Threat database

Use after free in Tint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

An integer overflow vulnerability exists in the Compositing component of Google Chrome prior to version 155.0.8059.39. This flaw allows a remote attacker to obtain cross-origin data by tricking a user into visiting a crafted HTML page. The vulnerability has a CVSS score of 4.3, indicating medium severity.

A high-severity vulnerability (CVE-2026-106203) in Google Chrome on iOS prior to version 155.0.8059.39 involves incomplete cleanup in the Autofill feature. This flaw allows a remote attacker, using social engineering and a crafted HTML page, to obtain sensitive information. The vulnerability has a CVSS score of 8.8, indicating a significant risk to confidentiality, integrity, and availability.

Uninitialized resource in Video in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Uninitialized resource in Dawn in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

A missing authorization vulnerability in Google Chrome for iOS prior to version 155.0.8059.39 allows a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page, leveraging social engineering. The vulnerability has a critical severity with a CVSS score of 9.6.

CVE-2026-106396 is a vulnerability in the Omnibox component of Google Chrome on Android versions prior to 155.0.8059.39. It involves improper input validation that allows a remote attacker to bypass the web origin policy through a crafted HTML page, leveraging social engineering. The vulnerability has a medium severity rating with a CVSS score of 5.4.

CVE-2026-106419 is a use-after-free vulnerability in the ANGLE component of Google Chrome on Android versions prior to 155.0.8059.39. This flaw allows a remote attacker to execute arbitrary code outside the sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a critical severity with a CVSS score of 9.6. Google has released an update to address this issue.

A race condition vulnerability exists in the font handling component of Google Chrome versions prior to 155.0.8059.39. This flaw could allow a remote attacker to execute arbitrary code outside the browser sandbox by tricking a user into visiting a specially crafted HTML page. The vulnerability is rated high severity with a CVSS score of 8.3.

Integer overflow in WebGL in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-106364 is a medium severity vulnerability in Google Chrome's Omnibox component prior to version 155.0.8059.39. It allows a remote attacker who has compromised the renderer process to obtain sensitive information via a crafted HTML page due to incorrect authorization. The vulnerability has a CVSS score of 5.3 and does not affect availability or integrity. A fix is available in Chrome version 155.0.8059.39.

An information leak vulnerability exists in the Proxy component of Google Chrome on Windows versions prior to 155.0.8059.39. This flaw allows an adjacent attacker to obtain sensitive information via crafted network traffic. The vulnerability has been assigned CVE-2026-106214 and is rated with medium severity based on a CVSS score of 5.3.

A vulnerability in Google Chrome prior to version 155.0.8059.39 involves incomplete cleanup in the Proxy Auth component. This flaw allows an adjacent attacker to obtain sensitive information through crafted network traffic. The issue has a medium severity rating with a CVSS score of 5.3.

A race condition vulnerability exists in the Core component of Google Chrome on Mac systems prior to version 155.0.8059.39. This flaw allows a remote attacker who has compromised the renderer process and uses social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. The vulnerability is rated with high severity and has a CVSS score of 8.3.

A race condition vulnerability exists in the Fonts component of Google Chrome prior to version 155.0.8059.39. This flaw allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox by delivering a crafted HTML page. The vulnerability has a high severity rating and a CVSS score of 8.3.

A type confusion vulnerability exists in the ANGLE component of Google Chrome versions prior to 155.0.8059.39. This flaw allows a remote attacker who has compromised the renderer process to potentially execute arbitrary code outside the sandbox by using a crafted HTML page. The vulnerability has a high severity rating and a CVSS score of 8.3.

A missing authorization vulnerability in the Translate feature of Google Chrome prior to version 155.0.8059.39 allows a remote attacker who has compromised the renderer process to bypass site isolation using a crafted HTML page. The vulnerability is rated as medium severity with a CVSS score of 4.2.

Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-106308 is a high severity vulnerability in Google Chrome on Android involving incorrect reference resolution in the Autofill feature. This flaw allows a remote attacker to use social engineering via a crafted HTML page to obtain sensitive information. Versions prior to 155.0.8059.39 are affected. A fix is available as indicated by the vendor advisory.