Threats affecting pkg:rpm/google/chrome

CVE-2026-113010 is an out-of-bounds read vulnerability in Google Chrome's Extensions component prior to version 156.0.8078.47. This flaw allows a remote attacker to read memory inside the sandbox by using a crafted HTML page. The vulnerability has a medium severity rating and was fixed in Chrome version 156.0.8078.47.

Use after free in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-113115 is a use-after-free vulnerability in the Transactions Platform component of Google Chrome prior to version 156.0.8078.47. This flaw allows a remote attacker to execute arbitrary code within the browser's sandbox by crafting a malicious HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8. Google has released an update to address this issue.

Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-112993 is a use-after-free vulnerability in the Input component of Google Chrome prior to version 156.0.8078.47. This flaw allows a remote attacker to execute arbitrary code within the browser sandbox by crafting a malicious HTML page. The vulnerability is rated high severity with a CVSS score of 8.8.

Memory corruption in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

A vulnerability in Google Chrome prior to version 155.0.8059.79 allows a remote attacker to leak cross-origin data via a crafted HTML page due to an observable discrepancy in media handling. The issue has a low CVSS score of 3.1 and is classified as low severity. A fix is available in version 155.0.8059.79.

CVE-2026-110144 is a critical vulnerability in Google Chrome on Windows prior to version 155.0.8059.79. It involves incorrect authorization in the Mojo component, allowing a local attacker to potentially execute arbitrary code outside the sandbox. This flaw could lead to full compromise of the affected system if exploited.

A race condition vulnerability exists in the Chromoting component of Google Chrome versions prior to 155.0.8059.39. This flaw could allow a remote attacker, using social engineering and crafted network traffic, to potentially bypass system access restrictions. The vulnerability has a medium severity rating with a CVSS score of 5.3.

A missing authorization vulnerability in the Animation component of Google Chrome versions prior to 155.0.8059.39 allows a remote attacker to bypass the web origin policy via a crafted HTML page. This vulnerability has a medium severity rating and could lead to unauthorized actions without compromising confidentiality or availability.

A missing authorization vulnerability in DevTools of Google Chrome versions prior to 155.0.8059.39 allows a remote attacker to bypass the web origin policy by leveraging social engineering through a crafted Chrome extension. The vulnerability has a medium severity rating with a CVSS score of 6.5. No known exploits are reported in the wild. No explicit patch information is provided in the input data.

A vulnerability in the scheduling component of Google Chrome prior to version 155.0.8059.39 allows a remote attacker to bypass the web origin policy by using a crafted HTML page. The issue is related to incorrect authorization checks. The vulnerability has a low security severity rating from Chromium and a CVSS score of 4.3, indicating a medium severity level overall.

An open redirect vulnerability exists in the AppManifest component of Google Chrome versions prior to 155.0.8059.39. This flaw allows a remote attacker to bypass the web origin policy by leveraging social engineering with a crafted HTML page. The vulnerability has a medium severity rating and a CVSS score of 6.1.

A missing authorization vulnerability in the Network component of Google Chrome prior to version 155.0.8059.39 allows a remote attacker who has compromised the renderer process to bypass site isolation using a crafted HTML page. The vulnerability has a medium severity rating.

A confused deputy vulnerability in the Omnibox component of Google Chrome prior to version 155.0.8059.39 allows a remote attacker to bypass the web origin policy via crafted network traffic. This vulnerability has a medium severity rating and impacts the integrity of web content handling.

A vulnerability in Google Chrome on Android prior to version 155.0.8059.39 allows a remote attacker to read memory outside the sandbox via a crafted HTML page due to an uninitialized GPU resource. The issue has a medium severity rating with a CVSS score of 4.7.

Use after free in CSS in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Use of released resource in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

A UI misrepresentation vulnerability exists in Google Chrome for Android versions prior to 155.0.8059.39. This flaw allows a remote attacker to spoof UI elements via a crafted HTML page, potentially misleading users. The vulnerability has a medium severity rating with a CVSS score of 5.4. A fix has been released in version 155.0.8059.39.

A missing authorization vulnerability in Google Chrome prior to version 155.0.8059.39 allows a remote attacker to bypass system access restrictions via a crafted HTML page, leveraging social engineering. The vulnerability is rated as medium severity with a CVSS score of 5.4.