Threat database

A missing authorization vulnerability in Google Chrome's Storage component prior to version 153.0.8010.52 allows a remote attacker who has compromised the renderer process to bypass site isolation by using a crafted PDF file. The vulnerability has a low severity rating and a CVSS score of 3.1.

CVE-2026-93376 is an out-of-bounds read vulnerability in the DataTransfer component of Google Chrome prior to version 153.0.8010.52. It allows a local attacker, through social engineering, to read memory outside the sandbox via a local program. The vulnerability has a medium severity rating and a CVSS score of 6.3.

CVE-2026-93383 is an information leak vulnerability in the Permissions component of Google Chrome versions prior to 153.0.8010.52. It allows a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability has a medium severity rating and a CVSS score of 4.3. Google has released an update to address this issue.

A server-side request forgery (SSRF) vulnerability exists in the Omnibox component of Google Chrome on Android versions prior to 153.0.8010.52. This flaw allows a remote attacker, using social engineering, to bypass system access restrictions by sending crafted network traffic. The vulnerability has a low severity rating and a CVSS score of 3.7.

A race condition vulnerability exists in the FileSystem component of Google Chrome prior to version 153.0.8010.52. This flaw could be exploited by a remote attacker who has already compromised the renderer process and uses social engineering with a crafted HTML page to bypass system access restrictions. The vulnerability has a low severity rating and a CVSS score of 3.1. No known exploits are reported in the wild. Google has published an advisory for this issue.

Type confusion in V8 in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Incorrect authorization in ORB in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)

Buffer overflow in PDFium in Google Chrome on on Windows prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)

Use after free in Extensions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)

CVE-2026-93387 is a medium severity vulnerability in Google Chrome prior to version 153.0.8010.52 involving improper state validation in the Skia component. This flaw could allow a remote attacker to obtain cross-origin data by tricking a user into visiting a crafted HTML page. The vulnerability does not allow integrity or availability impacts, but it compromises confidentiality to a limited extent. Google has released a stable channel update to address this issue.

Use after free in PDFium in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Incorrect reference resolution in Tracing in Google Chrome on on Windows prior to 153.0.8010.52 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)

Buffer overflow in WebGL in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of deeply nested START_GROUP wire bytes to any Node.js service that calls the generated deserializeBinary() API, causing a RangeError: Maximum call stack size exceeded and crashing the process. No authentication or prior knowledge of the schema is required.

Code injection in XML in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

Use after free in Input in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-91730 is a vulnerability in Google Chrome prior to version 153.0.8010.47 involving incomplete cleanup in the GetUserMedia API. This flaw could allow a remote attacker who has compromised the renderer process and used social engineering to obtain cross-origin data via a crafted HTML page. The issue has a low severity rating and a CVSS score of 3.1. A fix is available in Chrome version 153.0.8010.47.

Improper input validation in ANGLE in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

A missing authorization vulnerability in Google Chrome prior to version 153.0.8010.47 allows a remote attacker who has compromised the renderer process to spoof UI elements via a crafted HTML page. The issue has a medium severity rating and a CVSS score of 4.2. This vulnerability affects versions before 153.0.8010.47.