SB2026110426 - Multiple vulnerabilities in Google Chrome

Description

This security bulletin contains information about 213 vulnerabilities.

1) Buffer overflow (CVE-ID: CVE-2026-121156)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to a boundary error in Dawn in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger a buffer overflow and execute arbitrary code on the system.

2) Buffer overflow (CVE-ID: CVE-2026-121229)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to a boundary error in ANGLE in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger a buffer overflow and execute arbitrary code on the target system.

3) Use-after-free (CVE-ID: CVE-2026-121246)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the WebGL component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

4) Use-after-free (CVE-ID: CVE-2026-121035)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Prerender component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

5) Buffer overflow (CVE-ID: CVE-2026-121247)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to a boundary error in Dawn in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger a buffer overflow and execute arbitrary code on the system.

6) Use-after-free (CVE-ID: CVE-2026-121203)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Geometry component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

7) Use-after-free (CVE-ID: CVE-2026-121126)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Core component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

8) Improper Authorization (CVE-ID: CVE-2026-121107)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 7.4 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to incorrect authorization in BackgroundFetch in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and execute arbitrary code.

9) Out-of-bounds read (CVE-ID: CVE-2026-121197)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the ANGLE component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger an out-of-bounds read error and gain access to sensitive information.

10) Out-of-bounds read (CVE-ID: CVE-2026-121112)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the Permissions component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger an out-of-bounds read error and gain access to sensitive information.

11) Missing Authorization (CVE-ID: CVE-2026-121174)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to missing authorization checks in BackgroundFetch in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

12) State Issues (CVE-ID: CVE-2026-121098)

CWE-ID: CWE-371 - State Issues

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper state validation in GPU in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and execute arbitrary code on the system.

13) Buffer overflow (CVE-ID: CVE-2026-121074)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to a boundary error in GPU in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger a buffer overflow and execute arbitrary code on the target system.

14) Use of uninitialized resource (CVE-ID: CVE-2026-121173)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to usage of uninitialized resources in WebGL in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger uninitialized usage of resources and compromise the affected system.

15) Type Confusion (CVE-ID: CVE-2026-121233)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error within the CacheStorage component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

16) Out-of-bounds read (CVE-ID: CVE-2026-121140)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the Internals component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger an out-of-bounds read error and gain access to sensitive information.

17) Use of uninitialized resource (CVE-ID: CVE-2026-121095)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to usage of uninitialized resources in WebGL in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger uninitialized usage of resources and compromise the affected system.

18) Improper Authorization (CVE-ID: CVE-2026-121071)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 7.4 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to incorrect authorization in FileSystem in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and execute arbitrary code.

19) Use of uninitialized resource (CVE-ID: CVE-2026-121207)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to usage of uninitialized resources in Dawn in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger uninitialized usage of resources and compromise the affected system.

20) Use-after-free (CVE-ID: CVE-2026-121185)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the PictureInPicture component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

21) Type Confusion (CVE-ID: CVE-2026-121166)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error within the PDFium component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

22) Buffer overflow (CVE-ID: CVE-2026-121047)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to a boundary error in Media in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger a buffer overflow and execute arbitrary code on the system.

23) Improper Adherence to Coding Standards (CVE-ID: CVE-2026-121124)

CWE-ID: CWE-710 - Improper Adherence to Coding Standards

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially trigger unintended behavior in Google Chrome's XML processing; the specific security impact is not described.

The vulnerability exists due to improper adherence to coding standards in Google Chrome's XML component when processing XML content. A remote attacker can potentially supply crafted XML content to trigger unintended processing behavior, although the advisory does not specify the exploitation mechanism.

24) Use-after-free (CVE-ID: CVE-2026-121118)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the SVG component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

25) Use-after-free (CVE-ID: CVE-2026-121188)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the PerformanceAPIs component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

26) Buffer overflow (CVE-ID: CVE-2026-121113)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to a boundary error in PDFium in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger a buffer overflow and execute arbitrary code on the system.

27) Type Confusion (CVE-ID: CVE-2026-121082)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error within the V8 component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

28) Use-after-free (CVE-ID: CVE-2026-121083)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Compositing component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

29) Use-after-free (CVE-ID: CVE-2026-121179)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the PDFium component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

30) Buffer overflow (CVE-ID: CVE-2026-121180)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to a boundary error in Media in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger a buffer overflow and execute arbitrary code on the system.

31) Use-after-free (CVE-ID: CVE-2026-121181)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Editing component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

32) Type Confusion (CVE-ID: CVE-2026-121228)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error within the V8 component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

33) Use-after-free (CVE-ID: CVE-2026-121080)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Codecs component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

34) Use-after-free (CVE-ID: CVE-2026-121044)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Layout component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

35) Spoofing attack (CVE-ID: CVE-2026-121051)

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to misrepresent user interface information and potentially mislead users about the authenticity of displayed content.

The vulnerability exists due to improper representation of critical user interface information in the iOSWeb component of Google Chrome when displaying content. A remote attacker can present crafted content to potentially mislead users through deceptive interface information.

36) Information disclosure (CVE-ID: CVE-2026-121038)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose potentially sensitive information.

