Google Security Updates - November 2026

This roundup covers 56 Google security vulnerabilities. CVSS base scores range from 8.3 to 9.6. None are reported as actively exploited at the time of release. The issues affect Android, Chrome.

Summary

CVE-2026-105769

A vulnerability exists in kaniko versions prior to 1.25.20 due to the improper use of the Azure Container Registry credential helper. The helper uses an unanchored regex to validate hostnames, allowing an attacker to supply a lookalike domain (e.g., x.azurecr.io.attacker.com) to trigger the tool into sending the build environment's Microsoft Entra ID access token to an attacker-controlled endpoint. This allows for unauthorized token exfiltration and potential downstream access to Azure resources.

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-105769

CVE-2026-28588

CVE-2026-28588 describes a logic error in the shouldBlockDirectoryFromTree function within ExternalStorageProvider.java of the Android operating system. This vulnerability allows an attacker to bypass directory protection mechanisms and gain unauthorized access to protected data, resulting in local privilege escalation without the need for additional execution privileges or user interaction.

Affected products:

• Android

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-28588

Related in this roundup: CVE-2026-28597, CVE-2026-45514, CVE-2026-49922, CVE-2026-49923, CVE-2026-49931, CVE-2026-55257, CVE-2026-55287, CVE-2026-58836, CVE-2026-58837, CVE-2026-58866, CVE-2026-58884, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58957, CVE-2026-58965, CVE-2026-58970, CVE-2026-55262.

CVE-2026-28597

CVE-2026-28597 describes a vulnerability in UriGrantsManagerService.java within the Android platform where improper input validation in writeGrantedUriPermissions enables a local privilege escalation. An attacker can exploit this flaw without user interaction or elevated execution privileges to gain unauthorized access to URI permissions.

Affected products:

• Android

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-28597

Related in this roundup: CVE-2026-28588, CVE-2026-45514, CVE-2026-49922, CVE-2026-49923, CVE-2026-49931, CVE-2026-55257, CVE-2026-55287, CVE-2026-58836, CVE-2026-58837, CVE-2026-58866, CVE-2026-58884, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58957, CVE-2026-58965, CVE-2026-58970, CVE-2026-55262.

CVE-2026-45514

A logic error within the SaveUi.java component of the Android operating system allows an attacker to bypass package installation requirements. This vulnerability permits local privilege escalation without requiring user interaction or elevated execution privileges.

Affected products:

• Android

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-45514

Related in this roundup: CVE-2026-28588, CVE-2026-28597, CVE-2026-49922, CVE-2026-49923, CVE-2026-49931, CVE-2026-55257, CVE-2026-55287, CVE-2026-58836, CVE-2026-58837, CVE-2026-58866, CVE-2026-58884, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58957, CVE-2026-58965, CVE-2026-58970, CVE-2026-55262.

CVE-2026-49922

CVE-2026-49922 describes a local privilege escalation vulnerability in ConnectionServiceWrapper.java due to a confused deputy issue within queryRemoteConnectionServices. The vulnerability allows an attacker to bypass permission checks, facilitating unauthorized access or escalation without requiring additional execution privileges or user interaction.

Affected products:

• Android

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-49922

Related in this roundup: CVE-2026-28588, CVE-2026-28597, CVE-2026-45514, CVE-2026-49923, CVE-2026-49931, CVE-2026-55257, CVE-2026-55287, CVE-2026-58836, CVE-2026-58837, CVE-2026-58866, CVE-2026-58884, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58957, CVE-2026-58965, CVE-2026-58970, CVE-2026-55262.

CVE-2026-49923

A logic error in the AccountManagerService.java component of the Android framework within the onResult method allows for a local privilege escalation. The vulnerability enables a local attacker to perform unauthorized actions by presenting misleading UI elements, bypassing the need for additional execution privileges or user interaction.

Affected products:

• Android

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-49923

Related in this roundup: CVE-2026-28588, CVE-2026-28597, CVE-2026-45514, CVE-2026-49922, CVE-2026-49931, CVE-2026-55257, CVE-2026-55287, CVE-2026-58836, CVE-2026-58837, CVE-2026-58866, CVE-2026-58884, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58957, CVE-2026-58965, CVE-2026-58970, CVE-2026-55262.

CVE-2026-49931

CVE-2026-49931 describes a vulnerability in Android's onActivityResult handling where a confused deputy flaw allows for unauthorized access to contact information from a protected profile. This local escalation of privilege vulnerability does not require user interaction or additional execution privileges to exploit.

Affected products:

• Android

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-49931

Related in this roundup: CVE-2026-28588, CVE-2026-28597, CVE-2026-45514, CVE-2026-49922, CVE-2026-49923, CVE-2026-55257, CVE-2026-55287, CVE-2026-58836, CVE-2026-58837, CVE-2026-58866, CVE-2026-58884, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58957, CVE-2026-58965, CVE-2026-58970, CVE-2026-55262.

CVE-2026-55257

A vulnerability in UsbDialogHelper.java within the Android USB dialog handling mechanism allows for local privilege escalation. The flaw stems from insufficient or misleading UI, enabling an attacker to escalate privileges without requiring user interaction or elevated execution permissions.

Affected products:

• Android

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-55257

Related in this roundup: CVE-2026-28588, CVE-2026-28597, CVE-2026-45514, CVE-2026-49922, CVE-2026-49923, CVE-2026-49931, CVE-2026-55287, CVE-2026-58836, CVE-2026-58837, CVE-2026-58866, CVE-2026-58884, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58957, CVE-2026-58965, CVE-2026-58970, CVE-2026-55262.

CVE-2026-55287

CVE-2026-55287 is a privilege escalation vulnerability within the GrantCredentialsPermissionActivity.java component of the Android operating system. A vulnerability in the onCreate method allows an attacker to deceive a user into granting unauthorized access to account credentials through a misleading or insufficient user interface. The vulnerability does not require additional execution privileges or user interaction, potentially allowing for local privilege escalation.

Affected products:

• Android

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-55287

Related in this roundup: CVE-2026-28588, CVE-2026-28597, CVE-2026-45514, CVE-2026-49922, CVE-2026-49923, CVE-2026-49931, CVE-2026-55257, CVE-2026-58836, CVE-2026-58837, CVE-2026-58866, CVE-2026-58884, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58957, CVE-2026-58965, CVE-2026-58970, CVE-2026-55262.

CVE-2026-58836

A logic error in InstallPackageHelper.java within the Android framework's handlePackagePostInstall method allows a sideloaded application to bypass Enhanced Confirmation Mode (ECM) restrictions during self-updates. This vulnerability enables a local attacker to perform privilege escalation on the affected system, leveraging existing user-level execution privileges to modify the package source.

