2026-13839)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to incorrect implementation in CSS in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and compromise the system.

287) Use-after-free (CVE-ID: CVE-2026-13845)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the DOM component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

288) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-14050)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in Passwords in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

289) Input validation error (CVE-ID: CVE-2026-14106)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to crash the browser.

The vulnerability exists due to a improper input validation in Text in Google Chrome. A remote attacker can trick the victim to perform certain actions in browser and crash it.

290) Spoofing attack (CVE-ID: CVE-2026-13996)

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to insufficient validation of user-supplied input in Permissions in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and spoof web page content.

291) Input validation error (CVE-ID: CVE-2026-13920)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in Media in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

292) Improperly implemented security check for standard (CVE-ID: CVE-2026-13838)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to incorrect implementation in CSS in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and compromise the system.

293) Input validation error (CVE-ID: CVE-2026-13919)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in Extensions in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

294) Spoofing attack (CVE-ID: CVE-2026-13993)

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to insufficient validation of user-supplied input in WebAppInstalls in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and spoof web page content.

295) Use-after-free (CVE-ID: CVE-2026-13832)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Headless component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

296) Improperly implemented security check for standard (CVE-ID: CVE-2026-13837)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to incorrect implementation in CSS in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and compromise the system.

297) Input validation error (CVE-ID: CVE-2026-13911)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in Spellcheck in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

298) Input validation error (CVE-ID: CVE-2026-13990)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in DataTransfer in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

299) Use-after-free (CVE-ID: CVE-2026-13814)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Views component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

300) Improperly implemented security check for standard (CVE-ID: CVE-2026-13836)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to incorrect implementation in CSS in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and compromise the system.

301) Input validation error (CVE-ID: CVE-2026-14104)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to crash the browser.

The vulnerability exists due to a improper input validation in WebAppInstalls in Google Chrome. A remote attacker can trick the victim to perform certain actions in browser and crash it.

302) Use-after-free (CVE-ID: CVE-2026-14048)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to use-after-free error in Chromecast in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

303) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-13909)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in DevTools in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

304) Use-after-free (CVE-ID: CVE-2026-14103)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to use-after-free error in SSL in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

305) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-14047)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in Extensions in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

306) Improperly implemented security check for standard (CVE-ID: CVE-2026-13988)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Paint in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

307) Improperly implemented security check for standard (CVE-ID: CVE-2026-13835)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to incorrect implementation in XML in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and compromise the system.

308) Out-of-bounds read (CVE-ID: CVE-2026-13906)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the Codecs component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger an out-of-bounds read error and gain access to sensitive information.

309) Protection mechanism failure (CVE-ID: CVE-2026-14156)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to improperly imposed security restrictions in StorageAccessAPI. A remote attacker can trick the victim to visit a specially crafted webpage and bypass implemented policy.

310) Use-after-free (CVE-ID: CVE-2026-14102)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to use-after-free error in Passwords in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

311) Improperly implemented security check for standard (CVE-ID: CVE-2026-14046)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in CustomTabs in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

312) Improperly implemented security check for standard (CVE-ID: CVE-2026-13986)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Media UI in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

313) Input validation error (CVE-ID: CVE-2026-13834)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input in ANGLE in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and execute arbitrary code on the system.

314) Input validation error (CVE-ID: CVE-2026-14100)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in NetworkCache in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

315) Input validation error (CVE-ID: CVE-2026-14045)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to crash the browser.

The vulnerability exists due to a improper input validation in Network in Google Chrome. A remote attacker can trick the victim to perform certain actions in browser and crash it.

316) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-14155)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in StorageAccessAPI in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

317) Improperly implemented security check for standard (CVE-ID: CVE-2026-14098)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in CSS in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

318) Improperly implemented security check for standard (CVE-ID: CVE-2026-13985)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in MediaCapture in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

319) Input validation error (CVE-ID: CVE-2026-13901)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in Serial in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

320) Improperly implemented security check for standard (CVE-ID: CVE-2026-14154)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in DevTools in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

321) Use-after-free (CVE-ID: CVE-2026-14044)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to use-after-free error in ANGLE in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

322) Spoofing attack (CVE-ID: CVE-2026-13984)

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to insufficient validation of user-supplied input in TabStrip in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and spoof web page content.

323) Use-after-free (CVE-ID: CVE-2026-13831)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the GPU component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

324) Input validation error (CVE-ID: CVE-2026-13900)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in Chromecast in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

325) Improperly implemented security check for standard (CVE-ID: CVE-2026-14097)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in WebAppInstalls in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

326) Use-after-free (CVE-ID: CVE-2026-14043)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to use-after-free error in GetUserMedia in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

327) Spoofing attack (CVE-ID: CVE-2026-13982)

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to insufficient validation of user-supplied input in Passwords in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and spoof web page content.

328) Use-after-free (CVE-ID: CVE-2026-13830)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Chromoting component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

329) Use-after-free (CVE-ID: CVE-2026-13899)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within HTML in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

330) Input validation error (CVE-ID: CVE-2026-14095)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to crash the browser.

The vulnerability exists due to a improper input validation in Browser in Google Chrome. A remote attacker can trick the victim to perform certain actions in browser and crash it.

331) Improperly implemented security check for standard (CVE-ID: CVE-2026-14042)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Isolated Web Apps in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

332) Improperly implemented security check for standard (CVE-ID: CVE-2026-13979)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Paint in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

333) Input validation error (CVE-ID: CVE-2026-13829)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input in Settings in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and execute arbitrary code on the system.

334) Out-of-bounds write (CVE-ID: CVE-2026-14152)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to a boundary error when processing untrusted HTML content in ANGLE. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger out-of-bounds write and crash the browser.

335) Use-after-free (CVE-ID: CVE-2026-14094)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to use-after-free error in Installer in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

336) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-14041)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in Serial in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

337) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-13978)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in PageInfo in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

338) Use-after-free (CVE-ID: CVE-2026-13898)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within Cast Receiver in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

339) Improperly implemented security check for standard (CVE-ID: CVE-2026-14151)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in AI in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

340) Use-after-free (CVE-ID: CVE-2026-14093)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to use-after-free error in Cast in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

341) Use-after-free (CVE-ID: CVE-2026-14040)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to use-after-free error in BrowserTag in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

342) Improperly implemented security check for standard (CVE-ID: CVE-2026-13977)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in HTMLParser in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

343) Improperly implemented security check for standard (CVE-ID: CVE-2026-13828)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to incorrect implementation in Enterprise in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and compromise the system.

344) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-13897)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in Chromecast in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

345) Input validation error (CVE-ID: CVE-2026-14150)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to crash the browser.

The vulnerability exists due to a improper input validation in Speech in Google Chrome. A remote attacker can trick the victim to perform certain actions in browser and crash it.

346) Input validation error (CVE-ID: CVE-2026-13824)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input in Extensions in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and execute arbitrary code on the system.

347) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-13896)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in Glic in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

348) Use-after-free (CVE-ID: CVE-2026-14149)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to use-after-free error in Audio in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

349) Use-after-free (CVE-ID: CVE-2026-14091)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to use-after-free error in DevTools in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

350) Heap-based buffer overflow (CVE-ID: CVE-2026-13976)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in Storage. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

351) Use-after-free (CVE-ID: CVE-2026-13823)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Glic component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

352) Input validation error (CVE-ID: CVE-2026-14038)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to crash the browser.

The vulnerability exists due to a improper input validation in New Tab Page in Google Chrome. A remote attacker can trick the victim to perform certain actions in browser and crash it.

353) Use-after-free (CVE-ID: CVE-2026-13821)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Canvas component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

354) Improperly implemented security check for standard (CVE-ID: CVE-2026-13895)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Autofill in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

355) Type Confusion (CVE-ID: CVE-2026-14148)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a type confusion error within the CSS component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a type confusion error and crash the browser.

356) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-14037)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in GPU in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

357) Improperly implemented security check for standard (CVE-ID: CVE-2026-13972)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Paint in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

358) Out-of-bounds read (CVE-ID: CVE-2026-13820)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the Skia component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger an out-of-bounds read error and gain access to sensitive information.

359) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-13894)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in Network in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

360) Improperly implemented security check for standard (CVE-ID: CVE-2026-14147)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in CSS in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

361) Input validation error (CVE-ID: CVE-2026-14089)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to crash the browser.

The vulnerability exists due to a improper input validation in PopupBlocker in Google Chrome. A remote attacker can trick the victim to perform certain actions in browser and crash it.

362) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-14036)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in Bluetooth in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

363) Use of uninitialized resource (CVE-ID: CVE-2026-13971)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to usage of uninitialized resources in Skia in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger uninitialized usage of resources and bypass implemented security mechanisms.

364) Improperly implemented security check for standard (CVE-ID: CVE-2026-14146)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in CSS in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

365) Use of uninitialized resource (CVE-ID: CVE-2026-14088)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to usage of uninitialized resources in Canvas in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

366) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-14035)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in Bluetooth in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

367) Improperly implemented security check for standard (CVE-ID: CVE-2026-13818)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to incorrect implementation in Passwords in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and compromise the system.

