Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 8,163

Export CSV
CVE-2026-121184

chromium-browser: Out of bounds read in Media

Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-121128

chromium-browser: Use after free in Scheduling

Use after free in Scheduling in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-121117

chromium-browser: Use after free in Paint

Use after free in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-121078

chromium-browser: Type confusion in V8

Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-121099

chromium-browser: Information leak in PrivateTokens

Information leak in PrivateTokens in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-121198

chromium-browser: Confused deputy in WebUI

Confused deputy in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-121195

chromium-browser: Incorrect authorization in TrustedTypes

Incorrect authorization in TrustedTypes in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-121194

chromium-browser: Missing authorization in SiteIsolation

Missing authorization in SiteIsolation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted PDF file. (Chromium security severity: Medium)

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-121187

chromium-browser: Observable discrepancy in Paint

Observable discrepancy in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-121176

chromium-browser: Uninitialized resource in Media

Uninitialized resource in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-121174

chromium-browser: Missing authorization in BackgroundFetch

Missing authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-121172

chromium-browser: Incorrect authorization in Isolated

Incorrect authorization in Isolated in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-121222

chromium-browser: Incorrect authorization in Forms

Incorrect authorization in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-121217

chromium-browser: Use after free in Streaming

Use after free in Streaming in Google Chrome prior to 157.0.8103.38 allowed an adjacent attacker to execute arbitrary code inside the sandbox via crafted network traffic. (Chromium security severity: Low)

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-121216

chromium-browser: UI misrepresentation in UI

UI misrepresentation in UI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-121215

chromium-browser: UI misrepresentation in Bluetooth

UI misrepresentation in Bluetooth in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-121213

chromium-browser: Uninitialized resource in Images

Uninitialized resource in Images in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-121212

chromium-browser: Incorrect authorization in Core

Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-121211

chromium-browser: Use after free in PowerBookmarks

Use after free in PowerBookmarks in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-121206

chromium-browser: UI misrepresentation in Isolated

UI misrepresentation in Isolated in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome