CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.10)
Insufficient policy enforcement in Extensions in Google Chrome prior to version 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension.
Uninitialized Use in Skia in Google Chrome prior to version 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page.
In Google Chrome on Linux prior to version 149.0.7827.53, an out of bounds read in ANGLE allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
Inappropriate implementation in Extensions in Google Chrome prior to version 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to bypass same origin policy via a crafted Chrome Extension.
Insufficient validation of untrusted input in GPU in Google Chrome prior to version 149.0.7827.53 allowed a remote attacker who compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page.
Integer overflow in ANGLE in Google Chrome on Mac prior to version 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
Uninitialized use in Skia in Google Chrome prior to version 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Niewystarczające egzekwowanie polityki w Subresource Integrity w Google Chrome przed wersją 149.0.7827.53 umożliwiało zdalnemu atakującemu obejście polityki bezpieczeństwa treści za pomocą złośliwego ruchu sieciowego.
Inappropriate implementation in DOM in Google Chrome prior to version 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page.
Insufficient validation of untrusted input in Tab Group Sync in Google Chrome on Android prior to version 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via malicious network traffic.
In Google Chrome on Mac prior to version 149.0.7827.53, an uninitialized use in WebML allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
Inappropriate implementation in Password Manager in Google Chrome prior to version 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Insufficient validation of untrusted input in Password Manager in Google Chrome prior to version 149.0.7827.53 allowed a remote attacker to perform UI spoofing via malicious network traffic.
Insufficient validation of untrusted input in Glic in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.
Inappropriate implementation in Extensions in Google Chrome prior to version 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension.
Insufficient policy enforcement in Navigation in Google Chrome on Android prior to version 149.0.7827.53 allowed a remote attacker to bypass content security policy via a crafted HTML page.
Inappropriate implementation in WebAppInstalls in Google Chrome prior to version 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page.
Insufficient validation of untrusted input in DevTools in Google Chrome prior to version 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page.
Inappropriate implementation in Extensions in Google Chrome prior to version 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted XML file.
Inappropriate implementation in Payments in Google Chrome on Android prior to version 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform domain spoofing via a crafted HTML page.