The vulnerability exists due to improper protection of information in the Google Chrome compositing component when performing compositing operations. A remote attacker can trigger the affected functionality to obtain information that should not be disclosed.

37) Improper privilege management (CVE-ID: CVE-2026-121090)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially gain privileges beyond intended authorization limits in Google Chrome.

The vulnerability exists due to improper privilege management in the Navigation component of Google Chrome when handling navigation operations. A remote attacker can exploit incorrect privilege handling to potentially perform operations outside intended privilege restrictions.

38) Use-after-free (CVE-ID: CVE-2026-121052)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the GPU component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

39) Out-of-bounds write (CVE-ID: CVE-2026-121037)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in ANGLE. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger out-of-bounds write and execute arbitrary code on the target system.

40) Buffer overflow (CVE-ID: CVE-2026-121086)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to a boundary error in Skia in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger a buffer overflow and execute arbitrary code on the system.

41) Use-after-free (CVE-ID: CVE-2026-121131)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Mobile component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

42) Input validation error (CVE-ID: CVE-2026-121087)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input in Mobile in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and execute arbitrary code on the system.

43) Use-after-free (CVE-ID: CVE-2026-121178)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Aura component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

44) Use-after-free (CVE-ID: CVE-2026-121100)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the DOM component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

45) Use-after-free (CVE-ID: CVE-2026-121148)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the ANGLE component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

46) Use-after-free (CVE-ID: CVE-2026-121089)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the WebGPU component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

47) Use-after-free (CVE-ID: CVE-2026-121250)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Extensions component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

48) Out-of-bounds read (CVE-ID: CVE-2026-121032)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the Skia component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger an out-of-bounds read error and gain access to sensitive information.

49) Use-after-free (CVE-ID: CVE-2026-121114)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the TabStrip component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

50) Use-after-free (CVE-ID: CVE-2026-121127)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the WebAudio component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

51) Type Confusion (CVE-ID: CVE-2026-121210)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error within the V8 component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

52) Type Confusion (CVE-ID: CVE-2026-121057)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error within the V8 component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

53) Use-after-free (CVE-ID: CVE-2026-121201)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Animation component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

54) Out-of-bounds read (CVE-ID: CVE-2026-121084)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the Skia component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger an out-of-bounds read error and gain access to sensitive information.

55) Type Confusion (CVE-ID: CVE-2026-121094)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error within the V8 component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

56) Race condition (CVE-ID: CVE-2026-121079)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to a race condition in V8 in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage and execute arbitrary code on the target system.

57) Use of uninitialized resource (CVE-ID: CVE-2026-121143)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to usage of uninitialized resources in GPU in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger uninitialized usage of resources and compromise the affected system.

58) Use-after-free (CVE-ID: CVE-2026-121097)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Printing component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

59) Use-after-free (CVE-ID: CVE-2026-121214)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Passwords component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

60) Use of Incorrectly-Resolved Name or Reference (CVE-ID: CVE-2026-121133)

CWE-ID: CWE-706 - Use of Incorrectly-Resolved Name or Reference

CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to an incorrectly resolved reference in Images in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage and overwrite arbitrary files on the system.

61) Buffer overflow (CVE-ID: CVE-2026-121249)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to a boundary error in ANGLE in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger a buffer overflow and execute arbitrary code on the system.

62) Use of uninitialized resource (CVE-ID: CVE-2026-121213)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to usage of uninitialized resources in Images in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger uninitialized usage of resources and compromise the affected system.

63) Use-after-free (CVE-ID: CVE-2026-121241)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Navigation component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

64) Protection mechanism failure (CVE-ID: CVE-2026-121224)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 7.4 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to an unspecified error in Desktop in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

65) Use-after-free (CVE-ID: CVE-2026-121117)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Paint component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

66) Use-after-free (CVE-ID: CVE-2026-121123)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Canvas component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

67) Use-after-free (CVE-ID: CVE-2026-121182)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the DOM component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

68) Use-after-free (CVE-ID: CVE-2026-121061)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Modularization component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

69) Use of uninitialized resource (CVE-ID: CVE-2026-121227)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to usage of uninitialized resources in Skia in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger uninitialized usage of resources and compromise the affected system.

70) Type Confusion (CVE-ID: CVE-2026-121226)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error within the V8 component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

71) Type Confusion (CVE-ID: CVE-2026-121068)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error within the V8 component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

72) Type Confusion (CVE-ID: CVE-2026-121137)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error within the DevTools component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

73) Out-of-bounds read (CVE-ID: CVE-2026-121160)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the Skia component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger an out-of-bounds read error and gain access to sensitive information.

74) Use-after-free (CVE-ID: CVE-2026-121036)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the CSS component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

75) Improper Authorization (CVE-ID: CVE-2026-121104)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 7.4 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to incorrect authorization in FileSystem in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and execute arbitrary code.

76) Use-after-free (CVE-ID: CVE-2026-121034)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Views component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

77) Out-of-bounds read (CVE-ID: CVE-2026-121208)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the Media component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger an out-of-bounds read error and gain access to sensitive information.

