Threat database

CVE-2026-106395 is a medium severity vulnerability in Google Chrome on Android prior to version 155.0.8059.39. It involves an uninitialized resource in the Dawn component that allows a remote attacker to read memory outside the sandbox by delivering a crafted HTML page. This vulnerability does not allow code execution or denial of service but can lead to information disclosure. The issue is fixed in version 155.0.8059.39.

CVE-2026-106271 is a vulnerability in Google Chrome prior to version 155.0.8059.39 where missing authorization in Workers allowed a remote attacker with renderer process access to bypass site isolation using a crafted PDF file. The vulnerability is rated high severity with a CVSS score of 8.1. A fix is available in Chrome version 155.0.8059.39.

CVE-2026-106388 is a medium severity vulnerability in Google Chrome's DataTransfer component prior to version 155.0.8059.39. It involves missing authorization that allows a remote attacker who has compromised the renderer process to access sensitive information via a crafted HTML page. The vulnerability has a CVSS score of 5.3 and does not affect availability or integrity, only confidentiality.

CVE-2026-106398 is a medium severity vulnerability in Google Chrome prior to version 155.0.8059.39. It involves incorrect authorization in the Media component, allowing a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability does not impact integrity or availability and requires user interaction to exploit.

CVE-2026-106212 is a high-severity vulnerability in Google Chrome's Autofill feature prior to version 155.0.8059.39. It involves incorrect authorization that allows a remote attacker, using social engineering and a crafted HTML page, to obtain sensitive information. The vulnerability has a CVSS score of 8.8, indicating a critical impact on confidentiality, integrity, and availability. Google has released an update to address this issue.

CVE-2026-106307 is a medium severity vulnerability in Google Chrome prior to version 155.0.8059.39. It involves incorrect authorization in the Network component that allows a remote attacker, who has already compromised the renderer process, to bypass system access restrictions via a crafted HTML page.

CVE-2026-106348 is an information leak vulnerability in the Animation component of Google Chrome versions prior to 155.0.8059.39. A remote attacker can exploit this flaw by crafting a malicious HTML page to leak sensitive information. The vulnerability has a medium severity rating and a CVSS score of 6.5. Google has released a stable channel update addressing this issue.

CVE-2026-106375 is a critical vulnerability in Google Chrome prior to version 155.0.8059.39. It involves incomplete cleanup in the Dawn component, which could allow a remote attacker to execute arbitrary code outside the browser sandbox by delivering a crafted HTML page. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability.

An information leak vulnerability exists in the Payments component of Google Chrome versions prior to 155.0.8059.39. This flaw allows a remote attacker to obtain cross-origin data by tricking a user into visiting a crafted HTML page. The vulnerability is rated as medium severity with a CVSS score of 4.3.

Incomplete cleanup in GetUserMedia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

A buffer overflow vulnerability exists in the Fonts component of Google Chrome prior to version 155.0.8059.39. This flaw could allow a remote attacker who has compromised the renderer process to execute arbitrary code outside the sandbox by using a crafted HTML page. The vulnerability has been assigned CVE-2026-106292 and is rated with high severity.

A confused deputy vulnerability in Contextual Tasks of Google Chrome prior to version 155.0.8059.39 allows a remote attacker who has compromised the renderer process to bypass system access restrictions and access privileged pages via a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.1.

A use-after-free vulnerability exists in the Fonts component of Google Chrome on Windows versions prior to 155.0.8059.39. This flaw allows a remote attacker to execute arbitrary code within the sandbox by delivering a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8. An official fix is available as indicated by the vendor advisory.

An incorrect authorization vulnerability in the Accessibility component of Google Chrome prior to version 155.0.8059.39 allows a remote attacker who has compromised the renderer process to bypass site isolation by using a crafted HTML page. This vulnerability has a high severity rating with a CVSS score of 8.1.

An observable discrepancy in the Paint component of Google Chrome prior to version 155.0.8059.39 allowed a remote attacker to leak cross-origin data via a crafted HTML page. This vulnerability has a medium severity rating and affects Chrome desktop versions before the specified fixed version.

CVE-2026-106391 is a medium severity vulnerability in Google Chrome on Android prior to version 155.0.8059.39. It involves incorrect authorization in the WebShare feature, allowing a remote attacker who has compromised the renderer process to spoof UI elements via a crafted HTML page. This could mislead users by displaying deceptive interface elements. The vulnerability has a CVSS score of 4.2, indicating a moderate risk. No known exploits are reported in the wild. A stable channel update from Google addresses this issue.

CVE-2026-106232 is a UI misrepresentation vulnerability in Google Chrome prior to version 155.0.8059.39. It allows a remote attacker to use social engineering techniques to spoof UI elements by crafting malicious HTML pages. The vulnerability has a medium severity rating and a CVSS score of 5.4.

A UI misrepresentation vulnerability in the FileSystem component of Google Chrome prior to version 155.0.8059.39 allows a remote attacker to bypass system access restrictions via a crafted HTML page using social engineering techniques. The vulnerability has a medium severity rating and a CVSS score of 5.4.

Improper input validation in Compositing in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-106367 is a missing authorization vulnerability in Google Chrome on Android versions prior to 155.0.8059.39. It allows a local attacker, through social engineering and a co-installed app, to potentially execute arbitrary code outside the sandbox. The vulnerability has a high severity rating with a CVSS score of 8.4.