Security feed

24 October 2026

advisoryOfficial CVE List24 Oct 2026

CVE-2026-106274

Incorrect reference resolution in Browser in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

Chrome CVE-2026-106274

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-106274

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-106274
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #9610 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 23:20:22 GMT
Publisher date: Tue, 06 Oct 2026 18:41:16 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-106249

Incorrect authorization in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

Chrome CVE-2026-106249

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-106249

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-106249
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #9609 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 23:20:22 GMT
Publisher date: Tue, 06 Oct 2026 18:41:39 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-106256

Information leak in Passwords in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

Chrome CVE-2026-106256

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-106256

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-106256
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #9608 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 23:20:21 GMT
Publisher date: Tue, 06 Oct 2026 18:41:41 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-106254

Information leak in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via a co-installed app. (Chromium security severity: Medium)

Chrome CVE-2026-106254

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-106254

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-106254
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #9607 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 23:20:20 GMT
Publisher date: Tue, 06 Oct 2026 18:41:32 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-106225

Missing authorization in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

Chrome CVE-2026-106225

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-106225

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-106225
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #9606 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 23:20:20 GMT
Publisher date: Tue, 06 Oct 2026 18:41:18 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-106220

Information leak in Passwords in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

Chrome CVE-2026-106220

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-106220

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-106220
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #9605 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 23:20:20 GMT
Publisher date: Tue, 06 Oct 2026 18:41:38 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-106214

Information leak in Proxy in Google Chrome on on Windows prior to 155.0.8059.39 allowed an adjacent attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: High)

Chrome CVE-2026-106214

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-106214

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-106214
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #9604 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 23:20:19 GMT
Publisher date: Tue, 06 Oct 2026 18:41:08 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-106206

Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium)

Chrome CVE-2026-106206

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-106206

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-106206
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #9603 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 23:20:19 GMT
Publisher date: Tue, 06 Oct 2026 18:41:25 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-106212

Incorrect authorization in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

Chrome CVE-2026-106212

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-106212

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-106212
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #9602 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 23:20:19 GMT
Publisher date: Tue, 06 Oct 2026 18:41:29 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-106203

Incomplete cleanup in Autofill in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)

Chrome CVE-2026-106203

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-106203

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-106203
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #9601 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 23:20:18 GMT
Publisher date: Tue, 06 Oct 2026 18:41:10 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-106334

Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

Chrome CVE-2026-106334

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-106334

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-106334
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #9598 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 23:20:17 GMT
Publisher date: Tue, 06 Oct 2026 18:41:42 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-106340

Missing authorization in CredentialProvider in Google Chrome on on Windows prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via physical access. (Chromium security severity: Low)

Chrome CVE-2026-106340

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-106340

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-106340
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #9597 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 23:20:16 GMT
Publisher date: Tue, 06 Oct 2026 18:41:33 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-106341

Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Chrome CVE-2026-106341

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-106341

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-106341
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #9557 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 23:19:48 GMT
Publisher date: Tue, 06 Oct 2026 18:41:33 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-106252

Incorrect comparison in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Chrome CVE-2026-106252

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-106252

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-106252
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #9556 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 23:19:48 GMT
Publisher date: Tue, 06 Oct 2026 18:41:35 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-106388

Missing authorization in DataTransfer in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

Chrome CVE-2026-106388

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-106388

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-106388
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #9539 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 23:19:37 GMT
Publisher date: Tue, 06 Oct 2026 18:41:30 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-106364

Incorrect authorization in Omnibox in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)

Chrome CVE-2026-106364

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-106364

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-106364
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #9538 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 23:19:36 GMT
Publisher date: Tue, 06 Oct 2026 18:41:08 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-106355

Missing authorization in Media in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

Chrome CVE-2026-106355

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-106355

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-106355
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #9537 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 23:19:35 GMT
Publisher date: Tue, 06 Oct 2026 18:41:43 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-106351

Observable discrepancy in Safebrowsing in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

Chrome CVE-2026-106351

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-106351

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-106351
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #9536 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 23:19:34 GMT
Publisher date: Tue, 06 Oct 2026 18:41:32 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-106303

Observable discrepancy in Autofill AI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

Chrome CVE-2026-106303

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-106303

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-106303
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #9535 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 23:19:34 GMT
Publisher date: Tue, 06 Oct 2026 18:41:25 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

CVE-2026-106277

Information leak in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

Chrome CVE-2026-106277

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-106277

Chrome

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-106277
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #9534 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 23:19:33 GMT
Publisher date: Tue, 06 Oct 2026 18:41:26 GMT

Read the original announcement

Older events