apk package
chainguard/chromium-lang
pkg:apk/chainguard/chromium-lang
Vulnerabilities (1,178)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-79244 | Hig | 8.8 | < 152.0.7977.75-r0 | 152.0.7977.75-r0 | Aug 25, 2026 | Use after free in Animation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) | |
| CVE-2026-79242 | Med | 5.3 | < 152.0.7977.75-r0 | 152.0.7977.75-r0 | Aug 25, 2026 | Observable discrepancy in HTML in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) | |
| CVE-2026-79241 | Med | 6.5 | < 152.0.7977.75-r0 | 152.0.7977.75-r0 | Aug 25, 2026 | Out of bounds read in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | |
| CVE-2026-79239 | Med | 6.5 | < 152.0.7977.75-r0 | 152.0.7977.75-r0 | Aug 25, 2026 | Out of bounds read in Tint in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low) | |
| CVE-2026-79238 | Med | 4.3 | < 152.0.7977.75-r0 | 152.0.7977.75-r0 | Aug 25, 2026 | Incorrect authorization in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Medium) | |
| CVE-2026-79237 | Med | 4.3 | < 152.0.7977.75-r0 | 152.0.7977.75-r0 | Aug 25, 2026 | Incorrect authorization in Navigation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) | |
| CVE-2026-79236 | Hig | 8.8 | < 152.0.7977.75-r0 | 152.0.7977.75-r0 | Aug 25, 2026 | Type confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | |
| CVE-2026-79235 | Cri | 9.6 | < 152.0.7977.75-r0 | 152.0.7977.75-r0 | Aug 25, 2026 | Use after free in WebGL in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | |
| CVE-2026-79234 | Med | 6.5 | < 152.0.7977.75-r0 | 152.0.7977.75-r0 | Aug 25, 2026 | Injection in CSS in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) | |
| CVE-2026-79233 | Med | 4.3 | < 152.0.7977.75-r0 | 152.0.7977.75-r0 | Aug 25, 2026 | UI misrepresentation in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low) | |
| CVE-2026-79232 | Cri | 9.6 | < 152.0.7977.75-r0 | 152.0.7977.75-r0 | Aug 25, 2026 | Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | |
| CVE-2026-79231 | Hig | 8.8 | < 152.0.7977.75-r0 | 152.0.7977.75-r0 | Aug 25, 2026 | Buffer overflow in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | |
| CVE-2026-79230 | Hig | 8.8 | < 152.0.7977.75-r0 | 152.0.7977.75-r0 | Aug 25, 2026 | Improper input validation in ANGLE in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | |
| CVE-2026-79229 | Med | 6.5 | < 152.0.7977.75-r0 | 152.0.7977.75-r0 | Aug 25, 2026 | Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | |
| CVE-2026-79228 | Low | 3.1 | < 152.0.7977.75-r0 | 152.0.7977.75-r0 | Aug 25, 2026 | Incorrect authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation into a privileged page via a crafted HTML page. (Chromium security severity: Medium) | |
| CVE-2026-79227 | Hig | 8.8 | < 152.0.7977.75-r0 | 152.0.7977.75-r0 | Aug 25, 2026 | Type confusion in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | |
| CVE-2026-79226 | Hig | 8.8 | < 152.0.7977.75-r0 | 152.0.7977.75-r0 | Aug 25, 2026 | Improper privilege management in Regional Capabilities in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium) | |
| CVE-2026-79225 | Med | 4.3 | < 152.0.7977.75-r0 | 152.0.7977.75-r0 | Aug 25, 2026 | Incorrect authorization in Browser in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via UI Interaction. (Chromium security severity: Low) | |
| CVE-2026-79224 | Hig | 8.3 | < 152.0.7977.75-r0 | 152.0.7977.75-r0 | Aug 25, 2026 | Use after free in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | |
| CVE-2026-79223 | Hig | 8.8 | < 152.0.7977.75-r0 | 152.0.7977.75-r0 | Aug 25, 2026 | Integer overflow in Chromium in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to read memory inside the sandbox via a crafted file. (Chromium security severity: Low) |
- affected < 152.0.7977.75-r0fixed 152.0.7977.75-r0
Use after free in Animation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
- affected < 152.0.7977.75-r0fixed 152.0.7977.75-r0
Observable discrepancy in HTML in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
- affected < 152.0.7977.75-r0fixed 152.0.7977.75-r0
Out of bounds read in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- affected < 152.0.7977.75-r0fixed 152.0.7977.75-r0
Out of bounds read in Tint in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
- affected < 152.0.7977.75-r0fixed 152.0.7977.75-r0
Incorrect authorization in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Medium)
- affected < 152.0.7977.75-r0fixed 152.0.7977.75-r0
Incorrect authorization in Navigation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
- affected < 152.0.7977.75-r0fixed 152.0.7977.75-r0
Type confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- affected < 152.0.7977.75-r0fixed 152.0.7977.75-r0
Use after free in WebGL in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- affected < 152.0.7977.75-r0fixed 152.0.7977.75-r0
Injection in CSS in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
- affected < 152.0.7977.75-r0fixed 152.0.7977.75-r0
UI misrepresentation in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low)
- affected < 152.0.7977.75-r0fixed 152.0.7977.75-r0
Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- affected < 152.0.7977.75-r0fixed 152.0.7977.75-r0
Buffer overflow in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- affected < 152.0.7977.75-r0fixed 152.0.7977.75-r0
Improper input validation in ANGLE in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- affected < 152.0.7977.75-r0fixed 152.0.7977.75-r0
Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- affected < 152.0.7977.75-r0fixed 152.0.7977.75-r0
Incorrect authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation into a privileged page via a crafted HTML page. (Chromium security severity: Medium)
- affected < 152.0.7977.75-r0fixed 152.0.7977.75-r0
Type confusion in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- affected < 152.0.7977.75-r0fixed 152.0.7977.75-r0
Improper privilege management in Regional Capabilities in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)
- affected < 152.0.7977.75-r0fixed 152.0.7977.75-r0
Incorrect authorization in Browser in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via UI Interaction. (Chromium security severity: Low)
- affected < 152.0.7977.75-r0fixed 152.0.7977.75-r0
Use after free in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
- affected < 152.0.7977.75-r0fixed 152.0.7977.75-r0
Integer overflow in Chromium in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to read memory inside the sandbox via a crafted file. (Chromium security severity: Low)
Page 3 of 59