Threat database

CVE-2026-106280 is a medium severity vulnerability in Google Chrome prior to version 155.0.8059.39. It involves incorrect authorization in the PermissionElement component, which could allow a remote attacker to bypass the web origin policy by using a crafted HTML page. This vulnerability does not impact confidentiality but can affect integrity. No known exploits are reported in the wild. A fix is available in Chrome version 155.0.8059.39.

An open redirect vulnerability exists in the AppManifest component of Google Chrome versions prior to 155.0.8059.39. This flaw allows a remote attacker to bypass the web origin policy via a crafted HTML page, potentially leading to limited confidentiality and integrity impacts. The vulnerability has a medium severity rating and requires user interaction for exploitation.

A race condition vulnerability exists in the CustomTabs component of Google Chrome on Android versions prior to 155.0.8059.39. This flaw allows a local attacker to bypass the web origin policy via a co-installed app. The vulnerability has a medium severity rating and a CVSS score of 6. A vendor advisory link is provided but does not explicitly confirm patch status.

CVE-2026-106356 is a clickjacking vulnerability in Google Chrome prior to version 155.0.8059.39. It allows a remote attacker to use social engineering to spoof UI elements via a crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 5.4. A fix is available in Chrome version 155.0.8059.39.

CVE-2026-106370 is a medium severity vulnerability in Google Chrome on Android versions prior to 155.0.8059.39. It involves an uninitialized GPU resource that allows a remote attacker, who has already compromised the renderer process, to read memory outside the sandbox via a crafted HTML page. This vulnerability does not impact integrity or availability but can lead to information disclosure.

A confused deputy vulnerability in the SignIn component of Google Chrome on Android versions prior to 155.0.8059.39 allows a remote attacker to bypass system access restrictions to a privileged page via a crafted HTML page. The issue has a medium severity rating and a CVSS score of 6.1.

An information leak vulnerability exists in the WebAudio component of Google Chrome prior to version 155.0.8059.39. This flaw could allow a remote attacker to leak cross-origin data by tricking a user into visiting a crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 4.3. A fix is available in Chrome version 155.0.8059.39.

A UI misrepresentation vulnerability exists in the WebOTP feature of Google Chrome prior to version 155.0.8059.39. This flaw allows a remote attacker to spoof UI elements by crafting a malicious HTML page. The vulnerability has a medium severity rating and a CVSS score of 5.4.

A UI misrepresentation vulnerability exists in the Paint feature of Google Chrome prior to version 155.0.8059.39. This flaw allows a remote attacker to spoof UI elements by crafting a malicious HTML page. The vulnerability has a medium severity rating and a CVSS score of 5.4.

A code injection vulnerability exists in Google Chrome extensions prior to version 155.0.8059.39. This flaw allows a remote attacker, using social engineering, to spoof user interface elements via a crafted Chrome extension. The vulnerability has a medium severity rating and a CVSS score of 5.4.

CVE-2026-106302 is a medium severity UI misrepresentation vulnerability in Google Chrome prior to version 155.0.8059.39. It affects the PermissionElement component, allowing remote attackers to spoof UI elements via crafted HTML pages, potentially misleading users through social engineering. The vulnerability has a CVSS score of 5.4 and does not have known exploits in the wild. A fix is available in Chrome version 155.0.8059.39.

Incorrect authorization in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)

Clickjacking in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

A vulnerability in Google Chrome prior to version 155.0.8059.39 allows incorrect authorization in Extensions. This flaw enables a remote attacker, through social engineering, to spoof UI elements by crafting a malicious Chrome extension. The issue has a medium severity rating and a CVSS score of 4.8.

A vulnerability in Google Chrome on iOS prior to version 155.0.8059.39 allows a remote attacker to bypass the web origin policy via crafted network traffic, leveraging social engineering. This issue affects mobile Chrome on iOS and has a medium severity rating.

CVE-2026-106279 is a vulnerability in Google Chrome on iOS versions prior to 155.0.8059.39. It involves incorrect reference resolution in the Passwords component, which allows a local attacker who has compromised the renderer process to potentially execute arbitrary code outside the sandbox. The vulnerability has a CVSS score of 7.4, indicating high severity.

Incorrect authorization in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium)

An information leak vulnerability exists in the Audio component of Google Chrome prior to version 155.0.8059.39. This flaw allows a remote attacker who has already compromised the renderer process to read memory outside the sandbox by using a specially crafted Chrome extension. The vulnerability has a medium severity rating and a CVSS score of 4. A vendor advisory confirms the issue and indicates a stable channel update addressing it.

CVE-2026-106342 is an information leak vulnerability in the Autofill feature of Google Chrome versions prior to 155.0.8059.39. It allows a remote attacker to obtain sensitive information by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity with a CVSS score of 8.8. Google has released a stable channel update that fixes this issue.