CVE Intelligence

Google vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Google products: 4077 record(s), with severity, exploitation and fixes.

Exploited only (KEV) →

CVE-2026-106379 Medium · 4.3 CWE-908 Oct 6, 2026
Use of Uninitialized Resource in Google Chrome
Uninitialized resource in Skia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106385 Medium · 5.3 CWE-362 Oct 6, 2026
Race Condition in Google Chrome
Race condition in Chromoting in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)
CVE-2026-106381 Medium · 6.5 CWE-863 Oct 6, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in Passwords in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106378 High · 8.3 CWE-250 Oct 6, 2026
Execution with Unnecessary Privileges in Google Chrome
Privilege elevation in Sandbox in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106377 High · 8.3 CWE-362 Oct 6, 2026
Race Condition in Google Chrome
Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106376 Medium · 4.7 CWE-908 Oct 6, 2026
Use of Uninitialized Resource in Google Chrome
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106375 Critical · 9.6 CWE-459 Oct 6, 2026
Incomplete cleanup in Dawn in Google Chrome prior to 155.0.8059.39 allowed a remote…
Incomplete cleanup in Dawn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106374 High · 8.8 CWE-843 Oct 6, 2026
Type Confusion in Google Chrome
Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-106373 High · 8.8 CWE-416 Oct 6, 2026
Use After Free in Google Chrome
Use after free in Fonts in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106372 Critical · 9.6 CWE-863 Oct 6, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106371 High · 8.8 CWE-863 Oct 6, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in Transactions Platform in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-106370 Medium · 4.7 CWE-908 Oct 6, 2026
Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a...
Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106369 Medium · 4.2 CWE-862 Oct 6, 2026
Missing authorization in Translate in Google Chrome prior to 155.0.8059.39 allowed a remote...
Missing authorization in Translate in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106368 Medium · 5.4 CWE-451 Oct 6, 2026
UI misrepresentation in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote...
UI misrepresentation in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-106367 High · 8.4 CWE-862 Oct 6, 2026
Missing authorization in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a...
Missing authorization in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a co-installed app. (Chromium security severity: Medium)
CVE-2026-106366 Medium · 5.4 CWE-459 Oct 6, 2026
Incomplete cleanup in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a...
Incomplete cleanup in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106365 Medium · 6.5 CWE-862 Oct 6, 2026
Missing authorization in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote...
Missing authorization in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106364 Medium · 5.3 CWE-863 Oct 6, 2026
Incorrect authorization in Omnibox in Google Chrome prior to 155.0.8059.39 allowed a remote...
Incorrect authorization in Omnibox in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106363 High · 8.3 CWE-862 Oct 6, 2026
Missing authorization in FullScreen in Google Chrome prior to 155.0.8059.39 allowed a remote...
Missing authorization in FullScreen in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106362 Medium · 6.5 CWE-862 Oct 6, 2026
Missing authorization in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote...
Missing authorization in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low)
CVE-2026-106361 Medium · 6.5 CWE-684 Oct 6, 2026
Incorrect provision of specified functionality in Mobile in Google Chrome on on iOS…
Incorrect provision of specified functionality in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: Medium)
CVE-2026-106360 Medium · 4.3 CWE-200 Oct 6, 2026
Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to...
Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106359 Medium · 4.3 CWE-441 Oct 6, 2026
Confused deputy in DeviceBoundSessionCredentials in Google Chrome prior to 155.0.8059.39 allowed...
Confused deputy in DeviceBoundSessionCredentials in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-106358 Critical · 9.6 CWE-416 Oct 6, 2026
Use after free in Navigation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to...
Use after free in Navigation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-106357 High · 8.8 CWE-416 Oct 6, 2026
Use after free in WebRTC in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to...
Use after free in WebRTC in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)