BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

Google Chrome

Google Chrome Security Releases - September 2026

google-chrome-2026-09 Sep 1, 2026 Source: Vendor

Google Chrome security advisories for September 2026: 176 CVEs, 54 credited researchers.

Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

190 lines
All 190 CVEs 190 Additional recognition 0 Unclaimed only
Showing 1–50 of 190 matching , page 1 of 4 , clear filters
CVE-2026-102299 BR2026-0000-035477 V8 unclaimed
High: Type confusion in V8 (reported 2026-09-04)
Credited as Andrew Boni
CVE-2026-102300 BR2026-0000-035478 WebGPU unclaimed
High: Uninitialized resource in WebGPU (reported 2026-09-11)
Credited as Arni Hardarson (Neonix Security)
CVE-2026-102301 BR2026-0000-035479 GPU unclaimed
High: Out of bounds write in GPU (reported 2026-09-15)
Credited as Google
CVE-2026-102302 BR2026-0000-035480 V8 unclaimed
High: Buffer overflow in V8 (reported 2026-09-19)
Credited as Google
CVE-2026-102303 BR2026-0000-035481 GPU unclaimed
High: Uninitialized resource in GPU (reported 2026-09-10)
Credited as Google
CVE-2026-102304 BR2026-0000-035482 Passwords unclaimed
High: Use after free in Passwords (reported 2026-09-11)
Credited as Xinyang Ge
CVE-2026-102305 BR2026-0000-035483 SignIn unclaimed
Low: UI misrepresentation in SignIn (reported 2026-07-09)
Credited as Google
CVE-2026-102306 BR2026-0000-035484 Bluetooth unclaimed
High: Use after free in Bluetooth (reported 2026-09-04)
Credited as Google
CVE-2026-102307 BR2026-0000-035485 Dawn unclaimed
High: Uninitialized resource in Dawn (reported 2026-09-04)
Credited as Google
CVE-2026-102308 BR2026-0000-035486 Views unclaimed
High: Use after free in Views (reported 2026-09-15)
Credited as Google
CVE-2026-102309 BR2026-0000-035487 FullScreen unclaimed
High: Use after free in FullScreen (reported 2026-09-13)
Credited as sean geofrey
CVE-2026-102310 BR2026-0000-035488 Payments unclaimed
Low: Missing authorization in Payments (reported 2026-01-22)
Credited as Autodidact
CVE-2026-102311 BR2026-0000-035489 GPU unclaimed
High: Uninitialized resource in GPU (reported 2026-09-10)
Credited as Google
CVE-2026-102312 BR2026-0000-035490 Omnibox unclaimed
High: UI misrepresentation in Omnibox (reported 2026-08-24)
Credited as jodyritonga
CVE-2026-102313 BR2026-0000-035491 ANGLE unclaimed
High: Uninitialized resource in ANGLE (reported 2026-09-03)
Credited as Google
CVE-2026-102314 BR2026-0000-035492 TabStrip unclaimed
Low: UI misrepresentation in TabStrip (reported 2026-05-17)
Credited as Google
CVE-2026-102315 BR2026-0000-035493 Media unclaimed
High: Uninitialized resource in Media (reported 2026-09-18)
Credited as Google
CVE-2026-102316 BR2026-0000-035494 Views unclaimed
High: Use after free in Views (reported 2026-09-11)
Credited as Xinyang Ge
CVE-2026-102317 BR2026-0000-035495 Mojo unclaimed
High: Improper privilege management in Mojo (reported 2026-05-28)
Credited as Google
CVE-2026-102318 BR2026-0000-035496 WebGL unclaimed
High: Out of bounds read in WebGL (reported 2026-09-16)
Credited as Google
CVE-2026-102319 BR2026-0000-035497 GPU unclaimed
High: Uninitialized resource in GPU (reported 2026-09-15)
Credited as Google
CVE-2026-102321 BR2026-0000-035498 V8 unclaimed
High: Type confusion in V8 (reported 2026-09-23)
Credited as with Xint
CVE-2026-102321 BR2026-0000-035499 V8 unclaimed
High: Type confusion in V8 (reported 2026-09-23)
Credited as Taisic Yun (@taisic_) of Theori
CVE-2026-102323 BR2026-0000-035500 V8 unclaimed
High: Type confusion in V8 (reported 2026-09-10)
Credited as OpenAI Codex Security (amyb)
