Vulnerability-Lookup

CERTFR-2026-AVI-0811

Vulnerability from certfr_avis - Published: 2026-06-29 - Updated: 2026-06-29

De multiples vulnérabilités ont été découvertes dans Microsoft Edge. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et un problème de sécurité non spécifié par l'éditeur.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Microsoft	Edge	Microsoft Edge versions antérieures à 149.0.4022.96

References

Title

Publication Time

Tags

Bulletin de sécurité Microsoft Edge CVE-2026-12469	2026-06-26	vendor-advisory
Bulletin de sécurité Microsoft Edge CVE-2026-13033	2026-06-26	vendor-advisory
Bulletin de sécurité Microsoft Edge CVE-2026-13023	2026-06-26	vendor-advisory
Bulletin de sécurité Microsoft Edge CVE-2026-13036	2026-06-26	vendor-advisory
Bulletin de sécurité Microsoft Edge CVE-2026-12442	2026-06-26	vendor-advisory
Bulletin de sécurité Microsoft Edge CVE-2026-12028	2026-06-26	vendor-advisory
Bulletin de sécurité Microsoft Edge CVE-2026-13026	2026-06-26	vendor-advisory
Bulletin de sécurité Microsoft Edge CVE-2026-13021	2026-06-26	vendor-advisory
Bulletin de sécurité Microsoft Edge CVE-2026-13025	2026-06-26	vendor-advisory
Bulletin de sécurité Microsoft Edge CVE-2026-12030	2026-06-26	vendor-advisory
Bulletin de sécurité Microsoft Edge CVE-2026-11647	2026-06-26	vendor-advisory
Bulletin de sécurité Microsoft Edge CVE-2026-13024	2026-06-26	vendor-advisory
Bulletin de sécurité Microsoft Edge CVE-2026-12032	2026-06-26	vendor-advisory
Bulletin de sécurité Microsoft Edge CVE-2026-50521	2026-06-26	vendor-advisory
Bulletin de sécurité Microsoft Edge CVE-2026-12448	2026-06-26	vendor-advisory
Bulletin de sécurité Microsoft Edge CVE-2026-13031	2026-06-26	vendor-advisory
Bulletin de sécurité Microsoft Edge CVE-2026-12438	2026-06-26	vendor-advisory
Bulletin de sécurité Microsoft Edge CVE-2026-13038	2026-06-26	vendor-advisory
Bulletin de sécurité Microsoft Edge CVE-2026-13035	2026-06-26	vendor-advisory
Bulletin de sécurité Microsoft Edge CVE-2026-13027	2026-06-26	vendor-advisory
Bulletin de sécurité Microsoft Edge CVE-2026-13034	2026-06-26	vendor-advisory
Bulletin de sécurité Microsoft Edge CVE-2026-13029	2026-06-26	vendor-advisory
Bulletin de sécurité Microsoft Edge CVE-2026-13022	2026-06-26	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Microsoft Edge versions ant\u00e9rieures \u00e0 149.0.4022.96",
      "product": {
        "name": "Edge",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-50521",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-50521"
    },
    {
      "name": "CVE-2026-13034",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13034"
    },
    {
      "name": "CVE-2026-12442",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12442"
    },
    {
      "name": "CVE-2026-13027",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13027"
    },
    {
      "name": "CVE-2026-13024",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13024"
    },
    {
      "name": "CVE-2026-13025",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13025"
    },
    {
      "name": "CVE-2026-13023",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13023"
    },
    {
      "name": "CVE-2026-12469",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12469"
    },
    {
      "name": "CVE-2026-12028",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12028"
    },
    {
      "name": "CVE-2026-13022",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13022"
    },
    {
      "name": "CVE-2026-13021",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13021"
    },
    {
      "name": "CVE-2026-13033",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13033"
    },
    {
      "name": "CVE-2026-12032",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12032"
    },
    {
      "name": "CVE-2026-11647",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-11647"
    },
    {
      "name": "CVE-2026-13031",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13031"
    },
    {
      "name": "CVE-2026-13029",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13029"
    },
    {
      "name": "CVE-2026-13038",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13038"
    },
    {
      "name": "CVE-2026-12438",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12438"
    },
    {
      "name": "CVE-2026-13026",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13026"
    },
    {
      "name": "CVE-2026-12448",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12448"
    },
    {
      "name": "CVE-2026-13036",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13036"
    },
    {
      "name": "CVE-2026-13035",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13035"
    },
    {
      "name": "CVE-2026-12030",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12030"
    }
  ],
  "initial_release_date": "2026-06-29T00:00:00",
  "last_revision_date": "2026-06-29T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0811",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-06-29T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Microsoft Edge. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance et un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Microsoft Edge",
  "vendor_advisories": [
    {
      "published_at": "2026-06-26",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-12469",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-12469"
    },
    {
      "published_at": "2026-06-26",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-13033",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13033"
    },
    {
      "published_at": "2026-06-26",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-13023",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13023"
    },
    {
      "published_at": "2026-06-26",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-13036",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13036"
    },
    {
      "published_at": "2026-06-26",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-12442",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-12442"
    },
    {
      "published_at": "2026-06-26",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-12028",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-12028"
    },
    {
      "published_at": "2026-06-26",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-13026",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13026"
    },
    {
      "published_at": "2026-06-26",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-13021",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13021"
    },
    {
      "published_at": "2026-06-26",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-13025",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13025"
    },
    {
      "published_at": "2026-06-26",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-12030",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-12030"
    },
    {
      "published_at": "2026-06-26",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-11647",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-11647"
    },
    {
      "published_at": "2026-06-26",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-13024",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13024"
    },
    {
      "published_at": "2026-06-26",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-12032",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-12032"
    },
    {
      "published_at": "2026-06-26",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-50521",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50521"
    },
    {
      "published_at": "2026-06-26",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-12448",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-12448"
    },
    {
      "published_at": "2026-06-26",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-13031",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13031"
    },
    {
      "published_at": "2026-06-26",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-12438",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-12438"
    },
    {
      "published_at": "2026-06-26",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-13038",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13038"
    },
    {
      "published_at": "2026-06-26",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-13035",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13035"
    },
    {
      "published_at": "2026-06-26",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-13027",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13027"
    },
    {
      "published_at": "2026-06-26",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-13034",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13034"
    },
    {
      "published_at": "2026-06-26",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-13029",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13029"
    },
    {
      "published_at": "2026-06-26",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-13022",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-13022"
    }
  ]
}