Affected products:

• Android

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-58836

Related in this roundup: CVE-2026-28588, CVE-2026-28597, CVE-2026-45514, CVE-2026-49922, CVE-2026-49923, CVE-2026-49931, CVE-2026-55257, CVE-2026-55287, CVE-2026-58837, CVE-2026-58866, CVE-2026-58884, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58957, CVE-2026-58965, CVE-2026-58970, CVE-2026-55262.

CVE-2026-58837

CVE-2026-58837 describes a vulnerability involving a logic error that allows for unauthorized background activity launches. This flaw can be leveraged for local privilege escalation without requiring user interaction or elevated execution privileges.

Affected products:

• Android

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-58837

Related in this roundup: CVE-2026-28588, CVE-2026-28597, CVE-2026-45514, CVE-2026-49922, CVE-2026-49923, CVE-2026-49931, CVE-2026-55257, CVE-2026-55287, CVE-2026-58836, CVE-2026-58866, CVE-2026-58884, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58957, CVE-2026-58965, CVE-2026-58970, CVE-2026-55262.

CVE-2026-58866

A vulnerability in AccessibilityWindowManager.java within the Android framework allows for local privilege escalation due to a missing permission check in setAccessibilityWindowAttributes. This flaw enables a local attacker to present misleading UI components without requiring user interaction or elevated privileges, potentially leading to unauthorized actions or data access.

Affected products:

• Android

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-58866

Related in this roundup: CVE-2026-28588, CVE-2026-28597, CVE-2026-45514, CVE-2026-49922, CVE-2026-49923, CVE-2026-49931, CVE-2026-55257, CVE-2026-55287, CVE-2026-58836, CVE-2026-58837, CVE-2026-58884, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58957, CVE-2026-58965, CVE-2026-58970, CVE-2026-55262.

CVE-2026-58884

A vulnerability in WifiServiceImpl.java's startTetheredHotspotRequest method allows for a confused deputy attack, enabling a local attacker to escalate their privileges without requiring additional permissions or user interaction.

Affected products:

• Android

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-58884

Related in this roundup: CVE-2026-28588, CVE-2026-28597, CVE-2026-45514, CVE-2026-49922, CVE-2026-49923, CVE-2026-49931, CVE-2026-55257, CVE-2026-55287, CVE-2026-58836, CVE-2026-58837, CVE-2026-58866, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58957, CVE-2026-58965, CVE-2026-58970, CVE-2026-55262.

CVE-2026-58943

A vulnerability exists in AddAccountSettings.java where a confused deputy flaw allows for unauthorized background activity launches. This issue permits local privilege escalation without requiring additional execution privileges or user interaction, posing a significant risk to the affected system's security integrity.

Affected products:

• Android

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-58943

Related in this roundup: CVE-2026-28588, CVE-2026-28597, CVE-2026-45514, CVE-2026-49922, CVE-2026-49923, CVE-2026-49931, CVE-2026-55257, CVE-2026-55287, CVE-2026-58836, CVE-2026-58837, CVE-2026-58866, CVE-2026-58884, CVE-2026-58944, CVE-2026-58946, CVE-2026-58957, CVE-2026-58965, CVE-2026-58970, CVE-2026-55262.

CVE-2026-58944

CVE-2026-58944 describes a vulnerability in ActivityTaskManagerService.java involving a background application launch (BAL) issue caused by a confused deputy condition. This flaw allows a local attacker to achieve privilege escalation without requiring special execution permissions or user interaction.

Affected products:

• Android

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-58944

Related in this roundup: CVE-2026-28588, CVE-2026-28597, CVE-2026-45514, CVE-2026-49922, CVE-2026-49923, CVE-2026-49931, CVE-2026-55257, CVE-2026-55287, CVE-2026-58836, CVE-2026-58837, CVE-2026-58866, CVE-2026-58884, CVE-2026-58943, CVE-2026-58946, CVE-2026-58957, CVE-2026-58965, CVE-2026-58970, CVE-2026-55262.

CVE-2026-58946

A vulnerability in ActivityClientController.java within the Android framework allows a local user to bypass permission checks via a logic error in navigateUpTo. This flaw enables local privilege escalation without requiring additional execution privileges or user interaction, resulting in a CVSS v3.1 base score of 8.4.

Affected products:

• Android

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-58946

Related in this roundup: CVE-2026-28588, CVE-2026-28597, CVE-2026-45514, CVE-2026-49922, CVE-2026-49923, CVE-2026-49931, CVE-2026-55257, CVE-2026-55287, CVE-2026-58836, CVE-2026-58837, CVE-2026-58866, CVE-2026-58884, CVE-2026-58943, CVE-2026-58944, CVE-2026-58957, CVE-2026-58965, CVE-2026-58970, CVE-2026-55262.

CVE-2026-58957

CVE-2026-58957 is a local privilege escalation vulnerability in the Android ActivityStarter component. A confused deputy issue within the resolveToHeavyWeightSwitcherIfNeeded method allows for unauthorized background activity launches without user interaction or elevated execution privileges.

Affected products:

• Android

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-58957

Related in this roundup: CVE-2026-28588, CVE-2026-28597, CVE-2026-45514, CVE-2026-49922, CVE-2026-49923, CVE-2026-49931, CVE-2026-55257, CVE-2026-55287, CVE-2026-58836, CVE-2026-58837, CVE-2026-58866, CVE-2026-58884, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58965, CVE-2026-58970, CVE-2026-55262.

CVE-2026-58965

CVE-2026-58965 describes a vulnerability in the handleAudioEffectBroadcast method within MusicFxHelper.java on the Android platform. The issue arises from a confused deputy condition, allowing an attacker to bypass permission checks. This vulnerability facilitates local privilege escalation without requiring user interaction or elevated execution privileges.

Affected products:

• Android

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-58965

Related in this roundup: CVE-2026-28588, CVE-2026-28597, CVE-2026-45514, CVE-2026-49922, CVE-2026-49923, CVE-2026-49931, CVE-2026-55257, CVE-2026-55287, CVE-2026-58836, CVE-2026-58837, CVE-2026-58866, CVE-2026-58884, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58957, CVE-2026-58970, CVE-2026-55262.

CVE-2026-58970

A vulnerability in AppTimeTracker.java allows a confused deputy attack, enabling local privilege escalation without user interaction or special execution privileges.

Affected products:

• Android

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-58970

Related in this roundup: CVE-2026-28588, CVE-2026-28597, CVE-2026-45514, CVE-2026-49922, CVE-2026-49923, CVE-2026-49931, CVE-2026-55257, CVE-2026-55287, CVE-2026-58836, CVE-2026-58837, CVE-2026-58866, CVE-2026-58884, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58957, CVE-2026-58965, CVE-2026-55262.

CVE-2026-55262

CVE-2026-55262 involves a policy desynchronization flaw within the NotificationManagerService of the Android operating system. The vulnerability stems from improper input validation in the setNotificationListenerAccessGrantedForUserInternal function, enabling a local attacker to escalate privileges without requiring additional execution privileges or user interaction.

