Search
Find a vulnerability
Search criteria
15295 vulnerabilities found for Chrome by Google
CERTFR-2026-AVI-1268
Vulnerability from certfr_avis - Published: 2026-10-07 - Updated: 2026-10-07
De multiples vulnérabilités ont été découvertes dans Google Chrome. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Chrome versions ant\u00e9rieures \u00e0 155.0.8059.39 pour Windows et Linux",
"product": {
"name": "Chrome",
"vendor": {
"name": "Google",
"scada": false
}
}
},
{
"description": "Chrome versions ant\u00e9rieures \u00e0 155.0.8059.40 pour WindMacows",
"product": {
"name": "Chrome",
"vendor": {
"name": "Google",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-106298",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106298"
},
{
"name": "CVE-2026-106348",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106348"
},
{
"name": "CVE-2026-106208",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106208"
},
{
"name": "CVE-2026-106232",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106232"
},
{
"name": "CVE-2026-106281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106281"
},
{
"name": "CVE-2026-106384",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106384"
},
{
"name": "CVE-2026-106375",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106375"
},
{
"name": "CVE-2026-106191",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106191"
},
{
"name": "CVE-2026-106407",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106407"
},
{
"name": "CVE-2026-106268",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106268"
},
{
"name": "CVE-2026-106376",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106376"
},
{
"name": "CVE-2026-106221",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106221"
},
{
"name": "CVE-2026-106391",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106391"
},
{
"name": "CVE-2026-106251",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106251"
},
{
"name": "CVE-2026-106380",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106380"
},
{
"name": "CVE-2026-106189",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106189"
},
{
"name": "CVE-2026-106303",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106303"
},
{
"name": "CVE-2026-106241",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106241"
},
{
"name": "CVE-2026-106297",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106297"
},
{
"name": "CVE-2026-106413",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106413"
},
{
"name": "CVE-2026-106238",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106238"
},
{
"name": "CVE-2026-106273",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106273"
},
{
"name": "CVE-2026-106209",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106209"
},
{
"name": "CVE-2026-106276",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106276"
},
{
"name": "CVE-2026-106326",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106326"
},
{
"name": "CVE-2026-106363",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106363"
},
{
"name": "CVE-2026-106341",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106341"
},
{
"name": "CVE-2026-106418",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106418"
},
{
"name": "CVE-2026-106374",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106374"
},
{
"name": "CVE-2026-106320",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106320"
},
{
"name": "CVE-2026-106344",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106344"
},
{
"name": "CVE-2026-102322",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-102322"
},
{
"name": "CVE-2026-106200",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106200"
},
{
"name": "CVE-2026-106257",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106257"
},
{
"name": "CVE-2026-106203",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106203"
},
{
"name": "CVE-2026-106190",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106190"
},
{
"name": "CVE-2026-106199",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106199"
},
{
"name": "CVE-2026-106196",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106196"
},
{
"name": "CVE-2026-106230",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106230"
},
{
"name": "CVE-2026-106300",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106300"
},
{
"name": "CVE-2026-106332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106332"
},
{
"name": "CVE-2026-106329",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106329"
},
{
"name": "CVE-2026-106425",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106425"
},
{
"name": "CVE-2026-106212",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106212"
},
{
"name": "CVE-2026-106216",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106216"
},
{
"name": "CVE-2026-106207",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106207"
},
{
"name": "CVE-2026-106271",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106271"
},
{
"name": "CVE-2026-106366",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106366"
},
{
"name": "CVE-2026-106390",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106390"
},
{
"name": "CVE-2026-106342",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106342"
},
{
"name": "CVE-2026-106197",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106197"
},
{
"name": "CVE-2026-106339",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106339"
},
{
"name": "CVE-2026-106333",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106333"
},
{
"name": "CVE-2026-106193",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106193"
},
{
"name": "CVE-2026-106237",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106237"
},
{
"name": "CVE-2026-106201",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106201"
},
{
"name": "CVE-2026-106223",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106223"
},
{
"name": "CVE-2026-106421",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106421"
},
{
"name": "CVE-2026-106360",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106360"
},
{
"name": "CVE-2026-106343",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106343"
},
{
"name": "CVE-2026-106233",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106233"
},
{
"name": "CVE-2026-106247",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106247"
},
{
"name": "CVE-2026-106351",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106351"
},
{
"name": "CVE-2026-106179",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106179"
},
{
"name": "CVE-2026-106306",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106306"
},
{
"name": "CVE-2026-106355",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106355"
},
{
"name": "CVE-2026-106398",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106398"
},
{
"name": "CVE-2026-106411",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106411"
},
{
"name": "CVE-2026-106382",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106382"
},
{
"name": "CVE-2026-106279",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106279"
},
{
"name": "CVE-2026-106242",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106242"
},
{
"name": "CVE-2026-106245",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106245"
},
{
"name": "CVE-2026-106315",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106315"
},
{
"name": "CVE-2026-106261",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106261"
