Threat database

A vulnerability in Google Chrome's SanitizerAPI prior to version 155.0.8059.39 allows a remote attacker to leak sensitive information via a crafted HTML page. The issue is classified with a low security severity by Chromium and has a CVSS score of 4.3, indicating a medium severity level overall.

CVE-2026-106325 is a vulnerability in Google Chrome prior to version 155.0.8059.39 involving incorrect reference resolution in the browser's core. This flaw allows a remote attacker, using social engineering, to leak cross-origin data through a crafted HTML page. The vulnerability has a low Chromium security severity and a CVSS score of 4.3, indicating medium severity. No known exploits are reported in the wild. A stable channel update addressing this issue has been released by Google.

A race condition vulnerability exists in the Chromoting component of Google Chrome versions prior to 155.0.8059.39. This flaw could allow a remote attacker, using social engineering and crafted network traffic, to potentially bypass system access restrictions. The vulnerability has a medium severity rating with a CVSS score of 5.3.

A UI misrepresentation vulnerability exists in the Chromoting feature of Google Chrome on Mac platforms prior to version 155.0.8059.39. This flaw allows a remote attacker to spoof UI elements by sending crafted network traffic, potentially tricking users via social engineering. The issue has a medium severity rating with a CVSS score of 5.4. Google has released an update to address this vulnerability.

CVE-2026-106195 is an incorrect authorization vulnerability in the Chromoting component of Google Chrome on Mac systems prior to version 155.0.8059.39. This flaw allows a remote attacker to bypass system access restrictions by sending crafted network traffic. The vulnerability has a critical severity rating with a CVSS score of 9.1. Google has released a stable channel update addressing this issue.

Use of released resource in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-106339 is a low severity vulnerability in Google Chrome prior to version 155.0.8059.39. It involves use of a released resource in the browser's core, which could allow a remote attacker who has compromised the renderer process to potentially access cross-origin data via a crafted HTML page. The vulnerability has a CVSS score of 3.1, indicating low impact. Google has released a stable channel update addressing this issue.

A race condition vulnerability exists in Google Chrome prior to version 155.0.8059.39. This flaw allows a remote attacker who has already compromised the renderer process to spoof UI elements by using a specially crafted HTML page. The vulnerability has a low severity rating from Chromium security and a CVSS score of 4.2, indicating medium severity overall.

CVE-2026-106256 is an information leak vulnerability in Google Chrome on Android versions prior to 155.0.8059.39. A remote attacker could exploit this flaw by tricking a user into visiting a crafted HTML page, potentially exposing sensitive password information. The vulnerability has a high severity rating with a CVSS score of 8.8. Google has released a stable channel update to address this issue.

An incorrect authorization vulnerability in the Transactions Platform of Google Chrome on Android versions prior to 155.0.8059.39 allows a remote attacker to obtain sensitive information via a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8. A fix is available in version 155.0.8059.39.

CVE-2026-106343 is a vulnerability in Google Chrome on Android prior to version 155.0.8059.39 involving improper state validation in the Autofill AI feature. This flaw allows a remote attacker to spoof UI elements by crafting a malicious HTML page. The issue has a medium severity rating with a CVSS score of 5.4. A vendor advisory is available but does not explicitly confirm patch status in the provided data.

A missing authorization vulnerability in the Network component of Google Chrome prior to version 155.0.8059.39 allows a remote attacker to bypass the web origin policy via crafted network traffic, leveraging social engineering. The vulnerability has a medium severity rating with a CVSS score of 6.5.

A UI misrepresentation vulnerability exists in Google Chrome for Android versions prior to 155.0.8059.39. This flaw allows a remote attacker to spoof UI elements via a crafted HTML page, potentially misleading users. The vulnerability has a medium severity rating with a CVSS score of 5.4. A fix has been released in version 155.0.8059.39.

A missing authorization vulnerability in Google Chrome prior to version 155.0.8059.39 allows a remote attacker to bypass system access restrictions via a crafted HTML page, leveraging social engineering. The vulnerability is rated as medium severity with a CVSS score of 5.4.

CVE-2026-106350 is a high severity incorrect authorization vulnerability in Google Chrome versions prior to 155.0.8059.39. It allows a remote attacker to obtain sensitive information by leveraging a crafted HTML page. Google has released an update to address this issue.

Incorrect authorization in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-106331 is an improper input validation vulnerability in Google Chrome extensions prior to version 155.0.8059.39. This flaw allows a remote attacker, using social engineering, to bypass the web origin policy and access a privileged page via a crafted Chrome extension. The vulnerability has a medium severity rating with a CVSS score of 6.5.

An information leak vulnerability exists in the Permissions component of Google Chrome prior to version 155.0.8059.39. This flaw allows a remote attacker to bypass site isolation by crafting a malicious HTML page. The vulnerability is rated critical with a high CVSS score of 9.6, indicating severe confidentiality and integrity impacts. The issue affects versions before 155.0.8059.39. Google has published an advisory indicating a stable channel update addressing this vulnerability.

CVE-2026-106368 is a UI misrepresentation vulnerability in Google Chrome on Android versions prior to 155.0.8059.39. It allows a remote attacker to spoof UI elements via a crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 5.4. A fix is available in Chrome version 155.0.8059.39.

A UI misrepresentation vulnerability in Google Chrome's WebAppInstalls component prior to version 155.0.8059.39 allows remote attackers to spoof UI elements via crafted HTML pages. The issue has a medium severity rating with a CVSS score of 5.4. Google has released an official fix in Chrome version 155.0.8059.39.