Threats affecting pkg:deb/google/chrome

CVE-2026-95385 is a medium severity vulnerability in Google Chrome on Windows prior to version 154.0.8037.57. It involves an inappropriate implementation in the PlatformIntegration component that allows a remote attacker to bypass system access restrictions via a crafted HTML page, leveraging social engineering. The vulnerability requires user interaction to be exploited and does not impact confidentiality or availability but can impact integrity.

A vulnerability in Google Chrome prior to version 154.0.8037.57 allows incorrect authorization in DevTools. This flaw enables a remote attacker, using social engineering and a crafted Chrome extension, to bypass the web origin policy. The issue has a medium severity rating with a CVSS score of 5.4.

CVE-2026-95374 is a medium severity vulnerability in Google Chrome prior to version 154.0.8037.57. It involves incorrect authorization in the Network component that allows a remote attacker to bypass the web origin policy via a crafted HTML page. This could lead to unauthorized actions without user privileges. The issue has been addressed in Chrome version 154.0.8037.57.

CVE-2026-95317 is a vulnerability in Google Chrome's MediaCapture component prior to version 154.0.8037.57. It allows a remote attacker, through social engineering and a crafted Chrome extension, to bypass authorization and obtain cross-origin data. The issue has a low severity rating and a CVSS score of 3.1.

CVE-2026-95359 is a vulnerability in Google Chrome on Android prior to version 154.0.8037.57. It involves an uninitialized resource in the GPU component that allows a remote attacker who has compromised the renderer process to read memory outside the sandbox via a crafted HTML page. The issue has been fixed in version 154.0.8037.57. The vulnerability is rated with a low severity and a CVSS score of 3.4.

CVE-2026-95293 is a vulnerability in Google Chrome prior to version 154.0.8037.57 involving an uninitialized GPU resource. This flaw allows a remote attacker to read memory outside the sandbox by delivering a crafted HTML page. The issue has been fixed in Chrome version 154.0.8037.57.

A missing authorization vulnerability in Google Chrome Extensions prior to version 154.0.8037.57 allows a remote attacker who has compromised the renderer process to bypass site isolation using a crafted HTML page. This vulnerability has a high severity rating and affects Chrome versions before 154.0.8037.57.

A critical buffer overflow vulnerability exists in the ANGLE component of Google Chrome on Android versions prior to 154.0.8037.57. This flaw allows a remote attacker to execute arbitrary code outside the browser sandbox by delivering a crafted HTML page. The issue has been fixed in version 154.0.8037.57.

Inappropriate implementation in Extensions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Medium)

A type confusion vulnerability exists in the V8 JavaScript engine used by Google Chrome versions prior to 153.0.8010.52. This flaw allows a remote attacker to execute arbitrary code inside the browser's sandbox by tricking a user into visiting a maliciously crafted HTML page. The vulnerability is rated with high severity by the Chromium security team.

Use after free in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Workers in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Race condition in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

Race condition in Network in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

Missing authorization in Android in Google Chrome on on Android prior to 153.0.8010.47 allowed a local attacker to obtain sensitive information via a co-installed app. (Chromium security severity: High)

Uninitialized resource in ANGLE in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a local attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)

Out of bounds read in WebGL in Google Chrome on on Android prior to 153.0.8010.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

A vulnerability in Google Chrome's WebGL implementation prior to version 153.0.8010.36 allows a remote attacker to leak cross-origin data by exploiting an uninitialized resource. This issue could be triggered via a crafted HTML page. The Chromium project has assigned a medium severity level to this security flaw.

An incorrect authorization vulnerability exists in the ServiceWorker component of Google Chrome versions prior to 153.0.8010.36. This flaw allows a remote attacker who has already compromised the renderer process to bypass the web origin policy by using a crafted HTML page. The Chromium security team has rated the severity of this issue as low.