Threat database

CVE-2026-106230 is a medium severity vulnerability in Google Chrome on Android prior to version 155.0.8059.39. It involves incorrect reference resolution in the Offline component, which allows a remote attacker who has compromised the renderer process to obtain sensitive information via a crafted HTML page. The vulnerability has a CVSS score of 5.3. A stable channel update addressing this issue has been released by Google.

A race condition vulnerability exists in the WebAudio component of Google Chrome prior to version 155.0.8059.39. This flaw could allow a remote attacker to potentially leak cross-origin data by crafting a malicious HTML page. The vulnerability has a medium severity rating and a CVSS score of 4.3. Google has published a stable channel update addressing this issue.

A missing authorization vulnerability in the Passwords feature of Google Chrome on Android versions prior to 155.0.8059.39 allows a remote attacker who has compromised the renderer process to bypass site isolation via a crafted HTML page. This vulnerability has a high severity rating with a CVSS score of 8.1.

A clickjacking vulnerability exists in the Messages feature of Google Chrome on Android versions prior to 155.0.8059.39. This flaw allows a remote attacker to use social engineering to spoof UI elements via a crafted HTML page. The vulnerability has a medium severity rating and a CVSS score of 5.4.

A missing authorization vulnerability in Google Chrome on iOS prior to version 155.0.8059.39 allows a remote attacker to obtain sensitive information via a crafted HTML page leveraging social engineering. The vulnerability has a high severity with a CVSS score of 8.8. A vendor advisory from Google confirms the issue and indicates that a stable channel update has been released.

CVE-2026-106328 is a medium severity vulnerability in Google Chrome on Android prior to version 155.0.8059.39. It involves incorrect authorization in PDF handling that could allow a local attacker, leveraging social engineering and a co-installed app, to access sensitive information. Google has released a stable channel update that addresses this issue. There are no known exploits in the wild.

CVE-2026-106216 is a cross-site request forgery (CSRF) vulnerability in the ReadingList feature of Google Chrome on Android versions prior to 155.0.8059.39. This flaw allows a remote attacker to bypass the web origin policy by tricking a user into visiting a crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 5.4.

A UI misrepresentation vulnerability exists in Google Chrome on iOS versions prior to 155.0.8059.39. This flaw allows a remote attacker to spoof the address bar via a crafted HTML page, potentially misleading users through social engineering. The vulnerability has a medium severity rating.

Out of bounds read in Printing in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

A missing authorization vulnerability in Google Chrome prior to version 155.0.8059.39 allows a remote attacker who has compromised the renderer process to spoof UI elements using a crafted HTML page. The issue affects the Permissions component and has a medium severity rating.

An information leak vulnerability exists in the Animation component of Google Chrome versions prior to 155.0.8059.39. This flaw allows a remote attacker to leak cross-origin data by tricking a user into visiting a crafted HTML page. The vulnerability has a medium severity rating and a CVSS score of 4.3.

A missing authorization vulnerability in the FedCM component of Google Chrome prior to version 155.0.8059.39 allows a remote attacker to bypass the web origin policy via a crafted HTML page. This issue has been assigned CVE-2026-106289 and is rated medium severity with a CVSS score of 6.5. The vulnerability could lead to unauthorized actions due to improper enforcement of origin policy. Google has released a stable channel update addressing this issue.

Confused deputy in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

An incorrect authorization vulnerability in Google Chrome prior to version 155.0.8059.39 allows a remote attacker to spoof UI elements via a crafted HTML page, leveraging social engineering. This issue has a medium severity rating and impacts confidentiality and availability with limited scope.

Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-106303 is a medium severity vulnerability in Google Chrome's Autofill AI component prior to version 155.0.8059.39. It allows a remote attacker who has compromised the renderer process and uses social engineering via a crafted HTML page to obtain sensitive information. The attack requires user interaction and has high complexity. A fix is available from the vendor.

Observable discrepancy in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

A medium severity vulnerability (CVE-2026-106206) exists in Google Chrome on iOS prior to version 155.0.8059.39. It involves improper input validation in the mobile version of Chrome, which could allow a remote attacker to obtain sensitive information via crafted network traffic. The vulnerability has a CVSS score of 5.9 and does not require user interaction or privileges to exploit. A fix is available in version 155.0.8059.39.

A vulnerability in Google Chrome prior to version 155.0.8059.39 involves incorrect authorization in the PermissionElement component. This flaw could allow a remote attacker to bypass the web origin policy by using a crafted HTML page. The issue is rated medium severity with a CVSS score of 6.5.