},
{
"name": "CVE-2026-106312",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106312"
},
{
"name": "CVE-2026-106388",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106388"
},
{
"name": "CVE-2026-106356",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106356"
},
{
"name": "CVE-2026-106395",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106395"
},
{
"name": "CVE-2026-106301",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106301"
},
{
"name": "CVE-2026-106422",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106422"
},
{
"name": "CVE-2026-106389",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106389"
},
{
"name": "CVE-2026-106383",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106383"
},
{
"name": "CVE-2026-106372",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106372"
},
{
"name": "CVE-2026-106419",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106419"
},
{
"name": "CVE-2026-106234",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106234"
},
{
"name": "CVE-2026-106229",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106229"
},
{
"name": "CVE-2026-106396",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106396"
},
{
"name": "CVE-2026-106181",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106181"
},
{
"name": "CVE-2026-106292",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106292"
},
{
"name": "CVE-2026-106187",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106187"
},
{
"name": "CVE-2026-106321",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106321"
},
{
"name": "CVE-2026-106324",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106324"
},
{
"name": "CVE-2026-106236",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106236"
},
{
"name": "CVE-2026-106290",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106290"
},
{
"name": "CVE-2026-106269",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106269"
},
{
"name": "CVE-2026-106317",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106317"
},
{
"name": "CVE-2026-106240",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106240"
},
{
"name": "CVE-2026-106282",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106282"
},
{
"name": "CVE-2026-106357",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106357"
},
{
"name": "CVE-2026-106278",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106278"
},
{
"name": "CVE-2026-106265",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106265"
},
{
"name": "CVE-2026-106347",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106347"
},
{
"name": "CVE-2026-106295",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106295"
},
{
"name": "CVE-2026-106345",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106345"
},
{
"name": "CVE-2026-106335",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106335"
},
{
"name": "CVE-2026-106371",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106371"
},
{
"name": "CVE-2026-106192",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106192"
},
{
"name": "CVE-2026-106381",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106381"
},
{
"name": "CVE-2026-106399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106399"
},
{
"name": "CVE-2026-106373",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106373"
},
{
"name": "CVE-2026-106414",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106414"
},
{
"name": "CVE-2026-106358",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106358"
},
{
"name": "CVE-2026-106334",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106334"
},
{
"name": "CVE-2026-106401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106401"
},
{
"name": "CVE-2026-106359",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106359"
},
{
"name": "CVE-2026-106214",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106214"
},
{
"name": "CVE-2026-106213",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106213"
},
{
"name": "CVE-2026-106267",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106267"
},
{
"name": "CVE-2026-106338",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106338"
},
{
"name": "CVE-2026-106305",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106305"
},
{
"name": "CVE-2026-106426",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106426"
},
{
"name": "CVE-2026-106400",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106400"
},
{
"name": "CVE-2026-106259",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106259"
},
{
"name": "CVE-2026-106254",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106254"
},
{
"name": "CVE-2026-106322",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106322"
},
{
"name": "CVE-2026-106367",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106367"
},
{
"name": "CVE-2026-106427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106427"
},
{
"name": "CVE-2026-106202",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106202"
},
{
"name": "CVE-2026-106316",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106316"
},
{
"name": "CVE-2026-106394",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106394"
},
{
"name": "CVE-2026-106304",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106304"
},
{
"name": "CVE-2026-106314",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106314"
},
{
"name": "CVE-2026-106385",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106385"
},
{
"name": "CVE-2026-106313",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106313"
},
{
"name": "CVE-2026-106253",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106253"
},
{
"name": "CVE-2026-106330",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106330"
},
{
"name": "CVE-2026-106239",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106239"
},
{
"name": "CVE-2026-106243",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106243"
},
{
"name": "CVE-2026-106369",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106369"
},
{
"name": "CVE-2026-106194",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106194"
},
{
"name": "CVE-2026-106264",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106264"
},
{
"name": "CVE-2026-106296",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106296"
},
{
"name": "CVE-2026-106231",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106231"
},
{
"name": "CVE-2026-106352",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106352"
},
{
"name": "CVE-2026-106310",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106310"
},
{
"name": "CVE-2026-106410",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106410"
},
{
"name": "CVE-2026-106392",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106392"
},
{
"name": "CVE-2026-106224",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106224"
},
{
"name": "CVE-2026-106248",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106248"
},
{
"name": "CVE-2026-106370",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106370"
},
{
"name": "CVE-2026-106308",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106308"
},
{
"name": "CVE-2026-106260",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106260"
},
{
"name": "CVE-2026-106294",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106294"
},
{
"name": "CVE-2026-106252",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106252"
},
{