368) Input validation error (CVE-ID: CVE-2026-13893)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in WebUI in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

369) Improperly implemented security check for standard (CVE-ID: CVE-2026-14145)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in CSS in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

370) Input validation error (CVE-ID: CVE-2026-14087)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to crash the browser.

The vulnerability exists due to a improper input validation in WebNN in Google Chrome. A remote attacker can trick the victim to perform certain actions in browser and crash it.

371) Use of uninitialized resource (CVE-ID: CVE-2026-13970)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to usage of uninitialized resources in Media in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger uninitialized usage of resources and bypass implemented security mechanisms.

372) Improperly implemented security check for standard (CVE-ID: CVE-2026-14034)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in WebXR in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

373) Input validation error (CVE-ID: CVE-2026-13817)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input in Glic in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and execute arbitrary code on the system.

374) Input validation error (CVE-ID: CVE-2026-13891)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in Extensions in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

375) Spoofing attack (CVE-ID: CVE-2026-14144)

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to insufficient validation of user-supplied input in Views in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and spoof web page content.

376) Input validation error (CVE-ID: CVE-2026-13968)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in DevTools in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

377) Use-after-free (CVE-ID: CVE-2026-13815)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Blink component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

378) Out-of-bounds read (CVE-ID: CVE-2026-13890)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the Chromecast component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger an out-of-bounds read error and gain access to sensitive information.

379) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-14086)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in HID in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

380) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-14033)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in Media in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

381) Type Confusion (CVE-ID: CVE-2026-13967)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a type confusion error within the V8 component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a type confusion error and gain access to sensitive information.

382) Use-after-free (CVE-ID: CVE-2026-13888)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within Extensions in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

383) Spoofing attack (CVE-ID: CVE-2026-14143)

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to insufficient validation of user-supplied input in Passwords in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and spoof web page content.

384) Use-after-free (CVE-ID: CVE-2026-14032)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to use-after-free error in Bluetooth in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

385) Cryptographic issues (CVE-ID: CVE-2026-14085)

CWE-ID: CWE-310 - Cryptographic Issues

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to side-channel information leak in CSS. Chrome Low. A remote attacker can create a specially crafted web page, trick the victim into opening it and gain access to sensitive information.

386) Improperly implemented security check for standard (CVE-ID: CVE-2026-13966)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in History in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

387) Use-after-free (CVE-ID: CVE-2026-13811)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the IME component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

388) Improper access control (CVE-ID: CVE-2026-13886)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to improper access restrictions in Isolated Web Apps. A remote attacker can create a specially crafted web page, trick the victim into visiting it, bypass implemented security restrictions and gain unauthorized access to sensitive information.

389) Input validation error (CVE-ID: CVE-2026-14084)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to crash the browser.

The vulnerability exists due to a improper input validation in Chromoting in Google Chrome. A remote attacker can trick the victim to perform certain actions in browser and crash it.

390) Spoofing attack (CVE-ID: CVE-2026-14031)

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to insufficient validation of user-supplied input in File Input in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and spoof web page content.

391) Use-after-free (CVE-ID: CVE-2026-13965)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within Oilpan in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

392) Spoofing attack (CVE-ID: CVE-2026-14141)

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to insufficient validation of user-supplied input in Document Picture-in-Picture in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and spoof web page content.

393) Input validation error (CVE-ID: CVE-2026-14083)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to crash the browser.

The vulnerability exists due to a improper input validation in HTML in Google Chrome. A remote attacker can trick the victim to perform certain actions in browser and crash it.

394) Spoofing attack (CVE-ID: CVE-2026-14030)

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to insufficient validation of user-supplied input in SplitView in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and spoof web page content.

395) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-13810)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Input in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted website and gain access to sensitive information. 

396) Heap-based buffer overflow (CVE-ID: CVE-2026-13884)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in Chromecast. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

397) Input validation error (CVE-ID: CVE-2026-14140)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to crash the browser.

The vulnerability exists due to a improper input validation in Input in Google Chrome. A remote attacker can trick the victim to perform certain actions in browser and crash it.

398) Improperly implemented security check for standard (CVE-ID: CVE-2026-13963)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in DevTools in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

399) Input validation error (CVE-ID: CVE-2026-13962)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in PDF in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

400) Improperly implemented security check for standard (CVE-ID: CVE-2026-14139)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in TabStrip in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

401) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-14081)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in DevTools in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

402) Input validation error (CVE-ID: CVE-2026-13806)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input in Accessibility in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and execute arbitrary code on the system.

