Google vulnerabilities
Published CVEs affecting Google products: 4077 record(s), with severity, exploitation and fixes.
Chrome 3398Android 627Mcp Toolbox For Databases 14MCP Toolbox for Databases (googleapis/mcp-toolbox) 6Mcp-toolbox 5Go-attestation 2Libjxl 2Keras 2gVisor 2OSV-SCALIBR 2Chrome-devtools-mcp 2Android Xr 2V8 1Guava 1Google Devices 1Nest 1Tink Java 1A2ui/web Core 1Common Expression Language 1Tink-Android 1Google-ADK 1Libvpx 1Turbinia 1Langfun 1Android Wear 1Cel-go 1Site Kit by Google 1Protobuf-javascript (aka Google-protobuf Npm Package) 1Mcp-toolbox-sdk-python 1Fuse-archive 1Nest Wifi Pro Firmware 1Clasp 1Sentencepiece 1Protobuf 1Cloud Build 1Gemini-cli 1Run-gemini-cli 1Matter 1Web Designer 1Gerrit 1
CVE-2026-106330
Medium · 4.3
CWE-200 Oct 6, 2026
Exposure of Sensitive Information in Google Chrome
Information leak in Paint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106329
Critical · 9.6
CWE-863 Oct 6, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106328
Medium · 5.9
CWE-863 Oct 6, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in PDF in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Medium)
CVE-2026-106327
Medium · 6.1
CWE-863 Oct 6, 2026
Incorrect authorization in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker...
Incorrect authorization in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106331
Medium · 6.5
CWE-20 Oct 6, 2026
Improper Input Validation in Google Chrome
Improper input validation in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy into a privileged page via a crafted Chrome extension. (Chromium security severity: Low)
CVE-2026-106326
Medium · 4.4
CWE-441 Oct 6, 2026
Confused deputy in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a…
Confused deputy in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to bypass system access restrictions into a privileged page via a co-installed app. (Chromium security severity: Medium)
CVE-2026-106325
Medium · 4.3
CWE-706 Oct 6, 2026
Use of Incorrectly-Resolved Name or Reference in Google Chrome
Incorrect reference resolution in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-106324
Medium · 6.1
CWE-863 Oct 6, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in WebAppInstalls in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106323
Critical · 9.6
CWE-862 Oct 6, 2026
Missing Authorization in Google Chrome
Missing authorization in Chrome for iOS in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106322
Medium · 6.1
CWE-601 Oct 6, 2026
Open Redirect in Google Chrome
Open redirect in AppManifest in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106321
Medium · 4.3
CWE-200 Oct 6, 2026
Exposure of Sensitive Information in Google Chrome
Information leak in Editing in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106320
Medium · 4.2
CWE-672 Oct 6, 2026
Use of released resource in UI in Google Chrome prior to 155.0.8059.39 allowed a remote…
Use of released resource in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-106318
High · 8.8
CWE-416 Oct 6, 2026
Use After Free in Google Chrome
Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106317
Medium · 5.4
CWE-451 Oct 6, 2026
UI misrepresentation in FullScreen in Google Chrome on on Android prior to 155.0.8059.39…
UI misrepresentation in FullScreen in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-106316
Medium · 5.4
CWE-451 Oct 6, 2026
UI misrepresentation in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39…
UI misrepresentation in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. (Chromium security severity: Low)
CVE-2026-106315
High · 8.8
CWE-416 Oct 6, 2026
Use After Free in Google Chrome
Use after free in Modularization in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106314
High · 8.8
CWE-863 Oct 6, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in Bluetooth in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106313
Medium · 5.1
CWE-863 Oct 6, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in Browser in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Medium)
CVE-2026-106312
Medium · 6.5
CWE-862 Oct 6, 2026
Missing Authorization in Google Chrome
Missing authorization in SignIn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Low)
CVE-2026-106311
Medium · 5.4
CWE-1021 Oct 6, 2026
Clickjacking in Google Chrome
Clickjacking in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106310
Medium · 6.5
CWE-672 Oct 6, 2026
Use of released resource in FontAccess in Google Chrome prior to 155.0.8059.39 allowed a…
Use of released resource in FontAccess in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-106309
High · 8.8
CWE-863 Oct 6, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in Selection in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-106308
High · 8.8
CWE-706 Oct 6, 2026
Use of Incorrectly-Resolved Name or Reference in Google Chrome
Incorrect reference resolution in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)
CVE-2026-106307
Medium · 6.5
CWE-863 Oct 6, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-106306
Medium · 5.4
CWE-863 Oct 6, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in DevTools in Google Chrome prior to 155.0.8059.39 allowed a local attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)