CVE-2026-106379
Uninitialized resource in Skia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker...
Uninitialized resource in Skia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Uninitialized resource in Skia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
- Record
CVE-2026-106379- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-908
- Updated
- 2026-11-02
EUVDEUVD-2026-93828
Uninitialized resource in Skia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
- Record
EUVD-2026-93828- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-wrg2-qmh9-jwcg
Uninitialized resource in Skia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker...
Uninitialized resource in Skia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
- Record
GHSA-wrg2-qmh9-jwcg- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-908
- Updated
- 2026-11-02
NVD
Uninitialized resource in Skia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
- Record
CVE-2026-106379- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-908
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-106379
Uninitialized resource in Skia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
- Record
DEBIAN-CVE-2026-106379- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVRHSA-2026:95194
Red Hat Security Advisory: webkit2gtk3 security update
- Record
RHSA-2026:95194- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-13
Show 10 moreShow less
OSVRHSA-2026:96080
Red Hat Security Advisory: webkit2gtk3 security update
- Record
RHSA-2026:96080- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-13
OSVRHSA-2026:98455
Red Hat Security Advisory: webkit2gtk3 security, bug fix, and enhancement update
- Record
RHSA-2026:98455- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-13
OSVRLSA-2026:95194
Important: webkit2gtk3 security update
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
chromium-browser: skia: chromium-browser: skia: Use after free in Skia (CVE-2026-85049)
chromium-browser: skia: Skia: Cross-origin data disclosure via use-after-free vulnerability (CVE-2026-91747)
chromium-browser: skia: Skia in chromium-browser: Information disclosure via improper state validation (CVE-2026-91733)
chromium-browser: skia: Google Chrome: Cross-origin data disclosure due to uninitialized resource in Skia (CVE-2026-91740)
chromium-browser: skia: Google Chrome Skia: Cross-origin data disclosure via improper state validation (CVE-2026-93387)
chromium-browser: skia: chromium-browser: Uninitialized resource in Skia (CVE-2026-102325)
chromium-browser: skia: Integer overflow in Skia (CVE-2026-103629)
chromium-browser: skia: Uninitialized resource in Skia (CVE-2026-106379)
chromium-browser: skia: Out of bounds read in Skia (CVE-2026-106399)
chromium-browser: skia: Memory corruption in Skia (CVE-2026-113106)
chromium-browser: skia: Improper input validation in Skia (CVE-2026-118348)
chromium-browser: skia: Memory corruption in Skia (CVE-2026-118351)
chromium-browser: skia: Memory corruption in Skia (CVE-2026-118340)
chromium-browser: skia: Improper input validation in Skia (CVE-2026-118354)
chromium-browser: skia: Memory corruption in Skia (CVE-2026-118319)
chromium-browser: skia: Use after free in Skia (CVE-2026-119271)
chromium-browser: skia: Improper input validation in Skia (CVE-2026-119261)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:95194- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-05
OSVRLSA-2026:96080
Important: webkit2gtk3 security update
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
chromium-browser: skia: chromium-browser: Information leak in Skia (CVE-2026-84359)
chromium-browser: skia: chromium-browser: skia: Use after free in Skia (CVE-2026-85049)
chromium-browser: skia: Skia: Cross-origin data disclosure via use-after-free vulnerability (CVE-2026-91747)
chromium-browser: skia: Skia in chromium-browser: Information disclosure via improper state validation (CVE-2026-91733)