CVE-2026-11647 (GCVE-0-2026-11647)

Vulnerability from cvelistv5 – Published: 2026-06-08 23:27 – Updated: 2026-06-09 03:56

Summary

Use after free in Printing in Google Chrome on Android prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Severity

8.3 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-416 - Use after free

Assigner

Chrome

References

2 references

URL	Tags
https://chromereleases.googleblog.com/2026/06/sta…
https://issues.chromium.org/issues/502156940

Impacted products

1 product

Vendor	Product	Version
Google	Chrome	Affected: 149.0.7827.103 , < 149.0.7827.103 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.3,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-11647",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-08T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-09T03:56:13.924Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Chrome",
          "vendor": "Google",
          "versions": [
            {
              "lessThan": "149.0.7827.103",
              "status": "affected",
              "version": "149.0.7827.103",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Use after free in Printing in Google Chrome on Android prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "Use after free",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-08T23:27:32.358Z",
        "orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
        "shortName": "Chrome"
      },
      "references": [
        {
          "url": "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html"
        },
        {
          "url": "https://issues.chromium.org/issues/502156940"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
    "assignerShortName": "Chrome",
    "cveId": "CVE-2026-11647",
    "datePublished": "2026-06-08T23:27:32.358Z",
    "dateReserved": "2026-06-08T21:33:38.648Z",
    "dateUpdated": "2026-06-09T03:56:13.924Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-12028 (GCVE-0-2026-12028)

Vulnerability from cvelistv5 – Published: 2026-06-11 20:48 – Updated: 2026-06-12 03:55

Summary

Use after free in GPU in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Severity

8.3 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-416 - Use after free

Assigner

Chrome

References

2 references

URL	Tags
https://chromereleases.googleblog.com/2026/06/sta…
https://issues.chromium.org/issues/517555461