403) Use-after-free (CVE-ID: CVE-2026-13804)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Chromecast component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

404) Improperly implemented security check for standard (CVE-ID: CVE-2026-13882)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in USB in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

405) Improperly implemented security check for standard (CVE-ID: CVE-2026-13960)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Passwords in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

406) Spoofing attack (CVE-ID: CVE-2026-14026)

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to insufficient validation of user-supplied input in SplitView in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and spoof web page content.

407) Type Confusion (CVE-ID: CVE-2026-13803)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error within the Chrome Tabs component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

408) Input validation error (CVE-ID: CVE-2026-13881)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in WebAppInstalls in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

409) Input validation error (CVE-ID: CVE-2026-13959)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in Blink in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

410) Input validation error (CVE-ID: CVE-2026-14080)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to crash the browser.

The vulnerability exists due to a improper input validation in TabSwitcher in Google Chrome. A remote attacker can trick the victim to perform certain actions in browser and crash it.

411) Improperly implemented security check for standard (CVE-ID: CVE-2026-14138)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in WebAppInstalls in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

412) Use-after-free (CVE-ID: CVE-2026-14025)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to use-after-free error in Views in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

413) Use-after-free (CVE-ID: CVE-2026-13802)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Views component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

414) Use of uninitialized resource (CVE-ID: CVE-2026-13958)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to usage of uninitialized resources in Codecs in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger uninitialized usage of resources and bypass implemented security mechanisms.

415) Protection mechanism failure (CVE-ID: CVE-2026-14079)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to improperly imposed security restrictions in Network. A remote attacker can trick the victim to visit a specially crafted webpage and bypass implemented policy.

416) Use-after-free (CVE-ID: CVE-2026-14024)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within Ozone in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

417) Input validation error (CVE-ID: CVE-2026-14135)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to crash the browser.

The vulnerability exists due to a improper input validation in Network in Google Chrome. A remote attacker can trick the victim to perform certain actions in browser and crash it.

418) Integer overflow (CVE-ID: CVE-2026-13801)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in Chromecast component in Google Chrome. A remote attacker can trick the victim to open a specially crafted web page, trigger an integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

419) Use-after-free (CVE-ID: CVE-2026-13879)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within Bluetooth in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

420) Spoofing attack (CVE-ID: CVE-2026-13957)

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to insufficient validation of user-supplied input in Extensions in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and spoof web page content.

421) Protection mechanism failure (CVE-ID: CVE-2026-14078)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to improperly imposed security restrictions in WebRTC. A remote attacker can trick the victim to visit a specially crafted webpage and bypass implemented policy.

422) Improperly implemented security check for standard (CVE-ID: CVE-2026-14134)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Autofill in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

423) Input validation error (CVE-ID: CVE-2026-14023)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in SanitizerAPI in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

424) Input validation error (CVE-ID: CVE-2026-13877)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in ANGLE in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

425) Race condition (CVE-ID: CVE-2026-14133)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to improper input validation in History Embeddings in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage and bypass implemented security restrictions.

426) Spoofing attack (CVE-ID: CVE-2026-14077)

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to insufficient validation of user-supplied input in Select in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and spoof web page content.

427) Improperly implemented security check for standard (CVE-ID: CVE-2026-13876)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Network in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

428) Spoofing attack (CVE-ID: CVE-2026-13956)

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to insufficient validation of user-supplied input in PageInfo in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and spoof web page content.

429) Use-after-free (CVE-ID: CVE-2026-13774)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Extensions component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

430) Improperly implemented security check for standard (CVE-ID: CVE-2026-14132)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in WebXR in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

431) Protection mechanism failure (CVE-ID: CVE-2026-14076)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to improperly imposed security restrictions in Network. A remote attacker can trick the victim to visit a specially crafted webpage and bypass implemented policy.

432) Input validation error (CVE-ID: CVE-2026-14022)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in Network in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

433) Improperly implemented security check for standard (CVE-ID: CVE-2026-13800)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to incorrect implementation in Updater in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and compromise the system.

434) Improperly implemented security check for standard (CVE-ID: CVE-2026-14153)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in Glic in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

435) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2026-13954)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in XML in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

436) Cryptographic issues (CVE-ID: CVE-2026-14074)

CWE-ID: CWE-310 - Cryptographic Issues

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to side-channel information leak in WebAuthentication. Chrome Low. A remote attacker can create a specially crafted web page, trick the victim into opening it and gain access to sensitive information.

437) Input validation error (CVE-ID: CVE-2026-13875)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in GPU in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

438) Input validation error (CVE-ID: CVE-2026-14021)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in StorageAccessAPI in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

439) Use-after-free (CVE-ID: CVE-2026-13799)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the QUIC component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

440) Out-of-bounds read (CVE-ID: CVE-2026-14090)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to a boundary condition within the CameraCapture component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger an out-of-bounds read error and crash the browser.

