Priority LOW 29
Use of released resource in Mobile in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00306 · Published 2026-09-03 · Fixed in 152.0.7977.82 CWE-672
Priority MEDIUM 43
Improper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.
CVSS 3.1CRITICAL 9.6· Network · No auth · User interaction · EPSS 0.00462 · Published 2026-09-03 · Fixed in 152.0.7977.82 CWE-20
Priority MEDIUM 40
Type confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00451 · Published 2026-09-03 · Fixed in 152.0.7977.82 CWE-843
Priority MEDIUM 40
Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00283 · Published 2026-09-03 · Partial fix · 152.0.7977.82 CWE-416
Priority MEDIUM 43
Use after free in DevTools in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.
CVSS 3.1CRITICAL 9.6· Network · No auth · User interaction · EPSS 0.00462 · Published 2026-09-03 · Fixed in 152.0.7977.82 CWE-416
Priority MEDIUM 40
Improper resource exposure in CacheStorage in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00413 · Published 2026-09-03 · Fixed in 152.0.7977.82 CWE-668
Priority MEDIUM 43
Out of bounds write in WebGL in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.
CVSS 3.1CRITICAL 9.6· Network · No auth · User interaction · EPSS 0.00462 · Published 2026-09-03 · Fixed in 152.0.7977.82 CWE-787
Priority LOW 34
Race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
CVSS 3.1HIGH 7.5· Network · No auth · User interaction · EPSS 0.00217 · Published 2026-09-03 · Fixed in 152.0.7977.82 CWE-367
Priority LOW 38
Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page.
CVSS 3.1HIGH 8.3· Network · No auth · User interaction · EPSS 0.00404 · Published 2026-09-03 · Fixed in 152.0.7977.82 CWE-416
Priority MEDIUM 46
Incomplete cleanup in Network in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to bypass system access restrictions via crafted network traffic.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00441 · Published 2026-09-03 · Fixed in 152.0.7977.82 CWE-459
Priority LOW 15
Out of bounds read in CrashReporting in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page.
CVSS 3.1LOW 3.1· Network · No auth · User interaction · EPSS 0.0023 · Published 2026-09-03 · Fixed in 152.0.7977.82 CWE-125
Priority CRITICAL 97KEV
Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.01806 · Published 2026-09-03 · Fixed in 152.0.7977.82 CWE-843