Affected products:

• Android

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-55262

Related in this roundup: CVE-2026-28588, CVE-2026-28597, CVE-2026-45514, CVE-2026-49922, CVE-2026-49923, CVE-2026-49931, CVE-2026-55257, CVE-2026-55287, CVE-2026-58836, CVE-2026-58837, CVE-2026-58866, CVE-2026-58884, CVE-2026-58943, CVE-2026-58944, CVE-2026-58946, CVE-2026-58957, CVE-2026-58965, CVE-2026-58970.

CVE-2026-121030

An incorrect authorization vulnerability in the DevTools component of Google Chrome prior to version 157.0.8103.38 could allow a remote attacker to achieve arbitrary code execution outside the browser sandbox. The attack requires user interaction through social engineering, specifically enticing a user to navigate to a crafted HTML page.

Affected products:

• Chrome (< 157.0.8103.38)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121030

Related in this roundup: CVE-2026-121035, CVE-2026-121036, CVE-2026-121037, CVE-2026-121047, CVE-2026-121048, CVE-2026-121052, CVE-2026-121057, CVE-2026-121060, CVE-2026-121061, CVE-2026-121068, CVE-2026-121069, CVE-2026-121070, CVE-2026-121071, CVE-2026-121074, CVE-2026-121076, CVE-2026-121077, CVE-2026-121078, CVE-2026-121079, CVE-2026-121082, CVE-2026-121083, CVE-2026-121084, CVE-2026-121086, CVE-2026-121089, CVE-2026-121090, CVE-2026-121092, CVE-2026-121094, CVE-2026-121097, CVE-2026-121098, CVE-2026-121100, CVE-2026-121104, CVE-2026-121064, CVE-2026-121073, CVE-2026-121112.

CVE-2026-121034

A use-after-free vulnerability exists in the Views component of Google Chrome on Windows versions prior to 157.0.8103.38. This flaw allows a remote attacker to execute arbitrary code outside the browser sandbox by tricking a user into navigating to a crafted HTML page through social engineering.

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121034

CVE-2026-121035

A use-after-free vulnerability exists in the Prerender component of Google Chrome, specifically in versions prior to 157.0.8103.38. A remote attacker can exploit this flaw by enticing a user to visit a crafted HTML page, potentially leading to arbitrary code execution outside the browser sandbox.

Affected products:

• Chrome (< 157.0.8103.38)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121035

Related in this roundup: CVE-2026-121030, CVE-2026-121036, CVE-2026-121037, CVE-2026-121047, CVE-2026-121048, CVE-2026-121052, CVE-2026-121057, CVE-2026-121060, CVE-2026-121061, CVE-2026-121068, CVE-2026-121069, CVE-2026-121070, CVE-2026-121071, CVE-2026-121074, CVE-2026-121076, CVE-2026-121077, CVE-2026-121078, CVE-2026-121079, CVE-2026-121082, CVE-2026-121083, CVE-2026-121084, CVE-2026-121086, CVE-2026-121089, CVE-2026-121090, CVE-2026-121092, CVE-2026-121094, CVE-2026-121097, CVE-2026-121098, CVE-2026-121100, CVE-2026-121104, CVE-2026-121064, CVE-2026-121073, CVE-2026-121112.

CVE-2026-121036

A use-after-free vulnerability exists in the CSS implementation of Google Chrome versions prior to 157.0.8103.38. A remote attacker can exploit this via a specially crafted HTML page to achieve arbitrary code execution within the browser's sandbox environment.

Affected products:

• Chrome (< 157.0.8103.38)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121036

Related in this roundup: CVE-2026-121030, CVE-2026-121035, CVE-2026-121037, CVE-2026-121047, CVE-2026-121048, CVE-2026-121052, CVE-2026-121057, CVE-2026-121060, CVE-2026-121061, CVE-2026-121068, CVE-2026-121069, CVE-2026-121070, CVE-2026-121071, CVE-2026-121074, CVE-2026-121076, CVE-2026-121077, CVE-2026-121078, CVE-2026-121079, CVE-2026-121082, CVE-2026-121083, CVE-2026-121084, CVE-2026-121086, CVE-2026-121089, CVE-2026-121090, CVE-2026-121092, CVE-2026-121094, CVE-2026-121097, CVE-2026-121098, CVE-2026-121100, CVE-2026-121104, CVE-2026-121064, CVE-2026-121073, CVE-2026-121112.

CVE-2026-121037

CVE-2026-121037 describes an out-of-bounds write vulnerability within the ANGLE graphics engine in Google Chrome for Windows. The flaw allows a remote attacker to achieve arbitrary code execution outside of the browser sandbox by enticing a user to view a maliciously crafted HTML page.

Affected products:

• Chrome (< 157.0.8103.38)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121037

Related in this roundup: CVE-2026-121030, CVE-2026-121035, CVE-2026-121036, CVE-2026-121047, CVE-2026-121048, CVE-2026-121052, CVE-2026-121057, CVE-2026-121060, CVE-2026-121061, CVE-2026-121068, CVE-2026-121069, CVE-2026-121070, CVE-2026-121071, CVE-2026-121074, CVE-2026-121076, CVE-2026-121077, CVE-2026-121078, CVE-2026-121079, CVE-2026-121082, CVE-2026-121083, CVE-2026-121084, CVE-2026-121086, CVE-2026-121089, CVE-2026-121090, CVE-2026-121092, CVE-2026-121094, CVE-2026-121097, CVE-2026-121098, CVE-2026-121100, CVE-2026-121104, CVE-2026-121064, CVE-2026-121073, CVE-2026-121112.

CVE-2026-121044

A use-after-free vulnerability exists in the Layout component of Google Chrome prior to version 157.0.8103.38. A remote attacker could trigger this flaw by enticing a user to view a crafted HTML page, potentially leading to arbitrary code execution within the browser sandbox.

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121044

CVE-2026-121047

CVE-2026-121047 is a buffer overflow vulnerability in the Media component of Google Chrome prior to version 157.0.8103.38. A remote attacker can trigger this vulnerability by enticing a user to visit a specially crafted HTML page, potentially leading to arbitrary code execution within the browser's sandbox environment.

Affected products:

• Chrome (< 157.0.8103.38)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121047

Related in this roundup: CVE-2026-121030, CVE-2026-121035, CVE-2026-121036, CVE-2026-121037, CVE-2026-121048, CVE-2026-121052, CVE-2026-121057, CVE-2026-121060, CVE-2026-121061, CVE-2026-121068, CVE-2026-121069, CVE-2026-121070, CVE-2026-121071, CVE-2026-121074, CVE-2026-121076, CVE-2026-121077, CVE-2026-121078, CVE-2026-121079, CVE-2026-121082, CVE-2026-121083, CVE-2026-121084, CVE-2026-121086, CVE-2026-121089, CVE-2026-121090, CVE-2026-121092, CVE-2026-121094, CVE-2026-121097, CVE-2026-121098, CVE-2026-121100, CVE-2026-121104, CVE-2026-121064, CVE-2026-121073, CVE-2026-121112.

