Google Chrome for iOS contains a use-after-free vulnerability (CVE-2026-113043) in its iOSWeb component, which Google rates as Medium severity while NVD scores it 8.8 (High). A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. Exploitation requires the victim to open the page, and the attacker needs no prior access.
Google · Chrome for iOS
A use-after-free vulnerability (CWE-416) in the Extensions component of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs the victim to load a crafted HTML page, and no privileges are required. The advisory does not describe a sandbox escape, so full system compromise is not confirmed. Google rates the issue Medium, while NVD scores it 8.8 (High).
Google · Chrome
Google Chrome contains a use-after-free vulnerability in the Actor component (CVE-2026-113041, CVSS 8.8). A remote attacker can trigger it with a crafted HTML page, and successful exploitation allows arbitrary code execution inside the browser sandbox. User interaction is required, since the victim must visit the page, and no public exploit or in-the-wild exploitation has been reported.
Google · Chrome
Google Chrome has an improper input validation flaw in its Proxy component. A remote attacker can potentially execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. NVD rates it CVSS 3.1 8.8 (High), and Chrome rates it High internally. User interaction is required, and a sandbox-confined compromise is more limited than full system takeover.
Google · Chrome
Google Chrome versions before 156.0.8078.47 contain a use-after-free vulnerability in the Bookmarks component (CWE-416). A remote attacker can use a crafted HTML page to execute arbitrary code inside the browser sandbox, which is rated CVSS 8.8 by NVD. The attack requires that a user visits the malicious page, for example through a phishing link or a compromised website. Chromium rates the issue Low severity.
Google · Chrome
Research and translation in progress – available shortly.
A use-after-free flaw in the WebSockets component of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs a victim to open a crafted HTML page, for example through a malicious website or a link in a phishing email, and no login is required. NVD rates the issue CVSS 8.8 (High), while Chromium rates it Medium; no in-the-wild exploitation or public proof of concept was found.
Google · Chrome
Google Chrome before 156.0.8078.47 contains a memory corruption flaw in HTML processing. A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. The victim only needs to open the malicious page, and no login is required. Google rates the severity as Low, while the CVSS base score is 8.8.
Google · Chrome
Research and translation in progress – available shortly.
Google Chrome for desktop contains a memory corruption flaw (CWE-119) in its FileSystem component. A remote attacker can use a crafted HTML page to execute arbitrary code inside the browser sandbox. The attack requires that a user visits the malicious page, for example through a phishing link or a malicious advertisement. Chromium rates the issue Medium, while NVD scores it 8.8 (High).
Google · Chrome
Google Chrome before 156.0.8078.47 contains a use-after-free vulnerability (CWE-416) in the Streaming component. A remote attacker can use a crafted HTML page to execute arbitrary code inside the browser sandbox. User interaction is required (visiting the page), but no privileges. A full system compromise would also need a sandbox escape, which this CVE does not cover.
Google · Chrome
A memory corruption flaw in the Omnibox (address bar) of Google Chrome for Android allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs the victim to open a crafted HTML page, and no user privileges are required. NVD rates the issue 8.8 (High). No known exploitation or public proof of concept was found.
Google · Chrome for Android
Google Chrome on Windows prior to 156.0.8078.47 contains a memory corruption flaw in the Media component (CWE-119). A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. No authentication is required, but the user must open the page. Chromium rates the issue Medium; the CVSS 3.1 base score is 8.8.
Google · Chrome
Improper access control in the V8 JavaScript engine of Google Chrome allows a remote attacker to potentially bypass the web origin policy. The attacker needs a victim to open a crafted HTML page, and no authentication is required. A successful bypass could expose data across websites, for example in SaaS sessions or internal web applications used in the browser.
Google · Chrome
Improper access control in ANGLE, the graphics layer of Google Chrome, affects Chrome versions before 156.0.8078.47. A remote attacker who gets a user to open a crafted HTML page could potentially execute arbitrary code inside the browser sandbox. The sandbox is not reported as escaped, and Chromium rates the issue Low. No active exploitation or public proof of concept is known.
Google · Chrome
A use-after-free vulnerability in the Media component of Google Chrome prior to 156.0.8078.47 allows a remote attacker to execute arbitrary code inside the sandbox. The attack requires the victim to open a crafted HTML page, for example via a link or phishing message. NVD rates the issue CVSS 8.8 (High), while Chromium rates it Medium, and no in-the-wild exploitation is known.
Google · Chrome
Google Chrome versions prior to 156.0.8078.47 contain a memory corruption flaw in the WebFonts component. A remote attacker can create a crafted HTML page that may lead to arbitrary code execution inside the browser sandbox. The user must open the malicious page, and no authentication is required.
Google · Chrome
Research and translation in progress – available shortly.
A use-after-free flaw in the Input component of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs a user to visit a crafted HTML page. Chromium rates the bug with security severity Low, and CISA SSVC lists technical impact as total.
Google · Chrome
Google Chrome on desktop before 156.0.8078.47 contains a use-after-free flaw in the WebAppInstalls component (CWE-416). A remote attacker can trigger it by luring a user to a crafted HTML page, which may allow arbitrary code execution inside the browser sandbox. No account is required, but the user must open the page. The sandbox limits the impact unless the flaw is chained with a separate sandbox escape.
Google · Chrome
Improper input validation in the Extensions component of Google Chrome desktop allows a remote attacker to potentially execute arbitrary code outside the browser sandbox. The attack requires that a victim opens a crafted HTML page, for example via a link in email or chat. NVD rates the vulnerability CVSS 9.6 (critical), while Chromium rates it Low, so the severity should be checked against the vendor's own assessment.
Google · Chrome
A memory corruption flaw in PDFium, the PDF engine of Google Chrome, affects Chrome versions before 156.0.8078.47. An attacker who lures a user to a crafted HTML page may be able to execute arbitrary code inside the browser sandbox. Google rates the issue Medium; the NVD score is 8.8 because the attack requires a user to load the malicious page. No in-the-wild exploitation or public proof of concept was found.
Google · Chrome
A use-after-free flaw in the WebAppInstalls component of Google Chrome desktop allows a remote attacker to execute arbitrary code inside the browser sandbox. Exploitation requires that a user visits a crafted HTML page. The CVSS base score is 8.8 (High), and Google rates the Chromium security severity as Low.
Google · Chrome
Google Chrome versions before 156.0.8078.47 contain an improper input validation flaw in the Date component. A remote attacker can use a crafted HTML page to potentially execute arbitrary code outside the browser sandbox. The attack requires that a user visits the malicious page, and the CVSS base score is 9.6 (Critical).
Google · Chrome
Google Chrome contains a use-after-free vulnerability (CWE-416) in the component Turbolev. A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The CVSS score is 8.8 (high). The attack requires that the victim visits the malicious page, for example via a link in an email or a website.
Google · Chrome
