Threat database

CVE-2026-106386 is a medium severity vulnerability in Google Chrome's WebAudio component prior to version 155.0.8059.39. It involves an uninitialized resource that allows a remote attacker to read memory inside the sandbox by delivering a crafted HTML page. This vulnerability does not allow code execution or denial of service but can lead to information disclosure.

A missing authorization vulnerability in the Chromoting component of Google Chrome on Windows versions prior to 155.0.8059.39 allows a remote attacker to obtain sensitive information via crafted network traffic. The issue is rated medium severity with a CVSS score of 5.9. A fix is available in version 155.0.8059.39.

CVE-2026-106404 is a medium severity vulnerability in Google Chrome's FontAccess component prior to version 155.0.8059.39. It allows a remote attacker who has compromised the renderer process to bypass system access restrictions by using a crafted HTML page. This flaw affects Chrome versions before 155.0.8059.39 and has a CVSS score of 6.5. A fix is available as indicated by the vendor advisory.

CVE-2026-106263 is a medium severity vulnerability in Google Chrome prior to version 155.0.8059.39. It involves improper input validation in the SignIn component, which allows a remote attacker to bypass system access restrictions by tricking a user into installing a crafted Chrome extension. This vulnerability requires user interaction and does not impact confidentiality or availability directly.

A UI misrepresentation vulnerability exists in Google Chrome on Android versions prior to 155.0.8059.39. This flaw allows a remote attacker to spoof UI elements by crafting a malicious HTML page. The vulnerability has a medium severity rating and a CVSS score of 5.4.

CVE-2026-106352 is a high-severity incorrect authorization vulnerability in the WebProtect component of Google Chrome. It affects versions prior to 155.0.8059.39 and allows a remote attacker to obtain sensitive information by tricking a user into visiting a malicious HTML page. Google has released an official fix in Chrome version 155.0.8059.39.

Incorrect authorization in Unbounded Element in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

An information leak vulnerability exists in the Paint component of Google Chrome versions prior to 155.0.8059.39. This flaw allows a remote attacker to leak sensitive information by convincing a user to visit a crafted HTML page. The vulnerability has a medium severity rating and does not impact integrity or availability.

CVE-2026-106401 is a critical out-of-bounds write vulnerability in the Media component of Google Chrome prior to version 155.0.8059.39. This flaw could allow a remote attacker to execute arbitrary code outside the browser sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability. Google has released an update to address this issue in Chrome version 155.0.8059.39.

Out of bounds read in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-106395 is a medium severity vulnerability in Google Chrome on Android prior to version 155.0.8059.39. It involves an uninitialized resource in the Dawn component that allows a remote attacker to read memory outside the sandbox by delivering a crafted HTML page. This vulnerability does not allow code execution or denial of service but can lead to information disclosure. The issue is fixed in version 155.0.8059.39.

CVE-2026-106271 is a vulnerability in Google Chrome prior to version 155.0.8059.39 where missing authorization in Workers allowed a remote attacker with renderer process access to bypass site isolation using a crafted PDF file. The vulnerability is rated high severity with a CVSS score of 8.1. A fix is available in Chrome version 155.0.8059.39.

CVE-2026-106388 is a medium severity vulnerability in Google Chrome's DataTransfer component prior to version 155.0.8059.39. It involves missing authorization that allows a remote attacker who has compromised the renderer process to access sensitive information via a crafted HTML page. The vulnerability has a CVSS score of 5.3 and does not affect availability or integrity, only confidentiality.

CVE-2026-106398 is a medium severity vulnerability in Google Chrome prior to version 155.0.8059.39. It involves incorrect authorization in the Media component, allowing a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability does not impact integrity or availability and requires user interaction to exploit.

CVE-2026-106212 is a high-severity vulnerability in Google Chrome's Autofill feature prior to version 155.0.8059.39. It involves incorrect authorization that allows a remote attacker, using social engineering and a crafted HTML page, to obtain sensitive information. The vulnerability has a CVSS score of 8.8, indicating a critical impact on confidentiality, integrity, and availability. Google has released an update to address this issue.

CVE-2026-106307 is a medium severity vulnerability in Google Chrome prior to version 155.0.8059.39. It involves incorrect authorization in the Network component that allows a remote attacker, who has already compromised the renderer process, to bypass system access restrictions via a crafted HTML page.

CVE-2026-106348 is an information leak vulnerability in the Animation component of Google Chrome versions prior to 155.0.8059.39. A remote attacker can exploit this flaw by crafting a malicious HTML page to leak sensitive information. The vulnerability has a medium severity rating and a CVSS score of 6.5. Google has released a stable channel update addressing this issue.

CVE-2026-106375 is a critical vulnerability in Google Chrome prior to version 155.0.8059.39. It involves incomplete cleanup in the Dawn component, which could allow a remote attacker to execute arbitrary code outside the browser sandbox by delivering a crafted HTML page. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability.

An information leak vulnerability exists in the Payments component of Google Chrome versions prior to 155.0.8059.39. This flaw allows a remote attacker to obtain cross-origin data by tricking a user into visiting a crafted HTML page. The vulnerability is rated as medium severity with a CVSS score of 4.3.

Incomplete cleanup in GetUserMedia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)