Threat database

An incorrect authorization vulnerability in Google Chrome prior to version 155.0.8059.39 allows a remote attacker to bypass system access restrictions via crafted network traffic. This issue affects permissions handling and has been assigned a medium severity rating.

CVE-2026-106185 is an improper input validation vulnerability in the Viz component of Google Chrome prior to version 155.0.8059.39. This flaw allows a remote attacker who has already compromised the renderer process to bypass system access restrictions by using a specially crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 6.5.

Missing authorization in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

An information leak vulnerability exists in Google Chrome prior to version 155.0.8059.39. This flaw allows a remote attacker to leak sensitive information by crafting a malicious HTML page. The vulnerability affects the Enterprise version of Chrome and has been assigned a medium severity rating with a CVSS score of 4.3. A fix is available as indicated by the vendor advisory linked to the Chrome stable channel update.

CVE-2026-106335 is a use-after-free vulnerability in the Media component of Google Chrome prior to version 155.0.8059.39. This flaw allows a remote attacker to execute arbitrary code within the sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8. Google has released an official fix in Chrome version 155.0.8059.39.

CVE-2026-106189 is a code injection vulnerability in the ReaderMode feature of Google Chrome on iOS versions prior to 155.0.8059.39. This flaw allows a remote attacker to bypass the web origin policy by using a crafted HTML page, potentially leading to code injection. The vulnerability has a CVSS score of 7.3, indicating high severity.

CVE-2026-106266 is a medium severity confused deputy vulnerability in Google Chrome prior to version 155.0.8059.39. It allows a remote attacker who has compromised the renderer process to bypass the web origin policy and access privileged pages via a crafted HTML page. This vulnerability affects Chrome desktop versions before 155.0.8059.39.

A missing authorization vulnerability in the FullScreen feature of Google Chrome prior to version 155.0.8059.39 allows a remote attacker who has compromised the renderer process and uses social engineering to bypass system access restrictions via a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.3.

A missing authorization vulnerability in the Autofill feature of Google Chrome prior to version 155.0.8059.39 allows a remote attacker to obtain sensitive information via a crafted HTML page using social engineering techniques. The vulnerability has a high severity rating with a CVSS score of 8.8.

A missing authorization vulnerability in the BrowserTag component of Google Chrome prior to version 155.0.8059.39 allows a remote attacker who has compromised the renderer process and uses social engineering to bypass site isolation via a crafted HTML page. The vulnerability has a medium severity rating.

A missing authorization vulnerability in Google Lens within Google Chrome prior to version 155.0.8059.39 allows a remote attacker who has compromised the renderer process to leak cross-origin data via a crafted HTML page. The issue has a medium severity rating with a CVSS score of 4.3. This vulnerability affects Chrome versions before 155.0.8059.39.

A medium severity vulnerability (CVE-2026-106381) in Google Chrome on iOS versions prior to 155.0.8059.39 allows a remote attacker to bypass the web origin policy via a crafted HTML page due to incorrect authorization in the Passwords component.

Incorrect authorization in Search in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

An information leak vulnerability exists in the Omnibox component of Google Chrome on Android versions prior to 155.0.8059.39. This flaw allows a remote attacker to leak sensitive information by leveraging social engineering and crafted network traffic. The vulnerability has a medium severity rating and does not require privileges but does require user interaction.

Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-106314 is a high-severity vulnerability in Google Chrome's Bluetooth authorization mechanism prior to version 155.0.8059.39. It allows a remote attacker to obtain sensitive information by tricking a user into visiting a crafted HTML page. The issue arises from incorrect authorization checks in the browser's Bluetooth component.

Race condition in CacheStorage in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

A use-after-free vulnerability exists in the GarbageCollection component of Google Chrome prior to version 155.0.8059.39. This flaw allows a remote attacker to execute arbitrary code within the browser's sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8.

Use after free in Streaming in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-106313 is a medium severity vulnerability in Google Chrome on Android versions prior to 155.0.8059.39. It allows a local attacker to obtain sensitive information by exploiting incorrect authorization via a co-installed app. Exploitation requires local access and social engineering. The vulnerability does not allow privilege escalation or denial of service.