441) Information disclosure (CVE-ID: CVE-2026-56646)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform spoofing.

The vulnerability exists due to exposure of sensitive information to an unauthorized actor in Microsoft Edge (Chromium-based) when processing attacker-controlled web content. A remote attacker can cause the victim to visit an attacker-controlled webpage and perform two tap gestures that activate autofill to perform spoofing.

User interaction is required to visit the webpage and perform the gestures that trigger autofill.

442) Improper access control (CVE-ID: CVE-2026-58282)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform spoofing.

The vulnerability exists due to improper access control in Microsoft Edge (Chromium-based) when rendering attacker-controlled web content. A remote attacker can host a specially crafted website with deceptive or invisible form elements to perform spoofing.

User interaction is required, and successful exploitation requires the user to perform two sequential taps. Malicious JavaScript code can read information in the victim's browser associated with the vulnerable URL and send it to the attacker. The impact can extend beyond the security scope of the vulnerable component.

443) Type Confusion (CVE-ID: CVE-2026-58283)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform spoofing.

The vulnerability exists due to access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) when rendering a specially crafted website. A remote attacker can host crafted web content and convince a user to view it to perform spoofing.

Exploitation requires crafting deceptive or invisible form elements and successful user interaction involving two sequential taps. Malicious JavaScript may also read information in the victim's browser associated with the vulnerable URL.

444) Use-after-free (CVE-ID: CVE-2026-58287)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Microsoft Edge (Chromium-based) when rendering attacker-controlled web content. A remote attacker can host a specially crafted website and convince a user to view it to execute arbitrary code.

Successful exploitation requires user interaction and high attack complexity, including deceptive or invisible form elements and two sequential taps that activate autofill.

445) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-58299)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a time-of-check time-of-use race condition in Microsoft Edge for Android autofill handling when processing attacker-controlled web content and crafted files. A remote attacker can craft deceptive or invisible form elements and induce the user to perform two sequential taps to execute arbitrary code.

User interaction is required: the user must visit an attacker-controlled webpage or open a specially crafted file, and the exploitation sequence requires two tap gestures that cause autofill to activate.

446) Relative Path Traversal (CVE-ID: CVE-2026-58522)

CWE-ID: CWE-23 - Relative Path Traversal

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to relative path traversal in Microsoft Edge for Android when processing a crafted URL. A remote attacker can cause malicious JavaScript code to read information associated with the vulnerable URL and send it to the attacker to disclose sensitive information.

447) Improper access control (CVE-ID: CVE-2026-58523)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass a security feature.

The vulnerability exists due to improper access control in Microsoft Edge for Android autofill handling when a user visits an attacker-controlled webpage and performs two tap gestures that activate autofill. A remote attacker can craft a malicious webpage to bypass a security feature.

User interaction is required to visit the attacker-controlled webpage and perform two tap gestures that cause autofill to activate.

448) Spoofing attack (CVE-ID: CVE-2026-45488)

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform spoofing.

The vulnerability exists due to user interface misrepresentation of critical information in Microsoft Edge (Chromium-based) when rendering attacker-controlled web content. A remote attacker can host a specially crafted website and convince a user to visit it to perform spoofing.

User interaction is required to click a specially crafted URL and may involve responding to a popup requesting additional input.

449) Integer overflow (CVE-ID: CVE-2026-57974)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to integer overflow or wraparound in Microsoft Edge (Chromium-based) when processing crafted web content. A remote attacker can trick the victim into visiting an attacker-controlled webpage to execute arbitrary code.

User interaction is required to visit the crafted webpage and perform two tap gestures that activate autofill.

450) Cross-site scripting (CVE-ID: CVE-2026-57977)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote attacker to perform spoofing.

The vulnerability exists due to cross-site scripting in Microsoft Edge (Chromium-based) when generating web pages. A remote attacker can host a specially crafted website and convince a user to visit it to perform spoofing.

User interaction is required. The user must visit an attacker-controlled webpage and perform two tap gestures that cause autofill to activate.

451) Use-after-free (CVE-ID: CVE-2026-57981)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Microsoft Edge (Chromium-based) when rendering attacker-controlled web content. A remote attacker can host a specially crafted website and convince the user to visit it to execute arbitrary code.

User interaction is required, and exploitation requires the user to visit the attacker-controlled webpage and perform two tap gestures that cause autofill to activate.

