Google Chrome vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Google Chrome: 3398 record(s), with affected versions and fixes.cpe:2.3:a:google:chrome
CVE-2026-106223
Medium · 4.7
CWE-908 Oct 6, 2026
Use of Uninitialized Resource in Google Chrome
Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106222
Medium · 5.9
CWE-863 Oct 6, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in Sync in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium)
CVE-2026-106221
High · 8.3
CWE-441 Oct 6, 2026
Confused deputy in WebAPKs in Google Chrome on on Android prior to 155.0.8059.39 allowed…
Confused deputy in WebAPKs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-106220
High · 8.8
CWE-200 Oct 6, 2026
Exposure of Sensitive Information in Google Chrome
Information leak in Passwords in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-106217
Medium · 4.3
CWE-862 Oct 6, 2026
Missing Authorization in Google Chrome
Missing authorization in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106216
Medium · 5.4
CWE-352 Oct 6, 2026
Cross-Site Request Forgery (CSRF) in Google Chrome
Cross-site request forgery in ReadingList in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106215
Medium · 4.7
CWE-908 Oct 6, 2026
Use of Uninitialized Resource in Google Chrome
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106214
Medium · 5.3
CWE-200 Oct 6, 2026
Exposure of Sensitive Information in Google Chrome
Information leak in Proxy in Google Chrome on on Windows prior to 155.0.8059.39 allowed an adjacent attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: High)
CVE-2026-106213
Medium · 4.3
CWE-362 Oct 6, 2026
Race Condition in Google Chrome
Race condition in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106212
High · 8.8
CWE-863 Oct 6, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106211
Critical · 9.6
CWE-416 Oct 6, 2026
Use After Free in Google Chrome
Use after free in TabStrip in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106210
Low · 3.1
CWE-203 Oct 6, 2026
Observable Discrepancy in Google Chrome
Observable discrepancy in Scroll in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium)
CVE-2026-106209
Medium · 5.4
CWE-451 Oct 6, 2026
UI misrepresentation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed…
UI misrepresentation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106208
Medium · 6.1
CWE-862 Oct 6, 2026
Missing Authorization in Google Chrome
Missing authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted Chrome extension. (Chromium security severity: Medium)
CVE-2026-106207
High · 8.8
CWE-367 Oct 6, 2026
TOCTOU Race Condition in Google Chrome
Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106206
Medium · 5.9
CWE-20 Oct 6, 2026
Improper Input Validation in Google Chrome
Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium)
CVE-2026-106205
High · 8.1
CWE-862 Oct 6, 2026
Missing Authorization in Google Chrome
Missing authorization in Passwords in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106204
High · 8.8
CWE-416 Oct 6, 2026
Use After Free in Google Chrome
Use after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)
CVE-2026-106203
High · 8.8
CWE-459 Oct 6, 2026
Incomplete cleanup in Autofill in Google Chrome on on iOS prior to 155.0.8059.39 allowed…
Incomplete cleanup in Autofill in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106202
Medium · 4.7
CWE-908 Oct 6, 2026
Use of Uninitialized Resource in Google Chrome
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106201
High · 8.8
CWE-362 Oct 6, 2026
Race Condition in Google Chrome
Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106200
High · 8.8
CWE-416 Oct 6, 2026
Use After Free in Google Chrome
Use after free in Track in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106199
High · 8.2
CWE-863 Oct 6, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in Actor in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially bypass site isolation via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-106198
High · 8.2
CWE-862 Oct 6, 2026
Missing Authorization in Google Chrome
Missing authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106197
Critical · 9.6
CWE-416 Oct 6, 2026
Use After Free in Google Chrome
Use after free in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)