Threats affecting pkg:deb/google/chrome

A missing authorization vulnerability in Google Chrome prior to version 155.0.8059.39 allows a remote attacker who has compromised the renderer process to spoof UI elements using a crafted HTML page. The issue affects the Permissions component and has a medium severity rating.

CVE-2026-106303 is a medium severity vulnerability in Google Chrome's Autofill AI component prior to version 155.0.8059.39. It allows a remote attacker who has compromised the renderer process and uses social engineering via a crafted HTML page to obtain sensitive information. The attack requires user interaction and has high complexity. A fix is available from the vendor.

Observable discrepancy in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

An information leak vulnerability exists in the WebAudio component of Google Chrome prior to version 155.0.8059.39. This flaw could allow a remote attacker to leak cross-origin data by tricking a user into visiting a crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 4.3. A fix is available in Chrome version 155.0.8059.39.

A UI misrepresentation vulnerability exists in the WebOTP feature of Google Chrome prior to version 155.0.8059.39. This flaw allows a remote attacker to spoof UI elements by crafting a malicious HTML page. The vulnerability has a medium severity rating and a CVSS score of 5.4.

A UI misrepresentation vulnerability exists in the Paint feature of Google Chrome prior to version 155.0.8059.39. This flaw allows a remote attacker to spoof UI elements by crafting a malicious HTML page. The vulnerability has a medium severity rating and a CVSS score of 5.4.

CVE-2026-106302 is a medium severity UI misrepresentation vulnerability in Google Chrome prior to version 155.0.8059.39. It affects the PermissionElement component, allowing remote attackers to spoof UI elements via crafted HTML pages, potentially misleading users through social engineering. The vulnerability has a CVSS score of 5.4 and does not have known exploits in the wild. A fix is available in Chrome version 155.0.8059.39.

CVE-2026-106196 is a vulnerability in Google Chrome on iOS versions prior to 155.0.8059.39. It involves missing authorization in navigation, allowing a remote attacker to bypass the web origin policy and access privileged pages via a crafted HTML page. The vulnerability has a CVSS score of 7.6, indicating high severity.

CVE-2026-106389 is a medium severity vulnerability in Google Chrome prior to version 155.0.8059.39. It involves incorrect authorization related to USB access, allowing a remote attacker to bypass system access restrictions via a crafted Chrome extension using social engineering techniques.

An incorrect authorization vulnerability in Google Chrome prior to version 155.0.8059.39 allows a remote attacker to bypass system access restrictions via crafted network traffic. This issue affects permissions handling and has been assigned a medium severity rating.

A missing authorization vulnerability in the Autofill feature of Google Chrome prior to version 155.0.8059.39 allows a remote attacker to obtain sensitive information via a crafted HTML page using social engineering techniques. The vulnerability has a high severity rating with a CVSS score of 8.8.

Incorrect authorization in Search in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-106274 is a vulnerability in Google Chrome on Mac prior to version 155.0.8059.39 involving incorrect reference resolution. This flaw allows a remote attacker to use social engineering via a crafted HTML page to obtain sensitive information. The vulnerability has a high severity rating with a CVSS score of 8.8.

Use after free in TabStrip in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Uninitialized resource in Video in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

A vulnerability in Google Chrome prior to version 155.0.8059.39 involves incomplete cleanup in the Proxy Auth component. This flaw allows an adjacent attacker to obtain sensitive information through crafted network traffic. The issue has a medium severity rating with a CVSS score of 5.3.

CVE-2026-106308 is a high severity vulnerability in Google Chrome on Android involving incorrect reference resolution in the Autofill feature. This flaw allows a remote attacker to use social engineering via a crafted HTML page to obtain sensitive information. Versions prior to 155.0.8059.39 are affected. A fix is available as indicated by the vendor advisory.

CVE-2026-106382 is a critical use-after-free vulnerability in the Chromecast component of Google Chrome versions prior to 155.0.8059.39. This flaw allows a remote attacker to execute arbitrary code outside the browser sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability.

CVE-2026-102319 is a vulnerability in Google Chrome prior to version 154.0.8037.92 involving an uninitialized GPU resource. This flaw allows a remote attacker who has already compromised the renderer process to read memory outside the sandbox by using a specially crafted HTML page. The vulnerability has a low CVSS score of 3.4 and is rated low severity by the Chromium security team.

A missing authorization vulnerability in WebView within Google Chrome on Android versions prior to 154.0.8037.57 allows a remote attacker who has compromised the renderer process to bypass the web origin policy using a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.4. No explicit patch information is provided, so patch status is not confirmed.