Threat database

A race condition vulnerability exists in the V8 JavaScript engine of Google Chrome prior to version 154.0.8037.57. This flaw allows a remote attacker to execute arbitrary code within the browser's sandbox by delivering a specially crafted HTML page. The vulnerability has been assigned a high severity rating with a CVSS score of 7.5.

CVE-2026-95343 is a use-after-free vulnerability in the WebAudio component of Google Chrome prior to version 154.0.8037.57. This flaw allows a remote attacker to execute arbitrary code within the sandbox by crafting a malicious HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8.

A type confusion vulnerability exists in the IndexedDB component of Google Chrome prior to version 154.0.8037.57. This flaw could allow a remote attacker to execute arbitrary code within the browser's sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity rating and a CVSS score of 8.8.

A type confusion vulnerability in Google Chrome's Bindings component prior to version 154.0.8037.57 allows remote attackers to execute arbitrary code within the sandbox by delivering a crafted HTML page. This vulnerability has a high severity rating and a CVSS score of 8.8.

A buffer overflow vulnerability exists in the video component of Google Chrome prior to version 154.0.8037.57. This flaw could allow a remote attacker to execute arbitrary code outside the browser sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity rating and a CVSS score of 9.6, indicating critical impact on confidentiality, integrity, and availability.

A use-after-free vulnerability exists in the PDFium component of Google Chrome prior to version 154.0.8037.57. This flaw allows a remote attacker to execute arbitrary code within the sandbox by using a specially crafted PDF file. The vulnerability is rated as high severity with a CVSS score of 8.8.

CVE-2026-95335 is a use-after-free vulnerability in the Human Interface Device (HID) component of Google Chrome prior to version 154.0.8037.57. This flaw allows a remote attacker who has compromised the renderer process to potentially execute arbitrary code outside the browser sandbox by delivering a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.3.

CVE-2026-95348 is a use-after-free vulnerability in the Bluetooth component of Google Chrome prior to version 154.0.8037.57. It allows a remote attacker who has compromised the renderer process to potentially execute arbitrary code outside the sandbox by using a crafted HTML page. The vulnerability has a high severity rating and a CVSS score of 8.3.

A use-after-free vulnerability exists in the Views component of Google Chrome prior to version 154.0.8037.57. This flaw allows a remote attacker to potentially execute arbitrary code outside the browser sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity rating and a CVSS score of 9.6, indicating critical impact if exploited.

CVE-2026-95373 is a use-after-free vulnerability in the DevTools component of Google Chrome prior to version 154.0.8037.57. This flaw allows a remote attacker, through social engineering and a crafted HTML page, to execute arbitrary code within the sandbox environment. The vulnerability is rated high severity with a CVSS score of 8.8.

CVE-2026-95282 is a use-after-free vulnerability in the Platform component of Google Chrome prior to version 154.0.8037.57. This flaw allows a remote attacker to execute arbitrary code within the sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8. Google has released an update to address this issue.

CVE-2026-95274 is a high-severity vulnerability in Google Chrome prior to version 154.0.8037.57. It involves improper output encoding in the DevTools component, which could allow a remote attacker who has compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page.

Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

A buffer overflow vulnerability exists in the Tint component of Google Chrome on Android versions prior to 154.0.8037.57. This flaw allows a remote attacker to potentially execute arbitrary code outside the sandbox by delivering a crafted HTML page. The vulnerability has a high severity rating and a CVSS score of 9.6, indicating critical impact.

Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

A use-after-free vulnerability exists in the Chromecast component of Google Chrome versions prior to 154.0.8037.57. This flaw allows a remote attacker who has compromised the renderer process to potentially execute arbitrary code outside the sandbox by crafting a malicious HTML page. The vulnerability has a high severity rating and a CVSS score of 8.3.

CVE-2026-95298 is a use-after-free vulnerability in Google Chrome's browser component prior to version 154.0.8037.57. This flaw allows a local attacker to potentially execute arbitrary code outside the sandbox via user interface interaction. The vulnerability has a high severity rating with a CVSS score of 7.8. Google has released an update to address this issue in version 154.0.8037.57.

CVE-2026-95315 is a use-after-free vulnerability in the Aura component of Google Chrome prior to version 154.0.8037.57. This flaw allows a local attacker to potentially execute arbitrary code outside the browser sandbox via user interface interaction. The vulnerability has a high severity rating with a CVSS score of 7.8. Google has released an update to address this issue in Chrome version 154.0.8037.57.

CVE-2026-95355 is a high severity vulnerability in Google Chrome on iOS prior to version 154.0.8037.57. It involves incorrect authorization in the navigation component, allowing a remote attacker who has compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page.

UI misrepresentation in SecurityIndicators in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: High)