chromium-browser: skia: Google Chrome: Cross-origin data disclosure due to uninitialized resource in Skia (CVE-2026-91740)
chromium-browser: skia: Google Chrome Skia: Cross-origin data disclosure via improper state validation (CVE-2026-93387)
chromium-browser: skia: chromium-browser: Uninitialized resource in Skia (CVE-2026-102325)
chromium-browser: skia: Integer overflow in Skia (CVE-2026-103629)
chromium-browser: skia: Uninitialized resource in Skia (CVE-2026-106379)
chromium-browser: skia: Out of bounds read in Skia (CVE-2026-106399)
chromium-browser: skia: Memory corruption in Skia (CVE-2026-113106)
chromium-browser: skia: Improper input validation in Skia (CVE-2026-118348)
chromium-browser: skia: Memory corruption in Skia (CVE-2026-118351)
chromium-browser: skia: Memory corruption in Skia (CVE-2026-118340)
chromium-browser: skia: Improper input validation in Skia (CVE-2026-118354)
chromium-browser: skia: Memory corruption in Skia (CVE-2026-118319)
chromium-browser: skia: Use after free in Skia (CVE-2026-119271)
chromium-browser: skia: Improper input validation in Skia (CVE-2026-119261)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:96080- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-10
OSVRLSA-2026:98455
Critical: webkit2gtk3 security, bug fix, and enhancement update
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
chromium-browser: skia: chromium-browser: skia: Inappropriate implementation in Skia (CVE-2023-4860)
chromium-browser: skia: chromium-browser: skia: Out of bounds memory access in Skia in Google Chrome allows a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page (CVE-2024-7966)
chromium: skia: chromium: skia: Heap buffer overflow in Skia (CVE-2024-8193)
chromium: skia: chromium: skia: Heap buffer overflow in Skia (CVE-2024-8198)
chromium: skia: chromium: skia: Heap buffer overflow in Skia (CVE-2024-8636)
chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia in Google Chrome (CVE-2024-9123)
chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia (CVE-2025-0436)
chromium-browser: skia: chromium-browser: skia: Use after free in Skia (CVE-2025-0444)
chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia (CVE-2026-3538)
chromium-browser: skia: chromium-browser: skia: Heap buffer overflow in Skia (CVE-2026-3931)
chromium-browser: skia: chromium-browser: skia: Out of bounds read in Skia (CVE-2026-4460)
chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia (CVE-2026-5870)
chromium-browser: skia: chromium-browser: skia: Out of bounds read in Skia (CVE-2026-6364)
chromium-browser: skia: chromium-browser: skia: Heap buffer overflow in Skia (CVE-2026-6298)
chromium-browser: skia: chromium-browser: skia: Heap buffer overflow in Skia (CVE-2026-7353)
chromium-browser: skia: chromium-browser: skia: Out of bounds read in Skia (CVE-2026-7949)
chromium-browser: skia: chromium-browser: skia: Out of bounds write in Skia (CVE-2026-7923)
chromium-browser: skia: chromium-browser: skia: Use after free in Skia (CVE-2026-7920)
chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia (CVE-2026-8510)
chromium-browser: skia: chromium-browser: skia: Insufficient validation of untrusted input in Skia (CVE-2026-8579)
chromium-browser: skia: chromium-browser: skia: Use after free in Skia (CVE-2026-9923)
chromium-browser: skia: chromium-browser: skia: Insufficient validation of untrusted input in Skia (CVE-2026-10020)
chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia (CVE-2026-9909)
chromium-browser: skia: chromium-browser: skia: Use after free in Skia (CVE-2026-10012)
chromium-browser: skia: chromium-browser: skia: Use after free in Skia (CVE-2026-9893)
chromium-browser: skia: chromium-browser: skia: Inappropriate implementation in Skia (CVE-2026-9981)
chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia (CVE-2026-9998)
chromium-browser: skia: chromium-browser: skia: Inappropriate implementation in Skia (CVE-2026-10011)
chromium-browser: skia: chromium-browser: skia: Inappropriate implementation in Skia (CVE-2026-9892)
