CVE-2026-11237
High · 8.3CVSS
8.3
EPSS
0.2%
Published
Jun 4, 2026
CISA due date
—
The record
Insufficient validation of untrusted input in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | chromium | 0 | 149.0.7827.53-2.1 |
Related vulnerabilities
- CVE-2026-14425 Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker… Also affects chromium
- CVE-2026-14427 Heap buffer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote… Also affects chromium
- CVE-2026-14430 Integer overflow in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker… Also affects chromium
- CVE-2026-14431 Type Confusion in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to… Also affects chromium
- CVE-2026-14432 Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to… Also affects chromium
- CVE-2026-14426 Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker… Also affects chromium
- CVE-2026-14428 Insufficient validation of untrusted input in Dawn in Google Chrome on Android prior to… Also affects chromium
- CVE-2026-14429 Insufficient validation of untrusted input in Skia in Google Chrome prior to… Also affects chromium