CVE-2026-102324 BR2026-0000-035501 PictureInPicture unclaimed
High: Use after free in PictureInPicture (reported 2026-09-15)
Credited as Blockian Creator of Kritt and Open-Kritt
CVE-2026-102325 BR2026-0000-035502 Skia unclaimed
High: Uninitialized resource in Skia (reported 2026-09-15)
Credited as Google
CVE-2026-102326 BR2026-0000-035503 V8 unclaimed
High: Type confusion in V8 (reported 2026-09-11)
Credited as OpenAI Codex Security (amyb)
CVE-2026-102327 BR2026-0000-035504 WebView unclaimed
Low: Incorrect authorization in WebView (reported 2026-03-25)
Credited as Google
CVE-2026-102328 BR2026-0000-035505 V8 unclaimed
High: Type confusion in V8 (reported 2026-09-12)
Credited as OpenAI Codex Security (amyb)
CVE-2026-102329 BR2026-0000-035506 WebUI unclaimed
High: Cross-site scripting in WebUI (reported 2026-09-18)
Credited as chipsec
CVE-2026-102330 BR2026-0000-035507 SiteIsolation unclaimed
Low: Incorrect authorization in SiteIsolation (reported 2026-04-02)
Credited as Google
CVE-2026-102331 BR2026-0000-035508 ANGLE unclaimed
Critical: Buffer overflow in ANGLE (reported 2026-08-24)
Credited as @mfx
CVE-2026-84323 BR2026-0000-035509 FileSystem unclaimed
Medium: Missing authorization in FileSystem (reported 2026-04-14)
Credited as Google
CVE-2026-84324 BR2026-0000-035510 Proxy unclaimed
High: Use after free in Proxy (reported 2026-07-10)
Credited as Google
CVE-2026-84325 BR2026-0000-035511 DataTransfer unclaimed
High: Improper input validation in DataTransfer (reported 2026-08-26)
Credited as Google
CVE-2026-84326 BR2026-0000-035512 V8 unclaimed
High: Uninitialized resource in V8 (reported 2026-08-17)
Credited as Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern)
CVE-2026-84327 BR2026-0000-035513 Autofill unclaimed
Low: Incorrect authorization in Autofill (reported 2026-04-01)
Credited as Google
CVE-2026-84328 BR2026-0000-035514 FileSystem unclaimed
Medium: Missing authorization in FileSystem (reported 2026-04-01)
Credited as Google
CVE-2026-84329 BR2026-0000-035515 CredentialProvider unclaimed
Low: Confused deputy in CredentialProvider (reported 2026-04-02)
Credited as Google
CVE-2026-84330 BR2026-0000-035516 FullScreen unclaimed
Medium: UI misrepresentation in FullScreen (reported 2026-05-27)
Credited as Google
CVE-2026-84331 BR2026-0000-035517 Actor unclaimed
Low: Incorrect authorization in Actor (reported 2026-06-09)
Credited as Google
CVE-2026-84332 BR2026-0000-035518 SiteSettings unclaimed
Medium: Incorrect authorization in SiteSettings (reported 2026-05-19)
Credited as Google
CVE-2026-84333 BR2026-0000-035519 Dawn unclaimed
High: Use after free in Dawn (reported 2026-08-19)
Credited as Google
CVE-2026-84334 BR2026-0000-035520 Chromoting unclaimed
Medium: Incorrect authorization in Chromoting (reported 2026-05-29)
Credited as Google
CVE-2026-84335 BR2026-0000-035521 TabStrip unclaimed
Medium: Incorrect authorization in TabStrip (reported 2026-06-10)
Credited as Google
CVE-2026-84347 BR2026-0000-035522 WebRTC unclaimed
Medium: Use after free in WebRTC (reported 2026-04-11)
Credited as Google
CVE-2026-84348 BR2026-0000-035523 MediaCapture unclaimed
Medium: Information leak in MediaCapture (reported 2026-05-30)
Credited as Google
CVE-2026-84349 BR2026-0000-035524 Browser unclaimed
High: Use after free in Browser (reported 2026-07-21)
Credited as Google
CVE-2026-84350 BR2026-0000-035525 TabStrip unclaimed
Low: Use after free in TabStrip (reported 2026-05-16)
Credited as Google
CVE-2026-84351 BR2026-0000-035526 GPU unclaimed
High: Buffer overflow in GPU (reported 2026-08-24)
Credited as Cassio Lima