chromium-browser: skia: chromium-browser: skia: Type Confusion in Skia (CVE-2026-9983)
chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia (CVE-2026-10009)
chromium-browser: skia: chromium-browser: skia: Out of bounds read in Skia (CVE-2026-10985)
chromium-browser: skia: chromium-browser: skia: Heap buffer overflow in Skia (CVE-2026-10993)
chromium-browser: skia: chromium-browser: skia: Stack buffer overflow in Skia (CVE-2026-11024)
chromium-browser: skia: chromium-browser: skia: Insufficient validation of untrusted input in Skia (CVE-2026-11121)
chromium-browser: skia: chromium-browser: skia: Uninitialized Use in Skia (CVE-2026-11057)
chromium-browser: skia: chromium-browser: skia: Heap buffer overflow in Skia (CVE-2026-11124)
chromium-browser: skia: chromium-browser: skia: Uninitialized Use in Skia (CVE-2026-11039)
chromium-browser: skia: chromium-browser: skia: Uninitialized Use in Skia (CVE-2026-11159)
*…
- Record
RLSA-2026:98455- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-13
OSVALSA-2026:95194No score
Important: webkit2gtk3 security update
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
- chromium-browser: skia: chromium-browser: skia: Use after free in Skia (CVE-2026-85049)
- chromium-browser: skia: Skia: Cross-origin data disclosure via use-after-free vulnerability (CVE-2026-91747)
- chromium-browser: skia: Skia in chromium-browser: Information disclosure via improper state validation (CVE-2026-91733)
- chromium-browser: skia: Google Chrome: Cross-origin data disclosure due to uninitialized resource in Skia (CVE-2026-91740)
- chromium-browser: skia: Google Chrome Skia: Cross-origin data disclosure via improper state validation (CVE-2026-93387)
- chromium-browser: skia: chromium-browser: Uninitialized resource in Skia (CVE-2026-102325)
- chromium-browser: skia: Integer overflow in Skia (CVE-2026-103629)
- chromium-browser: skia: Uninitialized resource in Skia (CVE-2026-106379)
- chromium-browser: skia: Out of bounds read in Skia (CVE-2026-106399)
- chromium-browser: skia: Memory corruption in Skia (CVE-2026-113106)
- chromium-browser: skia: Improper input validation in Skia (CVE-2026-118348)
- chromium-browser: skia: Memory corruption in Skia (CVE-2026-118351)
- chromium-browser: skia: Memory corruption in Skia (CVE-2026-118340)
- chromium-browser: skia: Improper input validation in Skia (CVE-2026-118354)
- chromium-browser: skia: Memory corruption in Skia (CVE-2026-118319)
- chromium-browser: skia: Use after free in Skia (CVE-2026-119271)
- chromium-browser: skia: Improper input validation in Skia (CVE-2026-119261)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:95194- Updated
- 2026-11-05
OSVALSA-2026:96080No score
Important: webkit2gtk3 security update
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
- chromium-browser: skia: chromium-browser: Information leak in Skia (CVE-2026-84359)
- chromium-browser: skia: chromium-browser: skia: Use after free in Skia (CVE-2026-85049)
- chromium-browser: skia: Skia: Cross-origin data disclosure via use-after-free vulnerability (CVE-2026-91747)
- chromium-browser: skia: Skia in chromium-browser: Information disclosure via improper state validation (CVE-2026-91733)
- chromium-browser: skia: Google Chrome: Cross-origin data disclosure due to uninitialized resource in Skia (CVE-2026-91740)
- chromium-browser: skia: Google Chrome Skia: Cross-origin data disclosure via improper state validation (CVE-2026-93387)
- chromium-browser: skia: chromium-browser: Uninitialized resource in Skia (CVE-2026-102325)
- chromium-browser: skia: Integer overflow in Skia (CVE-2026-103629)
- chromium-browser: skia: Uninitialized resource in Skia (CVE-2026-106379)
- chromium-browser: skia: Out of bounds read in Skia (CVE-2026-106399)
- chromium-browser: skia: Memory corruption in Skia (CVE-2026-113106)
- chromium-browser: skia: Improper input validation in Skia (CVE-2026-118348)
- chromium-browser: skia: Memory corruption in Skia (CVE-2026-118351)