CVE-2026-121048

A race condition vulnerability exists in the V8 engine within Google Chrome versions prior to 157.0.8103.38. This flaw allows a remote attacker to execute arbitrary code within the browser sandbox by enticing a user to visit a crafted HTML page.

Affected products:

• Chrome (< 157.0.8103.38)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121048

Related in this roundup: CVE-2026-121030, CVE-2026-121035, CVE-2026-121036, CVE-2026-121037, CVE-2026-121047, CVE-2026-121052, CVE-2026-121057, CVE-2026-121060, CVE-2026-121061, CVE-2026-121068, CVE-2026-121069, CVE-2026-121070, CVE-2026-121071, CVE-2026-121074, CVE-2026-121076, CVE-2026-121077, CVE-2026-121078, CVE-2026-121079, CVE-2026-121082, CVE-2026-121083, CVE-2026-121084, CVE-2026-121086, CVE-2026-121089, CVE-2026-121090, CVE-2026-121092, CVE-2026-121094, CVE-2026-121097, CVE-2026-121098, CVE-2026-121100, CVE-2026-121104, CVE-2026-121064, CVE-2026-121073, CVE-2026-121112.

CVE-2026-121052

A use-after-free vulnerability exists in the GPU component of Google Chrome prior to version 157.0.8103.38. A remote attacker could exploit this vulnerability by enticing a user to visit a crafted HTML page, potentially leading to arbitrary code execution within the browser's sandbox.

Affected products:

• Chrome (< 157.0.8103.38)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121052

Related in this roundup: CVE-2026-121030, CVE-2026-121035, CVE-2026-121036, CVE-2026-121037, CVE-2026-121047, CVE-2026-121048, CVE-2026-121057, CVE-2026-121060, CVE-2026-121061, CVE-2026-121068, CVE-2026-121069, CVE-2026-121070, CVE-2026-121071, CVE-2026-121074, CVE-2026-121076, CVE-2026-121077, CVE-2026-121078, CVE-2026-121079, CVE-2026-121082, CVE-2026-121083, CVE-2026-121084, CVE-2026-121086, CVE-2026-121089, CVE-2026-121090, CVE-2026-121092, CVE-2026-121094, CVE-2026-121097, CVE-2026-121098, CVE-2026-121100, CVE-2026-121104, CVE-2026-121064, CVE-2026-121073, CVE-2026-121112.

CVE-2026-121057

A type confusion vulnerability exists in the V8 JavaScript engine within Google Chrome, which allows a remote attacker to achieve arbitrary code execution within the browser sandbox by enticing a user to visit a specially crafted HTML page.

Affected products:

• Chrome (< 157.0.8103.38)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121057

Related in this roundup: CVE-2026-121030, CVE-2026-121035, CVE-2026-121036, CVE-2026-121037, CVE-2026-121047, CVE-2026-121048, CVE-2026-121052, CVE-2026-121060, CVE-2026-121061, CVE-2026-121068, CVE-2026-121069, CVE-2026-121070, CVE-2026-121071, CVE-2026-121074, CVE-2026-121076, CVE-2026-121077, CVE-2026-121078, CVE-2026-121079, CVE-2026-121082, CVE-2026-121083, CVE-2026-121084, CVE-2026-121086, CVE-2026-121089, CVE-2026-121090, CVE-2026-121092, CVE-2026-121094, CVE-2026-121097, CVE-2026-121098, CVE-2026-121100, CVE-2026-121104, CVE-2026-121064, CVE-2026-121073, CVE-2026-121112.

CVE-2026-121060

Google Chrome versions prior to 157.0.8103.38 contain an incorrect authorization vulnerability within the FileSystem component. A remote attacker can exploit this via social engineering to achieve arbitrary code execution outside the browser sandbox by tricking a user into visiting a crafted HTML page.

Affected products:

• Chrome (< 157.0.8103.38)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121060

Related in this roundup: CVE-2026-121030, CVE-2026-121035, CVE-2026-121036, CVE-2026-121037, CVE-2026-121047, CVE-2026-121048, CVE-2026-121052, CVE-2026-121057, CVE-2026-121061, CVE-2026-121068, CVE-2026-121069, CVE-2026-121070, CVE-2026-121071, CVE-2026-121074, CVE-2026-121076, CVE-2026-121077, CVE-2026-121078, CVE-2026-121079, CVE-2026-121082, CVE-2026-121083, CVE-2026-121084, CVE-2026-121086, CVE-2026-121089, CVE-2026-121090, CVE-2026-121092, CVE-2026-121094, CVE-2026-121097, CVE-2026-121098, CVE-2026-121100, CVE-2026-121104, CVE-2026-121064, CVE-2026-121073, CVE-2026-121112.

CVE-2026-121061

A use-after-free vulnerability exists in the Modularization component of Google Chrome prior to version 157.0.8103.38. A remote attacker can exploit this via a crafted HTML page to trigger arbitrary code execution within the browser sandbox.

Affected products:

• Chrome (< 157.0.8103.38)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121061

Related in this roundup: CVE-2026-121030, CVE-2026-121035, CVE-2026-121036, CVE-2026-121037, CVE-2026-121047, CVE-2026-121048, CVE-2026-121052, CVE-2026-121057, CVE-2026-121060, CVE-2026-121068, CVE-2026-121069, CVE-2026-121070, CVE-2026-121071, CVE-2026-121074, CVE-2026-121076, CVE-2026-121077, CVE-2026-121078, CVE-2026-121079, CVE-2026-121082, CVE-2026-121083, CVE-2026-121084, CVE-2026-121086, CVE-2026-121089, CVE-2026-121090, CVE-2026-121092, CVE-2026-121094, CVE-2026-121097, CVE-2026-121098, CVE-2026-121100, CVE-2026-121104, CVE-2026-121064, CVE-2026-121073, CVE-2026-121112.

CVE-2026-121068

CVE-2026-121068 is a type confusion vulnerability residing in the V8 JavaScript engine within Google Chrome. An attacker can exploit this flaw by enticing a user to visit a specially crafted HTML page, leading to arbitrary code execution within the browser's sandbox environment.

Affected products:

• Chrome (< 157.0.8103.38)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121068

Related in this roundup: CVE-2026-121030, CVE-2026-121035, CVE-2026-121036, CVE-2026-121037, CVE-2026-121047, CVE-2026-121048, CVE-2026-121052, CVE-2026-121057, CVE-2026-121060, CVE-2026-121061, CVE-2026-121069, CVE-2026-121070, CVE-2026-121071, CVE-2026-121074, CVE-2026-121076, CVE-2026-121077, CVE-2026-121078, CVE-2026-121079, CVE-2026-121082, CVE-2026-121083, CVE-2026-121084, CVE-2026-121086, CVE-2026-121089, CVE-2026-121090, CVE-2026-121092, CVE-2026-121094, CVE-2026-121097, CVE-2026-121098, CVE-2026-121100, CVE-2026-121104, CVE-2026-121064, CVE-2026-121073, CVE-2026-121112.