78) Use-after-free (CVE-ID: CVE-2026-121129)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the WebRTC component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

79) Use-after-free (CVE-ID: CVE-2026-121211)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the PowerBookmarks component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

80) Type Confusion (CVE-ID: CVE-2026-121078)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error within the V8 component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

81) Improper Authorization (CVE-ID: CVE-2026-121060)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 7.4 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to incorrect authorization in FileSystem in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and execute arbitrary code.

82) Use-after-free (CVE-ID: CVE-2026-121076)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the WebXR component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

83) Type Confusion (CVE-ID: CVE-2026-121221)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error within the V8 component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

84) Use-after-free (CVE-ID: CVE-2026-121119)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Controls component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

85) Multiple Interpretations of UI Input (CVE-ID: CVE-2026-121244)

CWE-ID: CWE-450 - Multiple Interpretations of UI Input

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to multiple interpretation of UI input in FileAPI in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and perform a spoofing attack.

86) Input validation error (CVE-ID: CVE-2026-121242)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to insufficient validation of user-supplied input in WebPackaging in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

87) Information disclosure (CVE-ID: CVE-2026-121105)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output in Network in Google Chrome. A remote attacker can trick the victim to open a specially crafted web page and gain access to sensitive information.

88) State Issues (CVE-ID: CVE-2026-121237)

CWE-ID: CWE-371 - State Issues

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to improper state validation in FileSystem in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

89) Missing Authorization (CVE-ID: CVE-2026-121102)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to missing authorization checks in BackgroundFetch in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

90) Input validation error (CVE-ID: CVE-2026-121120)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to insufficient validation of user-supplied input in Prerender in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

91) Information disclosure (CVE-ID: CVE-2026-121161)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output in BackgroundFetch in Google Chrome. A remote attacker can trick the victim to open a specially crafted web page and gain access to sensitive information.

92) Incorrect authorization (CVE-ID: CVE-2026-121062)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due incorrect authorization checks in API in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

93) Missing Authorization (CVE-ID: CVE-2026-121031)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to missing authorization checks in PDF in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

94) Incorrect authorization (CVE-ID: CVE-2026-121063)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due incorrect authorization checks in CacheStorage in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

95) Unintended Proxy or Intermediary (CVE-ID: CVE-2026-121108)

CWE-ID: CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to unintended forwarding of requests to an external entity in BackgroundFetch in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

96) Missing Authorization (CVE-ID: CVE-2026-121199)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to missing authorization checks in Chromoting in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

97) Information disclosure (CVE-ID: CVE-2026-121099)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output in PrivateTokens in Google Chrome. A remote attacker can trick the victim to open a specially crafted web page and gain access to sensitive information.

98) Improper privilege management (CVE-ID: CVE-2026-121196)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain elevated privileges.

The vulnerability exists due to improper privilege management in the Mobile component of Google Chrome when enforcing privilege boundaries. A remote attacker can exploit this weakness to obtain permissions beyond those intended.

99) Incorrect authorization (CVE-ID: CVE-2026-121066)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due incorrect authorization checks in Extensions in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

100) Improper resource shutdown or release (CVE-ID: CVE-2026-121256)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to improper resource release in GPU in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

101) Input validation error (CVE-ID: CVE-2026-121115)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to insufficient validation of user-supplied input in Shopping in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

102) Improper privilege management (CVE-ID: CVE-2026-121234)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to escalate privileges.

The vulnerability exists due to improper privilege management in the Contacts component of Google Chrome when enforcing privilege boundaries. A remote attacker can exploit this weakness to gain privileges beyond those intended.

103) Multiple Interpretations of UI Input (CVE-ID: CVE-2026-121177)

CWE-ID: CWE-450 - Multiple Interpretations of UI Input

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to multiple interpretation of UI input in PageInfo in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and perform a spoofing attack.

104) Incorrect authorization (CVE-ID: CVE-2026-121193)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due incorrect authorization checks in Extensions in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

105) Incorrect authorization (CVE-ID: CVE-2026-121248)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due incorrect authorization checks in API in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

106) Information disclosure (CVE-ID: CVE-2026-121106)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output in Omnibox in Google Chrome. A remote attacker can trick the victim to open a specially crafted web page and gain access to sensitive information.

107) Use of Incorrectly-Resolved Name or Reference (CVE-ID: CVE-2026-121200)

CWE-ID: CWE-706 - Use of Incorrectly-Resolved Name or Reference

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to use of incorrectly resolved reference in DevTools in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

108) Incorrect authorization (CVE-ID: CVE-2026-121039)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due incorrect authorization checks in Proxy Auth in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

109) Multiple Interpretations of UI Input (CVE-ID: CVE-2026-121122)

CWE-ID: CWE-450 - Multiple Interpretations of UI Input

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to multiple interpretation of UI input in Prompts in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and perform a spoofing attack.

110) Integer overflow (CVE-ID: CVE-2026-121219)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to a integer overflow in GPU in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage and crash the browser.

