Uninitialized resource in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

Cross-site scripting in WebUI in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: High)

Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Chromium CVE-2026-93385: Information leak in Paint

Chromium CVE-2026-93386: UI misrepresentation in WebAppInstalls

Chromium CVE-2026-93383: Information leak in Permissions

Chromium CVE-2026-93376: Out of bounds read in DataTransfer

Chromium CVE-2026-93387: Improper state validation in Skia

Chromium CVE-2026-93379: Incorrect authorization in ORB

Out of bounds read in WebGL in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Chromium CVE-2026-91713: Missing authorization

Chromium CVE-2026-91725: Observable discrepancy

Chromium CVE-2026-91739: Missing authorization

Chromium CVE-2026-91714: Observable discrepancy

Chromium CVE-2026-91723: Race condition

Chromium CVE-2026-91742: Confused deputy

Chromium CVE-2026-91746: Integer overflow

Chromium CVE-2026-91717: Missing authorization

Chromium CVE-2026-91740: Uninitialized resource

Chromium CVE-2026-91720: Uninitialized resource

Chromium CVE-2026-91744: Race condition

Uninitialized resource in Skia in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

Integer overflow in Skia in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

Uninitialized resource in Skia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Uninitialized resource in WebGPU in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

Missing authorization in Media in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

Chromium CVE-2026-87593: Information leak in Editing

Chromium CVE-2026-87437: Information leak in Frames