CVE-2026-121069

CVE-2026-121069 is a use-after-free vulnerability located in the Track component of Google Chrome. A remote attacker can trigger this vulnerability by enticing a user to visit a crafted HTML page, potentially resulting in arbitrary code execution within the browser sandbox context.

Affected products:

• Chrome (< 157.0.8103.38)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121069

Related in this roundup: CVE-2026-121030, CVE-2026-121035, CVE-2026-121036, CVE-2026-121037, CVE-2026-121047, CVE-2026-121048, CVE-2026-121052, CVE-2026-121057, CVE-2026-121060, CVE-2026-121061, CVE-2026-121068, CVE-2026-121070, CVE-2026-121071, CVE-2026-121074, CVE-2026-121076, CVE-2026-121077, CVE-2026-121078, CVE-2026-121079, CVE-2026-121082, CVE-2026-121083, CVE-2026-121084, CVE-2026-121086, CVE-2026-121089, CVE-2026-121090, CVE-2026-121092, CVE-2026-121094, CVE-2026-121097, CVE-2026-121098, CVE-2026-121100, CVE-2026-121104, CVE-2026-121064, CVE-2026-121073, CVE-2026-121112.

CVE-2026-121070

A use-after-free vulnerability exists in the WTF (Web Template Framework) component of Google Chrome prior to version 157.0.8103.38. A remote attacker could trigger this vulnerability by enticing a user to visit a crafted HTML page, potentially leading to arbitrary code execution within the browser sandbox.

Affected products:

• Chrome (< 157.0.8103.38)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121070

Related in this roundup: CVE-2026-121030, CVE-2026-121035, CVE-2026-121036, CVE-2026-121037, CVE-2026-121047, CVE-2026-121048, CVE-2026-121052, CVE-2026-121057, CVE-2026-121060, CVE-2026-121061, CVE-2026-121068, CVE-2026-121069, CVE-2026-121071, CVE-2026-121074, CVE-2026-121076, CVE-2026-121077, CVE-2026-121078, CVE-2026-121079, CVE-2026-121082, CVE-2026-121083, CVE-2026-121084, CVE-2026-121086, CVE-2026-121089, CVE-2026-121090, CVE-2026-121092, CVE-2026-121094, CVE-2026-121097, CVE-2026-121098, CVE-2026-121100, CVE-2026-121104, CVE-2026-121064, CVE-2026-121073, CVE-2026-121112.

CVE-2026-121071

Google Chrome contains an incorrect authorization vulnerability in its FileSystem component that allows a remote attacker to execute arbitrary code outside the sandbox. Successful exploitation requires the attacker to use social engineering to convince a user to interact with a crafted HTML page.

Affected products:

• Chrome (< 157.0.8103.38)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121071

Related in this roundup: CVE-2026-121030, CVE-2026-121035, CVE-2026-121036, CVE-2026-121037, CVE-2026-121047, CVE-2026-121048, CVE-2026-121052, CVE-2026-121057, CVE-2026-121060, CVE-2026-121061, CVE-2026-121068, CVE-2026-121069, CVE-2026-121070, CVE-2026-121074, CVE-2026-121076, CVE-2026-121077, CVE-2026-121078, CVE-2026-121079, CVE-2026-121082, CVE-2026-121083, CVE-2026-121084, CVE-2026-121086, CVE-2026-121089, CVE-2026-121090, CVE-2026-121092, CVE-2026-121094, CVE-2026-121097, CVE-2026-121098, CVE-2026-121100, CVE-2026-121104, CVE-2026-121064, CVE-2026-121073, CVE-2026-121112.

CVE-2026-121074

CVE-2026-121074 is a memory corruption vulnerability within the GPU component of Google Chrome on Android. The flaw can be triggered by a remote attacker using a crafted HTML page, potentially allowing for arbitrary code execution outside of the browser's security sandbox.

Affected products:

• Chrome (< 157.0.8103.38)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121074

Related in this roundup: CVE-2026-121030, CVE-2026-121035, CVE-2026-121036, CVE-2026-121037, CVE-2026-121047, CVE-2026-121048, CVE-2026-121052, CVE-2026-121057, CVE-2026-121060, CVE-2026-121061, CVE-2026-121068, CVE-2026-121069, CVE-2026-121070, CVE-2026-121071, CVE-2026-121076, CVE-2026-121077, CVE-2026-121078, CVE-2026-121079, CVE-2026-121082, CVE-2026-121083, CVE-2026-121084, CVE-2026-121086, CVE-2026-121089, CVE-2026-121090, CVE-2026-121092, CVE-2026-121094, CVE-2026-121097, CVE-2026-121098, CVE-2026-121100, CVE-2026-121104, CVE-2026-121064, CVE-2026-121073, CVE-2026-121112.

CVE-2026-121076

A use-after-free vulnerability exists in the WebXR component of Google Chrome versions prior to 157.0.8103.38. This vulnerability can be triggered via a crafted HTML page to achieve arbitrary code execution outside the sandbox, provided a remote attacker successfully leverages social engineering to entice a user into visiting the malicious content.

Affected products:

• Chrome (< 157.0.8103.38)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121076

Related in this roundup: CVE-2026-121030, CVE-2026-121035, CVE-2026-121036, CVE-2026-121037, CVE-2026-121047, CVE-2026-121048, CVE-2026-121052, CVE-2026-121057, CVE-2026-121060, CVE-2026-121061, CVE-2026-121068, CVE-2026-121069, CVE-2026-121070, CVE-2026-121071, CVE-2026-121074, CVE-2026-121077, CVE-2026-121078, CVE-2026-121079, CVE-2026-121082, CVE-2026-121083, CVE-2026-121084, CVE-2026-121086, CVE-2026-121089, CVE-2026-121090, CVE-2026-121092, CVE-2026-121094, CVE-2026-121097, CVE-2026-121098, CVE-2026-121100, CVE-2026-121104, CVE-2026-121064, CVE-2026-121073, CVE-2026-121112.

CVE-2026-121077

A use-after-free vulnerability exists in the Mobile version of Google Chrome prior to version 157.0.8103.38. A remote attacker could exploit this vulnerability by enticing a user to navigate to a crafted HTML page through social engineering, potentially leading to arbitrary code execution outside of the browser sandbox.