111) Incorrect authorization (CVE-ID: CVE-2026-121255)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due incorrect authorization checks in Autofill AI in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

112) Incorrect authorization (CVE-ID: CVE-2026-121231)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due incorrect authorization checks in DevTools in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

113) Incorrect authorization (CVE-ID: CVE-2026-121183)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due incorrect authorization checks in Extensions in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

114) Use of uninitialized resource (CVE-ID: CVE-2026-121072)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to use of an uninitialized resource in Skia in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

115) Incorrect authorization (CVE-ID: CVE-2026-121103)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due incorrect authorization checks in Extensions in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

116) Missing Authorization (CVE-ID: CVE-2026-121136)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to missing authorization checks in DevTools in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

117) Incorrect authorization (CVE-ID: CVE-2026-121040)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due incorrect authorization checks in Core in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

118) Incorrect authorization (CVE-ID: CVE-2026-121030)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due incorrect authorization checks in DevTools in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

119) Missing Authorization (CVE-ID: CVE-2026-121075)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to missing authorization checks in DevTools in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

120) Incorrect authorization (CVE-ID: CVE-2026-121220)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due incorrect authorization checks in Core in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

121) Resource exhaustion (CVE-ID: CVE-2026-121170)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially cause a denial of service through excessive resource consumption.

The vulnerability exists due to improper resource control in Google Chrome WebCodecs when processing media input. A remote attacker can supply crafted input that may consume excessive resources and impair browser availability.

122) Information disclosure (CVE-ID: CVE-2026-121059)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output in Core in Google Chrome. A remote attacker can trick the victim to open a specially crafted web page and gain access to sensitive information.

123) Input validation error (CVE-ID: CVE-2026-121163)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to insufficient validation of user-supplied input in Browser in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

124) Missing Authorization (CVE-ID: CVE-2026-121088)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to missing authorization checks in PerformanceAPIs in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

125) Use of uninitialized resource (CVE-ID: CVE-2026-121033)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to use of an uninitialized resource in GPU in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

126) Information disclosure (CVE-ID: CVE-2026-121254)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output in Select in Google Chrome. A remote attacker can trick the victim to open a specially crafted web page and gain access to sensitive information.

127) Incorrect authorization (CVE-ID: CVE-2026-121065)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due incorrect authorization checks in DevTools in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

128) Unintended Proxy or Intermediary (CVE-ID: CVE-2026-121171)

CWE-ID: CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to unintended forwarding of requests to an external entity in DevTools in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

129) Missing Authorization (CVE-ID: CVE-2026-121116)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to missing authorization checks in WebView in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

130) Information disclosure (CVE-ID: CVE-2026-121239)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output in Core in Google Chrome. A remote attacker can trick the victim to open a specially crafted web page and gain access to sensitive information.

131) Observable discrepancy (CVE-ID: CVE-2026-121187)

CWE-ID: CWE-203 - Observable discrepancy

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to observable discrepency in Paint in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

132) Information disclosure (CVE-ID: CVE-2026-121132)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output in V8 in Google Chrome. A remote attacker can trick the victim to open a specially crafted web page and gain access to sensitive information.

133) Multiple Interpretations of UI Input (CVE-ID: CVE-2026-121067)

CWE-ID: CWE-450 - Multiple Interpretations of UI Input

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to multiple interpretation of UI input in PermissionElement in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and perform a spoofing attack.

134) Incomplete cleanup (CVE-ID: CVE-2026-121096)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to incomplete cleanup in V8 in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage and crash the browser.

135) Out-of-bounds read (CVE-ID: CVE-2026-121184)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the Media component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger an out-of-bounds read error and gain access to sensitive information.

136) Multiple Interpretations of UI Input (CVE-ID: CVE-2026-121215)

CWE-ID: CWE-450 - Multiple Interpretations of UI Input

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to multiple interpretation of UI input in Bluetooth in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and perform a spoofing attack.

137) Incorrect authorization (CVE-ID: CVE-2026-121212)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due incorrect authorization checks in Core in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

138) Missing Authorization (CVE-ID: CVE-2026-121194)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to missing authorization checks in SiteIsolation in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

139) Use-after-free (CVE-ID: CVE-2026-121202)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within Autofill in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

140) Race condition (CVE-ID: CVE-2026-121048)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to a race condition in in V8 in Google Chrome. A remote attacker can trick the victim to open a specially crafted web page and crash the browser.

141) Use-after-free (CVE-ID: CVE-2026-121070)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within WTF in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

142) Use-after-free (CVE-ID: CVE-2026-121257)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within TabStrip in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

143) Type Confusion (CVE-ID: CVE-2026-121218)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a type confusion error within the V8 component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a type confusion error and gain access to sensitive information.

144) Incorrect authorization (CVE-ID: CVE-2026-121164)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due incorrect authorization checks in Views in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

145) Observable discrepancy (CVE-ID: CVE-2026-121223)

CWE-ID: CWE-203 - Observable discrepancy

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to observable discrepency in Media in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

146) Multiple Interpretations of UI Input (CVE-ID: CVE-2026-121186)

CWE-ID: CWE-450 - Multiple Interpretations of UI Input

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to multiple interpretation of UI input in Passwords in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and perform a spoofing attack.

147) Use of uninitialized resource (CVE-ID: CVE-2026-121176)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to use of an uninitialized resource in Media in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

148) Use-after-free (CVE-ID: CVE-2026-121128)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within Scheduling in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

149) Multiple Interpretations of UI Input (CVE-ID: CVE-2026-121216)

CWE-ID: CWE-450 - Multiple Interpretations of UI Input

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to multiple interpretation of UI input in UI in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and perform a spoofing attack.

