BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

Google Chrome

Google Chrome Security Releases - September 2026

google-chrome-2026-09 Sep 1, 2026 Source: Vendor

Google Chrome security advisories for September 2026: 176 CVEs, 54 credited researchers.

Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

190 lines
All 190 CVEs 190 Additional recognition 0 Unclaimed only
Showing 51–100 of 190 , page 2 of 4
CVE-2026-84352 BR2026-0000-035527 WebGL unclaimed
Critical: Use after free in WebGL (reported 2026-08-14)
Credited as Google
CVE-2026-84353 BR2026-0000-035528 Shared Tab Groups unclaimed
Critical: Use after free in Shared Tab Groups (reported 2026-06-10)
Credited as Google
CVE-2026-84354 BR2026-0000-035529 FileSystem unclaimed
High: Incorrect authorization in FileSystem (reported 2026-04-02)
Credited as Google
CVE-2026-84355 BR2026-0000-035530 Navigation unclaimed
Medium: Incorrect authorization in Navigation (reported 2026-05-10)
Credited as Google
CVE-2026-84356 BR2026-0000-035531 FullScreen unclaimed
Low: UI misrepresentation in FullScreen (reported 2026-04-18)
Credited as Francesco Topol (k4tedu)
CVE-2026-84357 BR2026-0000-035532 Omnibox unclaimed
High: Improper input validation in Omnibox (reported 2026-06-12)
Credited as Google
CVE-2026-84358 BR2026-0000-035533 Downloads unclaimed
Medium: Improper privilege management in Downloads (reported 2026-05-17)
Credited as Google
CVE-2026-84359 BR2026-0000-035534 Skia unclaimed
High: Information leak in Skia (reported 2026-05-17)
Credited as Google
CVE-2026-85042 BR2026-0000-035535 DevTools unclaimed
High: Use after free in DevTools (reported 2026-08-26)
Credited as Google
CVE-2026-85044 BR2026-0000-035536 Mobile unclaimed
Medium: Use of released resource in Mobile (reported 2026-05-28)
Credited as Google
CVE-2026-85046 Known exploited (CISA KEV) BR2026-0000-035537 V8 unclaimed
High: Type confusion in V8 (reported 2026-08-04)
Credited as Salvatore Gulizia (nickname: Serotav)
CVE-2026-85047 BR2026-0000-035538 Transactions Platform unclaimed
Medium: Improper input validation in Transactions Platform (reported 2026-05-16)
Credited as Google
CVE-2026-85049 BR2026-0000-035539 Skia unclaimed
High: Use after free in Skia (reported 2026-08-27)
Credited as Google
CVE-2026-85050 BR2026-0000-035540 WebGL unclaimed
High: Out of bounds write in WebGL (reported 2026-08-20)
Credited as Google
CVE-2026-85051 BR2026-0000-035541 Compositing unclaimed
High: Type confusion in Compositing (reported 2026-08-27)
Credited as Google
CVE-2026-85052 BR2026-0000-035542 CrashReporting unclaimed
High: Out of bounds read in CrashReporting (reported 2026-08-17)
Credited as XBOW
CVE-2026-85052 BR2026-0000-035543 CrashReporting unclaimed
High: Out of bounds read in CrashReporting (reported 2026-08-17)
Credited as Google on 2026-04-13[N/A][533502257] High CVE-2026-85043: Incomplete cleanup in Network. Reported by Google on 2026-07-10[TBD][540357382] High CVE-2026-85048: Use after free in Compositing. Reported by Ngoc Hieu on 2026-
CVE-2026-85053 BR2026-0000-035544 CacheStorage unclaimed
High: Improper resource exposure in CacheStorage (reported 2026-08-26)
Credited as Salvatore Gulizia (Serotav)
CVE-2026-87464 BR2026-0000-035545 WebGL unclaimed
Critical: Use after free in WebGL (reported 2026-08-27)
Credited as Systems Lab on 2026-03-08 [$500][40058710] Low CVE-2026-87653: UI misrepresentation in FullScreen. Reported by Lijo A.T on 2022-02-07 [N/A][349994197] Low CVE-2026-87634: Use after free in WebPackaging. Reported by Googl
CVE-2026-87464 BR2026-0000-035546 WebGL unclaimed
Critical: Use after free in WebGL (reported 2026-08-27)
Credited as Security
CVE-2026-87464 BR2026-0000-035547 WebGL unclaimed
Critical: Use after free in WebGL (reported 2026-08-27)
Credited as Dept. of CS
CVE-2026-87464 BR2026-0000-035548 WebGL unclaimed
Critical: Use after free in WebGL (reported 2026-08-27)
Credited as Lexi Groves (49016) on 2026-08-08 [N/A][546252753] Critical CVE-2026-87488: Use after free in WebGL. Reported by Google on 2026-08-14 [N/A][548127218] Critical CVE-2026-87438: Out of bounds write in WebGL. Reported by Go
CVE-2026-91726 BR2026-0000-035549 WebGL unclaimed
