Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 8,163

Export CSV
CVE-2026-121257

chromium-browser: Use after free in TabStrip

Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-121133

chromium-browser: Incorrect reference resolution in Images

Incorrect reference resolution in Images in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Apple Google
Products
Macos Chrome
CVE-2026-121134

chromium-browser: Information loss in BackgroundFetch

Information loss in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-121135

chromium-browser: Security issue in Platform

Security issue in Platform in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-121138

chromium-browser: Observable discrepancy in CORS

Observable discrepancy in CORS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-121141

chromium-browser: Improper input validation in Editing

Improper input validation in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-121158

chromium-browser: Information leak in Paint

Information leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-121161

chromium-browser: Information leak in BackgroundFetch

Information leak in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-121162

chromium-browser: UI misrepresentation in Notifications

UI misrepresentation in Notifications in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Google Microsoft
Products
Chrome Windows
CVE-2026-121163

chromium-browser: Improper input validation in Browser

Improper input validation in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-121165

chromium-browser: UI misrepresentation in Mobile

UI misrepresentation in Mobile in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android Chrome
CVE-2026-121199

chromium-browser: Missing authorization in Chromoting

Missing authorization in Chromoting in Google Chrome on on Mac prior to 157.0.8103.38 allowed a local attacker to obtain sensitive information via a local program. (Chromium security severity: Medium)

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Google
Products
Macos Chrome
CVE-2026-121224

chromium-browser: Security issue in Desktop

Security issue in Desktop in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Apple Google
Products
Macos Chrome
CVE-2026-120930

chromium-browser: Incorrect authorization in Blink

Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-121189

chromium-browser: Use after free in Browser

Use after free in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-121168

chromium-browser: Improper resource exposure in DevTools

Improper resource exposure in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-120931

chromium-browser: Out of bounds write in WebGL

Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android Chrome
CVE-2026-121076

chromium-browser: Use after free in WebXR

Use after free in WebXR in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-121074

chromium-browser: Memory corruption in GPU

Memory corruption in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android Chrome
CVE-2026-121071

chromium-browser: Incorrect authorization in FileSystem

Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome