Threat database

UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: High)

Improper privilege management in Mojo in Google Chrome on on Windows prior to 154.0.8037.92 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)

A critical buffer overflow vulnerability exists in the ANGLE component of Google Chrome on Android versions prior to 154.0.8037.92. This flaw allows a remote attacker to potentially execute arbitrary code outside the sandbox by delivering a crafted HTML page. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability.

CVE-2026-102252 is a path traversal vulnerability in Google OSV-SCALIBR's embedded VMDK filesystem extractor versions 0.3.6 through 0.5.0. This flaw allows an attacker controlling the scan target to write arbitrary files outside the intended extraction directory on the host system by exploiting insufficient validation of archive path entries in crafted VMDK images.

Improper link resolution (CWE-59 / CWE-22) in the allowedLocalRoots path validation in Google MCP Toolbox for Databases versions 1.2.0 through 1.9.0 allows a remote authenticated attacker with tool execution permissions to bypass directory boundary restrictions via symbolic links. Because path validation checks directories lexically without resolving symbolic links first, an attacker can access or overwrite arbitrary local files located outside the permitted root directories.

UI misrepresentation in Chromoting in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. (Chromium security severity: Low)

Improper input validation in Passwords in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-95340 is a vulnerability in Google Chrome's PictureInPicture feature prior to version 154.0.8037.57. It involves incorrect authorization that allows a remote attacker, using social engineering, to bypass the web origin policy via a crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 4.3.

Confused deputy in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Low)

CVE-2026-95316 is a low severity vulnerability in Google Chrome's Performance component prior to version 154.0.8037.57. It involves an unchecked return value that could allow a local attacker to potentially read memory via a local program. The vulnerability has a CVSS score of 2.9, indicating low impact. No known exploits are reported in the wild. The issue is fixed in Chrome version 154.0.8037.57.

A missing authorization vulnerability in Google Chrome on Mac prior to version 154.0.8037.57 allows a remote attacker to obtain cross-origin data via a crafted HTML page through social engineering. The vulnerability has a low Chromium security severity and a CVSS score of 4.3, indicating medium severity.

A missing authorization vulnerability in the V8 engine of Google Chrome prior to version 154.0.8037.57 allows a remote attacker to bypass the web origin policy via a crafted HTML page. The issue has been assigned a medium severity with a CVSS score of 4.3. This vulnerability could enable limited integrity impact without compromising confidentiality or availability.

CVE-2026-95380 is a type confusion vulnerability in the V8 JavaScript engine of Google Chrome prior to version 154.0.8037.57. This flaw allows a remote attacker to potentially execute arbitrary code inside the browser sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8. Google has released an update to address this issue.

UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

A confused deputy vulnerability in Google Chrome DevTools prior to version 154.0.8037.57 allows a remote attacker to bypass the web origin policy via a crafted HTML page using social engineering techniques. The issue has a CVSS score of 4.3, indicating medium severity, and does not impact confidentiality or availability but can cause limited integrity loss. Google has released an update to address this vulnerability.

UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-95326 is a vulnerability in Google Chrome prior to version 154.0.8037.57 involving incomplete cleanup in the Bluetooth component. This flaw allows a remote attacker, through social engineering and a crafted HTML page, to bypass system access restrictions. The vulnerability has a high severity rating with a CVSS score of 8.4. Google has released a stable channel update addressing this issue.

CVE-2026-95319 is a use-after-free vulnerability in the printing component of Google Chrome prior to version 154.0.8037.57. This flaw could allow a remote attacker who has compromised the renderer process to execute arbitrary code outside the sandbox by crafting a malicious HTML page. The vulnerability has a high severity rating with a CVSS score of 8.3. Google has released an update to address this issue.

CVE-2026-95368 is a vulnerability in Google Chrome's DevTools prior to version 154.0.8037.57. It involves incorrect authorization that could allow a remote attacker, using social engineering, to potentially access cross-origin data via a crafted HTML page. The issue has a low severity rating from Chromium security and a CVSS score of 4.3, indicating medium severity overall.

CVE-2026-95385 is a medium severity vulnerability in Google Chrome on Windows prior to version 154.0.8037.57. It involves an inappropriate implementation in the PlatformIntegration component that allows a remote attacker to bypass system access restrictions via a crafted HTML page, leveraging social engineering. The vulnerability requires user interaction to be exploited and does not impact confidentiality or availability but can impact integrity.