Threat database

CVE-2026-110151 is a use-after-free vulnerability in the Media component of Google Chrome prior to version 155.0.8059.79. This flaw allows a remote attacker to execute arbitrary code within the sandbox by delivering a crafted HTML page. The vulnerability is rated with a high severity CVSS score of 8.8.

CVE-2026-110148 is a use-after-free vulnerability in the SVG component of Google Chrome prior to version 155.0.8059.79. This flaw allows a remote attacker to execute arbitrary code within the browser's sandbox by delivering a crafted HTML page. The vulnerability is rated with a high severity CVSS score of 8.8. A fix is available in Chrome version 155.0.8059.79.

CVE-2026-110165 is a critical use-after-free vulnerability in the Core component of Google Chrome on Android versions prior to 155.0.8059.79. This flaw allows a remote attacker to potentially execute arbitrary code outside the browser sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability.

A use-after-free vulnerability exists in the Network component of Google Chrome prior to version 155.0.8059.79. This flaw allows a remote attacker to execute arbitrary code outside the sandbox by sending crafted network traffic. The vulnerability is rated critical with a CVSS score of 9.6.

A use-after-free vulnerability exists in the PDF component of Google Chrome versions prior to 155.0.8059.79. This flaw allows a remote attacker to execute arbitrary code outside the sandbox by delivering a crafted HTML page. The vulnerability has a critical severity rating and a CVSS score of 9.6.

CVE-2026-110149 is a critical use-after-free vulnerability in the browser component of Google Chrome prior to version 155.0.8059.79. This flaw allows a remote attacker to execute arbitrary code outside the sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported. Google has released an update to fix this issue in version 155.0.8059.79.

A critical buffer overflow vulnerability exists in the ANGLE component of Google Chrome on Android versions prior to 155.0.8059.79. This flaw allows a remote attacker to potentially execute arbitrary code outside the browser sandbox by delivering a crafted HTML page. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability.

Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.

CVE-2026-95702 is a use-after-free vulnerability in the virtual file system (VFS) component of Google gVisor prior to release 20260831.0. It allows a local attacker with standard container privileges to execute code in the host sentry process by triggering a double-free of the backing MemoryFile in an in-sandbox overlay filesystem. The sentry process remains confined by Linux seccomp and namespace boundaries on the host.

Use after free in CSS in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Use after free in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Low)

CVE-2026-106355 is a medium severity vulnerability in Google Chrome's Media component on Windows. It involves missing authorization that allows a remote attacker, who has compromised the renderer process, to obtain sensitive information via a crafted HTML page. The vulnerability affects versions prior to 155.0.8059.39. The CVSS score is 5.3, indicating a moderate impact on confidentiality without affecting integrity or availability.

CVE-2026-106272 is a UI misrepresentation vulnerability in the Chromoting component of Google Chrome on Windows versions prior to 155.0.8059.39. It allows a remote attacker to potentially spoof UI elements by leveraging social engineering and crafted network traffic. The vulnerability has a medium severity rating with a CVSS score of 5.4.

CVE-2026-106345 is a vulnerability in Google Chrome prior to version 155.0.8059.39 involving use of a released resource in the Session component. This flaw allows a remote attacker who has compromised the renderer process to spoof UI elements via a crafted HTML page. The vulnerability has a low severity rating from Chromium security and a CVSS score of 4.2 (medium severity).

Use of released resource in FontAccess in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

A UI misrepresentation vulnerability exists in the Chromoting component of Google Chrome on Mac systems prior to version 155.0.8059.39. This flaw allows a remote attacker to spoof UI elements by sending crafted network traffic, potentially tricking users via social engineering. The vulnerability has a medium severity rating with a CVSS score of 5.4. Google has released a stable channel update addressing this issue.

A UI misrepresentation vulnerability exists in the Chromoting component of Google Chrome on Windows versions prior to 155.0.8059.39. This flaw allows a remote attacker to spoof UI elements by sending crafted network traffic, potentially tricking users via social engineering. The vulnerability is rated as medium severity with a CVSS score of 5.4. Google has released an update to address this issue.

CVE-2026-106334 is a high severity information leak vulnerability in the Payments component of Google Chrome versions prior to 155.0.8059.39. It allows a remote attacker to obtain sensitive information by tricking a user into visiting a crafted HTML page. The vulnerability requires user interaction and affects confidentiality, integrity, and availability.

CVE-2026-106294 is a critical vulnerability in Google Chrome on Mac platforms prior to version 155.0.8059.39. It involves incomplete cleanup in the Chromoting component, which allows a remote attacker to bypass system access restrictions by sending crafted network traffic. The vulnerability has a high CVSS score of 9.1, indicating critical severity with high confidentiality impact and high availability impact. The issue affects versions before 155.0.8059.39 and has been addressed in that version.