"name": "CVE-2026-106349",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106349"
},
{
"name": "CVE-2026-106258",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106258"
},
{
"name": "CVE-2026-106353",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106353"
},
{
"name": "CVE-2026-106274",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106274"
},
{
"name": "CVE-2026-106327",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106327"
},
{
"name": "CVE-2026-106404",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106404"
},
{
"name": "CVE-2026-106424",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106424"
},
{
"name": "CVE-2026-106415",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106415"
},
{
"name": "CVE-2026-106215",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106215"
},
{
"name": "CVE-2026-106188",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106188"
},
{
"name": "CVE-2026-106198",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106198"
},
{
"name": "CVE-2026-106284",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106284"
},
{
"name": "CVE-2026-106270",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106270"
},
{
"name": "CVE-2026-106250",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106250"
},
{
"name": "CVE-2026-106235",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106235"
},
{
"name": "CVE-2026-106266",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106266"
},
{
"name": "CVE-2026-106226",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106226"
},
{
"name": "CVE-2026-106412",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106412"
},
{
"name": "CVE-2026-106365",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106365"
},
{
"name": "CVE-2026-106211",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106211"
},
{
"name": "CVE-2026-106291",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106291"
},
{
"name": "CVE-2026-106286",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106286"
},
{
"name": "CVE-2026-106409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106409"
},
{
"name": "CVE-2026-106285",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106285"
},
{
"name": "CVE-2026-106340",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106340"
},
{
"name": "CVE-2026-106423",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106423"
},
{
"name": "CVE-2026-106331",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106331"
},
{
"name": "CVE-2026-106206",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106206"
},
{
"name": "CVE-2026-106406",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106406"
},
{
"name": "CVE-2026-106387",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106387"
},
{
"name": "CVE-2026-106287",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106287"
},
{
"name": "CVE-2026-106362",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106362"
},
{
"name": "CVE-2026-106256",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106256"
},
{
"name": "CVE-2026-106210",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106210"
},
{
"name": "CVE-2026-106337",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106337"
},
{
"name": "CVE-2026-106222",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106222"
},
{
"name": "CVE-2026-106263",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106263"
},
{
"name": "CVE-2026-106293",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106293"
},
{
"name": "CVE-2026-106393",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106393"
},
{
"name": "CVE-2026-106379",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106379"
},
{
"name": "CVE-2026-106180",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106180"
},
{
"name": "CVE-2026-106205",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106205"
},
{
"name": "CVE-2026-106280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106280"
},
{
"name": "CVE-2026-106416",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106416"
},
{
"name": "CVE-2026-106255",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106255"
},
{
"name": "CVE-2026-106195",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106195"
},
{
"name": "CVE-2026-106275",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106275"
},
{
"name": "CVE-2026-106350",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106350"
},
{
"name": "CVE-2026-106386",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106386"
},
{
"name": "CVE-2026-106368",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106368"
},
{
"name": "CVE-2026-106377",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106377"
},
{
"name": "CVE-2026-106204",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106204"
},
{
"name": "CVE-2026-106311",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106311"
},
{
"name": "CVE-2026-106227",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106227"
},
{
"name": "CVE-2026-106289",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106289"
},
{
"name": "CVE-2026-106402",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106402"
},
{
"name": "CVE-2026-106228",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106228"
},
{
"name": "CVE-2026-106262",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106262"
},
{
"name": "CVE-2026-106318",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106318"
},
{
"name": "CVE-2026-106220",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106220"
},
{
"name": "CVE-2026-106328",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106328"
},
{
"name": "CVE-2026-106244",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106244"
},
{
"name": "CVE-2026-106405",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106405"
},
{
"name": "CVE-2026-106217",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106217"
},
{
"name": "CVE-2026-106323",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106323"
},
{
"name": "CVE-2026-106186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106186"
},
{
"name": "CVE-2026-106225",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106225"
},
{
"name": "CVE-2026-106361",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106361"
},
{
"name": "CVE-2026-106182",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106182"
},
{
"name": "CVE-2026-106183",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106183"
},
{
"name": "CVE-2026-106185",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106185"
},
{
"name": "CVE-2026-106408",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106408"
},
{
"name": "CVE-2026-106288",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106288"
},
{
"name": "CVE-2026-106184",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106184"
},
{
"name": "CVE-2026-106309",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106309"
},
{
"name": "CVE-2026-106283",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106283"
},
{
"name": "CVE-2026-106272",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106272"
},
{
"name": "CVE-2026-106397",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106397"
},
{
"name": "CVE-2026-106249",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106249"
},
{
"name": "CVE-2026-106346",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106346"
},
{
"name": "CVE-2026-106417",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106417"
},
{
