Vulnerabilidades de Google
CVEs publicadas que afetam produtos de Google: 4077 registro(s), com severidade, exploração e correções.
Chrome 3398Android 627Mcp Toolbox For Databases 14MCP Toolbox for Databases (googleapis/mcp-toolbox) 6Mcp-toolbox 5Go-attestation 2Libjxl 2Keras 2gVisor 2OSV-SCALIBR 2Chrome-devtools-mcp 2Android Xr 2V8 1Guava 1Google Devices 1Nest 1Tink Java 1A2ui/web Core 1Common Expression Language 1Tink-Android 1Google-ADK 1Libvpx 1Turbinia 1Langfun 1Android Wear 1Cel-go 1Site Kit by Google 1Protobuf-javascript (aka Google-protobuf Npm Package) 1Mcp-toolbox-sdk-python 1Fuse-archive 1Nest Wifi Pro Firmware 1Clasp 1Sentencepiece 1Protobuf 1Cloud Build 1Gemini-cli 1Run-gemini-cli 1Matter 1Web Designer 1Gerrit 1
CVE-2026-95279
Média · 5.4
CWE-451 29/09/2026
UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.8037.57…
UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95278
Alta · 8.4
CWE-862 29/09/2026
Missing Authorization em Google Chrome
Missing authorization in WakeLock in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95277
Crítica · 9.6
CWE-416 29/09/2026
Use After Free em Google Chrome
Use after free in Views in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-95276
Alta · 8.3
CWE-20 29/09/2026
Improper Input Validation em Google Chrome
Improper input validation in Themes in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code inside the sandbox via crafted network traffic. (Chromium security severity: Medium)
CVE-2026-95275
Média · 6.5
CWE-706 29/09/2026
Use of Incorrectly-Resolved Name or Reference em Google Chrome
Incorrect reference resolution in MediaStream in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95274
Alta · 8.3
CWE-116 29/09/2026
Improper Encoding or Escaping of Output em Google Chrome
Improper output encoding in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-102242
Alta · 8.6
CWE-22 29/09/2026
Path Traversal via Symlink Following in allowedLocalRoots in MCP Toolbox for Databases
Improper link resolution (CWE-59 / CWE-22) in the allowedLocalRoots path validation in Google MCP Toolbox for Databases versions 1.2.0 through 1.9.0 allows a remote authenticated attacker with tool execution permissions to bypass directory boundary restrictions via symbolic links. Because path validation checks directories lexically without resolving symbolic links first, an attacker can access or overwrite arbitrary local files located outside the permitted root directories.
CVE-2026-13018
Média · 4.3
CWE-20 28/09/2026
Improper Input Validation em Google Chrome
Insufficient validation of untrusted input in Codecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially perform out of bounds memory access via a crafted video file. (Chromium security severity: Low)
CVE-2026-87723
Média · 5.4
CWE-426 28/09/2026
Untrusted Search Path (PATH Hijacking) in fuse-archive
In Google fuse-archive versions prior to 1.24, an attacker who can prepend a directory to PATH or write a malicious binary to an attacker-controlled or writable directory appearing in PATH can hijack the execution pathway. This allows the attacker to execute arbitrary local code under the security context of the user running the fuse-archive process. The issue was partially mitigated in version 1.22 and fully resolved in 1.24 via refined selective PATH filtering.
CVE-2026-96812
Alta · 8.8
CWE-269 25/09/2026
Host Root Sandbox Escape in gVisor via Character Device Passthrough and CUSE
Improper Exposure of Resource to Wrong Sphere in the host file helper (gofer) in Google gVisor prior to commit 573a9e73cf844f on Linux platforms with CUSE enabled allows a local attacker with container image deployment privileges to achieve root code execution on the host system. By including a /dev/cuse character device node in a container image, opening the device passes through to the host, allowing the sandboxed attacker to register a host device and exploit CUSE unrestricted ioctl handling to overwrite root udev helper memory.
CVE-2026-19202
Crítica · 9.1
CWE-524 22/09/2026
Token Cache Reuse in mcp-toolbox-sdk-python
A caching flaw in the toolbox-core package of the mcp-toolbox-sdk-python SDK causes the same Google ID token to be cached and reused across different audiences. If an application uses the SDK to authenticate to two or more different audiences within the same process, the module-level token cache fails to key its cached tokens by the requested audience. Consequently, a valid, unexpired token minted for a sensitive service (Service A) can be retrieved from the cache and sent to a secondary service (Service B). An attacker who operates, compromises, or monitors traffic to Service B can capture this token and replay it to impersonate the victim application against Service A.
CVE-2026-93387
Média · 4.3
CWE-754 17/09/2026
Improper Check for Unusual or Exceptional Conditions em Google Chrome
Improper state validation in Skia in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
CVE-2026-93386
Média · 5.4
CWE-451 17/09/2026
UI misrepresentation in WebAppInstalls in Google Chrome prior to 153.0.8010.52 allowed a…
UI misrepresentation in WebAppInstalls in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-93385
Média · 6.5
CWE-200 17/09/2026
Exposure of Sensitive Information em Google Chrome
Information leak in Paint in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-93384
Baixa · 3.7
CWE-918 17/09/2026
Server-Side Request Forgery (SSRF) em Google Chrome
Server-side request forgery in Omnibox in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium)
CVE-2026-93383
Média · 4.3
CWE-200 17/09/2026
Exposure of Sensitive Information em Google Chrome
Information leak in Permissions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-93382
Alta · 8.8
CWE-416 17/09/2026
Use After Free em Google Chrome
Use after free in PDFium in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-93381
Alta · 8.8
CWE-122 17/09/2026
Heap-based Buffer Overflow em Google Chrome
Buffer overflow in PDFium in Google Chrome on on Windows prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)
CVE-2026-93380
Baixa · 3.1
CWE-367 17/09/2026
TOCTOU Race Condition em Google Chrome
Race condition in FileSystem in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-93379
Média · 4.3
CWE-863 17/09/2026
Incorrect Authorization em Google Chrome
Incorrect authorization in ORB in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-93378
Baixa · 3.1
CWE-862 17/09/2026
Missing Authorization em Google Chrome
Missing authorization in Storage in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. (Chromium security severity: Medium)
CVE-2026-93377
Alta · 8.8
CWE-843 17/09/2026
Type Confusion em Google Chrome
Type confusion in V8 in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-93376
Média · 6.3
CWE-125 17/09/2026
Out-of-bounds Read em Google Chrome
Out of bounds read in DataTransfer in Google Chrome prior to 153.0.8010.52 allowed a local attacker leveraging social engineering to read memory outside the sandbox via a local program. (Chromium security severity: Medium)
CVE-2026-93375
Alta · 8.1
CWE-706 17/09/2026
Use of Incorrectly-Resolved Name or Reference em Google Chrome
Incorrect reference resolution in Tracing in Google Chrome on on Windows prior to 153.0.8010.52 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)
CVE-2026-93374
Crítica · 9.6
CWE-416 17/09/2026
Use After Free em Google Chrome
Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)