150) Information disclosure (CVE-ID: CVE-2026-121158)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output in Paint in Google Chrome. A remote attacker can trick the victim to open a specially crafted web page and gain access to sensitive information.

151) Multiple Interpretations of UI Input (CVE-ID: CVE-2026-121110)

CWE-ID: CWE-450 - Multiple Interpretations of UI Input

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to multiple interpretation of UI input in Shopping in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and perform a spoofing attack.

152) Incorrect authorization (CVE-ID: CVE-2026-121042)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due incorrect authorization checks in Permissions in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

153) Use-after-free (CVE-ID: CVE-2026-121238)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within Source in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

154) Use-after-free (CVE-ID: CVE-2026-121077)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within Mobile in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

155) Race condition (CVE-ID: CVE-2026-121245)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to a race condition in in Autofill in Google Chrome. A remote attacker can trick the victim to open a specially crafted web page and crash the browser.

156) Out-of-bounds read (CVE-ID: CVE-2026-121049)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the V8 component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger an out-of-bounds read error and gain access to sensitive information.

157) Incorrect authorization (CVE-ID: CVE-2026-121091)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due incorrect authorization checks in Permissions in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

158) Incorrect authorization (CVE-ID: CVE-2026-121167)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due incorrect authorization checks in Permissions in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

159) Protection mechanism failure (CVE-ID: CVE-2026-121135)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to an unspecified error in Platform in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

160) Multiple Interpretations of UI Input (CVE-ID: CVE-2026-121209)

CWE-ID: CWE-450 - Multiple Interpretations of UI Input

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to multiple interpretation of UI input in Input in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and perform a spoofing attack.

161) Input validation error (CVE-ID: CVE-2026-121134)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause information loss in Google Chrome.

The vulnerability exists due to an unspecified flaw in the BackgroundFetch component when handling background fetch operations. A remote attacker can trigger the affected functionality to cause information loss, although the precise exploitation mechanism is not described.

162) Use-after-free (CVE-ID: CVE-2026-121217)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to use-after-free error in Streaming in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

163) Inadequate Encryption Strength (CVE-ID: CVE-2026-121109)

CWE-ID: CWE-326 - Inadequate Encryption Strength

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially recover sensitive information from encrypted communications.

The vulnerability exists due to inadequate encryption strength in Google Chrome's SSL functionality when protecting communications. A remote attacker can attempt cryptanalytic attacks against weakly encrypted SSL traffic to potentially recover sensitive information.

164) Information disclosure (CVE-ID: CVE-2026-121243)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to information disclosure in Frames in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

165) Multiple Interpretations of UI Input (CVE-ID: CVE-2026-121053)

CWE-ID: CWE-450 - Multiple Interpretations of UI Input

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to multiple interpretation of UI input in Transactions Platform in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and perform a spoofing attack.

166) Multiple Interpretations of UI Input (CVE-ID: CVE-2026-121190)

CWE-ID: CWE-450 - Multiple Interpretations of UI Input

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to multiple interpretation of UI input in Extensions in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and perform a spoofing attack.

167) Information disclosure (CVE-ID: CVE-2026-121125)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to information disclosure in ServiceWorker in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

168) Incorrect authorization (CVE-ID: CVE-2026-121046)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due incorrect authorization checks in WebAppInstalls in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

169) Incorrect authorization (CVE-ID: CVE-2026-121222)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due incorrect authorization checks in Forms in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

170) Incorrect authorization (CVE-ID: CVE-2026-121157)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due incorrect authorization checks in Chromoting in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

171) Information disclosure (CVE-ID: CVE-2026-121235)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to information disclosure in Paint in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

172) Incorrect authorization (CVE-ID: CVE-2026-121252)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due incorrect authorization checks in Core in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

173) Exposure of Resource to Wrong Sphere (CVE-ID: CVE-2026-121168)

CWE-ID: CWE-668 - Exposure of resource to wrong sphere

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to access improperly exposed resources, potentially disclosing information outside intended access boundaries.

The vulnerability exists due to improper resource exposure in Google Chrome DevTools when handling access to resources. A remote attacker can access exposed resources to potentially obtain information that should be restricted.

174) Multiple Interpretations of UI Input (CVE-ID: CVE-2026-121043)

CWE-ID: CWE-450 - Multiple Interpretations of UI Input

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to multiple interpretation of UI input in Payments in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and perform a spoofing attack.

175) Incorrect authorization (CVE-ID: CVE-2026-121111)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due incorrect authorization checks in HID in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

176) Observable discrepancy (CVE-ID: CVE-2026-121138)

CWE-ID: CWE-203 - Observable discrepancy

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to observable discrepency in CORS in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

177) Incomplete cleanup (CVE-ID: CVE-2026-121055)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to incomplete cleanup in DevTools in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage and crash the browser.

178) Missing Authorization (CVE-ID: CVE-2026-121101)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to missing authorization checks in DevTools in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

179) Input validation error (CVE-ID: CVE-2026-121236)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to insufficient validation of user-supplied input in Network in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

180) Multiple Interpretations of UI Input (CVE-ID: CVE-2026-121165)

CWE-ID: CWE-450 - Multiple Interpretations of UI Input

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to multiple interpretation of UI input in Mobile in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and perform a spoofing attack.