"name": "CVE-2026-106307",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106307"
},
{
"name": "CVE-2026-106246",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106246"
},
{
"name": "CVE-2026-106364",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106364"
},
{
"name": "CVE-2026-106299",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106299"
},
{
"name": "CVE-2026-106336",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106336"
},
{
"name": "CVE-2026-106403",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106403"
},
{
"name": "CVE-2026-106302",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106302"
},
{
"name": "CVE-2026-106325",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106325"
},
{
"name": "CVE-2026-106277",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106277"
},
{
"name": "CVE-2026-106420",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106420"
},
{
"name": "CVE-2026-106378",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106378"
},
{
"name": "CVE-2026-106354",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106354"
}
],
"initial_release_date": "2026-10-07T00:00:00",
"last_revision_date": "2026-10-07T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1268",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-10-07T00:00:00.000000"
}
],
"risks": [
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Google Chrome. Elles permettent \u00e0 un attaquant de provoquer un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Google Chrome",
"vendor_advisories": [
{
"published_at": "2026-10-06",
"title": "Bulletin de s\u00e9curit\u00e9 Google Chrome",
"url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html"
}
]
}
CVE-2026-106427 (GCVE-0-2026-106427)
Vulnerability from nvd – Published: 2026-10-06 18:41 – Updated: 2026-10-07 20:34
VLAI
EPSS
VEX
Summary
Confused deputy in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Low)
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 20:24 UTC
CWE
- CWE-441 - Confused deputy
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-106427",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T20:24:19.466418Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T20:34:19.024Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "155.0.8059.39",
"status": "affected",
"version": "155.0.8059.39",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Confused deputy in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Low)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-441",
"description": "Confused deputy",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T18:41:35.793Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html"
},
{
"url": "https://issues.chromium.org/issues/513423334"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-106427",
"datePublished": "2026-10-06T18:41:35.793Z",
"dateReserved": "2026-10-06T16:39:06.425Z",
"dateUpdated": "2026-10-07T20:34:19.024Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106426 (GCVE-0-2026-106426)
Vulnerability from nvd – Published: 2026-10-06 18:41 – Updated: 2026-10-07 03:56
VLAI
EPSS
VEX
Summary
Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Severity
8.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 00:00 UTC
CWE
- CWE-362 - Race condition
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-106426",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T03:56:11.179Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "155.0.8059.39",
"status": "affected",
"version": "155.0.8059.39",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "Race condition",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T18:41:09.159Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html"
},
{
"url": "https://issues.chromium.org/issues/547065823"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-106426",
"datePublished": "2026-10-06T18:41:09.159Z",
"dateReserved": "2026-10-06T16:39:05.103Z",
"dateUpdated": "2026-10-07T03:56:11.179Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106425 (GCVE-0-2026-106425)
Vulnerability from nvd – Published: 2026-10-06 18:41 – Updated: 2026-10-06 18:41
VLAI
EPSS
VEX
Summary
Missing authorization in BrowserTag in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
Severity
No CVSS data available.
CWE
- CWE-862 - Missing authorization
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "155.0.8059.39",
"status": "affected",
"version": "155.0.8059.39",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Missing authorization in BrowserTag in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing authorization",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T18:41:18.458Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html"
},
{
"url": "https://issues.chromium.org/issues/501790682"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-106425",
"datePublished": "2026-10-06T18:41:18.458Z",
"dateReserved": "2026-10-06T16:38:56.385Z",
"dateUpdated": "2026-10-06T18:41:18.458Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106424 (GCVE-0-2026-106424)
Vulnerability from nvd – Published: 2026-10-06 18:41 – Updated: 2026-10-07 15:35
VLAI
EPSS
VEX
Summary
Information leak in Audio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)
Severity
4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 15:35 UTC
CWE
- CWE-200 - Information leak
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-106424",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T15:35:41.070683Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T15:35:44.408Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "155.0.8059.39",
"status": "affected",
"version": "155.0.8059.39",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Information leak in Audio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Information leak",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T18:41:22.292Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html"
},
{
"url": "https://issues.chromium.org/issues/513365978"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-106424",
"datePublished": "2026-10-06T18:41:22.292Z",
"dateReserved": "2026-10-06T16:38:55.081Z",
"dateUpdated": "2026-10-07T15:35:44.408Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106423 (GCVE-0-2026-106423)
Vulnerability from nvd – Published: 2026-10-06 18:41 – Updated: 2026-10-07 03:55
VLAI
EPSS
VEX
Summary
Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 00:00 UTC
CWE
- CWE-416 - Use after free
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-106423",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T03:55:45.071Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "155.0.8059.39",
"status": "affected",
"version": "155.0.8059.39",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use after free",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T18:41:13.206Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html"
},
{
"url": "https://issues.chromium.org/issues/566347711"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-106423",
"datePublished": "2026-10-06T18:41:13.206Z",
"dateReserved": "2026-10-06T16:38:54.157Z",
"dateUpdated": "2026-10-07T03:55:45.071Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106422 (GCVE-0-2026-106422)
Vulnerability from nvd – Published: 2026-10-06 18:41 – Updated: 2026-10-06 18:41
VLAI
EPSS
VEX
Summary
Incorrect authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
Severity
No CVSS data available.
