Chromium CVE-2026-91738: Improper input validation
Chromium CVE-2026-91729: Use after free
Chromium CVE-2026-91718: Use after free
Chromium CVE-2026-91716: Use after free
Chromium CVE-2026-91749: Use after free
Chromium CVE-2026-87544: Incorrect authorization in Extensions
Chromium CVE-2026-87638: Out of bounds write in Media
Chromium CVE-2026-87529: Numeric truncation error in Media
Chromium CVE-2026-87534: Missing authorization in WebView
Chromium CVE-2026-87547: Incorrect reference resolution in FileSystem
Chromium CVE-2026-87581: Use after free in Payments
Use after free in Bluetooth in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-19175 Use after free in Payments
Buffer overflow in Dawn in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Chromium: CVE-2026-78964 Use after free in Sync
Chromium: CVE-2026-78904 Type confusion in ANGLE
Chromium: CVE-2026-79026 Use after free in Extensions
Chromium: CVE-2026-79235 Use after free in WebGL
Chromium: CVE-2026-78989 Out of bounds read in ANGLE
Incorrect authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to bypass web origin policy via a co-installed app. (Chromium security severity: Low)
Chromium: CVE-2026-79148 Off-by-one error in DevTools
Chromium: CVE-2026-15773 Use after free in Core
Chromium: CVE-2026-79111 Improper input validation in Dawn
Chromium: CVE-2026-17656 Use after free in Ozone
Buffer overflow in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Chromium: CVE-2026-17717 Integer overflow in ANGLE
Use of uninitialized variable in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Chromium: CVE-2026-84353 Use after free in Shared Tab Groups
Chromium: CVE-2026-18002 Insufficient validation of untrusted input in Google Lens
Chromium: CVE-2026-16416 Integer overflow in Chromecast