Affected products:

• Chrome (< 157.0.8103.38)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121077

Related in this roundup: CVE-2026-121030, CVE-2026-121035, CVE-2026-121036, CVE-2026-121037, CVE-2026-121047, CVE-2026-121048, CVE-2026-121052, CVE-2026-121057, CVE-2026-121060, CVE-2026-121061, CVE-2026-121068, CVE-2026-121069, CVE-2026-121070, CVE-2026-121071, CVE-2026-121074, CVE-2026-121076, CVE-2026-121078, CVE-2026-121079, CVE-2026-121082, CVE-2026-121083, CVE-2026-121084, CVE-2026-121086, CVE-2026-121089, CVE-2026-121090, CVE-2026-121092, CVE-2026-121094, CVE-2026-121097, CVE-2026-121098, CVE-2026-121100, CVE-2026-121104, CVE-2026-121064, CVE-2026-121073, CVE-2026-121112.

CVE-2026-121078

A type confusion vulnerability exists in the V8 JavaScript engine within Google Chrome, prior to version 157.0.8103.38. A remote attacker could potentially exploit this flaw by enticing a user to visit a crafted HTML page, leading to arbitrary code execution within the browser sandbox.

Affected products:

• Chrome (< 157.0.8103.38)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121078

Related in this roundup: CVE-2026-121030, CVE-2026-121035, CVE-2026-121036, CVE-2026-121037, CVE-2026-121047, CVE-2026-121048, CVE-2026-121052, CVE-2026-121057, CVE-2026-121060, CVE-2026-121061, CVE-2026-121068, CVE-2026-121069, CVE-2026-121070, CVE-2026-121071, CVE-2026-121074, CVE-2026-121076, CVE-2026-121077, CVE-2026-121079, CVE-2026-121082, CVE-2026-121083, CVE-2026-121084, CVE-2026-121086, CVE-2026-121089, CVE-2026-121090, CVE-2026-121092, CVE-2026-121094, CVE-2026-121097, CVE-2026-121098, CVE-2026-121100, CVE-2026-121104, CVE-2026-121064, CVE-2026-121073, CVE-2026-121112.

CVE-2026-121079

A race condition vulnerability in the V8 JavaScript engine within Google Chrome allows a remote attacker to achieve arbitrary code execution within the sandbox by enticing a user to visit a crafted HTML page.

Affected products:

• Chrome (< 157.0.8103.38)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121079

Related in this roundup: CVE-2026-121030, CVE-2026-121035, CVE-2026-121036, CVE-2026-121037, CVE-2026-121047, CVE-2026-121048, CVE-2026-121052, CVE-2026-121057, CVE-2026-121060, CVE-2026-121061, CVE-2026-121068, CVE-2026-121069, CVE-2026-121070, CVE-2026-121071, CVE-2026-121074, CVE-2026-121076, CVE-2026-121077, CVE-2026-121078, CVE-2026-121082, CVE-2026-121083, CVE-2026-121084, CVE-2026-121086, CVE-2026-121089, CVE-2026-121090, CVE-2026-121092, CVE-2026-121094, CVE-2026-121097, CVE-2026-121098, CVE-2026-121100, CVE-2026-121104, CVE-2026-121064, CVE-2026-121073, CVE-2026-121112.

CVE-2026-121082

A type confusion vulnerability exists in the V8 JavaScript engine within Google Chrome versions prior to 157.0.8103.38. A remote attacker could trigger this vulnerability by enticing a user to visit a crafted HTML page, potentially leading to arbitrary code execution within the sandbox environment.

Affected products:

• Chrome (< 157.0.8103.38)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121082

Related in this roundup: CVE-2026-121030, CVE-2026-121035, CVE-2026-121036, CVE-2026-121037, CVE-2026-121047, CVE-2026-121048, CVE-2026-121052, CVE-2026-121057, CVE-2026-121060, CVE-2026-121061, CVE-2026-121068, CVE-2026-121069, CVE-2026-121070, CVE-2026-121071, CVE-2026-121074, CVE-2026-121076, CVE-2026-121077, CVE-2026-121078, CVE-2026-121079, CVE-2026-121083, CVE-2026-121084, CVE-2026-121086, CVE-2026-121089, CVE-2026-121090, CVE-2026-121092, CVE-2026-121094, CVE-2026-121097, CVE-2026-121098, CVE-2026-121100, CVE-2026-121104, CVE-2026-121064, CVE-2026-121073, CVE-2026-121112.

CVE-2026-121083

A use-after-free vulnerability exists in the Compositing component of Google Chrome prior to version 157.0.8103.38. This vulnerability allows a remote attacker to execute arbitrary code within the browser sandbox by enticing a user to view a specially crafted HTML page.

Affected products:

• Chrome (< 157.0.8103.38)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121083

Related in this roundup: CVE-2026-121030, CVE-2026-121035, CVE-2026-121036, CVE-2026-121037, CVE-2026-121047, CVE-2026-121048, CVE-2026-121052, CVE-2026-121057, CVE-2026-121060, CVE-2026-121061, CVE-2026-121068, CVE-2026-121069, CVE-2026-121070, CVE-2026-121071, CVE-2026-121074, CVE-2026-121076, CVE-2026-121077, CVE-2026-121078, CVE-2026-121079, CVE-2026-121082, CVE-2026-121084, CVE-2026-121086, CVE-2026-121089, CVE-2026-121090, CVE-2026-121092, CVE-2026-121094, CVE-2026-121097, CVE-2026-121098, CVE-2026-121100, CVE-2026-121104, CVE-2026-121064, CVE-2026-121073, CVE-2026-121112.

CVE-2026-121084

CVE-2026-121084 is an out-of-bounds read vulnerability in the Skia graphics library within Google Chrome. A remote attacker who has already compromised the renderer process can leverage this flaw via a crafted HTML page to achieve arbitrary code execution outside the browser sandbox.

Affected products:

• Chrome (< 157.0.8103.38)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121084

Related in this roundup: CVE-2026-121030, CVE-2026-121035, CVE-2026-121036, CVE-2026-121037, CVE-2026-121047, CVE-2026-121048, CVE-2026-121052, CVE-2026-121057, CVE-2026-121060, CVE-2026-121061, CVE-2026-121068, CVE-2026-121069, CVE-2026-121070, CVE-2026-121071, CVE-2026-121074, CVE-2026-121076, CVE-2026-121077, CVE-2026-121078, CVE-2026-121079, CVE-2026-121082, CVE-2026-121083, CVE-2026-121086, CVE-2026-121089, CVE-2026-121090, CVE-2026-121092, CVE-2026-121094, CVE-2026-121097, CVE-2026-121098, CVE-2026-121100, CVE-2026-121104, CVE-2026-121064, CVE-2026-121073, CVE-2026-121112.

CVE-2026-121086

A buffer overflow vulnerability exists in the Skia graphics library within Google Chrome versions prior to 157.0.8103.38. The vulnerability allows a remote attacker to achieve arbitrary code execution outside of the browser sandbox by enticing a user to visit a crafted HTML page.