- chromium-browser: skia: Memory corruption in Skia (CVE-2026-118340)
- chromium-browser: skia: Improper input validation in Skia (CVE-2026-118354)
- chromium-browser: skia: Memory corruption in Skia (CVE-2026-118319)
- chromium-browser: skia: Use after free in Skia (CVE-2026-119271)
- chromium-browser: skia: Improper input validation in Skia (CVE-2026-119261)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:96080- Updated
- 2026-11-09
OSVopenSUSE-SU-2026:12091-1No score
chromedriver-155.0.8059.39-1.1 on GA media
These are all security issues fixed in the chromedriver-155.0.8059.39-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12091-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:22041-1No score
Security update for chromium
This update for chromium fixes the following issues:
Changes in chromium:
- Chromium 155 promoted to stable - 155.0.8059.39 (boo#1284354):
- CVE-2026-106382: Use after free in Chromecast
- CVE-2026-106197: Use after free in Browser
- CVE-2026-106358: Use after free in Navigation
- CVE-2026-106347: Use after free in Track
- CVE-2026-106245: Uninitialized resource in ANGLE
- CVE-2026-106327: Incorrect authorization in Core
- CVE-2026-106366: Incomplete cleanup in CustomTabs
- CVE-2026-106258: Uninitialized resource in ANGLE
- CVE-2026-106376: Uninitialized resource in ANGLE
- CVE-2026-106308: Incorrect reference resolution in Autofill
- CVE-2026-106215: Uninitialized resource in ANGLE
- CVE-2026-106369: Missing authorization in Translate
- CVE-2026-106293: Type confusion in ANGLE
- CVE-2026-106377: Race condition in Fonts
- CVE-2026-106412: Race condition in Core
- CVE-2026-106243: Incomplete cleanup in Proxy Auth
- CVE-2026-106214: Information leak in Proxy
- CVE-2026-106364: Incorrect authorization in Omnibox
- CVE-2026-106239: Integer overflow in WebGL
- CVE-2026-106426: Race condition in Fonts
- CVE-2026-106419: Use after free in ANGLE
- CVE-2026-106396: Improper input validation in Omnibox
- CVE-2026-106323: Missing authorization in Chrome for iOS
- CVE-2026-106231: Uninitialized resource in Dawn
- CVE-2026-106202: Uninitialized resource in ANGLE
- CVE-2026-106273: Uninitialized resource in Video
- CVE-2026-106203: Incomplete cleanup in Autofill
- CVE-2026-106332: Integer overflow in Compositing
- CVE-2026-106281: Use after free in Tint
- CVE-2026-106298: Use after free in Chrome Tabs
- CVE-2026-106193: Use after free in Parser
- CVE-2026-106255: Race condition in V8
- CVE-2026-106393: Use after free in Storage
- CVE-2026-106227: Use after free in Core
- CVE-2026-106379: Uninitialized resource in Skia
- CVE-2026-106211: Use after free in TabStrip
- CVE-2026-106329: Incorrect authorization in FileSystem
- CVE-2026-106248: Use after free in Bindings
- CVE-2026-106235: Use after free in WebAudio
- CVE-2026-106257: Use after free in HTML
- CVE-2026-106268: Use after free in WebRTC
- CVE-2026-106278: Use after free in Select
- CVE-2026-106233: Use after free in Metrics
- CVE-2026-106318: Use after free in Media
- CVE-2026-106411: Use after free in Parser
- CVE-2026-106423: Use after free in Media
- CVE-2026-106346: Improper state validation in DevTools
- CVE-2026-106190: Use after free in Media
- CVE-2026-106357: Use after free in WebRTC
- CVE-2026-106240: Type confusion in V8
- CVE-2026-106184: Uninitialized resource in Media
- CVE-2026-106383: Use after free in Media
- CVE-2026-106349: Use after free in V8
- CVE-2026-106421: Use after free in PDF
- CVE-2026-106204: Use after free in PDF
- CVE-2026-106200: Use after free in Track
- CVE-2026-106265: UI misrepresentation in File
- CVE-2026-106238: Race condition in Fonts
- CVE-2026-106324: Incorrect authorization in WebAppInstalls
- CVE-2026-106420: Incorrect calculation in API
- CVE-2026-106222: Incorrect authorization in Sync
- CVE-2026-106208: Missing authorization in API
- CVE-2026-106286: Confused deputy in Omnibox
- CVE-2026-106181: Incorrect reference resolution in DevTools