181) Missing Authorization (CVE-ID: CVE-2026-121253)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to missing authorization checks in DevTools in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

182) Incorrect authorization (CVE-ID: CVE-2026-121172)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due incorrect authorization checks in Isolated in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

183) Multiple Interpretations of UI Input (CVE-ID: CVE-2026-121206)

CWE-ID: CWE-450 - Multiple Interpretations of UI Input

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to multiple interpretation of UI input in Isolated in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and perform a spoofing attack.

184) Use-after-free (CVE-ID: CVE-2026-121189)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to use-after-free error in Browser in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

185) Multiple Interpretations of UI Input (CVE-ID: CVE-2026-121121)

CWE-ID: CWE-450 - Multiple Interpretations of UI Input

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to multiple interpretation of UI input in PageInfo in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and perform a spoofing attack.

186) Observable discrepancy (CVE-ID: CVE-2026-121130)

CWE-ID: CWE-203 - Observable discrepancy

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to observable discrepency in Forms in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

187) Missing Authorization (CVE-ID: CVE-2026-121251)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to missing authorization checks in V8 in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

188) Incorrect authorization (CVE-ID: CVE-2026-121085)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due incorrect authorization checks in WebUI in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

189) Incorrect authorization (CVE-ID: CVE-2026-121159)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due incorrect authorization checks in History in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

190) Incomplete cleanup (CVE-ID: CVE-2026-121204)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to incomplete cleanup in DevTools in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage and crash the browser.

191) Incorrect authorization (CVE-ID: CVE-2026-121205)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due incorrect authorization checks in CORS in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

192) Race condition (CVE-ID: CVE-2026-121050)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to a race condition in in Mobile in Google Chrome. A remote attacker can trick the victim to open a specially crafted web page and crash the browser.

193) Multiple Interpretations of UI Input (CVE-ID: CVE-2026-121081)

CWE-ID: CWE-450 - Multiple Interpretations of UI Input

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to multiple interpretation of UI input in Passwords in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and perform a spoofing attack.

194) Input validation error (CVE-ID: CVE-2026-121240)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to insufficient validation of user-supplied input in Variations in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

195) Unintended Proxy or Intermediary (CVE-ID: CVE-2026-121198)

CWE-ID: CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to unintended forwarding of requests to an external entity in WebUI in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

196) Incorrect authorization (CVE-ID: CVE-2026-121225)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due incorrect authorization checks in Permissions in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

197) Multiple Interpretations of UI Input (CVE-ID: CVE-2026-121162)

CWE-ID: CWE-450 - Multiple Interpretations of UI Input

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to multiple interpretation of UI input in Notifications in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and perform a spoofing attack.

198) Multiple Interpretations of UI Input (CVE-ID: CVE-2026-121045)

CWE-ID: CWE-450 - Multiple Interpretations of UI Input

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to multiple interpretation of UI input in Browser in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and perform a spoofing attack.

199) Incorrect authorization (CVE-ID: CVE-2026-121029)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due incorrect authorization checks in ORB in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

200) State Issues (CVE-ID: CVE-2026-121054)

CWE-ID: CWE-371 - State Issues

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to improper state validation in XML in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

201) Exposure of Resource to Wrong Sphere (CVE-ID: CVE-2026-121175)

CWE-ID: CWE-668 - Exposure of resource to wrong sphere

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially access resources outside their intended access boundaries.

The vulnerability exists due to improper resource exposure in Google Chrome's ORB component when handling web resources. A remote attacker can access improperly exposed resources to potentially obtain information that should be restricted.

202) Uncontrolled Recursion (CVE-ID: CVE-2026-121092)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially cause a denial of service.

The vulnerability exists due to uncontrolled recursion in the SVG processing component of Google Chrome when processing crafted SVG content. A remote attacker can induce a user to view specially crafted SVG content to trigger excessive recursive processing, potentially exhausting resources and causing a denial of service.

203) Use-after-free (CVE-ID: CVE-2026-121073)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to use-after-free error in Network in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

204) Race condition (CVE-ID: CVE-2026-121230)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to a race condition in in ANGLE in Google Chrome. A remote attacker can trick the victim to open a specially crafted web page and crash the browser.

205) Out-of-bounds read (CVE-ID: CVE-2026-121093)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to a boundary condition within the Animation component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger an out-of-bounds read error and crash the browser.

206) Missing Authorization (CVE-ID: CVE-2026-121041)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to missing authorization checks in Input in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

207) Incorrect authorization (CVE-ID: CVE-2026-121232)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due incorrect authorization checks in Core in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

208) Incorrect authorization (CVE-ID: CVE-2026-121142)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due incorrect authorization checks in Network in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

209) Use-after-free (CVE-ID: CVE-2026-121069)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to use-after-free error in Track in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

210) Missing Authorization (CVE-ID: CVE-2026-121169)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to missing authorization checks in DevTools in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

211) Input validation error (CVE-ID: CVE-2026-121064)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to insufficient validation of user-supplied input in Performance in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

212) Incorrect authorization (CVE-ID: CVE-2026-121195)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due incorrect authorization checks in TrustedTypes in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions.