452) Use-after-free (CVE-ID: CVE-2026-57986)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Microsoft Edge (Chromium-based) when rendering attacker-controlled web content. A remote attacker can host a specially crafted website or provide a specially crafted file to execute arbitrary code.

User interaction is required, and successful exploitation requires the user to visit the crafted webpage or open the crafted file and perform two sequential tap gestures that activate autofill.

453) Link following (CVE-ID: CVE-2026-57991)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper link resolution before file access ('link following') in Microsoft Edge (Chromium-based) when rendering an attacker-controlled webpage. A remote attacker can host a specially crafted website and convince a user to visit it to disclose sensitive information.

User interaction is required, and the user must visit the attacker-controlled webpage and perform two tap gestures that cause autofill to activate.

454) Use-after-free (CVE-ID: CVE-2026-58276)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Microsoft Edge (Chromium-based) when rendering attacker-controlled web content. A remote attacker can host a specially crafted website and convince a user to visit it to execute arbitrary code.

User interaction is required, and successful exploitation requires the user to perform two sequential tap gestures that activate autofill.

455) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-58278)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform spoofing.

The vulnerability exists due to server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) when rendering an attacker-controlled webpage. A remote attacker can host a specially crafted website and convince a user to visit it to perform spoofing.

User interaction is required, and the user must visit the attacker-controlled webpage and perform two tap gestures that cause autofill to activate.

456) Improper Authorization (CVE-ID: CVE-2026-58284)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper authorization in Microsoft Edge (Chromium-based) when processing crafted web content or files that trigger autofill interactions. A remote attacker can host a specially crafted website or provide a specially crafted file and convince a user to interact with it to execute arbitrary code.

User interaction is required, and successful exploitation requires the victim to visit attacker-controlled content and perform two tap gestures that activate autofill. The vulnerable component and the impacted component are managed by different security authorities.

457) Type Confusion (CVE-ID: CVE-2026-58285)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) when rendering attacker-controlled web content or opening a specially crafted file. A remote attacker can host a specially crafted website or provide a specially crafted file to execute arbitrary code.

User interaction is required, and successful exploitation requires the victim to perform two sequential taps that cause autofill to activate. A successful exploit can affect resources beyond the security scope of the vulnerable component.

458) Improper access control (CVE-ID: CVE-2026-58286)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform spoofing and disclose sensitive information.

The vulnerability exists due to improper access control in Microsoft Edge (Chromium-based) when rendering attacker-controlled web content. A remote attacker can host a specially crafted website with deceptive or invisible form elements to perform spoofing and disclose sensitive information.

Successful exploitation requires crafting deceptive or invisible form elements and the user to perform two sequential taps. Malicious JavaScript code can read information in the victim's browser associated with the vulnerable URL.

459) Use-after-free (CVE-ID: CVE-2026-58288)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Microsoft Edge (Chromium-based) when rendering attacker-controlled web content. A remote attacker can host a specially crafted website and convince a user to visit it to execute arbitrary code.

User interaction is required, and successful exploitation requires the user to perform two sequential tap gestures that cause autofill to activate.

460) Type Confusion (CVE-ID: CVE-2026-58289)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) when rendering crafted web content. A remote attacker can host a specially crafted website and convince a user to view it to execute arbitrary code.

Successful exploitation requires deceptive or invisible form elements and two sequential taps by the user. An exploited vulnerability can affect resources beyond the security scope of the vulnerable component.

461) Type Confusion (CVE-ID: CVE-2026-58290)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) when rendering attacker-controlled web content or opening a specially crafted file. A remote attacker can convince a user to visit a specially crafted website or open a specially crafted file to execute arbitrary code.

Successful exploitation requires user interaction and depends on crafting deceptive or invisible form elements and having the user perform two sequential taps that activate autofill.

462) Input validation error (CVE-ID: CVE-2026-58292)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper input validation in Microsoft Edge (Chromium-based) when rendering attacker-controlled web content or opening a specially crafted file. A remote attacker can host a specially crafted website or provide a specially crafted file to execute arbitrary code.

User interaction is required, and successful exploitation requires the user to visit an attacker-controlled webpage or open crafted content. Successful exploitation also requires preparing the target environment to improve exploit reliability, and the impact may extend beyond the vulnerable component's security scope.

463) External Control of File Name or Path (CVE-ID: CVE-2026-58293)

CWE-ID: CWE-73 - External Control of File Name or Path

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to external control of file name or path in Microsoft Edge (Chromium-based) when processing attacker-controlled web content. A remote attacker can host a specially crafted website and convince a user to view it to execute arbitrary code.

Successful exploitation requires crafting deceptive or invisible form elements and the user performing two sequential taps.

