chrome android security

Chrome on Android releases before 150.0.7871.47 are affected by CVE-2026-13929. Update affected Android devices and verify that the complete installed Chrome version is 150.0.7871.47 or later. The supplied record does not establish that this CVE affects Chrome on Windows or Microsoft Edge. For...

Google Chrome on Android before version 150.0.7871.47 is affected by CVE-2026-14034, a low-severity Chromium WebXR flaw disclosed on June 30, 2026, that can let a remote attacker bypass navigation restrictions through a crafted HTML page. The important word there is not “low.” It is...

Google disclosed CVE-2026-14129 on June 30, 2026, as a low-severity Chrome for Android PreviewTab flaw fixed before version 150.0.7871.47, allowing a remote attacker to spoof browser UI if a user could be persuaded into specific gestures on a crafted page. The National Vulnerability Database...

Google and NVD published CVE-2026-11672 in June 2026 as a high-severity Chrome-on-Android GPU heap buffer overflow fixed before version 149.0.7827.103, with NVD’s initial configuration tying vulnerable Chrome builds to Android rather than listing a separate Android Chrome product CPE. The...

Google Chrome for Android versions earlier than 149.0.7827.53 are affected by CVE-2026-10959, a high-severity use-after-free flaw in the browser’s Input component disclosed on June 4, 2026, that can let a remote attacker execute code inside Chrome’s sandbox through a crafted HTML page. The bug...

Google Chrome for Android before version 149.0.7827.53 contained CVE-2026-11226, a PreviewTab policy-enforcement flaw disclosed on June 4, 2026, that could let a remote attacker bypass the browser’s same-origin policy after persuading a user to perform specific UI gestures. The vulnerability is...

Google Chrome on Android versions before 149.0.7827.53 were assigned CVE-2026-11175 on June 4, 2026, after Google disclosed that a crafted HTML page could spoof security-related UI in the browser’s Messages surface. The flaw is not a classic memory-corruption emergency, but it lands in a class...

Google’s CVE-2026-11082 is a Chrome-on-Android GPU race condition disclosed on June 4, 2026, affecting versions before 149.0.7827.53 and potentially allowing a renderer-compromising attacker to escape the browser sandbox through a crafted HTML page. The oddity is not merely the bug; it is the...

Google assigned CVE-2026-11029 to an insufficient-input-validation flaw in Chrome’s Drag and Drop handling on Android, fixed before version 149.0.7827.53 and published by NVD on June 4, 2026, where it remains without a final NIST CVSS score. The dry wording understates the interesting part: this...