CVE-2026-106403: Incorrect Authorization

Incorrect authorization in Accessibility in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106388: Missing Authorization

Missing authorization in DataTransfer in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106393: Use After Free

Use after free in Storage in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-106344: Missing Authorization

Missing authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Low...

CVE-2026-106339: Operation on a Resource after Expiration or Release

Use of released resource in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTML page. Chromium security severity: Low...

CVE-2026-106198: Missing Authorization

Missing authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106205: Missing Authorization

Missing authorization in Passwords in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106217: Missing Authorization

Missing authorization in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106228: Unintended Proxy or Intermediary

Confused deputy in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106266: Unintended Proxy or Intermediary

Confused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web origin policy into a privileged page via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106267: Missing Authorization

Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106295: Incorrect Authorization

Incorrect authorization in Unbounded Element in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106300: Time-of-check Time-of-use (TOCTOU) Race Condition

Race condition in CacheStorage in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

PT-2026-106856

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Incorrect reference resolution in DevTools allows a remote attacker who has compromised the renderer process to obtain sensitive information through a crafted HTML page. Recommendations...

PT-2026-106892

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Missing authorization in Google Lens allows a remote attacker who has compromised the renderer process to leak cross-origin data through a crafted HTML page. Cross-origin data leakage...

PT-2026-106901

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description A confused deputy issue in Google Lens allows a remote attacker who has already compromised the renderer process to potentially execute arbitrary code outside the sandbox by using a...

PT-2026-106903

Incorrect reference resolution in Offline in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

PT-2026-106911

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description A race condition exists in the Fonts component. This issue allows a remote attacker who has already compromised the renderer process to potentially execute arbitrary code outside the...

PT-2026-106920

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description A buffer overflow exists in ANGLE, a compatibility layer that allows OpenGL ES APIs to run on various graphics platforms. This issue allows a remote attacker who has already compromised...

PT-2026-106946

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description An uninitialized resource in the Video component allows a remote attacker who has already compromised the renderer process to read memory outside the sandbox by using a specially crafte...