CWE
- CWE-863 - Incorrect authorization
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "155.0.8059.39",
"status": "affected",
"version": "155.0.8059.39",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Incorrect authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect authorization",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T18:41:37.139Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html"
},
{
"url": "https://issues.chromium.org/issues/519458746"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-106422",
"datePublished": "2026-10-06T18:41:37.139Z",
"dateReserved": "2026-10-06T16:38:47.665Z",
"dateUpdated": "2026-10-06T18:41:37.139Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106421 (GCVE-0-2026-106421)
Vulnerability from nvd – Published: 2026-10-06 18:41 – Updated: 2026-10-07 03:55
VLAI
EPSS
VEX
Summary
Use after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 00:00 UTC
CWE
- CWE-416 - Use after free
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-106421",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T03:55:57.114Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "155.0.8059.39",
"status": "affected",
"version": "155.0.8059.39",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Use after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use after free",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T18:41:14.440Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html"
},
{
"url": "https://issues.chromium.org/issues/567873463"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-106421",
"datePublished": "2026-10-06T18:41:14.440Z",
"dateReserved": "2026-10-06T16:38:46.410Z",
"dateUpdated": "2026-10-07T03:55:57.114Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106420 (GCVE-0-2026-106420)
Vulnerability from nvd – Published: 2026-10-06 18:41 – Updated: 2026-10-07 10:30
VLAI
EPSS
VEX
Summary
Incorrect calculation in API in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Medium)
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 10:22 UTC
CWE
- CWE-682 - Incorrect calculation
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-106420",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T10:22:22.242026Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T10:30:15.568Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "155.0.8059.39",
"status": "affected",
"version": "155.0.8059.39",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Incorrect calculation in API in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-682",
"description": "Incorrect calculation",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T18:41:15.372Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html"
},
{
"url": "https://issues.chromium.org/issues/477327257"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-106420",
"datePublished": "2026-10-06T18:41:15.372Z",
"dateReserved": "2026-10-06T16:38:43.564Z",
"dateUpdated": "2026-10-07T10:30:15.568Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106419 (GCVE-0-2026-106419)
Vulnerability from nvd – Published: 2026-10-06 18:41 – Updated: 2026-10-07 03:55
VLAI
EPSS
VEX
Summary
Use after free in ANGLE in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 00:00 UTC
CWE
- CWE-416 - Use after free
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-106419",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T03:55:34.288Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "155.0.8059.39",
"status": "affected",
"version": "155.0.8059.39",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Use after free in ANGLE in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use after free",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T18:41:09.325Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html"
},
{
"url": "https://issues.chromium.org/issues/550379413"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-106419",
"datePublished": "2026-10-06T18:41:09.325Z",
"dateReserved": "2026-10-06T16:38:38.497Z",
"dateUpdated": "2026-10-07T03:55:34.288Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106418 (GCVE-0-2026-106418)
Vulnerability from nvd – Published: 2026-10-06 18:41 – Updated: 2026-10-06 18:41
VLAI
EPSS
VEX
Summary
Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: Low)
Severity
No CVSS data available.