- CVE-2026-106315: Use after free in Modularization
- CVE-2026-106274: Incorrect reference resolution in Browser
- CVE-2026-106365: Missing authorization in Animation
- CVE-2026-106267: Missing authorization in Network
- CVE-2026-106194: Missing authorization in WebAppInstalls
- CVE-2026-106313: Incorrect authorization in Browser
- CVE-2026-106283: Use after free in Streaming
- CVE-2026-106291: Use after free in GarbageCollection
- CVE-2026-106300: Race condition in CacheStorage
- CVE-2026-106314: Incorrect authorization in Bluetooth
- CVE-2026-106223: Uninitialized resource in GPU
- CVE-2026-106242: Information leak in Omnibox
- CVE-2026-106241:…
- Record
openSUSE-SU-2026:22041-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:22124-1No score
Security update for chromium
This update for chromium fixes the following issues:
Changes in chromium:
Chromium 155.0.8059.84 (boo#1285733):
- CVE-2026-110922: Use after free in Prerender
- CVE-2026-110913: Memory corruption in DOM
- CVE-2026-110919: Use after free in V8
- CVE-2026-110918: Memory corruption in Core
- CVE-2026-110917: Memory corruption in SVG
- CVE-2026-110921: Use after free in V8
- CVE-2026-110920: Memory corruption in V8
- CVE-2026-110916: Improper input validation in Desktop
- CVE-2026-110915: Use after free in Compositing
- CVE-2026-110914: Memory corruption in Workers
Chromium 155.0.8059.79 (boo#1285401):
- CVE-2026-110152: Buffer overflow in ANGLE
- CVE-2026-110149: Use after free in Browser
- CVE-2026-110136: Use after free in PDF
- CVE-2026-110161: Use after free in Network
- CVE-2026-110165: Use after free in Core
- CVE-2026-110148: Use after free in SVG
- CVE-2026-110151: Use after free in Media
- CVE-2026-110162: Use after free in Desktop
- CVE-2026-110170: Use after free in Bindings
- CVE-2026-110160: Missing authorization in ReadingMode
- CVE-2026-110143: Use of uninitialized variable in ThirdParty lmza_sdk
- CVE-2026-110146: Information leak in Passwords
- CVE-2026-110150: Privilege elevation in Installer
- CVE-2026-110156: Incorrect reference resolution in Extensions
- CVE-2026-110137: Use after free in WebRTC
- CVE-2026-110140: Type confusion in V8
- CVE-2026-110158: Use after free in Passwords
- CVE-2026-110145: Use after free in Passwords
- CVE-2026-110159: Incorrect authorization in Updater
- CVE-2026-110144: Incorrect authorization in Mojo
- CVE-2026-110153: Use after free in Media
- CVE-2026-110166: Buffer overflow in Animation
- CVE-2026-110169: Use after free in V8
- CVE-2026-110168: Use after free in V8
- CVE-2026-110139: Use after free in Media
- CVE-2026-110172: Use after free in Media
- CVE-2026-110164: Use after free in DOM
- CVE-2026-110163: Use after free in DOM
- CVE-2026-110141: Observable discrepancy in Media
- CVE-2026-110138: Use after free in ShapeDetection
- CVE-2026-110157: Use after free in SVG
- CVE-2026-110147: Use after free in PDF
- CVE-2026-110154: Use after free in Canvas
- CVE-2026-110155: Buffer overflow in PDFium
- CVE-2026-110167: Use after free in Media
- CVE-2026-110171: Use after free in Media
- CVE-2026-110142: Use after free in FileSystem
Chromium 155 promoted to stable - 155.0.8059.39 (boo#1284354):
- CVE-2026-106382: Use after free in Chromecast
- CVE-2026-106197: Use after free in Browser
- CVE-2026-106358: Use after free in Navigation
- CVE-2026-106347: Use after free in Track
- CVE-2026-106245: Uninitialized resource in ANGLE
- CVE-2026-106327: Incorrect authorization in Core
- CVE-2026-106366: Incomplete cleanup in CustomTabs
- CVE-2026-106258: Uninitialized resource in ANGLE
- CVE-2026-106376: Uninitialized resource in ANGLE
- CVE-2026-106308: Incorrect reference resolution in Autofill
- CVE-2026-106215: Uninitialized resource in ANGLE
- CVE-2026-106369: Missing authorization in Translate
- CVE-2026-106293: Type confusion in ANGLE
- CVE-2026-106377: Race condition in Fonts
- CVE-2026-106412: Race condition in Core
- CVE-2026-106243: Incomplete cleanup in Proxy Auth
- CVE-2026-106214: Information leak in Proxy