Affected products:

• Chrome (< 157.0.8103.38)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121086

Related in this roundup: CVE-2026-121030, CVE-2026-121035, CVE-2026-121036, CVE-2026-121037, CVE-2026-121047, CVE-2026-121048, CVE-2026-121052, CVE-2026-121057, CVE-2026-121060, CVE-2026-121061, CVE-2026-121068, CVE-2026-121069, CVE-2026-121070, CVE-2026-121071, CVE-2026-121074, CVE-2026-121076, CVE-2026-121077, CVE-2026-121078, CVE-2026-121079, CVE-2026-121082, CVE-2026-121083, CVE-2026-121084, CVE-2026-121089, CVE-2026-121090, CVE-2026-121092, CVE-2026-121094, CVE-2026-121097, CVE-2026-121098, CVE-2026-121100, CVE-2026-121104, CVE-2026-121064, CVE-2026-121073, CVE-2026-121112.

CVE-2026-121089

A use-after-free vulnerability exists in the WebGPU component of Google Chrome versions prior to 157.0.8103.38. This vulnerability allows a remote attacker to achieve arbitrary code execution outside the browser sandbox by enticing a user to visit a crafted HTML page.

Affected products:

• Chrome (< 157.0.8103.38)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121089

Related in this roundup: CVE-2026-121030, CVE-2026-121035, CVE-2026-121036, CVE-2026-121037, CVE-2026-121047, CVE-2026-121048, CVE-2026-121052, CVE-2026-121057, CVE-2026-121060, CVE-2026-121061, CVE-2026-121068, CVE-2026-121069, CVE-2026-121070, CVE-2026-121071, CVE-2026-121074, CVE-2026-121076, CVE-2026-121077, CVE-2026-121078, CVE-2026-121079, CVE-2026-121082, CVE-2026-121083, CVE-2026-121084, CVE-2026-121086, CVE-2026-121090, CVE-2026-121092, CVE-2026-121094, CVE-2026-121097, CVE-2026-121098, CVE-2026-121100, CVE-2026-121104, CVE-2026-121064, CVE-2026-121073, CVE-2026-121112.

CVE-2026-121090

Google Chrome on iOS versions prior to 157.0.8103.38 contain an improper privilege management vulnerability in the Navigation component. A remote attacker who has already compromised the renderer process can leverage this flaw via a crafted HTML page to execute arbitrary code outside the application sandbox, resulting in a sandbox escape.

Affected products:

• Chrome (< 157.0.8103.38)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121090

Related in this roundup: CVE-2026-121030, CVE-2026-121035, CVE-2026-121036, CVE-2026-121037, CVE-2026-121047, CVE-2026-121048, CVE-2026-121052, CVE-2026-121057, CVE-2026-121060, CVE-2026-121061, CVE-2026-121068, CVE-2026-121069, CVE-2026-121070, CVE-2026-121071, CVE-2026-121074, CVE-2026-121076, CVE-2026-121077, CVE-2026-121078, CVE-2026-121079, CVE-2026-121082, CVE-2026-121083, CVE-2026-121084, CVE-2026-121086, CVE-2026-121089, CVE-2026-121092, CVE-2026-121094, CVE-2026-121097, CVE-2026-121098, CVE-2026-121100, CVE-2026-121104, CVE-2026-121064, CVE-2026-121073, CVE-2026-121112.

CVE-2026-121092

Google Chrome versions prior to 157.0.8103.38 contain a vulnerability involving uncontrolled recursion within the Scalable Vector Graphics (SVG) implementation. This flaw allows a remote attacker to achieve arbitrary code execution within the browser's sandbox environment by convincing a user to navigate to a specially crafted HTML page.

Affected products:

• Chrome (< 157.0.8103.38)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121092

Related in this roundup: CVE-2026-121030, CVE-2026-121035, CVE-2026-121036, CVE-2026-121037, CVE-2026-121047, CVE-2026-121048, CVE-2026-121052, CVE-2026-121057, CVE-2026-121060, CVE-2026-121061, CVE-2026-121068, CVE-2026-121069, CVE-2026-121070, CVE-2026-121071, CVE-2026-121074, CVE-2026-121076, CVE-2026-121077, CVE-2026-121078, CVE-2026-121079, CVE-2026-121082, CVE-2026-121083, CVE-2026-121084, CVE-2026-121086, CVE-2026-121089, CVE-2026-121090, CVE-2026-121094, CVE-2026-121097, CVE-2026-121098, CVE-2026-121100, CVE-2026-121104, CVE-2026-121064, CVE-2026-121073, CVE-2026-121112.

CVE-2026-121094

A type confusion vulnerability exists in the V8 JavaScript engine within Google Chrome, enabling remote code execution within the sandbox environment when a user visits a specially crafted HTML page. Detection engineers should monitor for browser processes abnormally terminating or unexpected sub-process creation following navigation to untrusted web content.

Affected products:

• Chrome (< 157.0.8103.38)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121094

Related in this roundup: CVE-2026-121030, CVE-2026-121035, CVE-2026-121036, CVE-2026-121037, CVE-2026-121047, CVE-2026-121048, CVE-2026-121052, CVE-2026-121057, CVE-2026-121060, CVE-2026-121061, CVE-2026-121068, CVE-2026-121069, CVE-2026-121070, CVE-2026-121071, CVE-2026-121074, CVE-2026-121076, CVE-2026-121077, CVE-2026-121078, CVE-2026-121079, CVE-2026-121082, CVE-2026-121083, CVE-2026-121084, CVE-2026-121086, CVE-2026-121089, CVE-2026-121090, CVE-2026-121092, CVE-2026-121097, CVE-2026-121098, CVE-2026-121100, CVE-2026-121104, CVE-2026-121064, CVE-2026-121073, CVE-2026-121112.

CVE-2026-121097

A use-after-free vulnerability exists in the Printing component of Google Chrome prior to version 157.0.8103.38. A remote attacker can trigger this vulnerability via a crafted HTML page, potentially leading to arbitrary code execution within the browser's sandbox.

Affected products:

• Chrome (< 157.0.8103.38)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121097

Related in this roundup: CVE-2026-121030, CVE-2026-121035, CVE-2026-121036, CVE-2026-121037, CVE-2026-121047, CVE-2026-121048, CVE-2026-121052, CVE-2026-121057, CVE-2026-121060, CVE-2026-121061, CVE-2026-121068, CVE-2026-121069, CVE-2026-121070, CVE-2026-121071, CVE-2026-121074, CVE-2026-121076, CVE-2026-121077, CVE-2026-121078, CVE-2026-121079, CVE-2026-121082, CVE-2026-121083, CVE-2026-121084, CVE-2026-121086, CVE-2026-121089, CVE-2026-121090, CVE-2026-121092, CVE-2026-121094, CVE-2026-121098, CVE-2026-121100, CVE-2026-121104, CVE-2026-121064, CVE-2026-121073, CVE-2026-121112.

CVE-2026-121098

CVE-2026-121098 is a high-severity vulnerability in the Google Chrome GPU process resulting from improper state validation. An attacker who has already compromised the renderer process can leverage this vulnerability via a crafted HTML page to achieve arbitrary code execution outside of the browser's sandbox.

