Threat database

Missing authorization in CORS in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

A type confusion vulnerability in the V8 JavaScript engine of Google Chrome prior to version 154.0.8037.92 allows remote attackers to execute arbitrary code within the sandbox via a crafted HTML page. The vulnerability has a high severity rating and affects versions before the fixed release.

A buffer overflow vulnerability exists in the V8 engine of Google Chrome versions prior to 154.0.8037.92. This flaw allows a remote attacker to execute arbitrary code within the sandbox by delivering a crafted HTML page. The vulnerability is rated with high severity and has a CVSS score of 8.8.

Cross-site scripting in WebUI in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: High)

CVE-2026-102324 is a use-after-free vulnerability in the PictureInPicture feature of Google Chrome prior to version 154.0.8037.92. This flaw allows a remote attacker who has compromised the renderer process to potentially execute arbitrary code outside the sandbox by crafting a malicious HTML page. The vulnerability is rated high severity with a CVSS score of 8.3.

CVE-2026-102301 is a high-severity vulnerability in Google Chrome prior to version 154.0.8037.92. It involves an out-of-bounds write in the GPU component that could allow a remote attacker, who has already compromised the renderer process, to execute arbitrary code outside the sandbox via a crafted HTML page. This vulnerability affects desktop versions of Chrome and has a CVSS score of 8.3.

A use-after-free vulnerability exists in the Views component of Google Chrome prior to version 154.0.8037.92. This flaw allows a remote attacker to execute arbitrary code outside the sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity rating and a CVSS score of 9.6, indicating critical impact.

Uninitialized resource in Skia in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

A use-after-free vulnerability exists in the FullScreen component of Google Chrome prior to version 154.0.8037.92. This flaw allows a remote attacker to execute arbitrary code outside the browser sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a critical severity rating with a CVSS score of 9.6.

A type confusion vulnerability in the V8 JavaScript engine of Google Chrome prior to version 154.0.8037.92 allows remote attackers to execute arbitrary code within the browser sandbox via a crafted HTML page. This vulnerability has a high severity rating and can lead to full compromise of the affected browser instance.

CVE-2026-102304 is a use-after-free vulnerability in the Passwords component of Google Chrome prior to version 154.0.8037.92. This flaw allows a remote attacker to execute arbitrary code outside the browser sandbox by tricking a user into visiting a crafted HTML page. The vulnerability is rated critical with a CVSS score of 9.6. Google has released an official fix in version 154.0.8037.92.

CVE-2026-102316 is a use-after-free vulnerability in the Views component of Google Chrome prior to version 154.0.8037.92. This flaw allows a remote attacker to execute arbitrary code outside the sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity rating and a CVSS score of 9.6, indicating critical impact.

A type confusion vulnerability in the V8 JavaScript engine of Google Chrome prior to version 154.0.8037.92 allows remote attackers to execute arbitrary code within the sandbox by crafting a malicious HTML page. This vulnerability is rated high severity with a CVSS score of 8.8.

Uninitialized resource in WebGPU in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

A type confusion vulnerability in the V8 engine of Google Chrome prior to version 154.0.8037.92 allows remote attackers to execute arbitrary code within the sandbox via a crafted HTML page. This vulnerability has a high severity rating and affects Chrome desktop versions before the specified fixed release.

Uninitialized resource in Dawn in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

A use-after-free vulnerability exists in the Bluetooth component of Google Chrome prior to version 154.0.8037.92. This flaw could allow a remote attacker to execute arbitrary code outside the browser sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity rating and a CVSS score of 9.6, indicating critical impact.

A type confusion vulnerability exists in the V8 JavaScript engine of Google Chrome prior to version 154.0.8037.92. This flaw allows a remote attacker to execute arbitrary code within the sandbox by crafting a malicious HTML page. The vulnerability has a high severity rating and a CVSS score of 8.8.