Google vulnerabilities

CVE-2026-95281 Critical · 9.6 CWE-122 Sep 29, 2026

Heap-based Buffer Overflow in Google Chrome

Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-95280 High · 7.5 CWE-362 Sep 29, 2026

Race Condition in Google Chrome

Race condition in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-95279 Medium · 5.4 CWE-451 Sep 29, 2026

UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.8037.57…

UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-95278 High · 8.4 CWE-862 Sep 29, 2026

Missing Authorization in Google Chrome

Missing authorization in WakeLock in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-95277 Critical · 9.6 CWE-416 Sep 29, 2026

Use After Free in Google Chrome

Use after free in Views in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-95276 High · 8.3 CWE-20 Sep 29, 2026

Improper Input Validation in Google Chrome

Improper input validation in Themes in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code inside the sandbox via crafted network traffic. (Chromium security severity: Medium)

CVE-2026-95275 Medium · 6.5 CWE-706 Sep 29, 2026

Use of Incorrectly-Resolved Name or Reference in Google Chrome

Incorrect reference resolution in MediaStream in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-95274 High · 8.3 CWE-116 Sep 29, 2026

Improper Encoding or Escaping of Output in Google Chrome

Improper output encoding in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-102242 High · 8.6 CWE-22 Sep 29, 2026

Path Traversal via Symlink Following in allowedLocalRoots in MCP Toolbox for Databases

Improper link resolution (CWE-59 / CWE-22) in the allowedLocalRoots path validation in Google MCP Toolbox for Databases versions 1.2.0 through 1.9.0 allows a remote authenticated attacker with tool execution permissions to bypass directory boundary restrictions via symbolic links. Because path validation checks directories lexically without resolving symbolic links first, an attacker can access or overwrite arbitrary local files located outside the permitted root directories.

CVE-2026-13018 Medium · 4.3 CWE-20 Sep 28, 2026

Improper Input Validation in Google Chrome

Insufficient validation of untrusted input in Codecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially perform out of bounds memory access via a crafted video file. (Chromium security severity: Low)

CVE-2026-87723 Medium · 5.4 CWE-426 Sep 28, 2026

Untrusted Search Path (PATH Hijacking) in fuse-archive

In Google fuse-archive versions prior to 1.24, an attacker who can prepend a directory to PATH or write a malicious binary to an attacker-controlled or writable directory appearing in PATH can hijack the execution pathway. This allows the attacker to execute arbitrary local code under the security context of the user running the fuse-archive process. The issue was partially mitigated in version 1.22 and fully resolved in 1.24 via refined selective PATH filtering.

CVE-2026-96812 High · 8.8 CWE-269 Sep 25, 2026

Host Root Sandbox Escape in gVisor via Character Device Passthrough and CUSE

Improper Exposure of Resource to Wrong Sphere in the host file helper (gofer) in Google gVisor prior to commit 573a9e73cf844f on Linux platforms with CUSE enabled allows a local attacker with container image deployment privileges to achieve root code execution on the host system. By including a /dev/cuse character device node in a container image, opening the device passes through to the host, allowing the sandboxed attacker to register a host device and exploit CUSE unrestricted ioctl handling to overwrite root udev helper memory.

CVE-2026-19202 Critical · 9.1 CWE-524 Sep 22, 2026

Token Cache Reuse in mcp-toolbox-sdk-python

A caching flaw in the toolbox-core package of the mcp-toolbox-sdk-python SDK causes the same Google ID token to be cached and reused across different audiences. If an application uses the SDK to authenticate to two or more different audiences within the same process, the module-level token cache fails to key its cached tokens by the requested audience. Consequently, a valid, unexpired token minted for a sensitive service (Service A) can be retrieved from the cache and sent to a secondary service (Service B). An attacker who operates, compromises, or monitors traffic to Service B can capture this token and replay it to impersonate the victim application against Service A.

CVE-2026-93387 Medium · 4.3 CWE-754 Sep 17, 2026

Improper Check for Unusual or Exceptional Conditions in Google Chrome

Improper state validation in Skia in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

CVE-2026-93386 Medium · 5.4 CWE-451 Sep 17, 2026

UI misrepresentation in WebAppInstalls in Google Chrome prior to 153.0.8010.52 allowed a…

UI misrepresentation in WebAppInstalls in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-93385 Medium · 6.5 CWE-200 Sep 17, 2026

Exposure of Sensitive Information in Google Chrome

Information leak in Paint in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-93384 Low · 3.7 CWE-918 Sep 17, 2026

Server-Side Request Forgery (SSRF) in Google Chrome

Server-side request forgery in Omnibox in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium)

CVE-2026-93383 Medium · 4.3 CWE-200 Sep 17, 2026

Exposure of Sensitive Information in Google Chrome

Information leak in Permissions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-93382 High · 8.8 CWE-416 Sep 17, 2026

Use After Free in Google Chrome

Use after free in PDFium in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-93381 High · 8.8 CWE-122 Sep 17, 2026

Heap-based Buffer Overflow in Google Chrome

Buffer overflow in PDFium in Google Chrome on on Windows prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)

CVE-2026-93380 Low · 3.1 CWE-367 Sep 17, 2026

TOCTOU Race Condition in Google Chrome

Race condition in FileSystem in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-93379 Medium · 4.3 CWE-863 Sep 17, 2026

Incorrect Authorization in Google Chrome

Incorrect authorization in ORB in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-93378 Low · 3.1 CWE-862 Sep 17, 2026

Missing Authorization in Google Chrome

Missing authorization in Storage in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. (Chromium security severity: Medium)

CVE-2026-93377 High · 8.8 CWE-843 Sep 17, 2026

Type Confusion in Google Chrome

Type confusion in V8 in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-93376 Medium · 6.3 CWE-125 Sep 17, 2026

Out-of-bounds Read in Google Chrome

Out of bounds read in DataTransfer in Google Chrome prior to 153.0.8010.52 allowed a local attacker leveraging social engineering to read memory outside the sandbox via a local program. (Chromium security severity: Medium)