sandbox escape

Google patched CVE-2026-13780 in Chrome 150.0.7871.47 for Windows and macOS after disclosing on June 30, 2026, that insufficient validation in ANGLE could let an attacker who had already compromised Chrome’s renderer escape the browser sandbox through a crafted HTML page. The NVD later rated the...

Google Chrome’s CVE-2026-13776 is a critical type-confusion flaw in the Dawn graphics layer, fixed in Chrome 150.0.7871.47 on June 30, 2026, and NVD’s change history indicates that Chrome CPE data was added even if the public page still shows a loading prompt. That is the small but important...

Google disclosed CVE-2026-11655 on June 8, 2026, as a high-severity integer overflow in Chrome’s Media component on macOS before version 149.0.7827.103, where an attacker who had already compromised the renderer could potentially escape the browser sandbox using a crafted HTML page. That...

Google’s CVE-2026-11647 is a high-severity use-after-free flaw in Chrome’s Printing component on Android, disclosed June 8, 2026, affecting versions before 149.0.7827.103 and potentially allowing a renderer-compromising attacker to escape the browser sandbox with a crafted HTML page. That is the...

Google disclosed CVE-2026-11700 on June 8, 2026, as a use-after-free flaw in Chrome’s Tracing component before version 149.0.7827.103 that could let an attacker who already compromised the renderer process attempt a sandbox escape through a crafted HTML page. That description sounds narrow...

CVE-2026-11697 is a high-severity Google Chrome vulnerability, published by NVD on June 8, 2026, affecting Chrome versions before 149.0.7827.103 on Windows, macOS, and Linux, where insufficient UI input validation could let a remote attacker attempt sandbox escape through a crafted HTML page...

CVE-2026-11682 is a high-severity Google Chrome vulnerability disclosed on June 8, 2026, affecting Chrome on Linux before the 149.0.7827.103 line and allowing a sandbox escape after renderer compromise via a crafted HTML page. That sounds narrow, but it is the kind of narrow that matters: not a...

Google’s CVE-2026-11659 entry, published June 8, 2026 and modified June 9, describes a high-severity Chrome-on-Linux integer overflow in the browser UI that could let a remote attacker escape the sandbox through a crafted HTML page before version 149.0.7827.103. The short version is simple...

Google disclosed CVE-2026-11642 on June 8, 2026, as a critical Chromium Web Apps use-after-free flaw fixed in Chrome before version 149.0.7827.103, affecting desktop Chrome on Windows, macOS, and Linux where a crafted HTML page could help escape the browser sandbox. That is the dry database...

Google Chrome before version 149.0.7827.103 on macOS contains CVE-2026-11635, a critical Chromium Bluetooth use-after-free flaw disclosed June 8, 2026, that could let a remote attacker who already compromised the renderer process escape Chrome’s sandbox through a crafted HTML page. That is the...

Google Chrome on Windows before version 149.0.7827.103 is affected by CVE-2026-11634, a critical use-after-free flaw in the browser’s Gamepad component that Google disclosed in June 2026 and that could let a remote attacker attempt a sandbox escape through a crafted HTML page. The practical...

CVE-2026-12011 is a critical use-after-free flaw in Chrome’s WebMIDI implementation on Windows, disclosed on June 11, 2026, and fixed for desktop users in Chrome 149.0.7827.115 after Google said crafted HTML could help a compromised renderer attempt a sandbox escape. The interesting part is not...

Google published CVE-2026-12009 on June 11, 2026, describing a Critical Chromium Accessibility flaw in Google Chrome for Mac before version 149.0.7827.115 that could let an attacker who already compromised the renderer process escape the browser sandbox through a crafted HTML page. The bug is...

Google Chrome on Android before version 149.0.7827.115 is affected by CVE-2026-12010, a critical GPU heap buffer overflow disclosed on June 11, 2026, that could let an attacker escape Chrome’s sandbox after first compromising the renderer with a crafted HTML page. The important part is not just...

CVE-2026-12019 is a high-severity heap buffer overflow in Chrome’s Codecs component, disclosed by Chrome on June 11, 2026, affecting Google Chrome on Linux and ChromeOS before version 149.0.7827.115 and potentially enabling sandbox escape through a crafted HTML page. The vulnerability is not the...

CVE-2026-11163 is a Chrome on Android use-after-free flaw in the browser’s Messages component, disclosed June 4, 2026, fixed before version 149.0.7827.53, and described as allowing a remote attacker to potentially escape the sandbox through a crafted HTML page. The oddity is not the memory bug...

CVE-2026-10967 is a high-severity use-after-free vulnerability in Chrome’s SurfaceCapture component on Android, disclosed on June 4, 2026, affecting Google Chrome versions before 149.0.7827.53 and potentially allowing a renderer-compromise attacker to escape the browser sandbox through a crafted...

Google published CVE-2026-10934 on June 4, 2026, describing a high-severity use-after-free flaw in Chrome Autofill on Android before version 149.0.7827.53 that could let an attacker with renderer compromise attempt a sandbox escape through crafted HTML. That is a narrow sentence with a very...

Google published CVE-2026-10892 on June 4, 2026, identifying a critical out-of-bounds write in Chrome’s GPU component on Android before version 149.0.7827.53 that could let a remote attacker attempt a sandbox escape through a crafted HTML page. The phrasing is dry, but the implication is not...

Google Chrome’s CVE-2026-11119 was published by NVD on June 4, 2026, and describes a Chrome-on-Android GPU flaw fixed before version 149.0.7827.53 that could let an attacker escape the browser sandbox after first compromising the renderer with a crafted HTML page. The record is messy in exactly...