Critical: Out of bounds read in WebGL (reported 2026-08-03)
Credited as Siung kim (@ksw9722) on 2026-09-06 [TBD][558342353] High CVE-2026-91711: Out of bounds write in ServiceWorker. Reported by Cristian Di Nicola (@crih.exe) on 2026-09-07 [TBD][558367547] High CVE-2026-91715: Type confusion
CVE-2026-91726 BR2026-0000-035550 WebGL unclaimed
Critical: Out of bounds read in WebGL (reported 2026-08-03)
Credited as Google on 2026-09-03 [TBD][557320614] Critical CVE-2026-91721: Use after free in Internals. Reported by xinyang on 2026-09-04 [TBD][558456602] Critical CVE-2026-91749: Use after free in Workers. Reported by WinD39 - Huyn
CVE-2026-95274 BR2026-0000-035551 DevTools unclaimed
High: Improper output encoding in DevTools (reported 2026-08-26)
Credited as Google
CVE-2026-95275 BR2026-0000-035552 MediaStream unclaimed
Medium: Incorrect reference resolution in MediaStream (reported 2026-08-05)
Credited as Zabith Mohammed (@nmzabith)
CVE-2026-95276 BR2026-0000-035553 Themes unclaimed
Medium: Improper input validation in Themes (reported 2026-05-29)
Credited as Google
CVE-2026-95277 BR2026-0000-035554 Views unclaimed
High: Use after free in Views (reported 2026-08-26)
Credited as Google
CVE-2026-95278 BR2026-0000-035555 WakeLock unclaimed
Low: Missing authorization in WakeLock (reported 2026-03-29)
Credited as Google
CVE-2026-95279 BR2026-0000-035556 Omnibox unclaimed
Low: UI misrepresentation in Omnibox (reported 2026-05-17)
Credited as Google
CVE-2026-95280 BR2026-0000-035557 V8 unclaimed
High: Race condition in V8 (reported 2026-09-12)
Credited as Google
CVE-2026-95281 BR2026-0000-035558 ANGLE unclaimed
Critical: Buffer overflow in ANGLE (reported 2026-08-24)
Credited as Muhammad Alifa Ramdhan of STAR Labs SG Pte. Ltd.
CVE-2026-95282 BR2026-0000-035559 Platform unclaimed
High: Use after free in Platform (reported 2026-08-26)
Credited as Google
CVE-2026-95283 BR2026-0000-035560 Tint unclaimed
High: Buffer overflow in Tint (reported 2026-08-06)
Credited as Google
CVE-2026-95284 BR2026-0000-035561 ANGLE unclaimed
Critical: Buffer overflow in ANGLE (reported 2026-09-03)
Credited as Muhammad Alifa Ramdhan (STARLABS SG)
CVE-2026-95285 BR2026-0000-035562 WebView unclaimed
Low: Missing authorization in WebView (reported 2026-03-28)
Credited as Google
CVE-2026-95286 BR2026-0000-035563 Bindings unclaimed
High: Type confusion in Bindings (reported 2026-09-05)
Credited as @bean5oup
CVE-2026-95287 BR2026-0000-035564 Navigation unclaimed
Medium: Missing authorization in Navigation (reported 2026-03-23)
Credited as Google
CVE-2026-95288 BR2026-0000-035565 Mobile unclaimed
Low: UI misrepresentation in Mobile (reported 2026-07-09)
Credited as Google
CVE-2026-95289 BR2026-0000-035566 Scroll unclaimed
Medium: Incorrect authorization in Scroll (reported 2026-08-21)
Credited as Vu Van Tien (@n0_Be3r)
CVE-2026-95290 BR2026-0000-035567 NFC unclaimed
Medium: Missing authorization in NFC (reported 2026-07-18)
Credited as Google
CVE-2026-95291 BR2026-0000-035568 SecurityIndicators unclaimed
High: UI misrepresentation in SecurityIndicators (reported 2026-08-07)
Credited as NH DEV
CVE-2026-95292 BR2026-0000-035569 Safebrowsing unclaimed
Low: Incorrect authorization in Safebrowsing (reported 2026-05-16)
Credited as Google
CVE-2026-95293 BR2026-0000-035570 GPU unclaimed
High: Uninitialized resource in GPU (reported 2026-08-22)
Credited as TienPA - NGS Holdings
CVE-2026-95294 BR2026-0000-035571 Browser unclaimed
Medium: UI misrepresentation in Browser (reported 2026-05-17)
Credited as Google
CVE-2026-95295 BR2026-0000-035572 Mobile unclaimed
Medium: Information leak in Mobile (reported 2026-05-28)
Credited as Google
CVE-2026-95296 BR2026-0000-035573 Core unclaimed
Low: Missing authorization in Core (reported 2026-08-23)
Credited as Quyền Sơn (@zer0qs1337)
CVE-2026-95297 BR2026-0000-035574 Contextual Tasks unclaimed
Medium: Missing authorization in Contextual Tasks (reported 2026-04-11)
Credited as Google
CVE-2026-95298 BR2026-0000-035575 Browser unclaimed
High: Use after free in Browser (reported 2026-06-05)
Credited as Google
CVE-2026-95299 BR2026-0000-035576 GPU unclaimed
High: Use after free in GPU (reported 2026-09-15)
Credited as Google