Google Chrome vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Google Chrome: 3398 record(s), with affected versions and fixes.cpe:2.3:a:google:chrome
CVE-2026-106374
High · 8.8
CWE-843 Oct 6, 2026
Type Confusion in Google Chrome
Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-106373
High · 8.8
CWE-416 Oct 6, 2026
Use After Free in Google Chrome
Use after free in Fonts in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106372
Critical · 9.6
CWE-863 Oct 6, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106371
High · 8.8
CWE-863 Oct 6, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in Transactions Platform in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-106370
Medium · 4.7
CWE-908 Oct 6, 2026
Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a...
Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106369
Medium · 4.2
CWE-862 Oct 6, 2026
Missing authorization in Translate in Google Chrome prior to 155.0.8059.39 allowed a remote...
Missing authorization in Translate in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106368
Medium · 5.4
CWE-451 Oct 6, 2026
UI misrepresentation in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote...
UI misrepresentation in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-106367
High · 8.4
CWE-862 Oct 6, 2026
Missing authorization in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a...
Missing authorization in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a co-installed app. (Chromium security severity: Medium)
CVE-2026-106366
Medium · 5.4
CWE-459 Oct 6, 2026
Incomplete cleanup in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a...
Incomplete cleanup in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106365
Medium · 6.5
CWE-862 Oct 6, 2026
Missing authorization in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote...
Missing authorization in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106364
Medium · 5.3
CWE-863 Oct 6, 2026
Incorrect authorization in Omnibox in Google Chrome prior to 155.0.8059.39 allowed a remote...
Incorrect authorization in Omnibox in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106363
High · 8.3
CWE-862 Oct 6, 2026
Missing authorization in FullScreen in Google Chrome prior to 155.0.8059.39 allowed a remote...
Missing authorization in FullScreen in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106362
Medium · 6.5
CWE-862 Oct 6, 2026
Missing authorization in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote...
Missing authorization in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low)
CVE-2026-106361
Medium · 6.5
CWE-684 Oct 6, 2026
Incorrect provision of specified functionality in Mobile in Google Chrome on on iOS…
Incorrect provision of specified functionality in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: Medium)
CVE-2026-106360
Medium · 4.3
CWE-200 Oct 6, 2026
Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to...
Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106359
Medium · 4.3
CWE-441 Oct 6, 2026
Confused deputy in DeviceBoundSessionCredentials in Google Chrome prior to 155.0.8059.39 allowed...
Confused deputy in DeviceBoundSessionCredentials in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-106358
Critical · 9.6
CWE-416 Oct 6, 2026
Use after free in Navigation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to...
Use after free in Navigation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-106357
High · 8.8
CWE-416 Oct 6, 2026
Use after free in WebRTC in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to...
Use after free in WebRTC in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106356
Medium · 5.4
CWE-1021 Oct 6, 2026
Clickjacking in EVP in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging...
Clickjacking in EVP in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106355
Medium · 5.3
CWE-862 Oct 6, 2026
Missing authorization in Media in Google Chrome on on Windows prior to 155.0.8059.39 allowed a...
Missing authorization in Media in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-106354
Medium · 4.3
CWE-668 Oct 6, 2026
Improper resource exposure in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote...
Improper resource exposure in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106353
Medium · 6.5
CWE-20 Oct 6, 2026
Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a...
Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a co-installed app. (Chromium security severity: Low)
CVE-2026-106352
High · 8.8
CWE-863 Oct 6, 2026
Incorrect authorization in WebProtect in Google Chrome prior to 155.0.8059.39 allowed a remote...
Incorrect authorization in WebProtect in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106351
Medium · 5.3
CWE-203 Oct 6, 2026
Observable discrepancy in Safebrowsing in Google Chrome on on iOS prior to 155.0.8059.39 allowed...
Observable discrepancy in Safebrowsing in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106350
High · 8.8
CWE-863 Oct 6, 2026
Incorrect authorization in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote...
Incorrect authorization in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)