Google vulnerabilities

CVE-2026-106280 Medium · 6.5 CWE-863 Oct 6, 2026

Incorrect Authorization in Google Chrome

Incorrect authorization in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-106279 High · 7.4 CWE-706 Oct 6, 2026

Use of Incorrectly-Resolved Name or Reference in Google Chrome

Incorrect reference resolution in Passwords in Google Chrome on on iOS prior to 155.0.8059.39 allowed a local attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Medium)

CVE-2026-106278 High · 8.8 CWE-416 Oct 6, 2026

Use After Free in Google Chrome

Use after free in Select in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-106277 Medium · 4.3 CWE-200 Oct 6, 2026

Exposure of Sensitive Information in Google Chrome

Information leak in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-106276 Medium · 5.4 CWE-451 Oct 6, 2026

UI misrepresentation in Payments in Google Chrome prior to 155.0.8059.39 allowed a…

UI misrepresentation in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-106275 Medium · 4.7 CWE-908 Oct 6, 2026

Use of Uninitialized Resource in Google Chrome

Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-106274 High · 8.8 CWE-706 Oct 6, 2026

Use of Incorrectly-Resolved Name or Reference in Google Chrome

Incorrect reference resolution in Browser in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-106273 Medium · 4.7 CWE-908 Oct 6, 2026

Use of Uninitialized Resource in Google Chrome

Uninitialized resource in Video in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-106272 Medium · 5.4 CWE-451 Oct 6, 2026

UI misrepresentation in Chromoting in Google Chrome on on Windows prior to 155.0.8059.39…

UI misrepresentation in Chromoting in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially spoof UI elements via crafted network traffic. (Chromium security severity: Low)

CVE-2026-106271 High · 8.1 CWE-862 Oct 6, 2026

Missing Authorization in Google Chrome

Missing authorization in Workers in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. (Chromium security severity: Medium)

CVE-2026-106270 Medium · 5.4 CWE-863 Oct 6, 2026

Incorrect Authorization in Google Chrome

Incorrect authorization in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-106269 High · 8.8 CWE-416 Oct 6, 2026

Use After Free in Google Chrome

Use after free in CSS in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-106268 High · 8.8 CWE-416 Oct 6, 2026

Use After Free in Google Chrome

Use after free in WebRTC in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-106267 Medium · 6.5 CWE-862 Oct 6, 2026

Missing Authorization in Google Chrome

Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-106266 Medium · 6.5 CWE-441 Oct 6, 2026

Confused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a…

Confused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-106265 Medium · 5.4 CWE-451 Oct 6, 2026

UI misrepresentation in File in Google Chrome prior to 155.0.8059.39 allowed a remote…

UI misrepresentation in File in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-106264 Medium · 5.4 CWE-862 Oct 6, 2026

Missing Authorization in Google Chrome

Missing authorization in Web Authentication (Passkeys & Security Keys) in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-106263 Medium · 6.5 CWE-20 Oct 6, 2026

Improper Input Validation in Google Chrome

Improper input validation in SignIn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)

CVE-2026-106262 Medium · 4.2 CWE-459 Oct 6, 2026

Incomplete cleanup in GetUserMedia in Google Chrome prior to 155.0.8059.39 allowed a…

Incomplete cleanup in GetUserMedia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-106261 Medium · 6.5 CWE-908 Oct 6, 2026

Use of Uninitialized Resource in Google Chrome

Uninitialized resource in Video in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-106260 Medium · 4.3 CWE-863 Oct 6, 2026

Incorrect Authorization in Google Chrome

Incorrect authorization in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-106259 Medium · 5.4 CWE-863 Oct 6, 2026

Incorrect Authorization in Google Chrome

Incorrect authorization in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-106258 Medium · 4.7 CWE-908 Oct 6, 2026

Use of Uninitialized Resource in Google Chrome

Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-106257 High · 8.8 CWE-416 Oct 6, 2026

Use After Free in Google Chrome

Use after free in HTML in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-106256 High · 8.8 CWE-200 Oct 6, 2026

Exposure of Sensitive Information in Google Chrome

Information leak in Passwords in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)