Threat database

Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-95376 is a vulnerability in Google Chrome's DevTools prior to version 154.0.8037.57. It involves an externally controlled reference that allows an adjacent attacker, using social engineering and crafted network traffic, to bypass system access restrictions. The vulnerability has a high severity rating with a CVSS score of 8. A fix is available in Chrome version 154.0.8037.57.

CVE-2026-95369 is a high-severity vulnerability in Google Chrome prior to version 154.0.8037.57. It involves an inappropriate implementation in XML processing that could allow a remote attacker to execute arbitrary code within the browser's sandbox via a crafted HTML page. The vulnerability has a CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability. A fix is available in Chrome version 154.0.8037.57.

CVE-2026-95362 is a cross-site request forgery (CSRF) vulnerability in the DevTools component of Google Chrome prior to version 154.0.8037.57. This flaw allows a remote attacker to bypass the web origin policy by tricking a user into visiting a crafted HTML page, potentially leading to unauthorized actions within the browser. The vulnerability has a high severity rating with a CVSS score of 8.8.

CVE-2026-95302 is a vulnerability in Google Chrome on Android prior to version 154.0.8037.57. It involves incorrect authorization in WebAPKs that allows a local attacker to access cross-origin data via a co-installed app. The vulnerability has a low severity rating and a CVSS score of 2.9.

CVE-2026-95375 is a medium severity vulnerability in Google Chrome prior to version 154.0.8037.57. It involves incorrect authorization in the BrowserTag component, allowing a remote attacker who has compromised the renderer process to bypass the web origin policy via a crafted HTML page. This could lead to limited confidentiality, integrity, and availability impacts. A fix is available in Chrome version 154.0.8037.57.

A missing authorization vulnerability in the Contextual Tasks feature of Google Chrome prior to version 154.0.8037.57 allows a remote attacker to bypass the web origin policy using a crafted HTML page. This vulnerability has a medium severity rating and could lead to unauthorized actions within the browser context.

CVE-2026-95331 is an out-of-bounds write vulnerability in the ANGLE component of Google Chrome prior to version 154.0.8037.57. This flaw could allow a remote attacker to execute arbitrary code outside the browser sandbox by convincing a user to visit a specially crafted HTML page. The vulnerability has a high CVSS score of 9.6, indicating critical severity. Google has released an update to address this issue.

CVE-2026-95381 is a high severity vulnerability in Google Chrome prior to version 154.0.8037.57 involving improper input validation in the printing component. This flaw could allow a remote attacker who has compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. The vulnerability affects versions before 154.0.8037.57 and has been addressed in that version.

Improper input validation in Auth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-95366 is a use-after-release vulnerability in the Core component of Google Chrome prior to version 154.0.8037.57. This flaw allows a remote attacker who has compromised the renderer process to bypass the web origin policy by using a crafted HTML page. The vulnerability has a medium severity rating and a CVSS score of 6.5.

A missing authorization vulnerability in the navigation component of Google Chrome prior to version 154.0.8037.57 allows a remote attacker who has compromised the renderer process to bypass site isolation using a crafted HTML page. This issue has a medium severity rating and affects Chrome versions before 154.0.8037.57.

CVE-2026-95351 is a use-after-free vulnerability in the Views component of Google Chrome prior to version 154.0.8037.57. It allows a remote attacker who has compromised the renderer process to execute arbitrary code outside the sandbox by using a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.3.

CVE-2026-95299 is a use-after-free vulnerability in the GPU component of Google Chrome prior to version 154.0.8037.57. This flaw allows a remote attacker to execute arbitrary code outside the sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a critical severity rating with a CVSS score of 9.6.

A type confusion vulnerability in the V8 JavaScript engine of Google Chrome prior to version 154.0.8037.57 allows remote attackers to execute arbitrary code within the browser sandbox by delivering a crafted HTML page. This vulnerability has a high severity rating and affects Chrome desktop versions before the specified fixed release.

CVE-2026-95304 is a high-severity out-of-bounds write vulnerability in the V8 JavaScript engine used by Google Chrome. It affects versions prior to 154.0.8037.57 and allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability has a CVSS score of 8.8, indicating a significant risk if exploited. Google has released an update to address this issue.

A race condition vulnerability exists in the V8 JavaScript engine of Google Chrome prior to version 154.0.8037.57. This flaw allows a remote attacker to execute arbitrary code within the browser's sandbox by delivering a specially crafted HTML page. The vulnerability has been assigned a high severity rating with a CVSS score of 7.5.

CVE-2026-95343 is a use-after-free vulnerability in the WebAudio component of Google Chrome prior to version 154.0.8037.57. This flaw allows a remote attacker to execute arbitrary code within the sandbox by crafting a malicious HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8.

A type confusion vulnerability exists in the IndexedDB component of Google Chrome prior to version 154.0.8037.57. This flaw could allow a remote attacker to execute arbitrary code within the browser's sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity rating and a CVSS score of 8.8.

A type confusion vulnerability in Google Chrome's Bindings component prior to version 154.0.8037.57 allows remote attackers to execute arbitrary code within the sandbox by delivering a crafted HTML page. This vulnerability has a high severity rating and a CVSS score of 8.8.