Threat database

Information leak in Transactions Platform in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

Race condition in Transactions Platform in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-95354 is a use-after-free vulnerability in the Verifier component of Google Chrome prior to version 154.0.8037.57. This flaw could allow a remote attacker who has compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. The vulnerability has a high severity rating with a CVSS score of 8.3. Google has released an update to address this issue.

CVE-2026-95341 is a vulnerability in Google Chrome Desktop prior to version 154.0.8037.57 involving improper input validation. This flaw allows a remote attacker who has compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network traffic. The vulnerability has a high severity rating with a CVSS score of 8.3. A fix is available in Chrome version 154.0.8037.57.

UI misrepresentation in FileSystem in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

A use-after-free vulnerability exists in the Bindings component of Google Chrome prior to version 154.0.8037.57. This flaw allows a remote attacker to execute arbitrary code within the sandbox by delivering a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8. Google has released an update to address this issue.

Missing authorization in Views in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-95314 is a high-severity vulnerability in Google Chrome prior to version 154.0.8037.57. It involves incorrect authorization in the Human Interface Device (HID) component, allowing a remote attacker who has compromised the renderer process to bypass system access restrictions via a crafted HTML page. This vulnerability has a CVSS score of 8.1, indicating a significant impact on confidentiality and integrity. The issue is addressed in Chrome version 154.0.8037.57.

CVE-2026-95276 is a vulnerability in Google Chrome's Themes component prior to version 154.0.8037.57. It involves improper input validation that could allow a remote attacker who has compromised the renderer process to execute arbitrary code inside the sandbox via crafted network traffic. The vulnerability has a high severity rating with a CVSS score of 8.3.

Information leak in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a local attacker to leak sensitive information via physical access. (Chromium security severity: Medium)

Race condition in Editing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-95303 is a medium severity vulnerability in Google Chrome prior to version 154.0.8037.57. It involves incomplete cleanup in the SmartCard component, which allows a remote attacker to bypass system access restrictions via a crafted HTML page leveraging social engineering.

A medium severity vulnerability (CVE-2026-95370) in Google Chrome's NFC implementation prior to version 154.0.8037.57 allows a remote attacker to bypass system access restrictions via a crafted HTML page. This issue affects versions before 154.0.8037.57 and has a CVSS score of 5.4. Google has released an update to address this vulnerability.

CVE-2026-95330 is a medium severity vulnerability in Google Chrome prior to version 154.0.8037.57. It involves improper state validation in the Downloads component, which allows a remote attacker to bypass system access restrictions via a crafted HTML page. The vulnerability has a CVSS score of 6.5 and does not affect confidentiality or availability but impacts integrity. A fix is available in Chrome version 154.0.8037.57.

CVE-2026-95345 is a use-after-free vulnerability in the Actor component of Google Chrome prior to version 154.0.8037.57. This flaw allows a remote attacker to execute arbitrary code within the browser's sandbox by tricking a user into visiting a specially crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8. Google has released an update to address this issue in Chrome version 154.0.8037.57.

CVE-2026-95317 is a vulnerability in Google Chrome's MediaCapture component prior to version 154.0.8037.57. It allows a remote attacker, through social engineering and a crafted Chrome extension, to bypass authorization and obtain cross-origin data. The issue has a low severity rating and a CVSS score of 3.1.

Missing authorization in Navigation in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)

A UI misrepresentation vulnerability exists in the Chromoting component of Google Chrome prior to version 154.0.8037.57. This flaw allows a remote attacker to spoof UI elements by sending crafted network traffic. The vulnerability has a medium severity rating and a CVSS score of 4.8. It does not require user interaction or privileges to exploit, but the attack complexity is high. No known exploits are reported in the wild. Google has released a stable channel update addressing this issue.

A UI misrepresentation vulnerability in Google Chrome on Android versions prior to 154.0.8037.57 allows a remote attacker to potentially spoof UI elements via a crafted HTML page. This issue could be exploited through social engineering. The vulnerability has a medium severity rating and a CVSS score of 5.4.

UI misrepresentation in Browser in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)