Affected products:

• Chrome (< 157.0.8103.38)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121098

Related in this roundup: CVE-2026-121030, CVE-2026-121035, CVE-2026-121036, CVE-2026-121037, CVE-2026-121047, CVE-2026-121048, CVE-2026-121052, CVE-2026-121057, CVE-2026-121060, CVE-2026-121061, CVE-2026-121068, CVE-2026-121069, CVE-2026-121070, CVE-2026-121071, CVE-2026-121074, CVE-2026-121076, CVE-2026-121077, CVE-2026-121078, CVE-2026-121079, CVE-2026-121082, CVE-2026-121083, CVE-2026-121084, CVE-2026-121086, CVE-2026-121089, CVE-2026-121090, CVE-2026-121092, CVE-2026-121094, CVE-2026-121097, CVE-2026-121100, CVE-2026-121104, CVE-2026-121064, CVE-2026-121073, CVE-2026-121112.

CVE-2026-121100

A use-after-free vulnerability exists in the DOM component of Google Chrome prior to version 157.0.8103.38. A remote attacker can trigger this memory corruption via a specially crafted HTML page, potentially allowing for arbitrary code execution within the browser sandbox.

Affected products:

• Chrome (< 157.0.8103.38)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121100

Related in this roundup: CVE-2026-121030, CVE-2026-121035, CVE-2026-121036, CVE-2026-121037, CVE-2026-121047, CVE-2026-121048, CVE-2026-121052, CVE-2026-121057, CVE-2026-121060, CVE-2026-121061, CVE-2026-121068, CVE-2026-121069, CVE-2026-121070, CVE-2026-121071, CVE-2026-121074, CVE-2026-121076, CVE-2026-121077, CVE-2026-121078, CVE-2026-121079, CVE-2026-121082, CVE-2026-121083, CVE-2026-121084, CVE-2026-121086, CVE-2026-121089, CVE-2026-121090, CVE-2026-121092, CVE-2026-121094, CVE-2026-121097, CVE-2026-121098, CVE-2026-121104, CVE-2026-121064, CVE-2026-121073, CVE-2026-121112.

CVE-2026-121104

An incorrect authorization vulnerability exists in the FileSystem component of Google Chrome prior to version 157.0.8103.38. A remote attacker can leverage social engineering techniques to entice a user to visit a crafted HTML page, potentially allowing the execution of arbitrary code outside the browser sandbox.

Affected products:

• Chrome (< 157.0.8103.38)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121104

Related in this roundup: CVE-2026-121030, CVE-2026-121035, CVE-2026-121036, CVE-2026-121037, CVE-2026-121047, CVE-2026-121048, CVE-2026-121052, CVE-2026-121057, CVE-2026-121060, CVE-2026-121061, CVE-2026-121068, CVE-2026-121069, CVE-2026-121070, CVE-2026-121071, CVE-2026-121074, CVE-2026-121076, CVE-2026-121077, CVE-2026-121078, CVE-2026-121079, CVE-2026-121082, CVE-2026-121083, CVE-2026-121084, CVE-2026-121086, CVE-2026-121089, CVE-2026-121090, CVE-2026-121092, CVE-2026-121094, CVE-2026-121097, CVE-2026-121098, CVE-2026-121100, CVE-2026-121064, CVE-2026-121073, CVE-2026-121112.

CVE-2026-121064

CVE-2026-121064 is an improper input validation vulnerability in the Performance component of Google Chrome versions prior to 157.0.8103.38. The flaw allows a local attacker to execute arbitrary code within the browser sandbox via a malicious local program, posing a potential risk to users running outdated versions.

Affected products:

• Chrome (< 157.0.8103.38)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121064

Related in this roundup: CVE-2026-121030, CVE-2026-121035, CVE-2026-121036, CVE-2026-121037, CVE-2026-121047, CVE-2026-121048, CVE-2026-121052, CVE-2026-121057, CVE-2026-121060, CVE-2026-121061, CVE-2026-121068, CVE-2026-121069, CVE-2026-121070, CVE-2026-121071, CVE-2026-121074, CVE-2026-121076, CVE-2026-121077, CVE-2026-121078, CVE-2026-121079, CVE-2026-121082, CVE-2026-121083, CVE-2026-121084, CVE-2026-121086, CVE-2026-121089, CVE-2026-121090, CVE-2026-121092, CVE-2026-121094, CVE-2026-121097, CVE-2026-121098, CVE-2026-121100, CVE-2026-121104, CVE-2026-121073, CVE-2026-121112.

CVE-2026-121073

Google Chrome versions prior to 157.0.8103.38 contain a use-after-free vulnerability in the Network component. This flaw allows a remote attacker to achieve arbitrary code execution outside the browser sandbox by sending crafted network traffic to the victim.

Affected products:

• Chrome (< 157.0.8103.38)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121073

Related in this roundup: CVE-2026-121030, CVE-2026-121035, CVE-2026-121036, CVE-2026-121037, CVE-2026-121047, CVE-2026-121048, CVE-2026-121052, CVE-2026-121057, CVE-2026-121060, CVE-2026-121061, CVE-2026-121068, CVE-2026-121069, CVE-2026-121070, CVE-2026-121071, CVE-2026-121074, CVE-2026-121076, CVE-2026-121077, CVE-2026-121078, CVE-2026-121079, CVE-2026-121082, CVE-2026-121083, CVE-2026-121084, CVE-2026-121086, CVE-2026-121089, CVE-2026-121090, CVE-2026-121092, CVE-2026-121094, CVE-2026-121097, CVE-2026-121098, CVE-2026-121100, CVE-2026-121104, CVE-2026-121064, CVE-2026-121112.

CVE-2026-121112

Google Chrome versions prior to 157.0.8103.38 are vulnerable to an out-of-bounds read within the Permissions component. This flaw allows a remote attacker who has already compromised the renderer process to escape the sandbox and potentially execute arbitrary code on the host system via a maliciously crafted HTML page.

Affected products:

• Chrome (< 157.0.8103.38)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-121112

Related in this roundup: CVE-2026-121030, CVE-2026-121035, CVE-2026-121036, CVE-2026-121037, CVE-2026-121047, CVE-2026-121048, CVE-2026-121052, CVE-2026-121057, CVE-2026-121060, CVE-2026-121061, CVE-2026-121068, CVE-2026-121069, CVE-2026-121070, CVE-2026-121071, CVE-2026-121074, CVE-2026-121076, CVE-2026-121077, CVE-2026-121078, CVE-2026-121079, CVE-2026-121082, CVE-2026-121083, CVE-2026-121084, CVE-2026-121086, CVE-2026-121089, CVE-2026-121090, CVE-2026-121092, CVE-2026-121094, CVE-2026-121097, CVE-2026-121098, CVE-2026-121100, CVE-2026-121104, CVE-2026-121064, CVE-2026-121073.