CVE-2026-106390

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-106390
Incorrect provision of specified functionality in SanitizerAPI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html Release Notes Vendor Advisory
https://issues.chromium.org/issues/556213916 Permissions Required
Configurations

Configuration 1 (hide)

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
History

07 Oct 2026, 13:41

Type Values Removed Values Added
First Time Google
Google chrome
CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
References () https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html - () https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html - Release Notes, Vendor Advisory
References () https://issues.chromium.org/issues/556213916 - () https://issues.chromium.org/issues/556213916 - Permissions Required

07 Oct 2026, 11:17

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.3

06 Oct 2026, 19:18

Type Values Removed Values Added
New CVE
Information

Published : 2026-10-06 19:18

Updated : 2026-10-07 13:41

NVD link : CVE-2026-106390

Mitre link : CVE-2026-106390

CVE.ORG link : CVE-2026-106390

JSON object : View

Products Affected

google

  • chrome
CWE
CWE-684

Incorrect Provision of Specified Functionality