Threat database

A race condition vulnerability exists in Google Chrome prior to version 155.0.8059.39. This flaw allows a remote attacker who has already compromised the renderer process to spoof UI elements by using a specially crafted HTML page. The vulnerability has a low severity rating from Chromium security and a CVSS score of 4.2, indicating medium severity overall.

CVE-2026-106256 is an information leak vulnerability in Google Chrome on Android versions prior to 155.0.8059.39. A remote attacker could exploit this flaw by tricking a user into visiting a crafted HTML page, potentially exposing sensitive password information. The vulnerability has a high severity rating with a CVSS score of 8.8. Google has released a stable channel update to address this issue.

An incorrect authorization vulnerability in the Transactions Platform of Google Chrome on Android versions prior to 155.0.8059.39 allows a remote attacker to obtain sensitive information via a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8. A fix is available in version 155.0.8059.39.

CVE-2026-106343 is a vulnerability in Google Chrome on Android prior to version 155.0.8059.39 involving improper state validation in the Autofill AI feature. This flaw allows a remote attacker to spoof UI elements by crafting a malicious HTML page. The issue has a medium severity rating with a CVSS score of 5.4. A vendor advisory is available but does not explicitly confirm patch status in the provided data.

A missing authorization vulnerability in the Network component of Google Chrome prior to version 155.0.8059.39 allows a remote attacker to bypass the web origin policy via crafted network traffic, leveraging social engineering. The vulnerability has a medium severity rating with a CVSS score of 6.5.

A UI misrepresentation vulnerability exists in Google Chrome for Android versions prior to 155.0.8059.39. This flaw allows a remote attacker to spoof UI elements via a crafted HTML page, potentially misleading users. The vulnerability has a medium severity rating with a CVSS score of 5.4. A fix has been released in version 155.0.8059.39.

A missing authorization vulnerability in Google Chrome prior to version 155.0.8059.39 allows a remote attacker to bypass system access restrictions via a crafted HTML page, leveraging social engineering. The vulnerability is rated as medium severity with a CVSS score of 5.4.

CVE-2026-106350 is a high severity incorrect authorization vulnerability in Google Chrome versions prior to 155.0.8059.39. It allows a remote attacker to obtain sensitive information by leveraging a crafted HTML page. Google has released an update to address this issue.

Incorrect authorization in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-106331 is an improper input validation vulnerability in Google Chrome extensions prior to version 155.0.8059.39. This flaw allows a remote attacker, using social engineering, to bypass the web origin policy and access a privileged page via a crafted Chrome extension. The vulnerability has a medium severity rating with a CVSS score of 6.5.

An information leak vulnerability exists in the Permissions component of Google Chrome prior to version 155.0.8059.39. This flaw allows a remote attacker to bypass site isolation by crafting a malicious HTML page. The vulnerability is rated critical with a high CVSS score of 9.6, indicating severe confidentiality and integrity impacts. The issue affects versions before 155.0.8059.39. Google has published an advisory indicating a stable channel update addressing this vulnerability.

CVE-2026-106368 is a UI misrepresentation vulnerability in Google Chrome on Android versions prior to 155.0.8059.39. It allows a remote attacker to spoof UI elements via a crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 5.4. A fix is available in Chrome version 155.0.8059.39.

A UI misrepresentation vulnerability in Google Chrome's WebAppInstalls component prior to version 155.0.8059.39 allows remote attackers to spoof UI elements via crafted HTML pages. The issue has a medium severity rating with a CVSS score of 5.4. Google has released an official fix in Chrome version 155.0.8059.39.

CVE-2026-106380 is a UI misrepresentation vulnerability in Google Chrome versions prior to 155.0.8059.39. It allows a remote attacker to spoof UI elements by leveraging social engineering through a crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 5.4.

CVE-2026-106374 is a type confusion vulnerability in the V8 JavaScript engine used by Google Chrome versions prior to 155.0.8059.39. This flaw allows a remote attacker to execute arbitrary code within the sandbox by crafting a malicious HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8. Google has released a stable channel update to address this issue.

CVE-2026-106249 is a vulnerability in Google Chrome on Android versions prior to 155.0.8059.39. It involves incorrect authorization in the Autofill feature, allowing a remote attacker to obtain sensitive information via a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8.

CVE-2026-106296 is a medium severity vulnerability in Google Chrome on Mac systems prior to version 155.0.8059.39. It involves improper privilege management in the user interface that allows a remote attacker, using social engineering and a crafted HTML page, to bypass system access restrictions. The vulnerability has a CVSS score of 5.4 and does not have known exploits in the wild. A fix is available as indicated by the vendor advisory.

CVE-2026-106259 is a vulnerability in Google Chrome prior to version 155.0.8059.39 involving incorrect authorization in the PermissionElement component. This flaw allows a remote attacker to bypass system access restrictions by using a crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 5.4. It does not appear to be actively exploited in the wild. Google has released a stable channel update addressing this issue.

A confused deputy vulnerability in WebAPKs on Google Chrome for Android versions prior to 155.0.8059.39 allows a remote attacker, using social engineering, to bypass the web origin policy via a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.3.

An integer overflow vulnerability exists in the Media component of Google Chrome prior to version 155.0.8059.39. This flaw could allow a remote attacker to execute arbitrary code outside the browser sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high CVSS score of 9.6, indicating critical severity. Google has released an update to address this issue.