Google Chrome vulnerabilities
7,336 known vulnerabilities affecting google/chrome.
Total CVEs
7,336
CISA KEV
77
actively exploited
Public exploits
92
Exploited in wild
89
Severity breakdown
CRITICAL691HIGH3450MEDIUM2986LOW155UNKNOWN54
Vulnerabilities
Page 10 of 367
CVE-2024-0223P3HIGHCVSS 8.8fixed in 120.0.6099.199≥ 120.0.6099.199, < 120.0.6099.1992024-01-04
CVE-2024-0223 [HIGH] CWE-787 CVE-2024-0223: Heap buffer overflow in ANGLE in Google Chrome prior to 120.0.6099.199 allowed a remote attacker to
Heap buffer overflow in ANGLE in Google Chrome prior to 120.0.6099.199 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2019-13767P3HIGHCVSS 8.8fixed in 79.0.3945.88≥ unspecified, < 79.0.3945.882020-01-10
CVE-2019-13767 [HIGH] CWE-416 CVE-2019-13767: Use after free in media picker in Google Chrome prior to 79.0.3945.88 allowed a remote attacker who
Use after free in media picker in Google Chrome prior to 79.0.3945.88 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
nvd
CVE-2026-87595P3CRITICALCVSS 9.8fixed in 153.0.8010.36≥ 153.0.8010.36, < 153.0.8010.362026-09-09
CVE-2026-87595 [CRITICAL] CWE-918 CVE-2026-87595: Server-side request forgery in Mobile in Google Chrome prior to 153.0.8010.36 allowed a remote attac
Server-side request forgery in Mobile in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-78904P3CRITICALCVSS 9.6fixed in 152.0.7977.65≥ 152.0.7977.65, < 152.0.7977.652026-08-25
CVE-2026-78904 [CRITICAL] CWE-843 CVE-2026-78904: Type confusion in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potenti
Type confusion in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-113014P3CRITICALCVSS 9.6fixed in 156.0.8078.47≥ 156.0.8078.47, < 156.0.8078.472026-10-20
CVE-2026-113014 [CRITICAL] CWE-416 CVE-2026-113014: Use after free in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker
Use after free in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-113189P3CRITICALCVSS 9.6fixed in 156.0.8078.47≥ 156.0.8078.47, < 156.0.8078.472026-10-20
CVE-2026-113189 [CRITICAL] CWE-416 CVE-2026-113189: Use after free in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute
Use after free in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-113261P3CRITICALCVSS 9.6fixed in 156.0.8078.47≥ 156.0.8078.47, < 156.0.8078.472026-10-20
CVE-2026-113261 [CRITICAL] CWE-416 CVE-2026-113261: Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker t
Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-113270P3CRITICALCVSS 9.6fixed in 156.0.8078.47≥ 156.0.8078.47, < 156.0.8078.472026-10-20
CVE-2026-113270 [CRITICAL] CWE-416 CVE-2026-113270: Use after free in Internals in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to exe
Use after free in Internals in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-113222P3CRITICALCVSS 9.6fixed in 156.0.8078.47≥ 156.0.8078.47, < 156.0.8078.472026-10-20
CVE-2026-113222 [CRITICAL] CWE-416 CVE-2026-113222: Use after free in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentiall
Use after free in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-113116P3CRITICALCVSS 9.6fixed in 156.0.8078.47≥ 156.0.8078.47, < 156.0.8078.472026-10-20
CVE-2026-113116 [CRITICAL] CWE-416 CVE-2026-113116: Use after free in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to pote
Use after free in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2025-9478P3HIGHCVSS 8.8fixed in 139.0.7258.154≥ 139.0.7258.154, < 139.0.7258.1542025-08-26
CVE-2025-9478 [HIGH] CWE-416 CVE-2025-9478: Use after free in ANGLE in Google Chrome prior to 139.0.7258.154 allowed a remote attacker to potent
Use after free in ANGLE in Google Chrome prior to 139.0.7258.154 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2025-2135P3HIGHCVSS 8.8fixed in 134.0.6998.88≥ 134.0.6998.88, < 134.0.6998.882025-03-10
CVE-2025-2135 [HIGH] CWE-843 CVE-2025-2135: Type Confusion in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentiall
Type Confusion in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2025-7656P3HIGHCVSS 8.8fixed in 138.0.7204.157≥ 138.0.7204.157, < 138.0.7204.1572025-07-15
CVE-2025-7656 [HIGH] CWE-472 CVE-2025-7656: Integer overflow in V8 in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potenti
Integer overflow in V8 in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2008-5749P3MEDIUMCVSS 6.8PoCv1.0.154.362008-12-29
CVE-2008-5749 [MEDIUM] CWE-94 CVE-2008-5749: Argument injection vulnerability in Google Chrome 1.0.154.36 on Windows XP SP3 allows remote attacke
Argument injection vulnerability in Google Chrome 1.0.154.36 on Windows XP SP3 allows remote attackers to execute arbitrary commands via the --renderer-path option in a chromehtml: URI. NOTE: a third party disputes this issue, stating that Chrome "will ask for user permission" and "cannot launch the applet even [if] you have given out the permission.
nvd
CVE-2022-3842P3HIGHCVSS 7.5fixed in 105.0.5195.125≥ unspecified, < 105.0.5195.1252023-01-02
CVE-2022-3842 [HIGH] CWE-416 CVE-2022-3842: Use after free in Passwords in Google Chrome prior to 105.0.5195.125 allowed a remote attacker who h
Use after free in Passwords in Google Chrome prior to 105.0.5195.125 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2025-14765P3HIGHCVSS 8.8fixed in 143.0.7499.146≥ 143.0.7499.147, < 143.0.7499.1472025-12-16
CVE-2025-14765 [HIGH] CWE-416 CVE-2025-14765: Use after free in WebGPU in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to poten
Use after free in WebGPU in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-79090P3CRITICALCVSS 9.8fixed in 152.0.7977.65≥ 152.0.7977.65, < 152.0.7977.652026-08-25
CVE-2026-79090 [CRITICAL] CWE-269 CVE-2026-79090: Improper privilege management in Actor in Google Chrome prior to 152.0.7977.65 allowed a remote atta
Improper privilege management in Actor in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-3062P3CRITICALCVSS 9.8fixed in 145.0.7632.116fixed in 145.0.7632.117+1 more2026-02-23
CVE-2026-3062 [CRITICAL] CWE-125 CVE-2026-3062: Out of bounds read and write in Tint in Google Chrome on Mac prior to 145.0.7632.116 allowed a remot
Out of bounds read and write in Tint in Google Chrome on Mac prior to 145.0.7632.116 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2024-4058P3HIGHCVSS 8.8fixed in 124.0.6367.78≥ 124.0.6367.78, < 124.0.6367.782024-05-01
CVE-2024-4058 [HIGH] CWE-843 CVE-2024-4058: Type confusion in ANGLE in Google Chrome prior to 124.0.6367.78 allowed a remote attacker to potenti
Type confusion in ANGLE in Google Chrome prior to 124.0.6367.78 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2026-13775P3CRITICALCVSS 9.8fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-13775 [CRITICAL] CWE-416 CVE-2026-13775: Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had comp
Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
nvd