Threat database

CVE-2026-106380 is a UI misrepresentation vulnerability in Google Chrome versions prior to 155.0.8059.39. It allows a remote attacker to spoof UI elements by leveraging social engineering through a crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 5.4.

CVE-2026-106374 is a type confusion vulnerability in the V8 JavaScript engine used by Google Chrome versions prior to 155.0.8059.39. This flaw allows a remote attacker to execute arbitrary code within the sandbox by crafting a malicious HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8. Google has released a stable channel update to address this issue.

CVE-2026-106249 is a vulnerability in Google Chrome on Android versions prior to 155.0.8059.39. It involves incorrect authorization in the Autofill feature, allowing a remote attacker to obtain sensitive information via a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8.

CVE-2026-106296 is a medium severity vulnerability in Google Chrome on Mac systems prior to version 155.0.8059.39. It involves improper privilege management in the user interface that allows a remote attacker, using social engineering and a crafted HTML page, to bypass system access restrictions. The vulnerability has a CVSS score of 5.4 and does not have known exploits in the wild. A fix is available as indicated by the vendor advisory.

CVE-2026-106259 is a vulnerability in Google Chrome prior to version 155.0.8059.39 involving incorrect authorization in the PermissionElement component. This flaw allows a remote attacker to bypass system access restrictions by using a crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 5.4. It does not appear to be actively exploited in the wild. Google has released a stable channel update addressing this issue.

A confused deputy vulnerability in WebAPKs on Google Chrome for Android versions prior to 155.0.8059.39 allows a remote attacker, using social engineering, to bypass the web origin policy via a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.3.

An integer overflow vulnerability exists in the Media component of Google Chrome prior to version 155.0.8059.39. This flaw could allow a remote attacker to execute arbitrary code outside the browser sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high CVSS score of 9.6, indicating critical severity. Google has released an update to address this issue.

An information leak vulnerability in Google Chrome prior to version 155.0.8059.39 allows a remote attacker to obtain sensitive password information via a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8. A vendor advisory is available indicating a stable channel update addressing this issue.

CVE-2026-106285 is a UI misrepresentation vulnerability in Google Chrome's WebAppInstalls component prior to version 155.0.8059.39. It allows a remote attacker to bypass system access restrictions by tricking users through a crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 5.4. No known exploits are reported in the wild. Google has released a stable channel update addressing this issue.

Missing authorization in Web Authentication (Passkeys & Security Keys) in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-106399 is an out-of-bounds read vulnerability in the Skia component of Google Chrome versions prior to 155.0.8059.39. This flaw could allow a local attacker, using social engineering, to read memory via a crafted file. The vulnerability has a low severity rating and a CVSS score of 3.3. No known exploits are reported in the wild. Google has released a stable channel update addressing this issue.

An information leak vulnerability exists in Google Chrome on iOS versions prior to 155.0.8059.39. This flaw allows a local attacker with physical access to the device to obtain sensitive information. The vulnerability has a medium severity rating with a CVSS score of 4.6. A fix is available in version 155.0.8059.39.

Buffer overflow in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 155.0.8059.39 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Low)

An incorrect authorization vulnerability in Google Chrome prior to version 155.0.8059.39 allows a remote attacker to bypass the web origin policy via a crafted HTML page. This vulnerability has a low severity rating from Chromium security and a CVSS score of 4.3, indicating medium severity. The issue affects versions before 155.0.8059.39. Google has published a stable channel update addressing this vulnerability.

CVE-2026-106299 is a medium severity vulnerability in Google Chrome's WebAudio component prior to version 155.0.8059.39. It involves improper input validation that could allow a remote attacker, who has already compromised the renderer process, to bypass system access restrictions via a crafted HTML page. The vulnerability does not allow direct remote compromise without prior renderer process control and has a CVSS score of 5.4.

CVE-2026-106199 is a high-severity vulnerability in Google Chrome on Android prior to version 155.0.8059.39. It involves incorrect authorization in the Actor component, which could allow a remote attacker who has compromised the renderer process to bypass site isolation by using a crafted HTML page. This vulnerability has a CVSS score of 8.2 and affects versions before 155.0.8059.39.

Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Low)