464) Use-after-free (CVE-ID: CVE-2026-58294)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Microsoft Edge (Chromium-based) when rendering attacker-controlled web content. A remote attacker can host a specially crafted website or provide a crafted file to trigger the issue and execute arbitrary code.

User interaction is required, and successful exploitation requires the user to visit attacker-controlled content and perform two sequential tap gestures that activate autofill.

465) Type Confusion (CVE-ID: CVE-2026-58295)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass a security feature.

The vulnerability exists due to access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) when rendering attacker-controlled web content. A remote attacker can host a specially crafted website to bypass a security feature.

Successful exploitation can allow malicious JavaScript code to read information in the victim's browser associated with the vulnerable URL. User interaction is required to view the crafted content.

466) Exposure of Private Information ('Privacy Violation') (CVE-ID: CVE-2026-58296)

CWE-ID: CWE-359 - Exposure of Private Information ('Privacy Violation')

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to exposure of private personal information to an unauthorized actor in Microsoft Edge for Android autofill handling when the browser processes an attacker-controlled webpage. A remote attacker can craft malicious JavaScript and cause the victim to visit a crafted webpage to disclose sensitive information.

User interaction is required: the victim must visit an attacker-controlled webpage and perform two tap gestures that cause autofill to activate.

467) Exposure of Private Information ('Privacy Violation') (CVE-ID: CVE-2026-58297)

CWE-ID: CWE-359 - Exposure of Private Information ('Privacy Violation')

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to exposure of private personal information to an unauthorized actor in Microsoft Edge for Android autofill handling when visiting an attacker-controlled webpage and activating autofill. A remote attacker can use malicious JavaScript on a crafted webpage to read information associated with the vulnerable URL and send it to disclose sensitive information.

User interaction is required: the user must visit an attacker-controlled webpage and perform two tap gestures that cause autofill to activate.

468) Cross-site scripting (CVE-ID: CVE-2026-58298)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote attacker to perform spoofing.

The vulnerability exists due to cross-site scripting in Microsoft Edge (Chromium-based) when rendering a crafted web page. A remote attacker can host a specially crafted website and convince a user to view it to perform spoofing.

Information in the victim's browser associated with the vulnerable URL can be read by malicious JavaScript code and sent to the attacker. User interaction is required to visit the crafted website or URL.

469) Absolute Path Traversal (CVE-ID: CVE-2026-58300)

CWE-ID: CWE-36 - Absolute Path Traversal

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to absolute path traversal in Microsoft Edge for Android when processing path input. A remote attacker can provide a crafted path to disclose sensitive information.

470) Cross-site scripting (CVE-ID: CVE-2026-58524)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote attacker to perform spoofing.

The vulnerability exists due to cross-site scripting in Microsoft Edge (Chromium-based) when generating web pages. A remote attacker can host a specially crafted website and convince a user to visit it to perform spoofing.

User interaction is required, and the user must visit the attacker-controlled webpage and perform two tap gestures that cause autofill to activate.

471) Insufficient UI Warning of Dangerous Operations (CVE-ID: CVE-2026-58597)

CWE-ID: CWE-357 - Insufficient UI Warning of Dangerous Operations

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform spoofing.

The vulnerability exists due to insufficient ui warning of dangerous operations in Microsoft Edge (Chromium-based) when rendering an attacker-controlled webpage and activating autofill through user interaction. A remote attacker can trick the victim into visiting a crafted webpage and performing two tap gestures to perform spoofing.

Malicious JavaScript code may read information in the victim's browser associated with the vulnerable URL and send it to the attacker. User interaction is required to visit the attacker-controlled webpage and trigger autofill.

472) Exposed dangerous method or function (CVE-ID: CVE-2026-45489)

CWE-ID: CWE-749 - Exposed Dangerous Method or Function

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to exposed dangerous method or function in Microsoft Edge (Chromium-based) when handling a specially crafted URL. A remote attacker can convince a user to click a specially crafted URL to disclose sensitive information.

User interaction is required to click a specially crafted URL.

473) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-58291)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to operation on a resource after expiration or release in Microsoft Edge (Chromium-based) when rendering attacker-controlled web content. A remote attacker can host a specially crafted website and persuade a user to visit it to disclose sensitive information.

Successful exploitation requires deceptive or invisible form elements and two sequential user taps that activate autofill. The impact may extend beyond the security scope of the vulnerable component.

