CVE-2026-106328

chromium-browser: Incorrect authorization in PDF

Incorrect authorization in PDF in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Medium)

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Android Chrome

CVE-2026-106423

chromium-browser: Use after free in Media

Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-106337

chromium-browser: UI misrepresentation in UI

UI misrepresentation in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Android Chrome

CVE-2026-106426

chromium-browser: Race condition in Fonts

Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-106338

chromium-browser: UI misrepresentation in PictureInPicture

UI misrepresentation in PictureInPicture in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Android Chrome

CVE-2026-106321

chromium-browser: Information leak in Editing

Information leak in Editing in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-106320

chromium-browser: Use of released resource in UI

Use of released resource in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-106329

chromium-browser: Incorrect authorization in FileSystem

Incorrect authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-106325

chromium-browser: Incorrect reference resolution in Core

Incorrect reference resolution in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-106254

chromium-browser: Information leak in Mobile

Information leak in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via a co-installed app. (Chromium security severity: Medium)

CVSS 3.1 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Android Chrome

CVE-2026-106415

chromium-browser: Information leak in Enterprise

Information leak in Enterprise in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-106416

chromium-browser: Code injection in Extensions

Code injection in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Medium)

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-49933

Control-Flow Hijack via Uninitialized Pointer in Android Bluetooth Daemon

In handle_le_monitor_device_event of msft.cc, there is a possible control-flow hijack in the privileged bluetooth process due to an uninitialized pointer dereference. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Android

CVE-2026-106414

chromium-browser: Improper input validation in Mobile

Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Apple Google

Products

Iphone Os Chrome

CVE-2026-106413

chromium-browser: Race condition in Browser

Race condition in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-106255

chromium-browser: Race condition in V8

Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-106256

chromium-browser: Information leak in Passwords

Information leak in Passwords in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Android Chrome

CVE-2026-106253

chromium-browser: Incorrect authorization in Extensions

Incorrect authorization in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-106252

chromium-browser: Incorrect comparison in Fonts

Incorrect comparison in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-106251

chromium-browser: UI misrepresentation in Chromoting

UI misrepresentation in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. (Chromium security severity: Low)

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Google

Products

Macos Chrome