Impacted products

1 product

Vendor	Product	Version
Google	Chrome	Affected: 149.0.7827.115 , < 149.0.7827.115 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.3,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-12028",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-11T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-12T03:55:48.628Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Chrome",
          "vendor": "Google",
          "versions": [
            {
              "lessThan": "149.0.7827.115",
              "status": "affected",
              "version": "149.0.7827.115",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Use after free in GPU in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "Use after free",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-11T20:48:12.237Z",
        "orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
        "shortName": "Chrome"
      },
      "references": [
        {
          "url": "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01962725236.html"
        },
        {
          "url": "https://issues.chromium.org/issues/517555461"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
    "assignerShortName": "Chrome",
    "cveId": "CVE-2026-12028",
    "datePublished": "2026-06-11T20:48:12.237Z",
    "dateReserved": "2026-06-11T18:16:07.692Z",
    "dateUpdated": "2026-06-12T03:55:48.628Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-12030 (GCVE-0-2026-12030)

Vulnerability from cvelistv5 – Published: 2026-06-11 20:48 – Updated: 2026-06-12 03:55

Summary

Out of bounds write in GPU in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Severity

8.3 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-122 - Heap buffer overflow

Assigner

Chrome

References

2 references

URL	Tags
https://chromereleases.googleblog.com/2026/06/sta…
https://issues.chromium.org/issues/518007423

Impacted products

1 product

Vendor	Product	Version
Google	Chrome	Affected: 149.0.7827.115 , < 149.0.7827.115 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.3,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-12030",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-11T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-12T03:55:59.527Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Chrome",
          "vendor": "Google",
          "versions": [
            {
              "lessThan": "149.0.7827.115",
              "status": "affected",
              "version": "149.0.7827.115",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Out of bounds write in GPU in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "Heap buffer overflow",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-11T20:48:12.959Z",
        "orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
        "shortName": "Chrome"
      },
      "references": [
        {
          "url": "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01962725236.html"
        },
        {
          "url": "https://issues.chromium.org/issues/518007423"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
    "assignerShortName": "Chrome",
    "cveId": "CVE-2026-12030",
    "datePublished": "2026-06-11T20:48:12.959Z",
    "dateReserved": "2026-06-11T18:16:08.169Z",
    "dateUpdated": "2026-06-12T03:55:59.527Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-12032 (GCVE-0-2026-12032)

Vulnerability from cvelistv5 – Published: 2026-06-11 20:48 – Updated: 2026-06-12 01:34

Summary

Inappropriate implementation in Passwords in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

Severity

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

Inappropriate implementation
CWE-346 - Origin Validation Error

Assigner

Chrome

References

2 references

URL	Tags
https://chromereleases.googleblog.com/2026/06/sta…
https://issues.chromium.org/issues/518128953

Impacted products

1 product

Vendor	Product	Version
Google	Chrome	Affected: 149.0.7827.115 , < 149.0.7827.115 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 3.1,
              "baseSeverity": "LOW",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-12032",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-12T01:30:44.805257Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-346",
                "description": "CWE-346 Origin Validation Error",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-12T01:34:43.260Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Chrome",
          "vendor": "Google",
          "versions": [
            {
              "lessThan": "149.0.7827.115",
              "status": "affected",
              "version": "149.0.7827.115",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Inappropriate implementation in Passwords in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Inappropriate implementation",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-11T20:48:13.724Z",
        "orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
        "shortName": "Chrome"
      },
      "references": [
        {
          "url": "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01962725236.html"
        },
        {
          "url": "https://issues.chromium.org/issues/518128953"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
    "assignerShortName": "Chrome",
    "cveId": "CVE-2026-12032",
    "datePublished": "2026-06-11T20:48:13.724Z",
    "dateReserved": "2026-06-11T18:16:08.674Z",
    "dateUpdated": "2026-06-12T01:34:43.260Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-12438 (GCVE-0-2026-12438)

Vulnerability from cvelistv5 – Published: 2026-06-17 01:38 – Updated: 2026-06-18 03:55

Summary

Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

Severity

8.3 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

Inappropriate implementation
CWE-693 - Protection Mechanism Failure

Assigner

Chrome

References

2 references

URL	Tags
https://chromereleases.googleblog.com/2026/06/sta…
https://issues.chromium.org/issues/516947912

