Threat database

CVE-2026-49880 is a high severity elevation of privilege vulnerability in Google Android affecting versions 16, 16-qpr2, and 17. It arises from a missing bounds check in multiple functions within the nfa_nfcee_act.cc component, leading to a possible out-of-bounds write. Exploitation does not require user interaction or additional execution privileges.

CVE-2026-45524 is a high-severity information disclosure vulnerability in Google Android version 17. It arises from a missing permission check in the isSystem method of WifiPermissionsUtil.java, potentially allowing a local sandbox escape and escalation of privileges without requiring user interaction.

CVE-2026-28667 is an information disclosure vulnerability in Google Android affecting multiple versions. It arises from a missing bounds check in several functions of rw_t5t.cc, leading to a possible out-of-bounds read. Exploitation does not require user interaction or additional execution privileges. The vulnerability has a medium severity rating with a CVSS score of 5.5.

CVE-2026-103627 is an information leak vulnerability in the SVG component of Google Chrome prior to version 154.0.8037.97. It allows a remote attacker to obtain sensitive information by tricking a user into visiting a crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 6.5. A fix is available in Chrome version 154.0.8037.97.

A buffer overflow vulnerability exists in the WebRTC component of Google Chrome prior to version 154.0.8037.97. This flaw allows a remote attacker to execute arbitrary code within the browser's sandbox by delivering a specially crafted HTML page. The vulnerability is rated as high severity with a CVSS score of 8.8.

A use-after-free vulnerability exists in the MediaStream component of Google Chrome prior to version 154.0.8037.97. This flaw allows a remote attacker to execute arbitrary code within the sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8. Google has released an update to address this issue.

A use-after-free vulnerability in the SVG component of Google Chrome prior to version 154.0.8037.97 allows a remote attacker to execute arbitrary code within the sandbox via a crafted HTML page. This vulnerability is rated high severity with a CVSS score of 8.8.

An integer overflow vulnerability in the Skia component of Google Chrome prior to version 154.0.8037.97 allows a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability has a medium severity rating and a CVSS score of 4.3. A stable channel update addressing this issue has been released by Google.

CVE-2026-103624 is a use-after-free vulnerability in the Contextual Tasks component of Google Chrome on Windows. It affects versions prior to 154.0.8037.97 and allows a remote attacker who has compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.3.

A type confusion vulnerability in the V8 JavaScript engine of Google Chrome prior to version 154.0.8037.97 allows remote attackers to execute arbitrary code within the browser sandbox via a crafted HTML page. This vulnerability has a high severity rating and affects versions before the specified fixed release.

CVE-2026-103630 is a use-after-free vulnerability in the FedCM component of Google Chrome prior to version 154.0.8037.97. This flaw allows a remote attacker to execute arbitrary code outside the browser sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a critical severity with a CVSS score of 9.6. Google has released a stable channel update to address this issue.

An integer overflow vulnerability in the compositing component of Google Chrome prior to version 154.0.8037.97 allows a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability has a medium severity rating and a CVSS score of 4.3. This issue was addressed in Chrome version 154.0.8037.97.

A critical security vulnerability (CVE-2026-103626) exists in Google Chrome on Windows prior to version 154.0.8037.97. The flaw involves incorrect authorization in the FileSystem component, which could allow a remote attacker to execute arbitrary code outside the sandbox by tricking a user into visiting a crafted HTML page. This vulnerability has a high CVSS score of 9.6 and affects versions before 154.0.8037.97.

CVE-2026-103628 is a critical out-of-bounds write vulnerability in the WebGL component of Google Chrome prior to version 154.0.8037.97. This flaw allows a remote attacker to execute arbitrary code outside the browser sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability. Google has released an official fix in Chrome version 154.0.8037.97.

CVE-2026-102305 is a UI misrepresentation vulnerability in the SignIn feature of Google Chrome on iOS versions prior to 154.0.8037.92. This flaw allows a remote attacker to spoof UI elements by crafting a malicious HTML page. The vulnerability has a medium severity rating with a CVSS score of 5.4. It does not have known exploits in the wild and affects only specific Chrome versions on iOS.

UI misrepresentation in TabStrip in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

Incorrect authorization in SiteIsolation in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-102327 is a vulnerability in Google Chrome's WebView on Android versions prior to 154.0.8037.92. It involves incorrect authorization that could allow a remote attacker, who has compromised the renderer process, to execute arbitrary code outside the sandbox via a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 7.5.

Missing authorization in Payments in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)