CWE
- CWE-862 - Missing authorization
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "155.0.8059.39",
"status": "affected",
"version": "155.0.8059.39",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: Low)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing authorization",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T18:41:40.709Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html"
},
{
"url": "https://issues.chromium.org/issues/553283471"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-106418",
"datePublished": "2026-10-06T18:41:40.709Z",
"dateReserved": "2026-10-06T16:38:35.187Z",
"dateUpdated": "2026-10-06T18:41:40.709Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106417 (GCVE-0-2026-106417)
Vulnerability from nvd – Published: 2026-10-06 18:41 – Updated: 2026-10-07 03:55
VLAI
EPSS
VEX
Summary
Integer overflow in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 00:00 UTC
CWE
- CWE-190 - Integer overflow
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-106417",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T03:55:59.886Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "155.0.8059.39",
"status": "affected",
"version": "155.0.8059.39",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Integer overflow in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer overflow",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T18:41:38.420Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html"
},
{
"url": "https://issues.chromium.org/issues/536471438"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-106417",
"datePublished": "2026-10-06T18:41:38.420Z",
"dateReserved": "2026-10-06T16:38:33.920Z",
"dateUpdated": "2026-10-07T03:55:59.886Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106416 (GCVE-0-2026-106416)
Vulnerability from nvd – Published: 2026-10-06 18:41 – Updated: 2026-10-07 10:30
VLAI
EPSS
VEX
Summary
Code injection in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Medium)
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 10:22 UTC
CWE
- CWE-94 - Code injection
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-106416",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T10:22:14.129942Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T10:30:15.066Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "155.0.8059.39",
"status": "affected",
"version": "155.0.8059.39",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Code injection in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code injection",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T18:41:23.509Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html"
},
{
"url": "https://issues.chromium.org/issues/514072462"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-106416",
"datePublished": "2026-10-06T18:41:23.509Z",
"dateReserved": "2026-10-06T16:38:32.681Z",
"dateUpdated": "2026-10-07T10:30:15.066Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106415 (GCVE-0-2026-106415)
Vulnerability from nvd – Published: 2026-10-06 18:41 – Updated: 2026-10-07 10:20
VLAI
EPSS
VEX
Summary
Information leak in Enterprise in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 10:16 UTC
CWE
- CWE-200 - Information leak
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-106415",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T10:16:09.476667Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T10:20:11.255Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "155.0.8059.39",
"status": "affected",
"version": "155.0.8059.39",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Information leak in Enterprise in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Information leak",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T18:41:19.402Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html"
},
{
"url": "https://issues.chromium.org/issues/502179715"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-106415",
"datePublished": "2026-10-06T18:41:19.402Z",
"dateReserved": "2026-10-06T16:38:31.360Z",
"dateUpdated": "2026-10-07T10:20:11.255Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106414 (GCVE-0-2026-106414)
Vulnerability from nvd – Published: 2026-10-06 18:41 – Updated: 2026-10-07 03:56
VLAI
EPSS
VEX
Summary
Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 00:00 UTC
CWE
- CWE-20 - Improper input validation
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-106414",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T03:56:13.286Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "155.0.8059.39",
"status": "affected",
"version": "155.0.8059.39",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper input validation",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T18:41:20.764Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html"
},
{
"url": "https://issues.chromium.org/issues/504223609"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-106414",
"datePublished": "2026-10-06T18:41:20.764Z",
"dateReserved": "2026-10-06T16:38:29.985Z",
"dateUpdated": "2026-10-07T03:56:13.286Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106413 (GCVE-0-2026-106413)
Vulnerability from nvd – Published: 2026-10-06 18:41 – Updated: 2026-10-07 10:20
VLAI
EPSS
VEX
Summary
Race condition in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
Severity
4.2 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 10:18 UTC
CWE
- CWE-367 - Race condition
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-106413",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T10:18:57.405216Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T10:20:11.527Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "155.0.8059.39",
"status": "affected",
"version": "155.0.8059.39",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Race condition in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "Race condition",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T18:41:41.308Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html"
},
{
"url": "https://issues.chromium.org/issues/553336689"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-106413",
"datePublished": "2026-10-06T18:41:41.308Z",
"dateReserved": "2026-10-06T16:38:29.046Z",
"dateUpdated": "2026-10-07T10:20:11.527Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106412 (GCVE-0-2026-106412)
Vulnerability from nvd – Published: 2026-10-06 18:41 – Updated: 2026-10-07 03:55
VLAI
EPSS
VEX
Summary
Race condition in Core in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Severity
8.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 00:00 UTC
CWE
- CWE-367 - Race condition
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-106412",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T03:55:51.629Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "155.0.8059.39",
"status": "affected",
"version": "155.0.8059.39",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Race condition in Core in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "Race condition",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T18:41:08.397Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html"
},
{
"url": "https://issues.chromium.org/issues/520755056"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-106412",
"datePublished": "2026-10-06T18:41:08.397Z",
"dateReserved": "2026-10-06T16:38:28.155Z",
"dateUpdated": "2026-10-07T03:55:51.629Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106411 (GCVE-0-2026-106411)
Vulnerability from nvd – Published: 2026-10-06 18:41 – Updated: 2026-10-07 03:55
VLAI
EPSS
VEX
Summary
Use after free in Parser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 00:00 UTC
CWE
- CWE-416 - Use after free
