Threat database

CVE-2026-106423 is a use-after-free vulnerability in the Media component of Google Chrome prior to version 155.0.8059.39. This flaw allows a remote attacker to execute arbitrary code within the browser's sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8.

CVE-2026-106411 is a use-after-free vulnerability in the Parser component of Google Chrome prior to version 155.0.8059.39. This flaw allows a remote attacker to execute arbitrary code within the sandbox by crafting a malicious HTML page. The vulnerability is rated high severity with a CVSS score of 8.8.

A use-after-free vulnerability exists in the Media component of Google Chrome prior to version 155.0.8059.39. This flaw allows a remote attacker to execute arbitrary code within the sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8.

Use after free in Metrics in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Select in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in WebRTC in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in HTML in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Bindings in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-106329 is a critical security vulnerability in Google Chrome's FileSystem component prior to version 155.0.8059.39. It involves incorrect authorization that allows a remote attacker, through social engineering and a crafted HTML page, to potentially execute arbitrary code outside the browser sandbox. This vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability.

Use after free in TabStrip in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-106379 is a vulnerability in Google Chrome's Skia component prior to version 155.0.8059.39. It involves an uninitialized resource that could allow a remote attacker to obtain cross-origin data via a crafted HTML page. The vulnerability has a CVSS score of 4.3, indicating medium severity. Google has released a stable channel update addressing this issue.

Use after free in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-106393 is a use-after-free vulnerability in the Storage component of Google Chrome prior to version 155.0.8059.39. This flaw allows a remote attacker who has compromised the renderer process to execute arbitrary code outside the sandbox by delivering a crafted HTML page. The vulnerability is rated high severity with a CVSS score of 8.3. A fix is available in Chrome version 155.0.8059.39.

Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Parser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

A use-after-free vulnerability exists in Chrome Tabs on Google Chrome for Mac prior to version 155.0.8059.39. This flaw could allow a remote attacker to execute arbitrary code outside the sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has been assigned CVE-2026-106298 and is rated critical with a CVSS score of 9.6.

Use after free in Tint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

An integer overflow vulnerability exists in the Compositing component of Google Chrome prior to version 155.0.8059.39. This flaw allows a remote attacker to obtain cross-origin data by tricking a user into visiting a crafted HTML page. The vulnerability has a CVSS score of 4.3, indicating medium severity.

A high-severity vulnerability (CVE-2026-106203) in Google Chrome on iOS prior to version 155.0.8059.39 involves incomplete cleanup in the Autofill feature. This flaw allows a remote attacker, using social engineering and a crafted HTML page, to obtain sensitive information. The vulnerability has a CVSS score of 8.8, indicating a significant risk to confidentiality, integrity, and availability.