Threat database

Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-110916 is an improper input validation vulnerability in Google Chrome Desktop versions prior to 155.0.8059.84. This flaw allows a remote attacker to potentially execute arbitrary code outside the sandbox by crafting a malicious HTML page. The vulnerability has a critical severity rating with a CVSS score of 9.6.

Memory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)

Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)

Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-85298 is an Incorrect Authorization vulnerability in Google Cloud Application Integration's AuthConfig validation and integration execution runtime. It affects versions prior to 2026-08-27 and allows an authenticated user to escalate privileges and impersonate a service account within the project. The vulnerability was patched on August 27, 2026, and no customer action is required.

CVE-2026-110142 is a use-after-free vulnerability in the FileSystem component of Google Chrome prior to version 155.0.8059.79. This flaw allows a remote attacker to execute arbitrary code outside the browser sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a critical severity rating with a CVSS score of 9.6. Google has released an update to address this issue.

A use-after-free vulnerability exists in the Media component of Google Chrome prior to version 155.0.8059.79. This flaw allows a remote attacker to execute arbitrary code within the sandbox by tricking a user into visiting a crafted HTML page. The vulnerability is rated high severity with a CVSS score of 8.8. Google has released an update to address this issue.

A use-after-free vulnerability exists in the Media component of Google Chrome prior to version 155.0.8059.79. This flaw allows a remote attacker to execute arbitrary code within the sandbox by delivering a crafted HTML page. The vulnerability is rated as high severity with a CVSS score of 8.8.

A buffer overflow vulnerability exists in the PDFium component of Google Chrome prior to version 155.0.8059.79. This flaw allows a remote attacker to execute arbitrary code within the sandbox by using a specially crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8.

A use-after-free vulnerability exists in the Canvas component of Google Chrome versions prior to 155.0.8059.79. This flaw could allow a remote attacker to execute arbitrary code within the sandbox by tricking a user into visiting a crafted HTML page. The vulnerability is rated high severity with a CVSS score of 8.8.

CVE-2026-110147 is a use-after-free vulnerability in the PDF component of Google Chrome versions prior to 155.0.8059.79. This flaw allows a remote attacker to execute arbitrary code within the sandbox by delivering a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8. Google has released an update to address this issue.

A use-after-free vulnerability exists in the SVG component of Google Chrome prior to version 155.0.8059.79. This flaw allows a remote attacker to execute arbitrary code within the browser sandbox by tricking a user into visiting a crafted HTML page. The vulnerability is rated high severity with a CVSS score of 8.8.

CVE-2026-110138 is a use-after-free vulnerability in the ShapeDetection component of Google Chrome versions prior to 155.0.8059.79. This flaw allows a remote attacker who has compromised the renderer process to execute arbitrary code outside the sandbox by delivering a crafted HTML page. The vulnerability is rated high severity with a CVSS score of 8.3.

A vulnerability in Google Chrome prior to version 155.0.8059.79 allows a remote attacker to leak cross-origin data via a crafted HTML page due to an observable discrepancy in media handling. The issue has a low CVSS score of 3.1 and is classified as low severity. A fix is available in version 155.0.8059.79.

CVE-2026-110163 is a use-after-free vulnerability in the DOM component of Google Chrome prior to version 155.0.8059.79. This flaw allows a remote attacker to execute arbitrary code within the sandbox by crafting a malicious HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8.