Google Chrome before 156.0.8078.79 contains an improper input validation flaw in its Network component (CVE-2026-76029, rated High by Chromium). According to the CVE text, a remote attacker can execute arbitrary code inside the browser sandbox by sending crafted network traffic. Other sources describe a memory corruption flaw triggered by a crafted HTML page, so the exact conditions and the CVSS score of 8.8 must be verified against the NVD entry.
Google · Chrome
Google Chrome before 156.0.8078.79 contains an incorrect authorization flaw in its FileSystem component (CWE-863 in the CVE record). A remote attacker who lures a user to a crafted HTML page can, with social engineering, execute arbitrary code outside the sandbox. The CVE record rates it High (CVSS 8.8), but other sources differ on the bug class and score, so the vendor fix should be applied regardless.
Google · Chrome
Research and translation in progress – available shortly.
Google Chrome prior to 156.0.8078.79 contains an origin validation error in its Autofill feature (CWE-346, CVSS 8.8 per the supplied data). A remote attacker can use a crafted HTML page to bypass the web origin policy, and the victim must open that page. Secondary sources describe this issue as a memory corruption bug (CWE-119, VulDB CVSS 6.3), and the NVD record was still pending, so the details should be verified.
Google · Chrome
Google Chrome prior to 156.0.8078.79 contains an incorrect authorization flaw in the FileSystem component. A remote attacker can use social engineering and a crafted HTML page to execute arbitrary code outside the browser sandbox. The attack requires the victim to visit the malicious page.
Google · Chrome
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Google Chrome versions prior to 156.0.8078.79 contain an uninitialized resource flaw in the Skia graphics library. An attacker who has already compromised the renderer process can use a crafted HTML page to read memory outside the sandbox. The attack requires a user to visit the page, and the vendor rates the Chromium security severity as High. The CVE record and the research notes disagree on the weakness type (CWE-908 versus use-after-free), so the NVD record should be checked.
Google · Chrome
A flaw in the CacheStorage component of Google Chrome allows a remote attacker to obtain sensitive information via a crafted HTML page. According to the CVE record, the attacker must already have compromised the renderer process. The assessment is CVSS 8.8 (NVD status: Modified), and the Chromium severity is High.
Google · Chrome
Google Chrome before 156.0.8078.79 contains an incorrect authorization flaw in the Blink rendering engine. A remote attacker can bypass the web origin policy by luring a user to a crafted HTML page. The attack requires no login but needs the user to open the page. The official CVE record states High severity. The research notes indicate that public sources describe this CVE ID differently (use-after-free, CWE-416), so the description should be verified against NVD before client reporting.
Google · Chrome
A use-after-free flaw in the Editing component of Google Chrome before 156.0.8078.79 allows a remote attacker to execute arbitrary code inside the Chrome sandbox. The attacker needs a victim to open a crafted HTML page, so any user browsing the web is in scope. The CVE record lists CWE-416 (use-after-free), but one aggregator describes it as an integer overflow (CWE-190), so the weakness type should be verified in NVD.
Google · Chrome
A use-after-free flaw in the DOM component of Google Chrome desktop versions before 156.0.8078.79 can be exploited by a remote attacker. If a user opens a crafted HTML page, the attacker can execute arbitrary code inside the browser sandbox. Exploitation requires the victim to visit the page, and the sandbox escape needed for a full compromise is not described.
Google · Chrome
Google Chrome contains an incorrect reference resolution flaw in its Quota component (CWE-706). According to the official CVE record, a remote attacker who has already compromised the renderer process can use a crafted HTML page to potentially execute arbitrary code outside the sandbox. Exploitation requires a user to visit the page and a separate renderer compromise, so it is a chained attack. Third-party sources describe the bug as a use-after-free inside the sandbox, so the official record should be verified.
Google · Chrome
A flaw in the Quota component of Google Chrome allows incorrect reference resolution. A remote attacker who has already compromised the renderer process can use crafted network traffic to execute arbitrary code outside the sandbox. The attack requires a second, chained vulnerability to compromise the renderer first, and the record is marked as modified, so the final NVD text should be checked.
Google · Chrome
Google Chrome versions before 156.0.8078.79 contain a flaw in Dawn, the WebGPU implementation in Chromium. According to the CVE description, a remote attacker can use a crafted HTML page to potentially execute arbitrary code outside the sandbox, and user interaction is required. The sources differ on the bug class (use after free in the CVE description, memory corruption in Google's release notes) and on whether the sandbox is escaped, so this is unresolved.
Google · Chrome
A use-after-free flaw in the GarbageCollection component of Google Chrome before 156.0.8078.79 allows a remote attacker to execute arbitrary code inside the browser sandbox. The attack requires that a victim loads a crafted HTML page, for example via a malicious website, a phishing link or a malicious advertisement. The CVSS base score is 9.6 (critical), and Google rates the Chromium security severity as High.
Google · Chrome
A memory corruption flaw (out-of-bounds write) in the V8 JavaScript engine of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. An attacker needs a user to open a crafted HTML page, for example via a phishing link, a malicious advertisement or a compromised website. Code execution is limited to the sandbox; the description does not claim a full system compromise.
Google · Chrome
Improper input validation in Skia, the 2D graphics engine of Google Chrome desktop, is listed in the Chrome release notes as High severity. The supplied description calls it a buffer overflow that requires a compromised renderer process, but the release note and research notes do not confirm this, so the weakness type and preconditions must be verified on NVD. Per the description, an attacker could use a crafted HTML page to potentially execute code outside the sandbox. The CVSS score is 9.6 (critical), but the record should be checked before prioritising.
Google · Chrome
Google Chrome versions before 156.0.8078.79 contain a use-after-free flaw in the Frames component. A remote attacker can use a crafted HTML page to execute arbitrary code inside the browser sandbox. The attack requires a user to visit the malicious page, for example through a link in a phishing email.
Google · Chrome
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
The Delinea Privilege Manager Windows agent contains a flaw that allows a remote, unauthenticated attacker to execute arbitrary code as LocalSystem under certain conditions. Successful exploitation would give the attacker full control over the affected endpoint. The enabling conditions are not publicly described, and the CVSS vector (High privileges required, active user interaction) conflicts with the 'unauthenticated' claim, so the advisory needs to be verified.
Delinea · Privilege Manager
