Google Chrome vulnerabilities

CVE-2024-1670 [HIGH] CWE-416 CVE-2024-1670: Use after free in Mojo in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to potentia Use after free in Mojo in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2024-4058 [HIGH] CWE-843 CVE-2024-4058: Type confusion in ANGLE in Google Chrome prior to 124.0.6367.78 allowed a remote attacker to potenti Type confusion in ANGLE in Google Chrome prior to 124.0.6367.78 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-3062 [CRITICAL] CWE-125 CVE-2026-3062: Out of bounds read and write in Tint in Google Chrome on Mac prior to 145.0.7632.116 allowed a remot Out of bounds read and write in Tint in Google Chrome on Mac prior to 145.0.7632.116 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

CVE-2025-14765 [HIGH] CWE-416 CVE-2025-14765: Use after free in WebGPU in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to poten Use after free in WebGPU in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2026-11651 [CRITICAL] CWE-416 CVE-2026-11651: Use after free in Network in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to exec Use after free in Network in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-14405 [CRITICAL] CWE-457 CVE-2026-14405: Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

CVE-2025-2135 [HIGH] CWE-843 CVE-2025-2135: Type Confusion in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentiall Type Confusion in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2021-30558 [HIGH] CVE-2021-30558: Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 al Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chrome security severity: Medium)

CVE-2024-1675 [HIGH] CWE-284 CVE-2024-1675: Insufficient policy enforcement in Download in Google Chrome prior to 122.0.6261.57 allowed a remote Insufficient policy enforcement in Download in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVE-2025-14766 [HIGH] CWE-125 CVE-2025-14766: Out of bounds read and write in V8 in Google Chrome prior to 143.0.7499.147 allowed a remote attacke Out of bounds read and write in V8 in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2026-13776 [CRITICAL] CWE-843 CVE-2026-13776: Type Confusion in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had com Type Confusion in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-0906 [CRITICAL] CWE-451 CVE-2026-0906: Incorrect security UI in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker Incorrect security UI in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low)

CVE-2023-4430 [HIGH] CWE-416 CVE-2023-4430: Use after free in Vulkan in Google Chrome prior to 116.0.5845.110 allowed a remote attacker to poten Use after free in Vulkan in Google Chrome prior to 116.0.5845.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2025-7656 [HIGH] CWE-472 CVE-2025-7656: Integer overflow in V8 in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potenti Integer overflow in V8 in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2021-21121 [CRITICAL] CWE-416 CVE-2021-21121: Use after free in Omnibox in Google Chrome on Linux prior to 88.0.4324.96 allowed a remote attacker Use after free in Omnibox in Google Chrome on Linux prior to 88.0.4324.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.

CVE-2018-20346 [HIGH] CWE-190 CVE-2018-20346: SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and result SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases), aka Magell

CVE-2023-5482 [HIGH] CWE-345 CVE-2023-5482: Insufficient data validation in USB in Google Chrome prior to 119.0.6045.105 allowed a remote attack Insufficient data validation in USB in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

CVE-2017-15398 [CRITICAL] CWE-119 CVE-2017-15398: A stack buffer overflow in the QUIC networking stack in Google Chrome prior to 62.0.3202.89 allowed A stack buffer overflow in the QUIC networking stack in Google Chrome prior to 62.0.3202.89 allowed a remote attacker to gain code execution via a malicious server.

CVE-2024-9954 [HIGH] CWE-416 CVE-2024-9954: Use after free in AI in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentiall Use after free in AI in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2024-12692 [HIGH] CWE-843 CVE-2024-12692: Type Confusion in V8 in Google Chrome prior to 131.0.6778.204 allowed a remote attacker to potential Type Confusion in V8 in Google Chrome prior to 131.0.6778.204 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)