PT-2026-136631

Memory corruption in ANGLE in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

PT-2026-136648

Use after free in WebGL in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

Google Chrome processing logic error vulnerability

Google Chrome on Android versions prior to 157.0.8103.38 contains a logic error vulnerability stemming from improper UI rendering on mobile devices. Remote attackers can exploit this via social engineering by using specially crafted HTML pages to forge UI elements...

CVE-2026-121106: Google Chrome: Information leak in Omnibox in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to leak…

Information leak in Omnibox in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to leak sensitive information via UI Interaction. Chromium security severity: Medium...

PT-2026-136522

Information leak in Omnibox in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to leak sensitive information via UI Interaction. Chromium security severity: Medium...

CVE-2026-121229: Google Chrome: Memory corruption in ANGLE in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to…

Memory corruption in ANGLE in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

PT-2026-136451

Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

PT-2026-136471

UI misrepresentation in Transactions Platform in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. Chromium security severity: Low...

PT-2026-136532

Missing authorization in WebView in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

PT-2026-136643

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 157.0.8103.38 Description A use-after-free issue in the navigation component allows a remote attacker to potentially execute arbitrary code outside the sandbox by inducing the user to visit a crafted...

CVE-2026-121033: Google Chrome: Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had…

Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-121234: Google Chrome: Privilege elevation in Contacts in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to…

Privilege elevation in Contacts in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

Android WapPushOverSms DoS

The vulnerability in the decodeWapPdu function within the WapPushOverSms.java file of Android operating systems is related to improper type conversion of numeric values. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service...

CVE-2026-58915

A physical occupant on an Android Automotive OS AAOS Multi-User Multi-Display MUMD passenger display can view sensitive Heads-Up Notification HUN content and execute actions for a secure passenger user User N without authenticating. This bypasses the PassengerKeyguard because the HUN system only...

CVE-2026-49906

An unprivileged application can bypass the android.car.permission.CARDISPLAYINCLUSTER permission by registering an activity with the android.car.cluster.NAVIGATION category and requesting navigation app focus. The privileged ClusterHomeSample application, acting as a confused deputy, resolves and...

CVE-2026-58915

A physical occupant on an Android Automotive OS AAOS Multi-User Multi-Display MUMD passenger display can view sensitive Heads-Up Notification HUN content and execute actions for a secure passenger user User N without authenticating. This bypasses the PassengerKeyguard because the HUN system only...

CVE-2026-58915

A physical occupant of an Android Automotive OS (AAOS) Multi-User Multi-Display (MUMD) passenger display can view sensitive Heads-Up Notification (HUN) content and execute actions for a secure passenger user (User N ) without authentication. The root cause is a bypass of the PassengerKeyguard ; t...

EUVD-2026-115617

A physical occupant on an Android Automotive OS AAOS Multi-User Multi-Display MUMD passenger display can view sensitive Heads-Up Notification HUN content and execute actions for a secure passenger user User N without authenticating. This bypasses the PassengerKeyguard because the HUN system only...

CVE-2026-49906

In Android , an unprivileged application can bypass the android.car.permission.CAR_DISPLAY_IN_CLUSTER permission due to a confused deputy vulnerability in the privileged ClusterHomeSample application. By registering an activity with the android.car.cluster.NAVIGATION category and requesting navig...

CVE-2026-0053

In multiple locations, there is a possible method for a primary user to disable secure nfc on other full users due to insufficient isolation between Android users. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...