213) Input validation error (CVE-ID: CVE-2026-121141)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to crash the browser.

The vulnerability exists due to insufficient validation of user-supplied input in Editing in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and crash the browser.

Remediation

Install update from vendor's website.

References

• https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html
• https://issues.chromium.org/issues/567735302
• https://issues.chromium.org/issues/562777838
• https://issues.chromium.org/issues/558870371
• https://issues.chromium.org/issues/567216197
• https://issues.chromium.org/issues/569161611
• https://issues.chromium.org/issues/571065824
• https://issues.chromium.org/issues/571284308
• https://issues.chromium.org/issues/485855931
• https://issues.chromium.org/issues/566398391
• https://issues.chromium.org/issues/40063728
• https://issues.chromium.org/issues/496008447
• https://issues.chromium.org/issues/516958782
• https://issues.chromium.org/issues/536617330
• https://issues.chromium.org/issues/550489336
• https://issues.chromium.org/issues/552757015
• https://issues.chromium.org/issues/557605839
• https://issues.chromium.org/issues/558111285
• https://issues.chromium.org/issues/561994040
• https://issues.chromium.org/issues/563359278
• https://issues.chromium.org/issues/565681453
• https://issues.chromium.org/issues/566111382
• https://issues.chromium.org/issues/566251701
• https://issues.chromium.org/issues/566313798
• https://issues.chromium.org/issues/566377255
• https://issues.chromium.org/issues/566506819
• https://issues.chromium.org/issues/567106301
• https://issues.chromium.org/issues/567222737
• https://issues.chromium.org/issues/567321055
• https://issues.chromium.org/issues/567936263
• https://issues.chromium.org/issues/567936265
• https://issues.chromium.org/issues/567936269
• https://issues.chromium.org/issues/568794851
• https://issues.chromium.org/issues/568818122
• https://issues.chromium.org/issues/568832157
• https://issues.chromium.org/issues/568901837
• https://issues.chromium.org/issues/568903801
• https://issues.chromium.org/issues/568936993
• https://issues.chromium.org/issues/569129173
• https://issues.chromium.org/issues/569415790
• https://issues.chromium.org/issues/569674218
• https://issues.chromium.org/issues/570026889
• https://issues.chromium.org/issues/570028521
• https://issues.chromium.org/issues/570029317
• https://issues.chromium.org/issues/570796613
• https://issues.chromium.org/issues/571059182
• https://issues.chromium.org/issues/571648522
• https://issues.chromium.org/issues/572991399
• https://issues.chromium.org/issues/573263908
• https://issues.chromium.org/issues/573387527
• https://issues.chromium.org/issues/573836121
• https://issues.chromium.org/issues/574021176
• https://issues.chromium.org/issues/574038247
• https://issues.chromium.org/issues/574193110
• https://issues.chromium.org/issues/574214629
• https://issues.chromium.org/issues/574339635
• https://issues.chromium.org/issues/574351803
• https://issues.chromium.org/issues/574376940
• https://issues.chromium.org/issues/574409275
• https://issues.chromium.org/issues/574412369
• https://issues.chromium.org/issues/574604188
• https://issues.chromium.org/issues/574752676
• https://issues.chromium.org/issues/574762568
• https://issues.chromium.org/issues/574791491
• https://issues.chromium.org/issues/574922421
• https://issues.chromium.org/issues/575318807
• https://issues.chromium.org/issues/576097084
• https://issues.chromium.org/issues/576169244
• https://issues.chromium.org/issues/576723181
• https://issues.chromium.org/issues/576937680
• https://issues.chromium.org/issues/577318603
• https://issues.chromium.org/issues/577327383
• https://issues.chromium.org/issues/577352626
• https://issues.chromium.org/issues/577352772
• https://issues.chromium.org/issues/577378379
• https://issues.chromium.org/issues/577400245
• https://issues.chromium.org/issues/577400880
• https://issues.chromium.org/issues/577402416
• https://issues.chromium.org/issues/577403757
• https://issues.chromium.org/issues/577719868
• https://issues.chromium.org/issues/578083257
• https://issues.chromium.org/issues/578500839
• https://issues.chromium.org/issues/578670966
• https://issues.chromium.org/issues/578688670
• https://issues.chromium.org/issues/578691880
• https://issues.chromium.org/issues/479258455
• https://issues.chromium.org/issues/566857543
• https://issues.chromium.org/issues/571058818
• https://issues.chromium.org/issues/503201581
• https://issues.chromium.org/issues/40059500
• https://issues.chromium.org/issues/492163889
• https://issues.chromium.org/issues/495903812
• https://issues.chromium.org/issues/496187630
• https://issues.chromium.org/issues/497950736
• https://issues.chromium.org/issues/499181801
• https://issues.chromium.org/issues/500171457
• https://issues.chromium.org/issues/502023614
• https://issues.chromium.org/issues/502385220
• https://issues.chromium.org/issues/505177525
• https://issues.chromium.org/issues/507351304
• https://issues.chromium.org/issues/511768565
• https://issues.chromium.org/issues/513426189
• https://issues.chromium.org/issues/513767200
