Threat database

Integer overflow in Metrics in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-95334 is a vulnerability in Google Chrome's WebProtect component prior to version 154.0.8037.57. It involves incorrect reference resolution that could allow a remote attacker, who has already compromised the renderer process, to execute arbitrary code outside the sandbox via a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.3. Google has released an update to address this issue.

CVE-2026-95327 is an information leak vulnerability in the networking component of Google Chrome versions prior to 154.0.8037.57. A remote attacker can exploit this flaw by crafting a malicious HTML page to leak sensitive information. The vulnerability has a medium severity rating with a CVSS score of 6.5. There is no explicit vendor advisory or patch link provided, so patch status is not confirmed. No known exploits are reported in the wild.

A missing authorization vulnerability in the WakeLock feature of Google Chrome prior to version 154.0.8037.57 allows a remote attacker who has compromised the renderer process to bypass system access restrictions via a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.4. Google has released an update to address this issue.

A missing authorization vulnerability in the WebView component of Google Chrome on Android prior to version 154.0.8037.57 allows a remote attacker who has compromised the renderer process to bypass the web origin policy using a crafted HTML page. This vulnerability has a high severity rating with a CVSS score of 8.4.

UI misrepresentation in ExtensionsMenu in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-95333 is a use-after-free vulnerability in the Metrics component of Google Chrome prior to version 154.0.8037.57. This flaw allows a remote attacker to execute arbitrary code outside the browser sandbox via crafted network traffic. The vulnerability has a high severity rating with a CVSS score of 8.1. Google has released an update to address this issue.

CVE-2026-95358 is a medium severity vulnerability in Google Chrome on Android devices prior to version 154.0.8037.57. It involves incorrect authorization that allows a local attacker to bypass system access restrictions and access a privileged page via a co-installed app. The vulnerability requires local access and user interaction to exploit.

CVE-2026-95311 is a critical vulnerability in Google Chrome prior to version 154.0.8037.57 involving improper free of non-heap memory in the Fonts component. This flaw allows a remote attacker, through social engineering and a crafted HTML page, to potentially execute arbitrary code outside the sandbox. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability. Google has released a stable channel update to address this issue.

A use-after-free vulnerability exists in the Updater component of Google Chrome on Mac systems prior to version 154.0.8037.57. This flaw allows a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. The vulnerability has a high severity score and affects Chrome versions before the specified fixed release.

CVE-2026-95289 is an incorrect authorization vulnerability in the Scroll feature of Google Chrome versions prior to 154.0.8037.57. This flaw allows a remote attacker, through social engineering and a crafted HTML page, to access cross-origin data improperly. The vulnerability has a medium severity rating and a CVSS score of 4.3.

A race condition vulnerability exists in the DevTools component of Google Chrome prior to version 154.0.8037.57. This flaw allows a remote attacker, through social engineering and a crafted Chrome extension, to bypass site isolation protections. The vulnerability has a high severity rating with a CVSS score of 8.0. An official fix is available in Chrome version 154.0.8037.57.

An information leak vulnerability in Google Chrome prior to version 154.0.8037.57 allows a remote attacker who has compromised the renderer process to obtain cross-origin data via a crafted HTML page. The vulnerability has a low severity rating and a CVSS score of 3.1. This issue was addressed in Chrome version 154.0.8037.57.

UI misrepresentation in Chromium in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)

UI misrepresentation in Payments in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-95300 is a medium severity vulnerability in Google Chrome prior to version 154.0.8037.57. It involves missing authorization checks in the DevTools component, which could allow a remote attacker to bypass system access restrictions by leveraging social engineering and crafted network traffic. The vulnerability has a CVSS score of 4.8, indicating a moderate impact on confidentiality and integrity without affecting availability. No known exploits are reported in the wild. Google has released an update to address this issue.

CVE-2026-95374 is a medium severity vulnerability in Google Chrome prior to version 154.0.8037.57. It involves incorrect authorization in the Network component that allows a remote attacker to bypass the web origin policy via a crafted HTML page. This could lead to unauthorized actions without user privileges. The issue has been addressed in Chrome version 154.0.8037.57.

CVE-2026-95275 is a medium severity vulnerability in Google Chrome prior to version 154.0.8037.57. It involves incorrect reference resolution in the MediaStream component, which allows a remote attacker to bypass the web origin policy and access privileged pages via a crafted HTML page.

CVE-2026-95325 is a use-after-free vulnerability in the ANGLE component of Google Chrome prior to version 154.0.8037.57. This flaw allows a remote attacker to potentially execute arbitrary code outside the browser sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity with a CVSS score of 9.6, indicating critical impact on confidentiality, integrity, and availability. Google has released an official fix in Chrome version 154.0.8037.57 to address this issue.

CVE-2026-95290 is a medium severity vulnerability in Google Chrome prior to version 154.0.8037.57. It involves missing authorization in the NFC component, allowing a remote attacker who has compromised the renderer process to bypass system access restrictions via a crafted HTML page. The vulnerability has a CVSS score of 5.4 and affects desktop versions of Chrome before 154.0.8037.57.