CVE-2026-106359

A confused deputy vulnerability exists in the DeviceBoundSessionCredentials feature of Google Chrome (prior to version 155.0.8059.39 ). This flaw allows a remote attacker to trick the browser into misusing its authority by convincing a user to visit a specially crafted HTML page. Successful explo...

EUVD-2026-93735

Cross-site request forgery in ReadingList in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106216

Cross-site request forgery in ReadingList in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106216

Cross-site request forgery in ReadingList in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106289

Missing authorization in FedCM in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-93730

Missing authorization in FedCM in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106289

Google Chrome versions prior to 155.0.8059.39 are vulnerable to a missing authorization flaw in FedCM . This issue allows a remote attacker to bypass the web origin policy by providing a crafted HTML page. The vulnerability has been reported in the wild as of October 2026. Exploitation details or...

EUVD-2026-93721

Race condition in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to bypass web origin policy via a co-installed app. Chromium security severity: Medium...

EUVD-2026-93722

Open redirect in AppManifest in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106405

Race condition in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to bypass web origin policy via a co-installed app. Chromium security severity: Medium...

CVE-2026-106280

Incorrect authorization in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106322

Open redirect in AppManifest in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-93723

Incorrect authorization in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106280

Google Chrome versions prior to 155.0.8059.39 are vulnerable to an incorrect authorization flaw within the PermissionElement component. This vulnerability allows a remote attacker to potentially bypass the web origin policy by navigating to a crafted HTML page . The flaw is assigned a Medium secu...

CVE-2026-106322

An open redirect vulnerability exists in the AppManifest component of Google Chrome prior to version 155.0.8059.39 . A remote attacker can leverage social engineering to craft an HTML page that bypasses the web origin policy . The Chromium security severity for this issue is Medium . While specif...

CVE-2026-106405

A race condition flaw exists in the CustomTabs component of the Chromium browser (specifically affecting Google Chrome on Android versions prior to 155.0.8059.39 ). This vulnerability allows a local attacker to bypass the web origin policy by leveraging a co-installed app . The root causes are do...

CVE-2026-106361

Incorrect provision of specified functionality in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. Chromium security severity: Medium...

EUVD-2026-93709

Incorrect provision of specified functionality in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. Chromium security severity: Medium...

CVE-2026-106361

Google Chrome on iOS prior to version 155.0.8059.39 is vulnerable to an incorrect provision of specified functionality (CWE-684 ). A remote attacker could use social engineering and crafted network traffic to bypass the web origin policy . No specific exploits or in-the-wild exploitation details ...

EUVD-2026-93702

Missing authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...