CVE-2026-106415
UnknownSummary
An information leak vulnerability in Google Chrome prior to 155.0.8059.39 allows a remote attacker to leak sensitive information via a crafted HTML page. Chromium severity: Medium.
Risk Assessment
The organization may be exposed to leakage of confidential data if users visit a malicious page. This could lead to privacy breaches or data theft.
Recommendation
It is recommended to update Google Chrome to version 155.0.8059.39 or later as soon as possible to mitigate this vulnerability.
Other vulnerabilities in Google Chrome
See all- CVE-2026-106427Unknown
Confused deputy in Mobile in Google Chrome on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Low)
- CVE-2026-106426High
Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-106425Unknown
Missing authorization in BrowserTag in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
- CVE-2026-106424Unknown
Information leak in Audio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)
- CVE-2026-106423High
Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-106422Unknown
Incorrect authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
- CVE-2026-106421High
Use after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-106420Unknown
Incorrect calculation in API in Google Chrome on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Medium)
- CVE-2026-106418Unknown
Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: Low)
- CVE-2026-106416Unknown
Code injection in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Medium)
Original NVD description (English source)
Information leak in Enterprise in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Vulnerability data from NVD (NIST) · CISA KEV · EPSS