Google Chrome vulnerabilities

CVE-2023-0137 [HIGH] CWE-787 CVE-2023-0137: Heap buffer overflow in Platform Apps in Google Chrome on Chrome OS prior to 109.0.5414.74 allowed a Heap buffer overflow in Platform Apps in Google Chrome on Chrome OS prior to 109.0.5414.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

CVE-2023-0129 [HIGH] CWE-787 CVE-2023-0129: Heap buffer overflow in Network Service in Google Chrome prior to 109.0.5414.74 allowed an attacker Heap buffer overflow in Network Service in Google Chrome prior to 109.0.5414.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page and specific interactions. (Chromium security severity: High)

CVE-2022-4179 [HIGH] CWE-416 CVE-2022-4179: Use after free in Audio in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a Use after free in Audio in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)

CVE-2022-4180 [HIGH] CWE-416 CVE-2022-4180: Use after free in Mojo in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a u Use after free in Mojo in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)

CVE-2022-3658 [HIGH] CWE-416 CVE-2022-3658: Use after free in Feedback service on Chrome OS in Google Chrome on Chrome OS prior to 107.0.5304.62 Use after free in Feedback service on Chrome OS in Google Chrome on Chrome OS prior to 107.0.5304.62 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via specific UI interaction. (Chromium security severity: Medium)

CVE-2023-1227 [HIGH] CWE-416 CVE-2023-1227: Use after free in Core in Google Chrome on Lacros prior to 111.0.5563.64 allowed a remote attacker w Use after free in Core in Google Chrome on Lacros prior to 111.0.5563.64 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via crafted UI interaction. (Chromium security severity: Medium)

CVE-2022-3071 [HIGH] CWE-362 CVE-2022-3071: Use after free in Tab Strip in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a r Use after free in Tab Strip in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interaction.

CVE-2022-2609 [HIGH] CWE-362 CVE-2022-2609: Use after free in Nearby Share in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote Use after free in Nearby Share in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via specific UI interactions.

CVE-2022-2607 [HIGH] CWE-362 CVE-2022-2607: Use after free in Tab Strip in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote at Use after free in Tab Strip in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via specific UI interactions.

CVE-2024-0813 [HIGH] CWE-416 CVE-2024-0813: Use after free in Reading Mode in Google Chrome prior to 121.0.6167.85 allowed an attacker who convi Use after free in Reading Mode in Google Chrome prior to 121.0.6167.85 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via specific UI interaction. (Chromium security severity: Medium)

CVE-2023-4369 [HIGH] CVE-2023-4369: Insufficient data validation in Systems Extensions in Google Chrome on ChromeOS prior to 116.0.5845. Insufficient data validation in Systems Extensions in Google Chrome on ChromeOS prior to 116.0.5845.120 allowed an attacker who convinced a user to install a malicious extension to bypass file restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVE-2025-10201 [HIGH] CWE-284 CVE-2025-10201: Inappropriate implementation in Mojo in Google Chrome on Android, Linux, ChromeOS prior to 140.0.733 Inappropriate implementation in Mojo in Google Chrome on Android, Linux, ChromeOS prior to 140.0.7339.127 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

CVE-2019-5755 [HIGH] CWE-189 CVE-2019-5755: Incorrect handling of negative zero in V8 in Google Chrome prior to 72.0.3626.81 allowed a remote at Incorrect handling of negative zero in V8 in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page.

CVE-2026-3539 [HIGH] CWE-1091 CVE-2026-3539: Object lifecycle issue in DevTools in Google Chrome prior to 145.0.7632.159 allowed an attacker who Object lifecycle issue in DevTools in Google Chrome prior to 145.0.7632.159 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)

CVE-2021-21172 [HIGH] CVE-2021-21172: Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 89.0.4389.72 Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 89.0.4389.72 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page.

CVE-2026-17699 [HIGH] CWE-416 CVE-2026-17699: Use after free in Views in Google Chrome prior to 151.0.7922.72 allowed a local attacker to potentia Use after free in Views in Google Chrome prior to 151.0.7922.72 allowed a local attacker to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)

CVE-2015-1297 [HIGH] CWE-254 CVE-2015-1297: The WebRequest API implementation in extensions/browser/api/web_request/web_request_api.cc in Google The WebRequest API implementation in extensions/browser/api/web_request/web_request_api.cc in Google Chrome before 45.0.2454.85 does not properly consider a request's source before accepting the request, which allows remote attackers to bypass intended access restrictions via a crafted (1) app or (2) extension.

CVE-2026-7352 [HIGH] CWE-416 CVE-2026-7352: Use after free in Media in Google Chrome on Android prior to 147.0.7727.138 allowed a remote attacke Use after free in Media in Google Chrome on Android prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-10940 [HIGH] CWE-362 CVE-2026-10940: Race in Codecs in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had Race in Codecs in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-9972 [HIGH] CWE-457 CVE-2026-9972: Uninitialized Use in Gamepad in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attack Uninitialized Use in Gamepad in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)