Threats affecting pkg:deb/google/chrome

CVE-2026-106350 is a high severity incorrect authorization vulnerability in Google Chrome versions prior to 155.0.8059.39. It allows a remote attacker to obtain sensitive information by leveraging a crafted HTML page. Google has released an update to address this issue.

A UI misrepresentation vulnerability in Google Chrome's WebAppInstalls component prior to version 155.0.8059.39 allows remote attackers to spoof UI elements via crafted HTML pages. The issue has a medium severity rating with a CVSS score of 5.4. Google has released an official fix in Chrome version 155.0.8059.39.

CVE-2026-106249 is a vulnerability in Google Chrome on Android versions prior to 155.0.8059.39. It involves incorrect authorization in the Autofill feature, allowing a remote attacker to obtain sensitive information via a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8.

CVE-2026-106296 is a medium severity vulnerability in Google Chrome on Mac systems prior to version 155.0.8059.39. It involves improper privilege management in the user interface that allows a remote attacker, using social engineering and a crafted HTML page, to bypass system access restrictions. The vulnerability has a CVSS score of 5.4 and does not have known exploits in the wild. A fix is available as indicated by the vendor advisory.

CVE-2026-106285 is a UI misrepresentation vulnerability in Google Chrome's WebAppInstalls component prior to version 155.0.8059.39. It allows a remote attacker to bypass system access restrictions by tricking users through a crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 5.4. No known exploits are reported in the wild. Google has released a stable channel update addressing this issue.

CVE-2026-106199 is a high-severity vulnerability in Google Chrome on Android prior to version 155.0.8059.39. It involves incorrect authorization in the Actor component, which could allow a remote attacker who has compromised the renderer process to bypass site isolation by using a crafted HTML page. This vulnerability has a CVSS score of 8.2 and affects versions before 155.0.8059.39.

CVE-2026-106287 is a vulnerability in Google Chrome prior to version 155.0.8059.39 involving information loss in the Cross-Origin Resource Sharing (CORS) mechanism. This flaw allows a remote attacker to bypass the web origin policy via crafted network traffic. The vulnerability has a low severity rating from Chromium security and a CVSS score of 4.3, indicating medium severity. No known exploits are reported in the wild. The issue affects versions before 155.0.8059.39.

Missing authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-106312 is a missing authorization vulnerability in the SignIn component of Google Chrome before version 155.0.8059.39. It allows a remote attacker to obtain sensitive information by tricking users into installing a crafted Chrome extension. The vulnerability has a medium severity with a CVSS score of 6.5.

Observable discrepancy in Scroll in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium)

A missing authorization vulnerability in the SiteIsolation feature of Google Chrome prior to version 155.0.8059.39 allows a remote attacker who has compromised the renderer process to bypass site isolation using a crafted HTML page. This issue has a medium severity rating and does not impact confidentiality but can lead to integrity violations.

CVE-2026-106395 is a medium severity vulnerability in Google Chrome on Android prior to version 155.0.8059.39. It involves an uninitialized resource in the Dawn component that allows a remote attacker to read memory outside the sandbox by delivering a crafted HTML page. This vulnerability does not allow code execution or denial of service but can lead to information disclosure. The issue is fixed in version 155.0.8059.39.

CVE-2026-106388 is a medium severity vulnerability in Google Chrome's DataTransfer component prior to version 155.0.8059.39. It involves missing authorization that allows a remote attacker who has compromised the renderer process to access sensitive information via a crafted HTML page. The vulnerability has a CVSS score of 5.3 and does not affect availability or integrity, only confidentiality.

Incomplete cleanup in GetUserMedia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

An incorrect authorization vulnerability in the Accessibility component of Google Chrome prior to version 155.0.8059.39 allows a remote attacker who has compromised the renderer process to bypass site isolation by using a crafted HTML page. This vulnerability has a high severity rating with a CVSS score of 8.1.

CVE-2026-106232 is a UI misrepresentation vulnerability in Google Chrome prior to version 155.0.8059.39. It allows a remote attacker to use social engineering techniques to spoof UI elements by crafting malicious HTML pages. The vulnerability has a medium severity rating and a CVSS score of 5.4.

CVE-2026-106230 is a medium severity vulnerability in Google Chrome on Android prior to version 155.0.8059.39. It involves incorrect reference resolution in the Offline component, which allows a remote attacker who has compromised the renderer process to obtain sensitive information via a crafted HTML page. The vulnerability has a CVSS score of 5.3. A stable channel update addressing this issue has been released by Google.

A clickjacking vulnerability exists in the Messages feature of Google Chrome on Android versions prior to 155.0.8059.39. This flaw allows a remote attacker to use social engineering to spoof UI elements via a crafted HTML page. The vulnerability has a medium severity rating and a CVSS score of 5.4.

A missing authorization vulnerability in Google Chrome on iOS prior to version 155.0.8059.39 allows a remote attacker to obtain sensitive information via a crafted HTML page leveraging social engineering. The vulnerability has a high severity with a CVSS score of 8.8. A vendor advisory from Google confirms the issue and indicates that a stable channel update has been released.

A UI misrepresentation vulnerability exists in Google Chrome on iOS versions prior to 155.0.8059.39. This flaw allows a remote attacker to spoof the address bar via a crafted HTML page, potentially misleading users through social engineering. The vulnerability has a medium severity rating.