apk package

chainguard/chromium-lang

pkg:apk/chainguard/chromium-lang

Vulnerabilities (1,178)

CVE	Sev	CVSS	Affected versions	Fixed in	Published	Description
CVE-2026-14381	Med	6.5	< 150.0.7871.100-r2	150.0.7871.100-r2	Jul 1, 2026	Incorrect security UI in WebAppInstalls in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-14156	Med	6.5	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14155	Med	6.5	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14152	Cri	9.6	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Out of bounds read and write in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14151	Hig	8.3	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Inappropriate implementation in AI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14147	Med	6.1	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14146	Med	6.5	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14145	Med	6.1	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14143	Med	4.3	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Incorrect security UI in Passwords in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14141	Med	4.3	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Incorrect security UI in Document Picture-in-Picture in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14140	Med	4.3	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Insufficient validation of untrusted input in Input in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14136	Med	4.3	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14135	Med	5.4	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Insufficient validation of untrusted input in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14134	Med	4.3	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Inappropriate implementation in Autofill in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14133	Med	4.2	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Race in History Embeddings in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14132	Med	5.4	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Inappropriate implementation in WebXR in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14131	Med	5.4	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Insufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14128	Med	4.3	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14127	Med	4.3	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Inappropriate implementation in Printing in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14126	Med	4.3	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Incorrect security UI in UI in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-14381MedJul 1, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Incorrect security UI in WebAppInstalls in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-14156MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14155MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14152CriJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Out of bounds read and write in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14151HigJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Inappropriate implementation in AI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14147MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14146MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14145MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14143MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Incorrect security UI in Passwords in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14141MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Incorrect security UI in Document Picture-in-Picture in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14140MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Insufficient validation of untrusted input in Input in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14136MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14135MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Insufficient validation of untrusted input in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14134MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Inappropriate implementation in Autofill in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14133MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Race in History Embeddings in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14132MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Inappropriate implementation in WebXR in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14131MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Insufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14128MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14127MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Inappropriate implementation in Printing in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14126MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Incorrect security UI in UI in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low)

Page 39 of 59