Threat database

An information leak vulnerability in Google Chrome prior to version 155.0.8059.39 allows a remote attacker to obtain sensitive password information via a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8. A vendor advisory is available indicating a stable channel update addressing this issue.

CVE-2026-106285 is a UI misrepresentation vulnerability in Google Chrome's WebAppInstalls component prior to version 155.0.8059.39. It allows a remote attacker to bypass system access restrictions by tricking users through a crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 5.4. No known exploits are reported in the wild. Google has released a stable channel update addressing this issue.

Missing authorization in Web Authentication (Passkeys & Security Keys) in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-106399 is an out-of-bounds read vulnerability in the Skia component of Google Chrome versions prior to 155.0.8059.39. This flaw could allow a local attacker, using social engineering, to read memory via a crafted file. The vulnerability has a low severity rating and a CVSS score of 3.3. No known exploits are reported in the wild. Google has released a stable channel update addressing this issue.

An information leak vulnerability exists in Google Chrome on iOS versions prior to 155.0.8059.39. This flaw allows a local attacker with physical access to the device to obtain sensitive information. The vulnerability has a medium severity rating with a CVSS score of 4.6. A fix is available in version 155.0.8059.39.

Buffer overflow in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 155.0.8059.39 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Low)

An incorrect authorization vulnerability in Google Chrome prior to version 155.0.8059.39 allows a remote attacker to bypass the web origin policy via a crafted HTML page. This vulnerability has a low severity rating from Chromium security and a CVSS score of 4.3, indicating medium severity. The issue affects versions before 155.0.8059.39. Google has published a stable channel update addressing this vulnerability.

CVE-2026-106299 is a medium severity vulnerability in Google Chrome's WebAudio component prior to version 155.0.8059.39. It involves improper input validation that could allow a remote attacker, who has already compromised the renderer process, to bypass system access restrictions via a crafted HTML page. The vulnerability does not allow direct remote compromise without prior renderer process control and has a CVSS score of 5.4.

CVE-2026-106199 is a high-severity vulnerability in Google Chrome on Android prior to version 155.0.8059.39. It involves incorrect authorization in the Actor component, which could allow a remote attacker who has compromised the renderer process to bypass site isolation by using a crafted HTML page. This vulnerability has a CVSS score of 8.2 and affects versions before 155.0.8059.39.

Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

A missing authorization vulnerability in Google Chrome's DevTools prior to version 155.0.8059.39 allows a remote attacker to bypass the web origin policy via a crafted Chrome extension, leveraging social engineering. The vulnerability has a medium severity rating with a CVSS score of 6.5. This issue was addressed in Chrome version 155.0.8059.39.

An incorrect authorization vulnerability in Google Chrome's DevTools prior to version 155.0.8059.39 allows a remote attacker to leak cross-origin data via a crafted HTML page using social engineering techniques. The vulnerability has a CVSS score of 4.3, indicating medium severity. The issue is addressed in Chrome version 155.0.8059.39.

A vulnerability in Google Chrome prior to version 155.0.8059.39 allows a remote attacker to bypass the web origin policy due to incorrect authorization in the Scheduling component. This issue has been assigned CVE-2026-106297 and is rated as medium severity with a CVSS score of 4.3. The vulnerability requires user interaction and does not result in confidentiality or availability impact but can cause integrity issues. Google has released an update to address this flaw.

CVE-2026-106287 is a vulnerability in Google Chrome prior to version 155.0.8059.39 involving information loss in the Cross-Origin Resource Sharing (CORS) mechanism. This flaw allows a remote attacker to bypass the web origin policy via crafted network traffic. The vulnerability has a low severity rating from Chromium security and a CVSS score of 4.3, indicating medium severity. No known exploits are reported in the wild. The issue affects versions before 155.0.8059.39.

CVE-2026-106252 is a vulnerability in Google Chrome prior to version 155.0.8059.39 involving an incorrect comparison in font handling. This flaw could allow a remote attacker to execute arbitrary code within the sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8. Google has released an update to address this issue.

A confused deputy vulnerability in Google Chrome on iOS prior to version 155.0.8059.39 allows a remote attacker to bypass system access restrictions to a privileged page via a crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 5.4. Google has published a stable channel update addressing this issue.

An incorrect authorization vulnerability in Google Chrome's DevTools prior to version 155.0.8059.39 allows a local attacker to bypass system access restrictions by using a crafted HTML page. The issue has been assigned a medium severity rating with a CVSS score of 5.4. This vulnerability affects versions before 155.0.8059.39 and has been publicly disclosed.

A vulnerability in Google Chrome prior to version 155.0.8059.39 allows a remote attacker to leak cross-origin data by exploiting incomplete cleanup in the Glic component. The attack requires user interaction via social engineering and results in limited confidentiality impact without affecting integrity or availability. The issue has a medium severity rating with a CVSS score of 4.3.

Missing authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)