Impacted products

1 product

Vendor	Product	Version
Google	Chrome	Affected: 149.0.7827.155 , < 149.0.7827.155 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.3,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-12438",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-17T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-693",
                "description": "CWE-693 Protection Mechanism Failure",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-18T03:55:17.681Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Chrome",
          "vendor": "Google",
          "versions": [
            {
              "lessThan": "149.0.7827.155",
              "status": "affected",
              "version": "149.0.7827.155",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Inappropriate implementation",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-17T01:38:09.098Z",
        "orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
        "shortName": "Chrome"
      },
      "references": [
        {
          "url": "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html"
        },
        {
          "url": "https://issues.chromium.org/issues/516947912"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
    "assignerShortName": "Chrome",
    "cveId": "CVE-2026-12438",
    "datePublished": "2026-06-17T01:38:09.098Z",
    "dateReserved": "2026-06-16T19:38:23.390Z",
    "dateUpdated": "2026-06-18T03:55:17.681Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-12442 (GCVE-0-2026-12442)

Vulnerability from cvelistv5 – Published: 2026-06-17 01:38 – Updated: 2026-06-18 03:55

Summary

Use after free in Passwords in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-416 - Use after free

Assigner

Chrome

References

2 references

URL	Tags
https://chromereleases.googleblog.com/2026/06/sta…
https://issues.chromium.org/issues/521950423

Impacted products

1 product

Vendor	Product	Version
Google	Chrome	Affected: 149.0.7827.155 , < 149.0.7827.155 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-12442",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-17T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-18T03:55:22.178Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Chrome",
          "vendor": "Google",
          "versions": [
            {
              "lessThan": "149.0.7827.155",
              "status": "affected",
              "version": "149.0.7827.155",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Use after free in Passwords in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "Use after free",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-17T01:38:11.773Z",
        "orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
        "shortName": "Chrome"
      },
      "references": [
        {
          "url": "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html"
        },
        {
          "url": "https://issues.chromium.org/issues/521950423"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
    "assignerShortName": "Chrome",
    "cveId": "CVE-2026-12442",
    "datePublished": "2026-06-17T01:38:11.773Z",
    "dateReserved": "2026-06-16T19:38:25.102Z",
    "dateUpdated": "2026-06-18T03:55:22.178Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-12448 (GCVE-0-2026-12448)

Vulnerability from cvelistv5 – Published: 2026-06-17 01:38 – Updated: 2026-06-18 03:55

Summary

Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: High)

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

Inappropriate implementation
CWE-269 - Improper Privilege Management

Assigner

Chrome

References

2 references

URL	Tags
https://chromereleases.googleblog.com/2026/06/sta…
https://issues.chromium.org/issues/513458233

Impacted products

1 product

Vendor	Product	Version
Google	Chrome	Affected: 149.0.7827.155 , < 149.0.7827.155 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-12448",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-17T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-269",
                "description": "CWE-269 Improper Privilege Management",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-18T03:55:39.899Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Chrome",
          "vendor": "Google",
          "versions": [
            {
              "lessThan": "149.0.7827.155",
              "status": "affected",
              "version": "149.0.7827.155",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: High)"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Inappropriate implementation",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-17T01:38:15.234Z",
        "orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
        "shortName": "Chrome"
      },
      "references": [
        {
          "url": "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html"
        },
        {
          "url": "https://issues.chromium.org/issues/513458233"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
    "assignerShortName": "Chrome",
    "cveId": "CVE-2026-12448",
    "datePublished": "2026-06-17T01:38:15.234Z",
    "dateReserved": "2026-06-16T19:38:27.131Z",
    "dateUpdated": "2026-06-18T03:55:39.899Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-12469 (GCVE-0-2026-12469)

Vulnerability from cvelistv5 – Published: 2026-06-17 01:38 – Updated: 2026-06-17 10:58

Summary

Uninitialized Use in GPU in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-457 - Uninitialized Use

Assigner

Chrome

References

2 references

URL	Tags
https://chromereleases.googleblog.com/2026/06/sta…
https://issues.chromium.org/issues/521618871