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-106411",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T03:55:44.252Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "155.0.8059.39",
"status": "affected",
"version": "155.0.8059.39",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Use after free in Parser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use after free",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T18:41:13.042Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html"
},
{
"url": "https://issues.chromium.org/issues/566136674"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-106411",
"datePublished": "2026-10-06T18:41:13.042Z",
"dateReserved": "2026-10-06T16:38:26.847Z",
"dateUpdated": "2026-10-07T03:55:44.252Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106410 (GCVE-0-2026-106410)
Vulnerability from nvd – Published: 2026-10-06 18:41 – Updated: 2026-10-07 10:20
VLAI
EPSS
VEX
Summary
Missing authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
Severity
4.2 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 10:19 UTC
CWE
- CWE-862 - Missing authorization
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-106410",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T10:19:12.509215Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T10:20:12.268Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "155.0.8059.39",
"status": "affected",
"version": "155.0.8059.39",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Missing authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing authorization",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T18:41:26.209Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html"
},
{
"url": "https://issues.chromium.org/issues/517801814"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-106410",
"datePublished": "2026-10-06T18:41:26.209Z",
"dateReserved": "2026-10-06T16:38:23.272Z",
"dateUpdated": "2026-10-07T10:20:12.268Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106409 (GCVE-0-2026-106409)
Vulnerability from nvd – Published: 2026-10-06 18:41 – Updated: 2026-10-07 03:55
VLAI
EPSS
VEX
Summary
Incorrect reference resolution in WebAppInstalls in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)
Severity
8.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 00:00 UTC
CWE
- CWE-706 - Incorrect reference resolution
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-106409",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T03:55:53.726Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "155.0.8059.39",
"status": "affected",
"version": "155.0.8059.39",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Incorrect reference resolution in WebAppInstalls in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-706",
"description": "Incorrect reference resolution",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T18:41:33.459Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html"
},
{
"url": "https://issues.chromium.org/issues/559097675"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-106409",
"datePublished": "2026-10-06T18:41:33.459Z",
"dateReserved": "2026-10-06T16:38:22.332Z",
"dateUpdated": "2026-10-07T03:55:53.726Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106408 (GCVE-0-2026-106408)
Vulnerability from nvd – Published: 2026-10-06 18:41 – Updated: 2026-10-06 18:41
VLAI
EPSS
VEX
Summary
Protection mechanism failure in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Severity
No CVSS data available.
CWE
- CWE-693 - Protection mechanism failure
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "155.0.8059.39",
"status": "affected",
"version": "155.0.8059.39",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Protection mechanism failure in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "Protection mechanism failure",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T18:41:20.928Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html"
},
{
"url": "https://issues.chromium.org/issues/504227656"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-106408",
"datePublished": "2026-10-06T18:41:20.928Z",
"dateReserved": "2026-10-06T16:38:16.678Z",
"dateUpdated": "2026-10-06T18:41:20.928Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106407 (GCVE-0-2026-106407)
Vulnerability from nvd – Published: 2026-10-06 18:41 – Updated: 2026-10-08 12:05
VLAI
EPSS
VEX
Summary
Incorrect authorization in GetUserMedia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 12:01 UTC
CWE
- CWE-863 - Incorrect authorization
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-106407",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T12:01:43.636444Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T12:05:00.611Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "155.0.8059.39",
"status": "affected",
"version": "155.0.8059.39",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Incorrect authorization in GetUserMedia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect authorization",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T18:41:20.047Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html"
},
{
"url": "https://issues.chromium.org/issues/502648640"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-106407",
"datePublished": "2026-10-06T18:41:20.047Z",
"dateReserved": "2026-10-06T16:38:15.625Z",
"dateUpdated": "2026-10-08T12:05:00.611Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106406 (GCVE-0-2026-106406)
Vulnerability from nvd – Published: 2026-10-06 18:41 – Updated: 2026-10-07 10:30
VLAI
EPSS
VEX
Summary
Missing authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 10:22 UTC
CWE
- CWE-862 - Missing authorization
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-106406",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T10:22:20.278564Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T10:30:15.450Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "155.0.8059.39",
"status": "affected",
"version": "155.0.8059.39",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Missing authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing authorization",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T18:41:21.244Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html"
},
{
"url": "https://issues.chromium.org/issues/505186109"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-106406",
"datePublished": "2026-10-06T18:41:21.244Z",
"dateReserved": "2026-10-06T16:38:14.124Z",
"dateUpdated": "2026-10-07T10:30:15.450Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106405 (GCVE-0-2026-106405)
Vulnerability from nvd – Published: 2026-10-06 18:41 – Updated: 2026-10-08 15:47
VLAI
EPSS
VEX
Summary
Race condition in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to bypass web origin policy via a co-installed app. (Chromium security severity: Medium)
Severity
6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 15:46 UTC
CWE
- CWE-367 - Race condition
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-106405",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T15:46:13.844675Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T15:47:16.558Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "155.0.8059.39",
"status": "affected",
"version": "155.0.8059.39",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Race condition in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to bypass web origin policy via a co-installed app. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "Race condition",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T18:41:24.571Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html"
},
{