• https://issues.chromium.org/issues/514077956
• https://issues.chromium.org/issues/514542988
• https://issues.chromium.org/issues/517435285
• https://issues.chromium.org/issues/517448378
• https://issues.chromium.org/issues/528485835
• https://issues.chromium.org/issues/533454968
• https://issues.chromium.org/issues/536163128
• https://issues.chromium.org/issues/536516239
• https://issues.chromium.org/issues/540020706
• https://issues.chromium.org/issues/548943621
• https://issues.chromium.org/issues/550245671
• https://issues.chromium.org/issues/553130328
• https://issues.chromium.org/issues/553138801
• https://issues.chromium.org/issues/553145250
• https://issues.chromium.org/issues/553148542
• https://issues.chromium.org/issues/553152519
• https://issues.chromium.org/issues/553154932
• https://issues.chromium.org/issues/553158297
• https://issues.chromium.org/issues/553309390
• https://issues.chromium.org/issues/553652456
• https://issues.chromium.org/issues/556221528
• https://issues.chromium.org/issues/562158081
• https://issues.chromium.org/issues/562221093
• https://issues.chromium.org/issues/562225118
• https://issues.chromium.org/issues/562233597
• https://issues.chromium.org/issues/562238690
• https://issues.chromium.org/issues/562656015
• https://issues.chromium.org/issues/563355450
• https://issues.chromium.org/issues/563359033
• https://issues.chromium.org/issues/564190098
• https://issues.chromium.org/issues/565092623
• https://issues.chromium.org/issues/565490229
• https://issues.chromium.org/issues/565681451
• https://issues.chromium.org/issues/565902952
• https://issues.chromium.org/issues/566660676
• https://issues.chromium.org/issues/566683019
• https://issues.chromium.org/issues/566935544
• https://issues.chromium.org/issues/567169222
• https://issues.chromium.org/issues/567611695
• https://issues.chromium.org/issues/567672825
• https://issues.chromium.org/issues/568010379
• https://issues.chromium.org/issues/568972388
• https://issues.chromium.org/issues/568972975
• https://issues.chromium.org/issues/568978733
• https://issues.chromium.org/issues/568986882
• https://issues.chromium.org/issues/568988525
• https://issues.chromium.org/issues/568999538
• https://issues.chromium.org/issues/569005114
• https://issues.chromium.org/issues/569006789
• https://issues.chromium.org/issues/569012366
• https://issues.chromium.org/issues/569659190
• https://issues.chromium.org/issues/570026368
• https://issues.chromium.org/issues/570029913
• https://issues.chromium.org/issues/570104009
• https://issues.chromium.org/issues/571195939
• https://issues.chromium.org/issues/571960472
• https://issues.chromium.org/issues/578671521
• https://issues.chromium.org/issues/40052279
• https://issues.chromium.org/issues/498000798
• https://issues.chromium.org/issues/500600456
• https://issues.chromium.org/issues/504234693
• https://issues.chromium.org/issues/513451861
• https://issues.chromium.org/issues/514074839
• https://issues.chromium.org/issues/514078071
• https://issues.chromium.org/issues/517434186
• https://issues.chromium.org/issues/520554677
• https://issues.chromium.org/issues/523708065
• https://issues.chromium.org/issues/533070896
• https://issues.chromium.org/issues/540040995
• https://issues.chromium.org/issues/550356947
• https://issues.chromium.org/issues/553161888
• https://issues.chromium.org/issues/553171097
• https://issues.chromium.org/issues/553249498
• https://issues.chromium.org/issues/553249728
• https://issues.chromium.org/issues/553251045
• https://issues.chromium.org/issues/553259600
• https://issues.chromium.org/issues/553260839
• https://issues.chromium.org/issues/553262220
• https://issues.chromium.org/issues/553265115
• https://issues.chromium.org/issues/553270515
• https://issues.chromium.org/issues/553289241
• https://issues.chromium.org/issues/555547989
• https://issues.chromium.org/issues/556215096
• https://issues.chromium.org/issues/556233596
• https://issues.chromium.org/issues/561672123
• https://issues.chromium.org/issues/562108905
• https://issues.chromium.org/issues/562957377
• https://issues.chromium.org/issues/562957821
• https://issues.chromium.org/issues/562957845
• https://issues.chromium.org/issues/562964684
• https://issues.chromium.org/issues/562975181
• https://issues.chromium.org/issues/563181376
• https://issues.chromium.org/issues/563340726
• https://issues.chromium.org/issues/563349192
• https://issues.chromium.org/issues/563362904
• https://issues.chromium.org/issues/563689651
• https://issues.chromium.org/issues/563877891
• https://issues.chromium.org/issues/565252325
• https://issues.chromium.org/issues/565505280
• https://issues.chromium.org/issues/565674533
• https://issues.chromium.org/issues/565797214
• https://issues.chromium.org/issues/566683383
• https://issues.chromium.org/issues/567429681
• https://issues.chromium.org/issues/567726222
• https://issues.chromium.org/issues/567846676
• https://issues.chromium.org/issues/567956457
• https://issues.chromium.org/issues/568371493
• https://issues.chromium.org/issues/569965757
• https://issues.chromium.org/issues/570558711
• https://issues.chromium.org/issues/571784617
• https://issues.chromium.org/issues/578083806