Google Chrome vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Google Chrome: 3398 record(s), with affected versions and fixes.cpe:2.3:a:google:chrome
CVE-2026-106399
Low · 3.3
CWE-125 Oct 6, 2026
Out-of-bounds Read in Google Chrome
Out of bounds read in Skia in Google Chrome prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to potentially read memory via a crafted file. (Chromium security severity: Low)
CVE-2026-106398
Medium · 4.3
CWE-863 Oct 6, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106397
Medium · 6.1
CWE-863 Oct 6, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106396
Medium · 5.4
CWE-20 Oct 6, 2026
Improper input validation in Omnibox in Google Chrome on on Android prior to 155.0.8059.39...
Improper input validation in Omnibox in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106395
Medium · 4.7
CWE-908 Oct 6, 2026
Use of Uninitialized Resource in Google Chrome
Uninitialized resource in Dawn in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106394
Medium · 4.3
CWE-459 Oct 6, 2026
Incomplete cleanup in Glic in Google Chrome prior to 155.0.8059.39 allowed a remote…
Incomplete cleanup in Glic in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-106393
High · 8.3
CWE-416 Oct 6, 2026
Use After Free in Google Chrome
Use after free in Storage in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106392
Medium · 4.3
CWE-200 Oct 6, 2026
Exposure of Sensitive Information in Google Chrome
Information leak in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106391
Medium · 4.2
CWE-863 Oct 6, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in WebShare in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106390
Medium · 4.3
CWE-684 Oct 6, 2026
Incorrect provision of specified functionality in SanitizerAPI in Google Chrome prior to…
Incorrect provision of specified functionality in SanitizerAPI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-106389
Medium · 6.5
CWE-863 Oct 6, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in USB in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)
CVE-2026-106388
Medium · 5.3
CWE-862 Oct 6, 2026
Missing Authorization in Google Chrome
Missing authorization in DataTransfer in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106387
High · 8.8
CWE-862 Oct 6, 2026
Missing Authorization in Google Chrome
Missing authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106386
Medium · 6.5
CWE-908 Oct 6, 2026
Use of Uninitialized Resource in Google Chrome
Uninitialized resource in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106384
Medium · 6.5
CWE-862 Oct 6, 2026
Missing Authorization in Google Chrome
Missing authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106383
High · 8.8
CWE-416 Oct 6, 2026
Use After Free in Google Chrome
Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106382
Critical · 9.6
CWE-416 Oct 6, 2026
Use After Free in Google Chrome
Use after free in Chromecast in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-106380
Medium · 5.4
CWE-451 Oct 6, 2026
UI misrepresentation in UI in Google Chrome prior to 155.0.8059.39 allowed a remote…
UI misrepresentation in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-106379
Medium · 4.3
CWE-908 Oct 6, 2026
Use of Uninitialized Resource in Google Chrome
Uninitialized resource in Skia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106385
Medium · 5.3
CWE-362 Oct 6, 2026
Race Condition in Google Chrome
Race condition in Chromoting in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)
CVE-2026-106381
Medium · 6.5
CWE-863 Oct 6, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in Passwords in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106378
High · 8.3
CWE-250 Oct 6, 2026
Execution with Unnecessary Privileges in Google Chrome
Privilege elevation in Sandbox in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106377
High · 8.3
CWE-362 Oct 6, 2026
Race Condition in Google Chrome
Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106376
Medium · 4.7
CWE-908 Oct 6, 2026
Use of Uninitialized Resource in Google Chrome
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106375
Critical · 9.6
CWE-459 Oct 6, 2026
Incomplete cleanup in Dawn in Google Chrome prior to 155.0.8059.39 allowed a remote…
Incomplete cleanup in Dawn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)