PT-2026-106937

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Missing authorization in Web Authentication Passkeys & Security Keys allows a remote attacker to spoof UI elements by using a crafted HTML page. Recommendations Update Google Chrome to...

PT-2026-106962

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Missing authorization in the Federated Credential Management FedCM API allows a remote attacker to bypass the web origin policy by using a crafted HTML page. FedCM is a browser API...

PT-2026-107037

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Missing authorization in the Animation component allows a remote attacker to bypass the web origin policy, which is a security mechanism that restricts how a document or script loaded...

PT-2026-107090

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Missing authorization in the Network component allows a remote attacker to bypass the web origin policy—a security mechanism that restricts how a document or script loaded from one orig...

CVE-2026-106361: Incorrect Provision of Specified Functionality

Incorrect provision of specified functionality in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. Chromium security severity: Medium...

CVE-2026-106359: Unintended Proxy or Intermediary

Confused deputy in DeviceBoundSessionCredentials in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-106331: Improper Input Validation

Improper input validation in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy into a privileged page via a crafted Chrome extension. Chromium security severity: Low...

PT-2026-107068

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 155.0.8059.39 Description Improper input validation in the Omnibox allows a remote attacker to bypass the web origin policy through the use of a crafted HTML page and social engineering. The web origi...

CVE-2026-106408: Protection Mechanism Failure

Protection mechanism failure in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106405: Time-of-check Time-of-use (TOCTOU) Race Condition

Race condition in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to bypass web origin policy via a co-installed app. Chromium security severity: Medium...

CVE-2026-106396: Improper Input Validation

Improper input validation in Omnibox in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: High...

CVE-2026-106422: Incorrect Authorization

Incorrect authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-106418: Missing Authorization

Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. Chromium security severity: Low...

CVE-2026-106381: Incorrect Authorization

Incorrect authorization in Passwords in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106366: Incomplete Cleanup

Incomplete cleanup in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: High...

CVE-2026-106365: Missing Authorization

Missing authorization in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106362: Missing Authorization

Missing authorization in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. Chromium security severity: Low...

CVE-2026-39724: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in HTTP Requests Manager = 1.3.11 versions...

CVE-2026-32570: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Progressify - Progressive Web App PWA = 1.6.0 versions...

CVE-2026-106221: Unintended Proxy or Intermediary

Confused deputy in WebAPKs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...