Threat database

CVE-2026-106354 is a medium severity vulnerability in Google Chrome prior to version 155.0.8059.39. It involves improper resource exposure in Chrome Extensions, allowing a remote attacker to obtain cross-origin data via a crafted HTML page. This vulnerability does not impact integrity or availability but can lead to limited confidentiality loss. A fix is available in Chrome version 155.0.8059.39.

A confused deputy vulnerability in the UI of Google Chrome on Android versions prior to 155.0.8059.39 allows a local attacker to bypass system access restrictions and access a privileged page via a co-installed app. The issue has a medium severity rating and a CVSS score of 4.4.

A missing authorization vulnerability in the FileSystem component of Google Chrome prior to version 155.0.8059.39 allows a remote attacker who has compromised the renderer process to bypass the web origin policy via a crafted HTML page. This vulnerability has a high severity rating with a CVSS score of 8.2.

A privilege elevation vulnerability exists in the sandbox component of Google Chrome on Mac systems prior to version 155.0.8059.39. This flaw allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox by using a crafted HTML page. The vulnerability has a high severity rating and affects versions before 155.0.8059.39.

Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

A missing authorization vulnerability in Google Chrome on iOS versions prior to 155.0.8059.39 allows a remote attacker to spoof UI elements via a crafted HTML page, leveraging social engineering. The issue has a medium severity rating and affects Chrome Mobile on iOS.

CVE-2026-106261 is a medium severity vulnerability in Google Chrome prior to version 155.0.8059.39. It involves an uninitialized resource in the video component that allows a remote attacker to read memory inside the sandbox by using a crafted HTML page. This vulnerability could lead to unauthorized disclosure of information but does not affect integrity or availability.

A protection mechanism failure in Google Chrome on iOS prior to version 155.0.8059.39 allows a remote attacker to bypass the web origin policy via a crafted HTML page. This vulnerability has a medium severity rating and impacts the integrity of web content isolation in the browser.

An improper input validation vulnerability in Google Chrome on iOS prior to version 155.0.8059.39 allows a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page, leveraging social engineering. The vulnerability has a critical severity rating with a CVSS score of 9.6.

CVE-2026-106196 is a vulnerability in Google Chrome on iOS versions prior to 155.0.8059.39. It involves missing authorization in navigation, allowing a remote attacker to bypass the web origin policy and access privileged pages via a crafted HTML page. The vulnerability has a CVSS score of 7.6, indicating high severity.

CVE-2026-106397 is an incorrect authorization vulnerability in Google Chrome on iOS versions prior to 155.0.8059.39. It allows a remote attacker, using social engineering and a crafted HTML page, to bypass system access restrictions. The vulnerability has a medium severity rating and a CVSS score of 6.1.

CVE-2026-106389 is a medium severity vulnerability in Google Chrome prior to version 155.0.8059.39. It involves incorrect authorization related to USB access, allowing a remote attacker to bypass system access restrictions via a crafted Chrome extension using social engineering techniques.

CVE-2026-106407 is a medium severity vulnerability in Google Chrome prior to version 155.0.8059.39. It involves incorrect authorization in the GetUserMedia API, allowing a remote attacker who has compromised the renderer process to bypass system access restrictions via a crafted HTML page. This vulnerability does not affect confidentiality but impacts integrity by enabling unauthorized actions. A fix is available in Chrome version 155.0.8059.39.

An incorrect authorization vulnerability in Google Chrome prior to version 155.0.8059.39 allows a remote attacker to bypass system access restrictions via crafted network traffic. This issue affects permissions handling and has been assigned a medium severity rating.

CVE-2026-106185 is an improper input validation vulnerability in the Viz component of Google Chrome prior to version 155.0.8059.39. This flaw allows a remote attacker who has already compromised the renderer process to bypass system access restrictions by using a specially crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 6.5.

Missing authorization in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

An information leak vulnerability exists in Google Chrome prior to version 155.0.8059.39. This flaw allows a remote attacker to leak sensitive information by crafting a malicious HTML page. The vulnerability affects the Enterprise version of Chrome and has been assigned a medium severity rating with a CVSS score of 4.3. A fix is available as indicated by the vendor advisory linked to the Chrome stable channel update.