apk package

wolfi/chromium-lang

pkg:apk/wolfi/chromium-lang

Vulnerabilities (1,178)

CVE	Sev	CVSS	Affected versions	Fixed in	Published	Description
CVE-2026-14004	Med	6.5	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-14002	Med	6.5	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Inappropriate implementation in Geolocation in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-14001	Med	6.1	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Inappropriate implementation in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-14000	Med	6.1	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Inappropriate implementation in XML in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-13999	Med	4.3	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Insufficient validation of untrusted input in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Medium)
CVE-2026-13997	Med	4.2	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Incorrect security UI in Extensions in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-13996	Med	6.5	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Inappropriate implementation in Permissions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-13995	Med	4.3	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Insufficient validation of untrusted input in Autofill in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-13992	Med	4.2	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Inappropriate implementation in UI in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-13991	Med	4.3	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-13989	Med	5.3	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Inappropriate implementation in PageInfo in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-13987	Med	4.3	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Incorrect security UI in Mobile in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-13986	Med	4.2	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Inappropriate implementation in Media UI in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-13985	Med	6.5	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Inappropriate implementation in MediaCapture in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-13984	Med	4.3	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Incorrect security UI in TabStrip in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-13983	Med	4.2	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medi
CVE-2026-13979	Med	4.3	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Inappropriate implementation in Paint in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-13976	Med	5.8	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Insufficient data validation in Storage in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-13974	Hig	8.1	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Integer overflow in Safe Browsing in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a malicious file. (Chromium security severity: Medium)
CVE-2026-13972	Med	4.3	< 150.0.7871.100-r2	150.0.7871.100-r2	Jun 30, 2026	Inappropriate implementation in Paint in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-14004MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-14002MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Inappropriate implementation in Geolocation in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-14001MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Inappropriate implementation in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-14000MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Inappropriate implementation in XML in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-13999MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Insufficient validation of untrusted input in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Medium)
CVE-2026-13997MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Incorrect security UI in Extensions in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-13996MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Inappropriate implementation in Permissions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-13995MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Insufficient validation of untrusted input in Autofill in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-13992MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Inappropriate implementation in UI in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-13991MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-13989MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Inappropriate implementation in PageInfo in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-13987MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Incorrect security UI in Mobile in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-13986MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Inappropriate implementation in Media UI in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-13985MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Inappropriate implementation in MediaCapture in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-13984MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Incorrect security UI in TabStrip in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-13983MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medi
CVE-2026-13979MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Inappropriate implementation in Paint in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-13976MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Insufficient data validation in Storage in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-13974HigJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Integer overflow in Safe Browsing in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a malicious file. (Chromium security severity: Medium)
CVE-2026-13972MedJun 30, 2026
affected < 150.0.7871.100-r2fixed 150.0.7871.100-r2
Inappropriate implementation in Paint in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

Page 43 of 59