The control plane of Google OSS Agent Mesh (SAM) returns an approved peer's signed Biscuit identity token from the GET /enroll/status endpoint without any authentication. An attacker only needs the peer_id, which the unauthenticated GET /info endpoint publishes. The stolen token can then be replayed as a bearer credential to read mesh authorization policies on /policies and to overwrite router addresses on /routers/lease.
Google · OSS Agent Mesh (SAM)
Google Chrome versions prior to 156.0.8078.47 contain a use-after-free vulnerability in the Performance component (CWE-416). A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The attack requires user interaction, such as opening a malicious link or visiting a compromised website, and no authentication.
Google · Chrome
Google Chrome on desktop has a memory corruption flaw in its Sandbox component. A remote attacker can use a crafted HTML page to execute arbitrary code inside the sandbox, which the record rates as CVSS 8.8. The attack requires that a user loads the malicious page, for example through a phishing link or a compromised website.
Google · Chrome
A memory corruption flaw in the Network component of Google Chrome prior to 156.0.8078.47 allows a remote attacker to execute arbitrary code outside the browser sandbox. The attack requires a user to open a crafted HTML page, but no login. Google rates the issue Medium in its Chromium severity scale, while NVD scores it 9.6 (Critical).
Google · Chrome
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Google Chrome desktop builds before 156.0.8078.47 contain a use-after-free vulnerability (CWE-416) in the SVG component. A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The attack requires that the user opens the page, and the CVSS score is 8.8 (High).
Google · Chrome
Google Chrome contains a use-after-free vulnerability in the Turbolev component (CVE-2026-113338, CVSS 8.8, Chromium severity High). A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The attack requires user interaction, but no privileges.
Google · Chrome
Google Chrome contains a memory corruption flaw in its Scroll component (CWE-119). A remote attacker can execute arbitrary code inside the browser sandbox if a user visits a crafted HTML page. Full compromise would normally require a further sandbox escape, which is not described in the CVE data. The CVSS 8.8 score is as listed in the CVE data and has not been verified against NVD.
Google · Chrome
Google Chrome for desktop contains a memory corruption flaw in the Compositing component, which assembles page content for display. A remote attacker may be able to execute arbitrary code outside the browser sandbox by luring a user to a crafted HTML page. The attack requires the victim to load the malicious page; the CVSS 3.1 base score is 9.6 (critical).
Google · Chrome
Google Chrome before 156.0.8078.47 contains a memory corruption flaw in its Extensions component (CWE-119). A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. Chromium rates the issue Medium, and no exploitation in the wild is known.
Google · Chrome
Improper input validation in the ANGLE graphics component of Google Chrome on Windows allows a remote attacker to potentially execute arbitrary code inside the browser sandbox. The attack requires the user to open a crafted HTML page. Code execution inside the sandbox is limited, so a full compromise usually also needs a second sandbox-escape flaw.
Google · Chrome
Research and translation in progress – available shortly.
A memory corruption flaw in the GPU component of Google Chrome allows a remote attacker to execute arbitrary code inside the browser's sandbox. The attack requires that a user visits a crafted HTML page, and no login is needed. A full compromise would additionally require a sandbox escape, which is not described in the available data.
Google · Chrome
Google Chrome before 156.0.8078.47 contains a memory corruption flaw in the Controls component. A remote attacker can potentially execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. No login is required, but the victim must open the page. Google rates the issue Low, while NVD scores it CVSS 8.8.
Google · Chrome
A memory corruption flaw (CWE-119) in the CustomTabs component of Google Chrome for Android allows a remote attacker to potentially execute arbitrary code inside the browser sandbox. The attacker needs to lure a user to a crafted HTML page, so user interaction is required and no login is needed. Chromium rates the issue Low, and the CVSS base score is 8.8 according to NVD. Full device compromise would normally also require a separate sandbox escape, which is an inference and not a source statement.
Google · Chrome for Android
Research and translation in progress – available shortly.
An improper input validation flaw in the Privacy component of desktop Google Chrome before 156.0.8078.47 allows a remote attacker to potentially execute arbitrary code outside the browser sandbox. The attacker needs to lure a user to a crafted HTML page; no authentication is required. NVD rates the issue Critical (CVSS 3.1 9.6), while Google's Chromium security severity is Medium and VulDB lists a base score of 6.3.
Google · Chrome
A use-after-free vulnerability in the Chromecast component of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs the user to open a crafted HTML page, for example through phishing or a malicious or compromised website. The NVD assigns a CVSS 3.1 base score of 8.8 (High). No exploitation in the wild or public proof of concept is known.
Google · Chrome
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
A use-after-free vulnerability in the GPU component of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs to lure a user to a crafted HTML page; no login is required. The sources do not describe a sandbox escape, so impact beyond the sandbox is unknown. Chromium rates the issue High, and the CVSS 3.1 base score is 8.8.
Google · Chrome
Google Chrome for iOS before 156.0.8078.47 contains a use-after-free memory flaw (CWE-416) that can be triggered by a crafted HTML page. A remote attacker may potentially execute arbitrary code inside the browser sandbox. The victim must open the malicious page, and no authentication is needed. Google rates the issue Low, the CVSS score of 8.8 is an NVD/CNA score, and no exploitation is known.
Google · Chrome for iOS
Research and translation in progress – available shortly.
A use-after-free flaw in the Extensions component of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. The attack requires that a user opens a crafted HTML page. The attacker would gain code execution within the sandbox, not full control of the system.
Google · Chrome
