Threat database

CVE-2026-106335 is a use-after-free vulnerability in the Media component of Google Chrome prior to version 155.0.8059.39. This flaw allows a remote attacker to execute arbitrary code within the sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8. Google has released an official fix in Chrome version 155.0.8059.39.

CVE-2026-106189 is a code injection vulnerability in the ReaderMode feature of Google Chrome on iOS versions prior to 155.0.8059.39. This flaw allows a remote attacker to bypass the web origin policy by using a crafted HTML page, potentially leading to code injection. The vulnerability has a CVSS score of 7.3, indicating high severity.

CVE-2026-106266 is a medium severity confused deputy vulnerability in Google Chrome prior to version 155.0.8059.39. It allows a remote attacker who has compromised the renderer process to bypass the web origin policy and access privileged pages via a crafted HTML page. This vulnerability affects Chrome desktop versions before 155.0.8059.39.

A missing authorization vulnerability in the FullScreen feature of Google Chrome prior to version 155.0.8059.39 allows a remote attacker who has compromised the renderer process and uses social engineering to bypass system access restrictions via a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.3.

A missing authorization vulnerability in the Autofill feature of Google Chrome prior to version 155.0.8059.39 allows a remote attacker to obtain sensitive information via a crafted HTML page using social engineering techniques. The vulnerability has a high severity rating with a CVSS score of 8.8.

A missing authorization vulnerability in the BrowserTag component of Google Chrome prior to version 155.0.8059.39 allows a remote attacker who has compromised the renderer process and uses social engineering to bypass site isolation via a crafted HTML page. The vulnerability has a medium severity rating.

A missing authorization vulnerability in Google Lens within Google Chrome prior to version 155.0.8059.39 allows a remote attacker who has compromised the renderer process to leak cross-origin data via a crafted HTML page. The issue has a medium severity rating with a CVSS score of 4.3. This vulnerability affects Chrome versions before 155.0.8059.39.

A medium severity vulnerability (CVE-2026-106381) in Google Chrome on iOS versions prior to 155.0.8059.39 allows a remote attacker to bypass the web origin policy via a crafted HTML page due to incorrect authorization in the Passwords component.

Incorrect authorization in Search in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

An information leak vulnerability exists in the Omnibox component of Google Chrome on Android versions prior to 155.0.8059.39. This flaw allows a remote attacker to leak sensitive information by leveraging social engineering and crafted network traffic. The vulnerability has a medium severity rating and does not require privileges but does require user interaction.

Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-106314 is a high-severity vulnerability in Google Chrome's Bluetooth authorization mechanism prior to version 155.0.8059.39. It allows a remote attacker to obtain sensitive information by tricking a user into visiting a crafted HTML page. The issue arises from incorrect authorization checks in the browser's Bluetooth component.

Race condition in CacheStorage in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

A use-after-free vulnerability exists in the GarbageCollection component of Google Chrome prior to version 155.0.8059.39. This flaw allows a remote attacker to execute arbitrary code within the browser's sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8.

Use after free in Streaming in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-106313 is a medium severity vulnerability in Google Chrome on Android versions prior to 155.0.8059.39. It allows a local attacker to obtain sensitive information by exploiting incorrect authorization via a co-installed app. Exploitation requires local access and social engineering. The vulnerability does not allow privilege escalation or denial of service.

Missing authorization in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

A missing authorization vulnerability in the Network component of Google Chrome prior to version 155.0.8059.39 allows a remote attacker who has compromised the renderer process to bypass site isolation using a crafted HTML page. This vulnerability has a medium severity rating and does not impact confidentiality but can affect integrity.

A missing authorization vulnerability in the Animation component of Google Chrome prior to version 155.0.8059.39 allows a remote attacker to bypass the web origin policy via a crafted HTML page. This vulnerability has a medium severity rating and impacts the integrity of web content isolation.