Threat database

CVE-2026-107858 is a high-severity vulnerability in Google Agent Development Kit (ADK) for Java versions before 1.13.0. It involves missing origin validation in WebSockets and permissive cross-domain policies, allowing remote attackers to control a locally running agent via malicious web pages. The vulnerability affects the /run_live WebSocket endpoint and REST API, which accept connections and requests from any origin by default. This enables cross-origin attacks that can trigger tools, stream responses, and manipulate sessions and artifacts. The issue is fixed in version 1.13.0 by enforcing same-origin policies and rejecting DNS-rebinding requests over loopback.

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

CVE-2026-103090 is a high-severity vulnerability in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8. It involves missing authentication for critical functions and insufficiently protected credentials, allowing unauthenticated remote attackers to retrieve signed Biscuit identity tokens of enrolled peers. Attackers can use these tokens to read mesh authorization policies and overwrite router multiaddrs. The issue is fixed in version 0.1.0-alpha.9 and later, which require cryptographic proof of possession of enrollment private keys, enforce rate limiting, and validate router lease addresses.

Use after free in ReadingMode in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Use after free in Bookmarks in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Memory corruption in Mobile in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Memory corruption in Actor in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Memory corruption in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Use after free in Editing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Memory corruption in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Memory corruption in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Improper input validation in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-113130 is a use-after-free vulnerability in the Actor component of Google Chrome versions prior to 156.0.8078.47. This flaw allows a remote attacker to execute arbitrary code within the sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8. Google has released a stable channel update to address this issue.

CVE-2026-113074 is a use-after-free vulnerability in the Media component of Google Chrome on Windows versions prior to 156.0.8078.47. This flaw allows a remote attacker to execute arbitrary code inside the sandbox by delivering a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8. A fix is available in Chrome version 156.0.8078.47.

CVE-2026-113067 is a use-after-free vulnerability in the Chromoting component of Google Chrome versions prior to 156.0.8078.47. This flaw allows a remote attacker to execute arbitrary code within the sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8. Google has released an update to address this issue.

Improper input validation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Memory corruption in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Memory corruption in Controls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)