apk package

chainguard/chromium

pkg:apk/chainguard/chromium

Vulnerabilities (2,281)

CVE	Sev	CVSS	Affected versions	Fixed in	Published	Description
CVE-2026-14024	Hig	8.8	< 150.0.7871.100-r3	150.0.7871.100-r3	Jun 30, 2026	Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-14023	Med	6.5	< 150.0.7871.100-r3	150.0.7871.100-r3	Jun 30, 2026	Insufficient validation of untrusted input in SanitizerAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-14022	Med	6.5	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Insufficient validation of untrusted input in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-14019	Med	6.5	< 150.0.7871.100-r3	150.0.7871.100-r3	Jun 30, 2026	Inappropriate implementation in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-14016	Med	6.5	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Inappropriate implementation in SVG in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-14014	Med	6.5	< 150.0.7871.100-r3	150.0.7871.100-r3	Jun 30, 2026	Inappropriate implementation in Paint in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-14013	Med	4.3	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Inappropriate implementation in SVG in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-14011	Hig	8.1	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Out of bounds read in SurfaceCapture in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-14009	Hig	8.8	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Inappropriate implementation in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-14008	Med	6.5	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Uninitialized Use in WebXR in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-14007	Med	6.5	< 150.0.7871.100-r3	150.0.7871.100-r3	Jun 30, 2026	Insufficient policy enforcement in PermissionsPolicy in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-14006	Hig	8.8	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Use after free in Navigation in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-14002	Med	6.5	< 150.0.7871.100-r3	150.0.7871.100-r3	Jun 30, 2026	Inappropriate implementation in Geolocation in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-13996	Med	6.5	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Inappropriate implementation in Permissions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-13995	Med	4.3	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Insufficient validation of untrusted input in Autofill in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-13994	Med	4.3	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Inappropriate implementation in Credential Management in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-13991	Med	4.3	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-13989	Med	5.3	< 150.0.7871.100-r3	150.0.7871.100-r3	Jun 30, 2026	Inappropriate implementation in PageInfo in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-13988	Med	6.5	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Inappropriate implementation in Paint in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-13987	Med	4.3	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Incorrect security UI in Mobile in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-14024HigJun 30, 2026
affected < 150.0.7871.100-r3fixed 150.0.7871.100-r3
Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-14023MedJun 30, 2026
affected < 150.0.7871.100-r3fixed 150.0.7871.100-r3
Insufficient validation of untrusted input in SanitizerAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-14022MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Insufficient validation of untrusted input in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-14019MedJun 30, 2026
affected < 150.0.7871.100-r3fixed 150.0.7871.100-r3
Inappropriate implementation in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-14016MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Inappropriate implementation in SVG in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-14014MedJun 30, 2026
affected < 150.0.7871.100-r3fixed 150.0.7871.100-r3
Inappropriate implementation in Paint in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-14013MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Inappropriate implementation in SVG in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-14011HigJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Out of bounds read in SurfaceCapture in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-14009HigJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Inappropriate implementation in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-14008MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Uninitialized Use in WebXR in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-14007MedJun 30, 2026
affected < 150.0.7871.100-r3fixed 150.0.7871.100-r3
Insufficient policy enforcement in PermissionsPolicy in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-14006HigJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Use after free in Navigation in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-14002MedJun 30, 2026
affected < 150.0.7871.100-r3fixed 150.0.7871.100-r3
Inappropriate implementation in Geolocation in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-13996MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Inappropriate implementation in Permissions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-13995MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Insufficient validation of untrusted input in Autofill in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-13994MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Inappropriate implementation in Credential Management in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-13991MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-13989MedJun 30, 2026
affected < 150.0.7871.100-r3fixed 150.0.7871.100-r3
Inappropriate implementation in PageInfo in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-13988MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Inappropriate implementation in Paint in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-13987MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Incorrect security UI in Mobile in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

Page 27 of 115