Google vulnerabilities
Published CVEs affecting Google products: 4077 record(s), with severity, exploitation and fixes.
Chrome 3398Android 627Mcp Toolbox For Databases 14MCP Toolbox for Databases (googleapis/mcp-toolbox) 6Mcp-toolbox 5Go-attestation 2Libjxl 2Keras 2gVisor 2OSV-SCALIBR 2Chrome-devtools-mcp 2Android Xr 2V8 1Guava 1Google Devices 1Nest 1Tink Java 1A2ui/web Core 1Common Expression Language 1Tink-Android 1Google-ADK 1Libvpx 1Turbinia 1Langfun 1Android Wear 1Cel-go 1Site Kit by Google 1Protobuf-javascript (aka Google-protobuf Npm Package) 1Mcp-toolbox-sdk-python 1Fuse-archive 1Nest Wifi Pro Firmware 1Clasp 1Sentencepiece 1Protobuf 1Cloud Build 1Gemini-cli 1Run-gemini-cli 1Matter 1Web Designer 1Gerrit 1
CVE-2026-106379
Medium · 4.3
CWE-908 Oct 6, 2026
Use of Uninitialized Resource in Google Chrome
Uninitialized resource in Skia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106385
Medium · 5.3
CWE-362 Oct 6, 2026
Race Condition in Google Chrome
Race condition in Chromoting in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)
CVE-2026-106381
Medium · 6.5
CWE-863 Oct 6, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in Passwords in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106378
High · 8.3
CWE-250 Oct 6, 2026
Execution with Unnecessary Privileges in Google Chrome
Privilege elevation in Sandbox in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106377
High · 8.3
CWE-362 Oct 6, 2026
Race Condition in Google Chrome
Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106376
Medium · 4.7
CWE-908 Oct 6, 2026
Use of Uninitialized Resource in Google Chrome
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106375
Critical · 9.6
CWE-459 Oct 6, 2026
Incomplete cleanup in Dawn in Google Chrome prior to 155.0.8059.39 allowed a remote…
Incomplete cleanup in Dawn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106374
High · 8.8
CWE-843 Oct 6, 2026
Type Confusion in Google Chrome
Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-106373
High · 8.8
CWE-416 Oct 6, 2026
Use After Free in Google Chrome
Use after free in Fonts in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106372
Critical · 9.6
CWE-863 Oct 6, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106371
High · 8.8
CWE-863 Oct 6, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in Transactions Platform in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-106370
Medium · 4.7
CWE-908 Oct 6, 2026
Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a...
Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106369
Medium · 4.2
CWE-862 Oct 6, 2026
Missing authorization in Translate in Google Chrome prior to 155.0.8059.39 allowed a remote...
Missing authorization in Translate in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106368
Medium · 5.4
CWE-451 Oct 6, 2026
UI misrepresentation in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote...
UI misrepresentation in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-106367
High · 8.4
CWE-862 Oct 6, 2026
Missing authorization in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a...
Missing authorization in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a co-installed app. (Chromium security severity: Medium)
CVE-2026-106366
Medium · 5.4
CWE-459 Oct 6, 2026
Incomplete cleanup in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a...
Incomplete cleanup in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106365
Medium · 6.5
CWE-862 Oct 6, 2026
Missing authorization in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote...
Missing authorization in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106364
Medium · 5.3
CWE-863 Oct 6, 2026
Incorrect authorization in Omnibox in Google Chrome prior to 155.0.8059.39 allowed a remote...
Incorrect authorization in Omnibox in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106363
High · 8.3
CWE-862 Oct 6, 2026
Missing authorization in FullScreen in Google Chrome prior to 155.0.8059.39 allowed a remote...
Missing authorization in FullScreen in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106362
Medium · 6.5
CWE-862 Oct 6, 2026
Missing authorization in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote...
Missing authorization in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low)
CVE-2026-106361
Medium · 6.5
CWE-684 Oct 6, 2026
Incorrect provision of specified functionality in Mobile in Google Chrome on on iOS…
Incorrect provision of specified functionality in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: Medium)
CVE-2026-106360
Medium · 4.3
CWE-200 Oct 6, 2026
Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to...
Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106359
Medium · 4.3
CWE-441 Oct 6, 2026
Confused deputy in DeviceBoundSessionCredentials in Google Chrome prior to 155.0.8059.39 allowed...
Confused deputy in DeviceBoundSessionCredentials in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-106358
Critical · 9.6
CWE-416 Oct 6, 2026
Use after free in Navigation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to...
Use after free in Navigation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-106357
High · 8.8
CWE-416 Oct 6, 2026
Use after free in WebRTC in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to...
Use after free in WebRTC in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)