- CVE-2026-106364: Incorrect authorization in Omnibox
- CVE-2026-106239: Integer overflow in WebGL
- CVE-2026-106426: Race condition in Fonts
- CVE-2026-106419: Use after free in ANGLE
- CVE-2026-106396: Improper input validation in Omnibox
- CVE-2026-106323: Missing authorization in Chrome for iOS
- CVE-2026-106231: Uninitialized resource in Dawn
- CVE-2026-106202: Uninitialized resource in ANGLE
- CVE-2026-106273: Uninitialized resource in Video
- CVE-2026-106203: Incomplete cleanup in Autofill
- CVE-2026-106332: Integer overflow in Compositing
- CVE-2026-106281: Use after free in Tint
- CVE-2026-106298: Use…
- Record
openSUSE-SU-2026:22124-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
webkit2gtk3AlmaLinux:9 From an advisory covering 17 CVEs | before 2.54.2-0.el9_8.2 | 2.54.2-0.el9_8.2 |
webkit2gtk3-develAlmaLinux:9 From an advisory covering 17 CVEs | before 2.54.2-0.el9_8.2 | 2.54.2-0.el9_8.2 |
webkit2gtk3-jscAlmaLinux:9 From an advisory covering 17 CVEs | before 2.54.2-0.el9_8.2 | 2.54.2-0.el9_8.2 |
webkit2gtk3-jsc-develAlmaLinux:9 From an advisory covering 17 CVEs | before 2.54.2-0.el9_8.2 | 2.54.2-0.el9_8.2 |
webkit2gtk3AlmaLinux:8 From an advisory covering 18 CVEs | before 2.54.2-2.el8_10 | 2.54.2-2.el8_10 |
webkit2gtk3-develAlmaLinux:8 From an advisory covering 18 CVEs | before 2.54.2-2.el8_10 | 2.54.2-2.el8_10 |
webkit2gtk3-jscAlmaLinux:8 From an advisory covering 18 CVEs | before 2.54.2-2.el8_10 | 2.54.2-2.el8_10 |
webkit2gtk3-jsc-develAlmaLinux:8 From an advisory covering 18 CVEs | before 2.54.2-2.el8_10 | 2.54.2-2.el8_10 |
chromiumDebian:12 | before 155.0.8059.39-1~deb12u1, plus listed versions 113.0.5672.126-1114.0.5735.106-1114.0.5735.106-1~deb11u1114.0.5735.106-1~deb12u1114.0.5735.133-1 Show 45 moreShow less114.0.5735.133-1~deb11u1114.0.5735.133-1~deb12u1114.0.5735.198-1114.0.5735.198-1~deb11u1114.0.5735.198-1~deb12u1114.0.5735.90-1114.0.5735.90-2114.0.5735.90-2~deb11u1114.0.5735.90-2~deb12u1115.0.5790.102-1115.0.5790.102-2115.0.5790.170-1115.0.5790.170-1~deb11u1115.0.5790.170-1~deb12u1115.0.5790.98-1115.0.5790.98-1~deb11u1115.0.5790.98-1~deb12u1115.0.5790.98-2116.0.5845.110-1116.0.5845.110-1~deb11u1116.0.5845.110-1~deb12u1116.0.5845.110-2116.0.5845.140-1116.0.5845.140-1~deb11u1116.0.5845.140-1~deb12u1116.0.5845.180-1116.0.5845.180-1~deb11u1116.0.5845.180-1~deb12u1116.0.5845.96-1116.0.5845.96-1~deb11u1116.0.5845.96-1~deb12u1116.0.5845.96-2117.0.5938.132-1117.0.5938.132-1~deb11u1117.0.5938.132-1~deb12u1117.0.5938.132-2117.0.5938.149-1117.0.5938.149-1~deb11u1117.0.5938.149-1~deb12u1117.0.5938.62-1117.0.5938.62-1~deb11u1117.0.5938.62-1~deb12u1117.0.5938.92-1118.0.5993.117-1118.0.5993.117-1~deb11u1 | 155.0.8059.39-1~deb12u1 |
chromiumDebian:13 | before 155.0.8059.39-1~deb13u1, plus listed versions 138.0.7204.183-1139.0.7258.127-1139.0.7258.127-1~deb12u1139.0.7258.127-1~deb13u1139.0.7258.127-2 Show 45 moreShow less139.0.7258.138-1139.0.7258.138-1~deb12u1139.0.7258.138-1~deb13u1139.0.7258.154-1139.0.7258.154-1~deb12u1139.0.7258.154-1~deb13u1139.0.7258.66-1139.0.7258.66-1~deb12u1140.0.7339.127-1140.0.7339.127-1~deb12u1140.0.7339.127-1~deb13u1140.0.7339.185-1140.0.7339.185-1~deb12u1140.0.7339.185-1~deb13u1140.0.7339.207-1140.0.7339.207-1~deb12u1140.0.7339.207-1~deb13u1140.0.7339.80-1140.0.7339.80-1~deb12u1140.0.7339.80-1~deb13u1141.0.7390.107-1141.0.7390.107-1~deb12u1141.0.7390.107-1~deb13u1141.0.7390.122-1141.0.7390.122-1~deb12u1141.0.7390.122-1~deb13u1141.0.7390.54-1141.0.7390.54-1~deb12u1141.0.7390.54-1~deb13u1141.0.7390.65-1141.0.7390.65-1~deb12u1141.0.7390.65-1~deb13u1142.0.7444.134-1142.0.7444.134-1~deb12u1142.0.7444.134-1~deb13u1142.0.7444.162-1142.0.7444.162-1~deb12u1142.0.7444.162-1~deb13u1142.0.7444.175-1142.0.7444.175-1~deb12u1142.0.7444.175-1~deb13u1142.0.7444.59-1142.0.7444.59-1~deb12u1142.0.7444.59-1~deb13u1143.0.7499.109-1 | 155.0.8059.39-1~deb13u1 |
Show 42 moreShow less
| Package | Affected | Fixed |
|---|---|---|
