Threat database

A buffer overflow vulnerability exists in the Fonts component of Google Chrome prior to version 155.0.8059.39. This flaw could allow a remote attacker who has compromised the renderer process to execute arbitrary code outside the sandbox by using a crafted HTML page. The vulnerability has been assigned CVE-2026-106292 and is rated with high severity.

A confused deputy vulnerability in Contextual Tasks of Google Chrome prior to version 155.0.8059.39 allows a remote attacker who has compromised the renderer process to bypass system access restrictions and access privileged pages via a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.1.

A use-after-free vulnerability exists in the Fonts component of Google Chrome on Windows versions prior to 155.0.8059.39. This flaw allows a remote attacker to execute arbitrary code within the sandbox by delivering a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8. An official fix is available as indicated by the vendor advisory.

An incorrect authorization vulnerability in the Accessibility component of Google Chrome prior to version 155.0.8059.39 allows a remote attacker who has compromised the renderer process to bypass site isolation by using a crafted HTML page. This vulnerability has a high severity rating with a CVSS score of 8.1.

An observable discrepancy in the Paint component of Google Chrome prior to version 155.0.8059.39 allowed a remote attacker to leak cross-origin data via a crafted HTML page. This vulnerability has a medium severity rating and affects Chrome desktop versions before the specified fixed version.

CVE-2026-106391 is a medium severity vulnerability in Google Chrome on Android prior to version 155.0.8059.39. It involves incorrect authorization in the WebShare feature, allowing a remote attacker who has compromised the renderer process to spoof UI elements via a crafted HTML page. This could mislead users by displaying deceptive interface elements. The vulnerability has a CVSS score of 4.2, indicating a moderate risk. No known exploits are reported in the wild. A stable channel update from Google addresses this issue.

CVE-2026-106232 is a UI misrepresentation vulnerability in Google Chrome prior to version 155.0.8059.39. It allows a remote attacker to use social engineering techniques to spoof UI elements by crafting malicious HTML pages. The vulnerability has a medium severity rating and a CVSS score of 5.4.

A UI misrepresentation vulnerability in the FileSystem component of Google Chrome prior to version 155.0.8059.39 allows a remote attacker to bypass system access restrictions via a crafted HTML page using social engineering techniques. The vulnerability has a medium severity rating and a CVSS score of 5.4.

Improper input validation in Compositing in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-106367 is a missing authorization vulnerability in Google Chrome on Android versions prior to 155.0.8059.39. It allows a local attacker, through social engineering and a co-installed app, to potentially execute arbitrary code outside the sandbox. The vulnerability has a high severity rating with a CVSS score of 8.4.

CVE-2026-106230 is a medium severity vulnerability in Google Chrome on Android prior to version 155.0.8059.39. It involves incorrect reference resolution in the Offline component, which allows a remote attacker who has compromised the renderer process to obtain sensitive information via a crafted HTML page. The vulnerability has a CVSS score of 5.3. A stable channel update addressing this issue has been released by Google.

A race condition vulnerability exists in the WebAudio component of Google Chrome prior to version 155.0.8059.39. This flaw could allow a remote attacker to potentially leak cross-origin data by crafting a malicious HTML page. The vulnerability has a medium severity rating and a CVSS score of 4.3. Google has published a stable channel update addressing this issue.

A missing authorization vulnerability in the Passwords feature of Google Chrome on Android versions prior to 155.0.8059.39 allows a remote attacker who has compromised the renderer process to bypass site isolation via a crafted HTML page. This vulnerability has a high severity rating with a CVSS score of 8.1.

A clickjacking vulnerability exists in the Messages feature of Google Chrome on Android versions prior to 155.0.8059.39. This flaw allows a remote attacker to use social engineering to spoof UI elements via a crafted HTML page. The vulnerability has a medium severity rating and a CVSS score of 5.4.

A missing authorization vulnerability in Google Chrome on iOS prior to version 155.0.8059.39 allows a remote attacker to obtain sensitive information via a crafted HTML page leveraging social engineering. The vulnerability has a high severity with a CVSS score of 8.8. A vendor advisory from Google confirms the issue and indicates that a stable channel update has been released.

CVE-2026-106328 is a medium severity vulnerability in Google Chrome on Android prior to version 155.0.8059.39. It involves incorrect authorization in PDF handling that could allow a local attacker, leveraging social engineering and a co-installed app, to access sensitive information. Google has released a stable channel update that addresses this issue. There are no known exploits in the wild.

CVE-2026-106216 is a cross-site request forgery (CSRF) vulnerability in the ReadingList feature of Google Chrome on Android versions prior to 155.0.8059.39. This flaw allows a remote attacker to bypass the web origin policy by tricking a user into visiting a crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 5.4.

A UI misrepresentation vulnerability exists in Google Chrome on iOS versions prior to 155.0.8059.39. This flaw allows a remote attacker to spoof the address bar via a crafted HTML page, potentially misleading users through social engineering. The vulnerability has a medium severity rating.

Out of bounds read in Printing in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

A missing authorization vulnerability in Google Chrome prior to version 155.0.8059.39 allows a remote attacker who has compromised the renderer process to spoof UI elements using a crafted HTML page. The issue affects the Permissions component and has a medium severity rating.