Remediation

Install update from vendor's website.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-58596
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-55945
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-56645
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-57975
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-57983
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-57984
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-57985
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-57987
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-57988
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-57992
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-57993
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14428
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14382
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14126
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14114
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14096
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14005
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13997
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13995
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13994
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13987
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13969
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13964
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13955
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13949
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13943
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13939
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13936
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13932
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13929
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13927
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13926
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13924
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13923
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13910
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13887
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13885
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13872
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13870
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13868
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13866
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13863
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13856
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13852
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13851
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13826
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13825
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13822
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13816
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13788
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14137
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14136
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14128
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14123
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14099
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14075
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14067
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14066
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14028
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13991
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13983
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13981
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13980
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13946
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13918
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13917
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13916
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13915
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13913
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13912
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13908
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13907
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13905
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13904
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13902
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13892
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13889
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13862
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13850
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13847
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13843
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13842
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13813
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13812
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13809
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13808
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13807
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13795
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13777
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14424
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14422
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14397
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14396
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14386
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14385
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14101
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13998
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13992
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13975
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13974
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13944
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13914
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13880
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13878
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13846
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13833
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13827
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13819
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13805
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13792
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13791
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13785
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13778
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14421
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14401
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14388
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14432
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14431
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14430
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14429
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14427
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14426
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14425
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14423
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14420
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14419
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14418
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14417
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14416
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14415
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14414
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14413
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14412
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14411
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14410
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14409
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14408
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14407
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14406
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14405
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14404
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14403
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14402
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14400
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14399
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14398
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14395
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14394
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14393
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14392
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14391
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14390
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58281
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13874
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13953
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14142
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14131
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14020
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13798
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13797
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13952
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14130
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14019
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14073
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13873
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13951
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14129
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14072
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14018
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13871
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14116
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13796
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13794
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13869
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13950
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14105
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14127
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14017
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14125
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13793
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14092
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14070
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13790
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13865
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13947
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14082
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14124
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14069
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14015
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13945
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14122
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14014
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14068
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13864
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13942
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14071
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14121
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14065
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14013
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13787
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13861
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13941
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14059
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14064
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13786
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13860
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14012
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14120
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14049
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13784
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13859
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13940
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14039
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14119
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14063
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14011
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13858
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13938
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14027
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14062
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14118
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14010
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13783
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13857
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13937
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14117
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14061
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14009
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13782
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13935
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14016
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14060
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13781
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13855
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13934
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14006
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14008
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13780
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13854
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13989
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14115
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14007
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13933
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13779
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13853
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14058
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13849
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13931
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13973
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14004
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14113
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14057
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13776
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13848
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13961
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14112
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14056
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14003
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13948
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14055
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14111
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13775
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13928
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13930
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14110
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14002
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14054
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13844
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13903
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13925
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14001
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13841
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13922
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14109
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14000
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14053
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13840
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13883
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13921
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14052
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13999
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14108
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13867
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14051
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14107
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13839
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13845
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14050
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14106
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13996
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13920
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13838
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13919
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13993
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13832
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13837
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13911
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13990
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13814
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13836
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14104
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14048
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13909
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14103
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14047
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13988
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13835
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13906
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14156
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14102
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14046
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13986
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13834
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14100
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14045
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14155
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14098
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13985
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13901
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14154
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14044
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13984
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13831
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13900
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14097
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14043
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13982
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13830
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13899
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14095
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14042
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13979
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13829
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14152
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14094
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14041
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13978
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13898
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14151
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14093
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14040
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13977
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13828
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13897
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14150
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13824
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13896
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14149
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14091
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13976
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13823
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14038
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13821
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13895
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14148
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14037
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13972
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13820
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13894
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14147
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14089
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14036
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13971
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14146
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14088
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14035
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13818
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13893
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14145
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14087
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13970
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14034
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13817
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13891
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14144
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13968
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13815
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13890
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14086
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14033
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13967
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13888
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14143
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14032
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14085
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13966
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13811
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13886
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14084
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14031
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13965
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14141
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14083
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14030
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13810
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13884
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14140
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13963
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13962
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14139
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14081
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13806
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13804
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13882
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13960
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14026
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13803
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13881
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13959
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14080
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14138
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14025
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13802
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13958
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14079
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14024
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14135
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13801
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13879
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13957
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14078
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14134
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14023
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13877
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14133
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14077
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13876
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13956
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13774
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14132
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14076
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14022
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13800
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14153
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13954
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14074
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13875
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14021
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13799
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14090
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-56646
• https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-58282
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-58283
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-58287
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-58299
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-58522
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-58523
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-45488
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-57974
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-57977
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-57981
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-57986
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-57991
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-58276
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-58278
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-58284
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-58285
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-58286
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-58288
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-58289
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-58290
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-58292
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-58293
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-58294
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-58295
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-58296
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-58297
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-58298
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-58300
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-58524
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-58597
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-45489
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-58291