apk package

wolfi/chromium

pkg:apk/wolfi/chromium

Vulnerabilities (1,378)

CVE	Sev	CVSS	KEV	Affected versions	Fixed in	Published	Description
CVE-2026-5866	Hig	8.8		< 147.0.7727.101-r0	147.0.7727.101-r0	Apr 8, 2026	Use after free in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-5865	Hig	8.8		< 147.0.7727.101-r0	147.0.7727.101-r0	Apr 8, 2026	Type Confusion in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-5864	Med	4.3		< 147.0.7727.101-r0	147.0.7727.101-r0	Apr 8, 2026	Heap buffer overflow in WebAudio in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
CVE-2026-5863	Hig	8.8		< 147.0.7727.101-r0	147.0.7727.101-r0	Apr 8, 2026	Inappropriate implementation in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-5862	Hig	8.8		< 147.0.7727.101-r0	147.0.7727.101-r0	Apr 8, 2026	Inappropriate implementation in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-5861	Hig	8.8		< 147.0.7727.101-r0	147.0.7727.101-r0	Apr 8, 2026	Use after free in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-5860	Hig	8.8		< 147.0.7727.101-r0	147.0.7727.101-r0	Apr 8, 2026	Use after free in WebRTC in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-5859	Hig	8.8		< 147.0.7727.101-r0	147.0.7727.101-r0	Apr 8, 2026	Integer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-5858	Hig	8.8		< 147.0.7727.101-r0	147.0.7727.101-r0	Apr 8, 2026	Heap buffer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-5292	Hig	8.8		< 146.0.7680.177-r0	146.0.7680.177-r0	Apr 1, 2026	Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-5290	Cri	9.6		< 146.0.7680.177-r0	146.0.7680.177-r0	Apr 1, 2026	Use after free in Compositing in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVE-2026-5289	Cri	9.6		< 146.0.7680.177-r0	146.0.7680.177-r0	Apr 1, 2026	Use after free in Navigation in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVE-2026-5286	Hig	8.8		< 146.0.7680.177-r0	146.0.7680.177-r0	Apr 1, 2026	Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
CVE-2026-5285	Hig	8.8		< 146.0.7680.177-r0	146.0.7680.177-r0	Apr 1, 2026	Use after free in WebGL in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-5284	Hig	7.5		< 146.0.7680.177-r0	146.0.7680.177-r0	Apr 1, 2026	Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
CVE-2026-5282	Hig	8.1		< 146.0.7680.177-r0	146.0.7680.177-r0	Apr 1, 2026	Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
CVE-2026-5281	Hig	8.8	KEV	< 146.0.7680.177-r0	146.0.7680.177-r0	Apr 1, 2026	Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
CVE-2026-5280	Hig	8.8		< 146.0.7680.177-r0	146.0.7680.177-r0	Apr 1, 2026	Use after free in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-5279	Hig	8.8		< 146.0.7680.177-r0	146.0.7680.177-r0	Apr 1, 2026	Object corruption in V8 in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-5278	Hig	8.8		< 146.0.7680.177-r0	146.0.7680.177-r0	Apr 1, 2026	Use after free in Web MIDI in Google Chrome on Android prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

CVE-2026-5866HigApr 8, 2026
affected < 147.0.7727.101-r0fixed 147.0.7727.101-r0
Use after free in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-5865HigApr 8, 2026
affected < 147.0.7727.101-r0fixed 147.0.7727.101-r0
Type Confusion in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-5864MedApr 8, 2026
affected < 147.0.7727.101-r0fixed 147.0.7727.101-r0
Heap buffer overflow in WebAudio in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
CVE-2026-5863HigApr 8, 2026
affected < 147.0.7727.101-r0fixed 147.0.7727.101-r0
Inappropriate implementation in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-5862HigApr 8, 2026
affected < 147.0.7727.101-r0fixed 147.0.7727.101-r0
Inappropriate implementation in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-5861HigApr 8, 2026
affected < 147.0.7727.101-r0fixed 147.0.7727.101-r0
Use after free in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-5860HigApr 8, 2026
affected < 147.0.7727.101-r0fixed 147.0.7727.101-r0
Use after free in WebRTC in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-5859HigApr 8, 2026
affected < 147.0.7727.101-r0fixed 147.0.7727.101-r0
Integer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-5858HigApr 8, 2026
affected < 147.0.7727.101-r0fixed 147.0.7727.101-r0
Heap buffer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-5292HigApr 1, 2026
affected < 146.0.7680.177-r0fixed 146.0.7680.177-r0
Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-5290CriApr 1, 2026
affected < 146.0.7680.177-r0fixed 146.0.7680.177-r0
Use after free in Compositing in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVE-2026-5289CriApr 1, 2026
affected < 146.0.7680.177-r0fixed 146.0.7680.177-r0
Use after free in Navigation in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVE-2026-5286HigApr 1, 2026
affected < 146.0.7680.177-r0fixed 146.0.7680.177-r0
Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
CVE-2026-5285HigApr 1, 2026
affected < 146.0.7680.177-r0fixed 146.0.7680.177-r0
Use after free in WebGL in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-5284HigApr 1, 2026
affected < 146.0.7680.177-r0fixed 146.0.7680.177-r0
Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
CVE-2026-5282HigApr 1, 2026
affected < 146.0.7680.177-r0fixed 146.0.7680.177-r0
Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
CVE-2026-5281HigKEVApr 1, 2026
affected < 146.0.7680.177-r0fixed 146.0.7680.177-r0
Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
CVE-2026-5280HigApr 1, 2026
affected < 146.0.7680.177-r0fixed 146.0.7680.177-r0
Use after free in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-5279HigApr 1, 2026
affected < 146.0.7680.177-r0fixed 146.0.7680.177-r0
Object corruption in V8 in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-5278HigApr 1, 2026
affected < 146.0.7680.177-r0fixed 146.0.7680.177-r0
Use after free in Web MIDI in Google Chrome on Android prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

Page 46 of 69