Threat database

Missing authorization in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

A missing authorization vulnerability in the Network component of Google Chrome prior to version 155.0.8059.39 allows a remote attacker who has compromised the renderer process to bypass site isolation using a crafted HTML page. This vulnerability has a medium severity rating and does not impact confidentiality but can affect integrity.

A missing authorization vulnerability in the Animation component of Google Chrome prior to version 155.0.8059.39 allows a remote attacker to bypass the web origin policy via a crafted HTML page. This vulnerability has a medium severity rating and impacts the integrity of web content isolation.

CVE-2026-106274 is a vulnerability in Google Chrome on Mac prior to version 155.0.8059.39 involving incorrect reference resolution. This flaw allows a remote attacker to use social engineering via a crafted HTML page to obtain sensitive information. The vulnerability has a high severity rating with a CVSS score of 8.8.

CVE-2026-106315 is a use-after-free vulnerability in the modularization component of Google Chrome prior to version 155.0.8059.39. This flaw allows a remote attacker to execute arbitrary code within the sandbox by delivering a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8. A fix is available in Chrome version 155.0.8059.39.

CVE-2026-106181 is a medium severity vulnerability in Google Chrome's DevTools prior to version 155.0.8059.39. It involves incorrect reference resolution that could allow a remote attacker, who has already compromised the renderer process, to obtain sensitive information via a crafted HTML page. The vulnerability has a CVSS score of 5.3 and does not have known exploits in the wild. A fix is available in Chrome version 155.0.8059.39.

A confused deputy vulnerability in the Omnibox component of Google Chrome prior to version 155.0.8059.39 allows a remote attacker to bypass the web origin policy via crafted network traffic. This vulnerability has a medium severity rating and impacts the integrity of web content handling.

A missing authorization vulnerability in an API of Google Chrome prior to version 155.0.8059.39 allows a remote attacker to leak sensitive information by tricking a user into installing a crafted Chrome extension. The vulnerability has a medium severity rating.

Incorrect authorization in Sync in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium)

CVE-2026-106420 is a medium severity vulnerability in Google Chrome on Windows prior to version 155.0.8059.39. It involves an incorrect calculation in an API that allows a remote attacker, through social engineering and a crafted Chrome extension, to spoof UI elements. This vulnerability has a CVSS score of 5.4 and affects versions before the fixed release 155.0.8059.39.

A medium severity vulnerability (CVE-2026-106324) in Google Chrome on Android versions prior to 155.0.8059.39 allows a remote attacker to bypass system access restrictions via a crafted HTML page due to incorrect authorization in the WebAppInstalls component.

Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

A UI misrepresentation vulnerability in Google Chrome prior to version 155.0.8059.39 allows a remote attacker to spoof UI elements via a crafted HTML page, potentially tricking users through social engineering. The issue has a medium severity rating and affects versions before 155.0.8059.39.

Use after free in Track in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)

A use-after-free vulnerability exists in the PDF component of Google Chrome prior to version 155.0.8059.39. This flaw allows a remote attacker to execute arbitrary code within the sandbox by delivering a crafted HTML page. The vulnerability has a high severity rating and a CVSS score of 8.8.

CVE-2026-106349 is a use-after-free vulnerability in the V8 JavaScript engine of Google Chrome prior to version 155.0.8059.39. This flaw allows a remote attacker to execute arbitrary code within the browser's sandbox by crafting a malicious HTML page. The vulnerability is rated as high severity with a CVSS score of 8.8. Google has released an official fix in Chrome version 155.0.8059.39.

CVE-2026-106383 is a use-after-free vulnerability in the Media component of Google Chrome prior to version 155.0.8059.39. This flaw allows a remote attacker to execute arbitrary code within the sandbox by delivering a crafted HTML page. The vulnerability has a high severity rating and a CVSS score of 8.8.

Uninitialized resource in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)