"url": "https://issues.chromium.org/issues/517150523"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-106405",
"datePublished": "2026-10-06T18:41:24.571Z",
"dateReserved": "2026-10-06T16:38:12.996Z",
"dateUpdated": "2026-10-08T15:47:16.558Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106404 (GCVE-0-2026-106404)
Vulnerability from nvd – Published: 2026-10-06 18:41 – Updated: 2026-10-07 19:58
VLAI
EPSS
VEX
Summary
Incorrect authorization in FontAccess in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 19:57 UTC
CWE
- CWE-863 - Incorrect authorization
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-106404",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T19:57:38.337520Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T19:58:00.783Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "155.0.8059.39",
"status": "affected",
"version": "155.0.8059.39",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Incorrect authorization in FontAccess in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect authorization",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T18:41:31.802Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html"
},
{
"url": "https://issues.chromium.org/issues/553150261"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-106404",
"datePublished": "2026-10-06T18:41:31.802Z",
"dateReserved": "2026-10-06T16:38:12.094Z",
"dateUpdated": "2026-10-07T19:58:00.783Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106403 (GCVE-0-2026-106403)
Vulnerability from nvd – Published: 2026-10-06 18:41 – Updated: 2026-10-07 19:52
VLAI
EPSS
VEX
Summary
Incorrect authorization in Accessibility in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 19:51 UTC
CWE
- CWE-863 - Incorrect authorization
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-106403",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T19:51:37.467082Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T19:52:09.923Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "155.0.8059.39",
"status": "affected",
"version": "155.0.8059.39",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Incorrect authorization in Accessibility in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect authorization",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T18:41:28.649Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html"
},
{
"url": "https://issues.chromium.org/issues/523601696"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-106403",
"datePublished": "2026-10-06T18:41:28.649Z",
"dateReserved": "2026-10-06T16:38:10.644Z",
"dateUpdated": "2026-10-07T19:52:09.923Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106402 (GCVE-0-2026-106402)
Vulnerability from nvd – Published: 2026-10-06 18:41 – Updated: 2026-10-07 10:26
VLAI
EPSS
VEX
Summary
Incorrect authorization in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Medium)
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 10:26 UTC
CWE
- CWE-863 - Incorrect authorization
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-106402",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T10:26:04.049704Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T10:26:07.584Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "155.0.8059.39",
"status": "affected",
"version": "155.0.8059.39",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Incorrect authorization in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect authorization",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T18:41:22.891Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html"
},
{
"url": "https://issues.chromium.org/issues/514041626"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-106402",
"datePublished": "2026-10-06T18:41:22.891Z",
"dateReserved": "2026-10-06T16:38:09.696Z",
"dateUpdated": "2026-10-07T10:26:07.584Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106401 (GCVE-0-2026-106401)
Vulnerability from nvd – Published: 2026-10-06 18:41 – Updated: 2026-10-07 03:56
VLAI
EPSS
VEX
Summary
Out of bounds write in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 00:00 UTC
CWE
- CWE-787 - Out of bounds write
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-106401",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T03:56:04.388Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "155.0.8059.39",
"status": "affected",
"version": "155.0.8059.39",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Out of bounds write in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out of bounds write",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T18:41:30.880Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html"
},
{
"url": "https://issues.chromium.org/issues/553129739"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-106401",
"datePublished": "2026-10-06T18:41:30.880Z",
"dateReserved": "2026-10-06T16:38:08.685Z",
"dateUpdated": "2026-10-07T03:56:04.388Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106400 (GCVE-0-2026-106400)
Vulnerability from nvd – Published: 2026-10-06 18:41 – Updated: 2026-10-07 10:30
VLAI
EPSS
VEX
Summary
Clickjacking in Messages in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 10:22 UTC
CWE
- CWE-1021 - Clickjacking
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-106400",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T10:22:08.004427Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T10:30:14.685Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "155.0.8059.39",
"status": "affected",
"version": "155.0.8059.39",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Clickjacking in Messages in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1021",
"description": "Clickjacking",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T18:41:27.141Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html"
},
{
"url": "https://issues.chromium.org/issues/518108937"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-106400",
"datePublished": "2026-10-06T18:41:27.141Z",
"dateReserved": "2026-10-06T16:38:07.323Z",
"dateUpdated": "2026-10-07T10:30:14.685Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106399 (GCVE-0-2026-106399)
Vulnerability from nvd – Published: 2026-10-06 18:41 – Updated: 2026-10-07 15:45
VLAI
EPSS
VEX
Summary
Out of bounds read in Skia in Google Chrome prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to potentially read memory via a crafted file. (Chromium security severity: Low)
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 15:45 UTC
CWE
- CWE-125 - Out of bounds read
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-106399",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T15:45:36.506465Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T15:45:39.506Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "155.0.8059.39",
"status": "affected",
"version": "155.0.8059.39",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Out of bounds read in Skia in Google Chrome prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to potentially read memory via a crafted file. (Chromium security severity: Low)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out of bounds read",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T18:41:37.813Z",
"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"shortName": "Chrome"
},
"references": [
{
"url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html"
},
{
"url": "https://issues.chromium.org/issues/530237174"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
"assignerShortName": "Chrome",
"cveId": "CVE-2026-106399",
"datePublished": "2026-10-06T18:41:37.813Z",
"dateReserved": "2026-10-06T16:38:06.375Z",
"dateUpdated": "2026-10-07T15:45:39.506Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}