Threat database

CVE-2026-106309 is an incorrect authorization vulnerability in the Selection component of Google Chrome on iOS. It affects versions prior to 155.0.8059.39 and allows a remote attacker to obtain sensitive information by crafting a malicious HTML page. The vulnerability has a high severity with a CVSS score of 8.8. A fix is available in version 155.0.8059.39.

CVE-2026-106250 is a vulnerability in Google Chrome prior to version 155.0.8059.39 where missing authorization in an Actor component allows a remote attacker to bypass system access restrictions via a crafted HTML page using social engineering. The issue has a medium severity rating with a CVSS score of 5.4. A fix is available in Chrome version 155.0.8059.39.

Missing authorization in Actor in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-106312 is a missing authorization vulnerability in the SignIn component of Google Chrome before version 155.0.8059.39. It allows a remote attacker to obtain sensitive information by tricking users into installing a crafted Chrome extension. The vulnerability has a medium severity with a CVSS score of 6.5.

CVE-2026-106353 is a medium severity vulnerability in Google Chrome for iOS versions prior to 155.0.8059.39. It involves improper input validation that allows a remote attacker, using social engineering, to bypass the web origin policy via a co-installed app. The vulnerability does not impact confidentiality but can affect integrity. No known exploits are reported in the wild. A vendor advisory is available but does not explicitly confirm patch status.

A confused deputy vulnerability in DeviceBoundSessionCredentials in Google Chrome prior to version 155.0.8059.39 allows a remote attacker to bypass the web origin policy via a crafted HTML page. The issue has a low security severity rating from Chromium and a CVSS score of 4.3 (medium severity).

A missing authorization vulnerability in Google Chrome prior to version 155.0.8059.39 allows a remote attacker who has compromised the renderer process and uses social engineering to bypass system access restrictions via a crafted HTML page. The issue has a medium severity rating with a CVSS score of 5.4.

CVE-2026-106317 is a medium severity UI misrepresentation vulnerability in Google Chrome on Android. It allows a remote attacker to spoof the address bar by using a crafted HTML page in fullscreen mode. This could mislead users about the actual website they are visiting. The issue is fixed in Chrome version 155.0.8059.39.

A UI misrepresentation vulnerability in the PictureInPicture feature of Google Chrome on Android versions prior to 155.0.8059.39 allows a remote attacker to spoof the address bar via a crafted HTML page. This vulnerability has a medium severity rating and does not have known exploits in the wild. It affects versions before 155.0.8059.39.

A UI misrepresentation vulnerability exists in the Payments feature of Google Chrome versions prior to 155.0.8059.39. This flaw allows a remote attacker to use social engineering techniques to spoof UI elements via a crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 5.4.

CVE-2026-106340 is a medium severity vulnerability in Google Chrome on Windows prior to version 155.0.8059.39. It involves missing authorization in the CredentialProvider component, allowing a local attacker with physical access to obtain sensitive information. The vulnerability does not require user interaction and has no known exploits in the wild. Google has released an update to fix this issue.

CVE-2026-106409 is a vulnerability in Google Chrome on Mac prior to version 155.0.8059.39 involving incorrect reference resolution in WebAppInstalls. This flaw allows a remote attacker who has compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. The vulnerability has a high severity rating with a CVSS score of 8.3. A stable channel update addressing this issue has been released by Google.

A type confusion vulnerability exists in the V8 JavaScript engine of Google Chrome before version 155.0.8059.39. This flaw allows a remote attacker to potentially execute arbitrary code within the browser sandbox by delivering a crafted HTML page. The vulnerability has a high severity with a CVSS score of 8.8. Google has released a stable channel update that addresses this issue.

CVE-2026-106372 is an incorrect authorization vulnerability in the UI of Google Chrome versions prior to 155.0.8059.39. This flaw could allow a remote attacker to execute arbitrary code outside the browser sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity score and affects Chrome desktop versions before the fixed release.

An information leak vulnerability exists in Google Chrome on Android versions prior to 155.0.8059.39. This flaw allows a local attacker, via a co-installed app, to obtain sensitive information. The vulnerability has a medium severity rating and a CVSS score of 5.1.

Observable discrepancy in Scroll in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium)

An information leak vulnerability exists in the Editing component of Google Chrome versions prior to 155.0.8059.39. This flaw allows a remote attacker, using social engineering techniques, to leak sensitive information via a crafted HTML page. The vulnerability has a medium severity rating and does not affect integrity or availability.

Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

A missing authorization vulnerability in the SiteIsolation feature of Google Chrome prior to version 155.0.8059.39 allows a remote attacker who has compromised the renderer process to bypass site isolation using a crafted HTML page. This issue has a medium severity rating and does not impact confidentiality but can lead to integrity violations.

CVE-2026-106351 is a medium severity vulnerability in Google Chrome on iOS prior to version 155.0.8059.39. It involves an observable discrepancy in the Safe Browsing feature that could allow a remote attacker, who has already compromised the renderer process, to obtain sensitive information via a crafted HTML page. The vulnerability affects confidentiality but does not impact integrity or availability. A fix is available from the vendor.