Threat database

CVE-2026-106409 is a vulnerability in Google Chrome on Mac prior to version 155.0.8059.39 involving incorrect reference resolution in WebAppInstalls. This flaw allows a remote attacker who has compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. The vulnerability has a high severity rating with a CVSS score of 8.3. A stable channel update addressing this issue has been released by Google.

A type confusion vulnerability exists in the V8 JavaScript engine of Google Chrome before version 155.0.8059.39. This flaw allows a remote attacker to potentially execute arbitrary code within the browser sandbox by delivering a crafted HTML page. The vulnerability has a high severity with a CVSS score of 8.8. Google has released a stable channel update that addresses this issue.

CVE-2026-106372 is an incorrect authorization vulnerability in the UI of Google Chrome versions prior to 155.0.8059.39. This flaw could allow a remote attacker to execute arbitrary code outside the browser sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity score and affects Chrome desktop versions before the fixed release.

An information leak vulnerability exists in Google Chrome on Android versions prior to 155.0.8059.39. This flaw allows a local attacker, via a co-installed app, to obtain sensitive information. The vulnerability has a medium severity rating and a CVSS score of 5.1.

Observable discrepancy in Scroll in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium)

An information leak vulnerability exists in the Editing component of Google Chrome versions prior to 155.0.8059.39. This flaw allows a remote attacker, using social engineering techniques, to leak sensitive information via a crafted HTML page. The vulnerability has a medium severity rating and does not affect integrity or availability.

Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

A missing authorization vulnerability in the SiteIsolation feature of Google Chrome prior to version 155.0.8059.39 allows a remote attacker who has compromised the renderer process to bypass site isolation using a crafted HTML page. This issue has a medium severity rating and does not impact confidentiality but can lead to integrity violations.

CVE-2026-106351 is a medium severity vulnerability in Google Chrome on iOS prior to version 155.0.8059.39. It involves an observable discrepancy in the Safe Browsing feature that could allow a remote attacker, who has already compromised the renderer process, to obtain sensitive information via a crafted HTML page. The vulnerability affects confidentiality but does not impact integrity or availability. A fix is available from the vendor.

CVE-2026-106386 is a medium severity vulnerability in Google Chrome's WebAudio component prior to version 155.0.8059.39. It involves an uninitialized resource that allows a remote attacker to read memory inside the sandbox by delivering a crafted HTML page. This vulnerability does not allow code execution or denial of service but can lead to information disclosure.

A missing authorization vulnerability in the Chromoting component of Google Chrome on Windows versions prior to 155.0.8059.39 allows a remote attacker to obtain sensitive information via crafted network traffic. The issue is rated medium severity with a CVSS score of 5.9. A fix is available in version 155.0.8059.39.

CVE-2026-106404 is a medium severity vulnerability in Google Chrome's FontAccess component prior to version 155.0.8059.39. It allows a remote attacker who has compromised the renderer process to bypass system access restrictions by using a crafted HTML page. This flaw affects Chrome versions before 155.0.8059.39 and has a CVSS score of 6.5. A fix is available as indicated by the vendor advisory.

CVE-2026-106263 is a medium severity vulnerability in Google Chrome prior to version 155.0.8059.39. It involves improper input validation in the SignIn component, which allows a remote attacker to bypass system access restrictions by tricking a user into installing a crafted Chrome extension. This vulnerability requires user interaction and does not impact confidentiality or availability directly.

A UI misrepresentation vulnerability exists in Google Chrome on Android versions prior to 155.0.8059.39. This flaw allows a remote attacker to spoof UI elements by crafting a malicious HTML page. The vulnerability has a medium severity rating and a CVSS score of 5.4.

CVE-2026-106352 is a high-severity incorrect authorization vulnerability in the WebProtect component of Google Chrome. It affects versions prior to 155.0.8059.39 and allows a remote attacker to obtain sensitive information by tricking a user into visiting a malicious HTML page. Google has released an official fix in Chrome version 155.0.8059.39.

Incorrect authorization in Unbounded Element in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

An information leak vulnerability exists in the Paint component of Google Chrome versions prior to 155.0.8059.39. This flaw allows a remote attacker to leak sensitive information by convincing a user to visit a crafted HTML page. The vulnerability has a medium severity rating and does not impact integrity or availability.

CVE-2026-106401 is a critical out-of-bounds write vulnerability in the Media component of Google Chrome prior to version 155.0.8059.39. This flaw could allow a remote attacker to execute arbitrary code outside the browser sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability. Google has released an update to address this issue in Chrome version 155.0.8059.39.

Out of bounds read in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

An uninitialized resource vulnerability in the Dawn component of Google Chrome on Android versions prior to 155.0.8059.39 allows a remote attacker to read memory outside the sandbox by delivering a crafted HTML page. This vulnerability has a medium severity rating and does not impact integrity or availability.