CVE-2026-106344: Missing Authorization

Missing authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Low...

PT-2026-106890

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description An uninitialized resource in ANGLE Almost Native Graphics Layer Engine, a compatibility layer that allows OpenGL ES APIs to run on Windows, enables a remote attacker to read memory...

PT-2026-107062

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description An issue in the SanitizerAPI allows a remote attacker to leak sensitive information through the use of a crafted HTML page. The SanitizerAPI is a browser interface designed to clean and...

PT-2026-107018

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Improper state validation in DevTools allows a remote attacker to potentially execute arbitrary code inside the sandbox by using a crafted HTML page. Recommendations Update Google Chrom...

PT-2026-107008

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description An observable discrepancy in the Paint process allows a remote attacker to leak cross-origin data, which is information from a different origin than the one serving the page, by using a...

PT-2026-106948

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 155.0.8059.39 Description An uninitialized resource in the GPU allows a remote attacker to read memory outside the sandbox by using a crafted HTML page. Recommendations Update Google Chrome on Android...

PT-2026-107052

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description An issue exists where a remote attacker can use social engineering and a specially crafted HTML page to spoof UI elements, leading to UI misrepresentation. Recommendations Update Google...

PT-2026-106946

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description An uninitialized resource in the Video component allows a remote attacker who has already compromised the renderer process to read memory outside the sandbox by using a specially crafte...

PT-2026-106980

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Incorrect authorization in the Network component allows a remote attacker who has compromised the renderer process to bypass system access restrictions by using a crafted HTML page...

PT-2026-106932

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Incorrect authorization in the PermissionElement allows a remote attacker to bypass system access restrictions by using a crafted HTML page. Recommendations Update Google Chrome to...

PT-2026-107020

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description An information leak exists in the Animation component that allows a remote attacker to leak sensitive information by inducing a user to visit a crafted HTML page. Recommendations Update...

PT-2026-107069

Name of the Vulnerable Software and Affected Versions Google Chrome on iOS versions prior to 155.0.8059.39 Description Incorrect authorization in the mobile version of the browser allows a remote attacker to bypass system access restrictions. This is achieved by leveraging social engineering to...

CVE-2026-106329: Incorrect Authorization

Incorrect authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-106404: Incorrect Authorization

Incorrect authorization in FontAccess in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106393: Use After Free

Use after free in Storage in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

PT-2026-107041

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Missing authorization in the Translate feature allows a remote attacker who has compromised the renderer process to bypass site isolation by using a crafted HTML page. Site isolation is...

PT-2026-106961

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Missing authorization in the Browser component allows a remote attacker to bypass system access restrictions. This is achieved by leveraging social engineering to entice a user to visit...

DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes

Environment - dompurify 3.4.15 current npm release; reproduced independently on jsdom 30.0.1 and 29.1.1 Node.js 20.x / 26.x - Config: DOMPurify.sanitizenode, INPLACE: true on a Node input; SAFEFORXML at its default true Summary The 3.4.9 fix for the INPLACE detached-root class added two protectio...

Cross-site Scripting (XSS)

Overview dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient sanitization in the HTML purification logic, allowing an attacker to inject and execute arbitrary JavaScript in a victim's browser...

Cross-site Scripting (XSS)

Overview org.webjars.npm:dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient sanitization in the HTML purification logic, allowing an attacker to inject and execute arbitrary JavaScript in a...