chromiumDebian:14 | before 155.0.8059.39-1, plus listed versions 138.0.7204.183-1139.0.7258.127-1139.0.7258.127-1~deb12u1139.0.7258.127-1~deb13u1139.0.7258.127-2 Show 45 moreShow less139.0.7258.138-1139.0.7258.138-1~deb12u1139.0.7258.138-1~deb13u1139.0.7258.154-1139.0.7258.154-1~deb12u1139.0.7258.154-1~deb13u1139.0.7258.66-1139.0.7258.66-1~deb12u1140.0.7339.127-1140.0.7339.127-1~deb12u1140.0.7339.127-1~deb13u1140.0.7339.185-1140.0.7339.185-1~deb12u1140.0.7339.185-1~deb13u1140.0.7339.207-1140.0.7339.207-1~deb12u1140.0.7339.207-1~deb13u1140.0.7339.80-1140.0.7339.80-1~deb12u1140.0.7339.80-1~deb13u1141.0.7390.107-1141.0.7390.107-1~deb12u1141.0.7390.107-1~deb13u1141.0.7390.122-1141.0.7390.122-1~deb12u1141.0.7390.122-1~deb13u1141.0.7390.54-1141.0.7390.54-1~deb12u1141.0.7390.54-1~deb13u1141.0.7390.65-1141.0.7390.65-1~deb12u1141.0.7390.65-1~deb13u1142.0.7444.134-1142.0.7444.134-1~deb12u1142.0.7444.134-1~deb13u1142.0.7444.162-1142.0.7444.162-1~deb12u1142.0.7444.162-1~deb13u1142.0.7444.175-1142.0.7444.175-1~deb12u1142.0.7444.175-1~deb13u1142.0.7444.59-1142.0.7444.59-1~deb12u1142.0.7444.59-1~deb13u1143.0.7499.109-1 | 155.0.8059.39-1 |
libskiaDebian:14 | All versions, plus listed versions 146.20260311+dfsg-1146.20260311+dfsg-2146.20260311+dfsg-3146.20260311+dfsg-4146.20260414~git.ef5f213+dfsg-1 Show 9 moreShow less146.20260414~git.ef5f213+dfsg-2146.20260414~git.ef5f213+dfsg-3146.20260414~git.ef5f213+dfsg-4146.20260414~git.ef5f213+dfsg-5146.20260602~git.3476902+dfsg-1146.20260602~git.3476902+dfsg-2146.20260602~git.3476902+dfsg-3146.20260602~git.3476902+dfsg-4146.20260602~git.3476902+dfsg-5 | None known |
webkit2gtk3Red Hat:enterprise_linux:9::appstream From an advisory covering 18 CVEs | before 0:2.54.2-0.el9_8.2 | 0:2.54.2-0.el9_8.2 |
webkit2gtk3-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 18 CVEs | before 0:2.54.2-0.el9_8.2 | 0:2.54.2-0.el9_8.2 |
webkit2gtk3-debugsourceRed Hat:enterprise_linux:9::appstream From an advisory covering 18 CVEs | before 0:2.54.2-0.el9_8.2 | 0:2.54.2-0.el9_8.2 |
webkit2gtk3-develRed Hat:enterprise_linux:9::appstream From an advisory covering 18 CVEs | before 0:2.54.2-0.el9_8.2 | 0:2.54.2-0.el9_8.2 |
webkit2gtk3-devel-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 18 CVEs | before 0:2.54.2-0.el9_8.2 | 0:2.54.2-0.el9_8.2 |
webkit2gtk3-jscRed Hat:enterprise_linux:9::appstream From an advisory covering 18 CVEs | before 0:2.54.2-0.el9_8.2 | 0:2.54.2-0.el9_8.2 |
webkit2gtk3-jsc-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 18 CVEs | before 0:2.54.2-0.el9_8.2 | 0:2.54.2-0.el9_8.2 |
webkit2gtk3-jsc-develRed Hat:enterprise_linux:9::appstream From an advisory covering 18 CVEs | before 0:2.54.2-0.el9_8.2 | 0:2.54.2-0.el9_8.2 |
webkit2gtk3-jsc-devel-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 18 CVEs | before 0:2.54.2-0.el9_8.2 | 0:2.54.2-0.el9_8.2 |
webkit2gtk3Red Hat:enterprise_linux:8::appstream From an advisory covering 18 CVEs | before 0:2.54.2-2.el8_10 | 0:2.54.2-2.el8_10 |
webkit2gtk3-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 18 CVEs | before 0:2.54.2-2.el8_10 | 0:2.54.2-2.el8_10 |
webkit2gtk3-debugsourceRed Hat:enterprise_linux:8::appstream From an advisory covering 18 CVEs | before 0:2.54.2-2.el8_10 | 0:2.54.2-2.el8_10 |
webkit2gtk3-develRed Hat:enterprise_linux:8::appstream From an advisory covering 18 CVEs | before 0:2.54.2-2.el8_10 | 0:2.54.2-2.el8_10 |
webkit2gtk3-devel-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 18 CVEs | before 0:2.54.2-2.el8_10 | 0:2.54.2-2.el8_10 |
webkit2gtk3-jscRed Hat:enterprise_linux:8::appstream From an advisory covering 18 CVEs | before 0:2.54.2-2.el8_10 | 0:2.54.2-2.el8_10 |
webkit2gtk3-jsc-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 18 CVEs | before 0:2.54.2-2.el8_10 | 0:2.54.2-2.el8_10 |
webkit2gtk3-jsc-develRed Hat:enterprise_linux:8::appstream From an advisory covering 18 CVEs | before 0:2.54.2-2.el8_10 | 0:2.54.2-2.el8_10 |
webkit2gtk3-jsc-devel-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 18 CVEs | before 0:2.54.2-2.el8_10 | 0:2.54.2-2.el8_10 |
