Threat database

Clickjacking in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

A vulnerability in Google Chrome prior to version 155.0.8059.39 allows incorrect authorization in Extensions. This flaw enables a remote attacker, through social engineering, to spoof UI elements by crafting a malicious Chrome extension. The issue has a medium severity rating and a CVSS score of 4.8.

A vulnerability in Google Chrome on iOS prior to version 155.0.8059.39 allows a remote attacker to bypass the web origin policy via crafted network traffic, leveraging social engineering. This issue affects mobile Chrome on iOS and has a medium severity rating.

CVE-2026-106279 is a vulnerability in Google Chrome on iOS versions prior to 155.0.8059.39. It involves incorrect reference resolution in the Passwords component, which allows a local attacker who has compromised the renderer process to potentially execute arbitrary code outside the sandbox. The vulnerability has a CVSS score of 7.4, indicating high severity.

Incorrect authorization in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium)

An information leak vulnerability exists in the Audio component of Google Chrome prior to version 155.0.8059.39. This flaw allows a remote attacker who has already compromised the renderer process to read memory outside the sandbox by using a specially crafted Chrome extension. The vulnerability has a medium severity rating and a CVSS score of 4. A vendor advisory confirms the issue and indicates a stable channel update addressing it.

CVE-2026-106342 is an information leak vulnerability in the Autofill feature of Google Chrome versions prior to 155.0.8059.39. It allows a remote attacker to obtain sensitive information by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity with a CVSS score of 8.8. Google has released a stable channel update that fixes this issue.

CVE-2026-106354 is a medium severity vulnerability in Google Chrome prior to version 155.0.8059.39. It involves improper resource exposure in Chrome Extensions, allowing a remote attacker to obtain cross-origin data via a crafted HTML page. This vulnerability does not impact integrity or availability but can lead to limited confidentiality loss. A fix is available in Chrome version 155.0.8059.39.

A confused deputy vulnerability in the UI of Google Chrome on Android versions prior to 155.0.8059.39 allows a local attacker to bypass system access restrictions and access a privileged page via a co-installed app. The issue has a medium severity rating and a CVSS score of 4.4.

A missing authorization vulnerability in the FileSystem component of Google Chrome prior to version 155.0.8059.39 allows a remote attacker who has compromised the renderer process to bypass the web origin policy via a crafted HTML page. This vulnerability has a high severity rating with a CVSS score of 8.2.

A privilege elevation vulnerability exists in the sandbox component of Google Chrome on Mac systems prior to version 155.0.8059.39. This flaw allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox by using a crafted HTML page. The vulnerability has a high severity rating and affects versions before 155.0.8059.39.

Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

A missing authorization vulnerability in Google Chrome on iOS versions prior to 155.0.8059.39 allows a remote attacker to spoof UI elements via a crafted HTML page, leveraging social engineering. The issue has a medium severity rating and affects Chrome Mobile on iOS.

CVE-2026-106261 is a medium severity vulnerability in Google Chrome prior to version 155.0.8059.39. It involves an uninitialized resource in the video component that allows a remote attacker to read memory inside the sandbox by using a crafted HTML page. This vulnerability could lead to unauthorized disclosure of information but does not affect integrity or availability.

A protection mechanism failure in Google Chrome on iOS prior to version 155.0.8059.39 allows a remote attacker to bypass the web origin policy via a crafted HTML page. This vulnerability has a medium severity rating and impacts the integrity of web content isolation in the browser.

An improper input validation vulnerability in Google Chrome on iOS prior to version 155.0.8059.39 allows a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page, leveraging social engineering. The vulnerability has a critical severity rating with a CVSS score of 9.6.

CVE-2026-106196 is a vulnerability in Google Chrome on iOS versions prior to 155.0.8059.39. It involves missing authorization in navigation, allowing a remote attacker to bypass the web origin policy and access privileged pages via a crafted HTML page. The vulnerability has a CVSS score of 7.6, indicating high severity.

CVE-2026-106397 is an incorrect authorization vulnerability in Google Chrome on iOS versions prior to 155.0.8059.39. It allows a remote attacker, using social engineering and a crafted HTML page, to bypass system access restrictions. The vulnerability has a medium severity rating and a CVSS score of 6.1.

CVE-2026-106389 is a medium severity vulnerability in Google Chrome prior to version 155.0.8059.39. It involves incorrect authorization related to USB access, allowing a remote attacker to bypass system access restrictions via a crafted Chrome extension using social engineering techniques.

CVE-2026-106407 is a medium severity vulnerability in Google Chrome prior to version 155.0.8059.39. It involves incorrect authorization in the GetUserMedia API, allowing a remote attacker who has compromised the renderer process to bypass system access restrictions via a crafted HTML page. This vulnerability does not affect confidentiality but impacts integrity by enabling unauthorized actions. A fix is available in Chrome version 155.0.8059.39.