Google Chrome versions before 155.0.8059.39 (Linux) and before 155.0.8059.39/.40 (Windows, macOS) contain a critical use-after-free flaw in the Chromecast component (CVE-2026-106382, CVSS 9.6). A remote attacker can execute arbitrary code outside the browser sandbox by luring a user to a crafted HTML page. The attack requires no authentication, but the victim must open the page, so drive-by links and malicious advertisements are the main risk.
Google · Chrome
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Google Chrome on macOS contains a sandbox flaw that allows privilege elevation. A remote attacker who has already compromised the renderer process can use a crafted HTML page to execute arbitrary code outside the sandbox. The attack requires a separate renderer compromise and user interaction, so the flaw is typically exploited as part of a chain.
Google · Chrome
Google Chrome prior to 155.0.8059.39 contains a race condition (CWE-362) in its Fonts component. A remote attacker who has already compromised the renderer process can execute arbitrary code outside the sandbox by luring a user to a crafted HTML page. The CVSS vector requires user interaction and high attack complexity, and the scope is changed.
Google · Chrome
Research and translation in progress – available shortly.
Google Chrome versions before 155.0.8059.39 contain an incomplete cleanup flaw in Dawn, the WebGPU implementation used by Chrome. A remote attacker can create a crafted HTML page that may lead to arbitrary code execution outside the browser sandbox. The attack requires the user to open the malicious page, and an attacker would likely need to combine this with a second exploit to reach the sandbox boundary.
Google · Chrome
Type confusion in the V8 JavaScript engine of Google Chrome before 155.0.8059.39 allows a remote attacker to execute arbitrary code inside the browser sandbox. The attack requires that a user opens a crafted HTML page. Google rates the issue Low in Chromium, while the NVD/CNA CVSS score is 8.8 (High).
Google · Chrome
A use-after-free flaw in the Fonts component of Google Chrome on Windows allows a remote attacker to execute arbitrary code inside the browser sandbox. Exploitation requires that a user visits a crafted HTML page. The CVE record describes code execution inside the sandbox and does not describe a sandbox escape. The CVSS score is 8.8 (High), while Chromium rates the issue Medium.
Google · Chrome
Google Chrome desktop versions before 155.0.8059.39 contain an incorrect authorization flaw in the user interface (CWE-863). A remote attacker can potentially execute arbitrary code outside the browser sandbox by luring a user to a crafted HTML page. No authentication is required, but the user must open the page. NVD rates the issue CRITICAL (CVSS 9.6), while Chromium rates it Medium.
Google · Chrome
Google Chrome for Android contains an incorrect authorization flaw (CWE-863) in the Transactions Platform component. A remote attacker can use a crafted HTML page to obtain sensitive information. The victim must open the malicious page in Chrome on an affected Android device. Google rates the severity as Low, while the CVSS 3.1 base score is 8.8.
Google · Chrome for Android
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
A missing authorization check in the Mobile component of Google Chrome for Android allows a local attacker to potentially execute arbitrary code outside the browser sandbox. The attacker needs a malicious co-installed app on the device and must use social engineering to get the user to install it. The CVSS vector lists no user interaction, but the description requires it, so the real-world risk is likely lower than the score suggests.
Google · Chrome for Android
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
A missing authorization check in the FullScreen component of Google Chrome before 155.0.8059.39 allows a remote attacker to bypass system access restrictions. The attacker must first have compromised the renderer process, usually through another vulnerability, and then use social engineering to get the user to open a crafted HTML page. NVD lists a CVSS score of 8.3, while Google rates the issue Medium in its Chromium severity scale.
Google · Chrome
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
A use-after-free flaw in the Navigation component of Google Chrome allows a remote attacker to execute arbitrary code outside the browser sandbox. The attacker needs the victim to open a crafted HTML page, so no privileges or prior access are required. The CVSS 3.1 score is 9.6 (Critical), with high impact on confidentiality, integrity and availability.
Google · Chrome
