Threat database

An information leak vulnerability exists in the Animation component of Google Chrome versions prior to 155.0.8059.39. This flaw allows a remote attacker to leak cross-origin data by tricking a user into visiting a crafted HTML page. The vulnerability has a medium severity rating and a CVSS score of 4.3.

A missing authorization vulnerability in the FedCM component of Google Chrome prior to version 155.0.8059.39 allows a remote attacker to bypass the web origin policy via a crafted HTML page. This issue has been assigned CVE-2026-106289 and is rated medium severity with a CVSS score of 6.5. The vulnerability could lead to unauthorized actions due to improper enforcement of origin policy. Google has released a stable channel update addressing this issue.

Confused deputy in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

An incorrect authorization vulnerability in Google Chrome prior to version 155.0.8059.39 allows a remote attacker to spoof UI elements via a crafted HTML page, leveraging social engineering. This issue has a medium severity rating and impacts confidentiality and availability with limited scope.

Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-106303 is a medium severity vulnerability in Google Chrome's Autofill AI component prior to version 155.0.8059.39. It allows a remote attacker who has compromised the renderer process and uses social engineering via a crafted HTML page to obtain sensitive information. The attack requires user interaction and has high complexity. A fix is available from the vendor.

Observable discrepancy in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

A medium severity vulnerability (CVE-2026-106206) exists in Google Chrome on iOS prior to version 155.0.8059.39. It involves improper input validation in the mobile version of Chrome, which could allow a remote attacker to obtain sensitive information via crafted network traffic. The vulnerability has a CVSS score of 5.9 and does not require user interaction or privileges to exploit. A fix is available in version 155.0.8059.39.

CVE-2026-106280 is a medium severity vulnerability in Google Chrome prior to version 155.0.8059.39. It involves incorrect authorization in the PermissionElement component, which could allow a remote attacker to bypass the web origin policy by using a crafted HTML page. This vulnerability does not impact confidentiality but can affect integrity. No known exploits are reported in the wild. A fix is available in Chrome version 155.0.8059.39.

An open redirect vulnerability exists in the AppManifest component of Google Chrome versions prior to 155.0.8059.39. This flaw allows a remote attacker to bypass the web origin policy via a crafted HTML page, potentially leading to limited confidentiality and integrity impacts. The vulnerability has a medium severity rating and requires user interaction for exploitation.

A race condition vulnerability exists in the CustomTabs component of Google Chrome on Android versions prior to 155.0.8059.39. This flaw allows a local attacker to bypass the web origin policy via a co-installed app. The vulnerability has a medium severity rating and a CVSS score of 6. A vendor advisory link is provided but does not explicitly confirm patch status.

CVE-2026-106356 is a clickjacking vulnerability in Google Chrome prior to version 155.0.8059.39. It allows a remote attacker to use social engineering to spoof UI elements via a crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 5.4. A fix is available in Chrome version 155.0.8059.39.

CVE-2026-106370 is a medium severity vulnerability in Google Chrome on Android versions prior to 155.0.8059.39. It involves an uninitialized GPU resource that allows a remote attacker, who has already compromised the renderer process, to read memory outside the sandbox via a crafted HTML page. This vulnerability does not impact integrity or availability but can lead to information disclosure.

A confused deputy vulnerability in the SignIn component of Google Chrome on Android versions prior to 155.0.8059.39 allows a remote attacker to bypass system access restrictions to a privileged page via a crafted HTML page. The issue has a medium severity rating and a CVSS score of 6.1.

An information leak vulnerability exists in the WebAudio component of Google Chrome prior to version 155.0.8059.39. This flaw could allow a remote attacker to leak cross-origin data by tricking a user into visiting a crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 4.3. A fix is available in Chrome version 155.0.8059.39.

A UI misrepresentation vulnerability exists in the WebOTP feature of Google Chrome prior to version 155.0.8059.39. This flaw allows a remote attacker to spoof UI elements by crafting a malicious HTML page. The vulnerability has a medium severity rating and a CVSS score of 5.4.

A UI misrepresentation vulnerability exists in the Paint feature of Google Chrome prior to version 155.0.8059.39. This flaw allows a remote attacker to spoof UI elements by crafting a malicious HTML page. The vulnerability has a medium severity rating and a CVSS score of 5.4.

A code injection vulnerability exists in Google Chrome extensions prior to version 155.0.8059.39. This flaw allows a remote attacker, using social engineering, to spoof user interface elements via a crafted Chrome extension. The vulnerability has a medium severity rating and a CVSS score of 5.4.

CVE-2026-106302 is a medium severity UI misrepresentation vulnerability in Google Chrome prior to version 155.0.8059.39. It affects the PermissionElement component, allowing remote attackers to spoof UI elements via crafted HTML pages, potentially misleading users through social engineering. The vulnerability has a CVSS score of 5.4 and does not have known exploits in the wild. A fix is available in Chrome version 155.0.8059.39.

Incorrect authorization in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)