webkit2gtk3Red Hat:enterprise_linux:9::appstream From an advisory covering 93 CVEs | before 0:2.54.2-2.el9_9 | 0:2.54.2-2.el9_9 |
webkit2gtk3-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 93 CVEs | before 0:2.54.2-2.el9_9 | 0:2.54.2-2.el9_9 |
webkit2gtk3-debugsourceRed Hat:enterprise_linux:9::appstream From an advisory covering 93 CVEs | before 0:2.54.2-2.el9_9 | 0:2.54.2-2.el9_9 |
webkit2gtk3-develRed Hat:enterprise_linux:9::appstream From an advisory covering 93 CVEs | before 0:2.54.2-2.el9_9 | 0:2.54.2-2.el9_9 |
webkit2gtk3-devel-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 93 CVEs | before 0:2.54.2-2.el9_9 | 0:2.54.2-2.el9_9 |
webkit2gtk3-jscRed Hat:enterprise_linux:9::appstream From an advisory covering 93 CVEs | before 0:2.54.2-2.el9_9 | 0:2.54.2-2.el9_9 |
webkit2gtk3-jsc-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 93 CVEs | before 0:2.54.2-2.el9_9 | 0:2.54.2-2.el9_9 |
webkit2gtk3-jsc-develRed Hat:enterprise_linux:9::appstream From an advisory covering 93 CVEs | before 0:2.54.2-2.el9_9 | 0:2.54.2-2.el9_9 |
webkit2gtk3-jsc-devel-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 93 CVEs | before 0:2.54.2-2.el9_9 | 0:2.54.2-2.el9_9 |
webkit2gtk3Rocky Linux:9 From an advisory covering 17 CVEs | before 0:2.54.2-0.el9_8.2 | 0:2.54.2-0.el9_8.2 |
webkit2gtk3Rocky Linux:8 From an advisory covering 18 CVEs | before 0:2.54.2-2.el8_10 | 0:2.54.2-2.el8_10 |
webkit2gtk3Rocky Linux:9 From an advisory covering 93 CVEs | before 0:2.54.2-2.el9_9 | 0:2.54.2-2.el9_9 |
webkit2gtk3-debuginfoRocky Linux:9 From an advisory covering 93 CVEs | before 0:2.54.2-2.el9_9 | 0:2.54.2-2.el9_9 |
webkit2gtk3-debugsourceRocky Linux:9 From an advisory covering 93 CVEs | before 0:2.54.2-2.el9_9 | 0:2.54.2-2.el9_9 |
webkit2gtk3-develRocky Linux:9 From an advisory covering 93 CVEs | before 0:2.54.2-2.el9_9 | 0:2.54.2-2.el9_9 |
webkit2gtk3-devel-debuginfoRocky Linux:9 From an advisory covering 93 CVEs | before 0:2.54.2-2.el9_9 | 0:2.54.2-2.el9_9 |
webkit2gtk3-jscRocky Linux:9 From an advisory covering 93 CVEs | before 0:2.54.2-2.el9_9 | 0:2.54.2-2.el9_9 |
webkit2gtk3-jsc-debuginfoRocky Linux:9 From an advisory covering 93 CVEs | before 0:2.54.2-2.el9_9 | 0:2.54.2-2.el9_9 |
webkit2gtk3-jsc-develRocky Linux:9 From an advisory covering 93 CVEs | before 0:2.54.2-2.el9_9 | 0:2.54.2-2.el9_9 |
webkit2gtk3-jsc-devel-debuginfoRocky Linux:9 From an advisory covering 93 CVEs | before 0:2.54.2-2.el9_9 | 0:2.54.2-2.el9_9 |
chromiumopenSUSE:Tumbleweed From an advisory covering 246 CVEs | before 155.0.8059.39-1.1 | 155.0.8059.39-1.1 |
chromiumopenSUSE:Leap 16.0 From an advisory covering 293 CVEs | before 155.0.8059.84-bp160.1.1 | 155.0.8059.84-bp160.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected, aliases, references | OSV | |
| affected, aliases, references | OSV | |
| affected, aliases, references | OSV | |
| affected | ||
| affected, aliases, references | OSV | |
| affected, aliases, facts, references | OSV | |
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-106379 is a medium vulnerability (CVSS 4.3) in Google Chrome, published October 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. Fixed in chromium 155.0.8059.39-1~deb12u1.
References
chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html
issues.chromium.org/issues/561987051
nvd.nist.gov/vuln/detail/CVE-2026-106379
github.com/advisories/GHSA-wrg2-qmh9-jwcg
access.redhat.com/errata/RHSA-2026:95194
Show 194 moreShow less
bugzilla.redhat.com/2528197
errata.almalinux.org/9/ALSA-2026-95194.html
security-tracker.debian.org/tracker/CVE-2026-106379
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_95194.json
cve.org/CVERecord?id=CVE-2026-84359
issues.redhat.com/browse/RHEL-271317
support.apple.com/en-us/148281
errata.rockylinux.org/RLSA-2026:95194
suse.com/security/cve/CVE-2026-106179
bugzilla.suse.com/1284354
Left out here: 676 versions, 630 references and the rest of 3 source descriptions. The JSON record has them.