Impacted products

1 product

Vendor	Product	Version
Google	Chrome	Affected: 149.0.7827.155 , < 149.0.7827.155 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-12469",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-17T10:58:22.552410Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-17T10:58:36.490Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Chrome",
          "vendor": "Google",
          "versions": [
            {
              "lessThan": "149.0.7827.155",
              "status": "affected",
              "version": "149.0.7827.155",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Uninitialized Use in GPU in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-457",
              "description": "Uninitialized Use",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-17T01:38:27.553Z",
        "orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
        "shortName": "Chrome"
      },
      "references": [
        {
          "url": "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html"
        },
        {
          "url": "https://issues.chromium.org/issues/521618871"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
    "assignerShortName": "Chrome",
    "cveId": "CVE-2026-12469",
    "datePublished": "2026-06-17T01:38:27.553Z",
    "dateReserved": "2026-06-16T19:38:34.520Z",
    "dateUpdated": "2026-06-17T10:58:36.490Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-13021 (GCVE-0-2026-13021)

Vulnerability from cvelistv5 – Published: 2026-06-24 18:43 – Updated: 2026-06-24 19:27

Summary

Inappropriate implementation in DeviceBoundSessionCredentials in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

Inappropriate implementation
CWE-346 - Origin Validation Error

Assigner

Chrome

References

2 references

URL	Tags
https://chromereleases.googleblog.com/2026/06/sta…
https://issues.chromium.org/issues/511776603

Impacted products

1 product

Vendor	Product	Version
Google	Chrome	Affected: 149.0.7827.197 , < 149.0.7827.197 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-13021",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-24T19:26:57.003812Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-346",
                "description": "CWE-346 Origin Validation Error",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-24T19:27:44.583Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Chrome",
          "vendor": "Google",
          "versions": [
            {
              "lessThan": "149.0.7827.197",
              "status": "affected",
              "version": "149.0.7827.197",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Inappropriate implementation in DeviceBoundSessionCredentials in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Inappropriate implementation",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-24T18:43:14.428Z",
        "orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
        "shortName": "Chrome"
      },
      "references": [
        {
          "url": "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0482630350.html"
        },
        {
          "url": "https://issues.chromium.org/issues/511776603"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
    "assignerShortName": "Chrome",
    "cveId": "CVE-2026-13021",
    "datePublished": "2026-06-24T18:43:14.428Z",
    "dateReserved": "2026-06-23T17:14:07.554Z",
    "dateUpdated": "2026-06-24T19:27:44.583Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-13022 (GCVE-0-2026-13022)

Vulnerability from cvelistv5 – Published: 2026-06-24 18:43 – Updated: 2026-06-24 18:43

Summary

Inappropriate implementation in Autofill in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

Severity

No CVSS data available.

CWE

Inappropriate implementation

Assigner

Chrome

References

2 references

URL	Tags
https://chromereleases.googleblog.com/2026/06/sta…
https://issues.chromium.org/issues/516734537

Impacted products

1 product

Vendor	Product	Version
Google	Chrome	Affected: 149.0.7827.197 , < 149.0.7827.197 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Chrome",
          "vendor": "Google",
          "versions": [
            {
              "lessThan": "149.0.7827.197",
              "status": "affected",
              "version": "149.0.7827.197",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Inappropriate implementation in Autofill in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Inappropriate implementation",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-24T18:43:14.861Z",
        "orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
        "shortName": "Chrome"
      },
      "references": [
        {
          "url": "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0482630350.html"
        },
        {
          "url": "https://issues.chromium.org/issues/516734537"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
    "assignerShortName": "Chrome",
    "cveId": "CVE-2026-13022",
    "datePublished": "2026-06-24T18:43:14.861Z",
    "dateReserved": "2026-06-23T17:14:08.100Z",
    "dateUpdated": "2026-06-24T18:43:14.861Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CERTFR-2026-AVI-0811

Solutions

CVE-2026-11647 (GCVE-0-2026-11647)

CVE-2026-12028 (GCVE-0-2026-12028)

CVE-2026-12030 (GCVE-0-2026-12030)

CVE-2026-12032 (GCVE-0-2026-12032)

CVE-2026-12438 (GCVE-0-2026-12438)

CVE-2026-12442 (GCVE-0-2026-12442)

CVE-2026-12448 (GCVE-0-2026-12448)

CVE-2026-12469 (GCVE-0-2026-12469)

CVE-2026-13021 (GCVE-0-2026-13021)

CVE-2026-13022 (GCVE-0-2026-13022)

Tags

Sightings

Nomenclature