Threat database

Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-106346 is a high-severity vulnerability in Google Chrome's DevTools prior to version 155.0.8059.39. It involves improper state validation that could allow a remote attacker to execute arbitrary code within the sandbox by delivering a crafted HTML page. This vulnerability affects desktop versions of Chrome before the stated fixed version.

CVE-2026-106423 is a use-after-free vulnerability in the Media component of Google Chrome prior to version 155.0.8059.39. This flaw allows a remote attacker to execute arbitrary code within the browser's sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8.

TP-Link Tapo C500 v2.0 contains an out-of-bounds stack write vulnerability in its ONVIF PTZ SOAP handlers. An authenticated ONVIF client can submit an excessive number of preset-related elements, causing writes beyond the bounds of fixed-size stack arrays and resulting in a crash of the affected service. Successful exploitation may allow an authenticated attacker to cause the affected service to crash, resulting in a denial-of-service condition. Repeated exploitation may repeatedly disrupt camera management and PTZ-related functionality until the service recovers or restarts.

CVE-2026-106411 is a use-after-free vulnerability in the Parser component of Google Chrome prior to version 155.0.8059.39. This flaw allows a remote attacker to execute arbitrary code within the sandbox by crafting a malicious HTML page. The vulnerability is rated high severity with a CVSS score of 8.8.

A use-after-free vulnerability exists in the Media component of Google Chrome prior to version 155.0.8059.39. This flaw allows a remote attacker to execute arbitrary code within the sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8.

Use after free in Metrics in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Select in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in WebRTC in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in HTML in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Bindings in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-106329 is a critical security vulnerability in Google Chrome's FileSystem component prior to version 155.0.8059.39. It involves incorrect authorization that allows a remote attacker, through social engineering and a crafted HTML page, to potentially execute arbitrary code outside the browser sandbox. This vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability.

Use after free in TabStrip in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-106379 is a vulnerability in Google Chrome's Skia component prior to version 155.0.8059.39. It involves an uninitialized resource that could allow a remote attacker to obtain cross-origin data via a crafted HTML page. The vulnerability has a CVSS score of 4.3, indicating medium severity. Google has released a stable channel update addressing this issue.

Use after free in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-106393 is a use-after-free vulnerability in the Storage component of Google Chrome prior to version 155.0.8059.39. This flaw allows a remote attacker who has compromised the renderer process to execute arbitrary code outside the sandbox by delivering a crafted HTML page. The vulnerability is rated high severity with a CVSS score of 8.3. A fix is available in Chrome version 155.0.8059.39.

Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Parser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

A use-after-free vulnerability exists in Chrome Tabs on Google Chrome for Mac prior to version 155.0.8059.39. This flaw could allow a remote attacker to execute arbitrary code outside the sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has been assigned CVE-2026-106298 and is rated critical with a CVSS score of 9.6.