Google Chrome vulnerabilities
7,357 known vulnerabilities affecting google/chrome.
Total CVEs
7,357
CISA KEV
77
actively exploited
Public exploits
92
Exploited in wild
89
Severity breakdown
CRITICAL707HIGH3501MEDIUM2993LOW155UNKNOWN1
Vulnerabilities
Page 107 of 368
CVE-2025-2136P3HIGHCVSS 8.8fixed in 134.0.6998.88≥ 134.0.6998.88, < 134.0.6998.882025-03-10
CVE-2025-2136 [HIGH] CWE-416 CVE-2025-2136: Use after free in Inspector in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to pot
Use after free in Inspector in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2025-8901P3HIGHCVSS 8.8fixed in 139.0.7258.127≥ 139.0.7258.127, < 139.0.7258.1272025-08-13
CVE-2025-8901 [HIGH] CWE-787 CVE-2025-8901: Out of bounds write in ANGLE in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to p
Out of bounds write in ANGLE in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-5292P3HIGHCVSS 8.8fixed in 146.0.7680.177≥ 146.0.7680.178, < 146.0.7680.1782026-04-01
CVE-2026-5292 [HIGH] CWE-125 CVE-2026-5292: Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker t
Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2021-38023P3HIGHCVSS 8.8fixed in 92.0.4515.107≥ 92.0.4515.107, < 92.0.4515.1072024-09-23
CVE-2021-38023 [HIGH] CWE-416 CVE-2021-38023: Use after free in Extensions in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to po
Use after free in Extensions in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-113143P3HIGHCVSS 8.8fixed in 156.0.8078.47≥ 156.0.8078.47, < 156.0.8078.472026-10-20
CVE-2026-113143 [HIGH] CWE-119 CVE-2026-113143: Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read
Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-113137P3HIGHCVSS 8.8fixed in 156.0.8078.47≥ 156.0.8078.47, < 156.0.8078.472026-10-20
CVE-2026-113137 [HIGH] CWE-119 CVE-2026-113137: Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to
Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2025-3620P3HIGHCVSS 8.8fixed in 135.0.7049.95≥ 135.0.7049.95, < 135.0.7049.952025-04-16
CVE-2025-3620 [HIGH] CWE-416 CVE-2025-3620: Use after free in USB in Google Chrome prior to 135.0.7049.95 allowed a remote attacker to potential
Use after free in USB in Google Chrome prior to 135.0.7049.95 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2025-10502P3HIGHCVSS 8.8fixed in 140.0.7339.185≥ 140.0.7339.185, < 140.0.7339.1852025-09-24
CVE-2025-10502 [HIGH] CWE-122 CVE-2025-10502: Heap buffer overflow in ANGLE in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to
Heap buffer overflow in ANGLE in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via malicious network traffic. (Chromium security severity: High)
nvd
CVE-2025-10892P3HIGHCVSS 8.8fixed in 140.0.7339.207≥ 140.0.7339.207, < 140.0.7339.2072025-09-24
CVE-2025-10892 [HIGH] CWE-472 CVE-2025-10892: Integer overflow in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to potenti
Integer overflow in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-4460P3HIGHCVSS 8.8fixed in 146.0.7680.153≥ 146.0.7680.153, < 146.0.7680.1532026-03-20
CVE-2026-4460 [HIGH] CWE-125 CVE-2026-4460: Out of bounds read in Skia in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to per
Out of bounds read in Skia in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2025-12727P3HIGHCVSS 8.8fixed in 142.0.7444.134fixed in 142.0.7444.135+1 more2025-11-10
CVE-2025-12727 [HIGH] CWE-787 CVE-2025-12727: Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.137 allowed a remote attacke
Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2025-13042P3HIGHCVSS 8.8fixed in 142.0.7444.162≥ 142.0.7444.166, < 142.0.7444.1662025-11-12
CVE-2025-13042 [HIGH] CWE-787 CVE-2025-13042: Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.166 allowed a remote attacke
Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.166 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2025-12438P3HIGHCVSS 8.8fixed in 142.0.7444.59≥ 142.0.7444.59, < 142.0.7444.592025-11-10
CVE-2025-12438 [HIGH] CWE-416 CVE-2025-12438: Use after free in Ozone in Google Chrome on Linux and ChromeOS prior to 142.0.7444.59 allowed a remo
Use after free in Ozone in Google Chrome on Linux and ChromeOS prior to 142.0.7444.59 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-4462P3HIGHCVSS 8.8fixed in 146.0.7680.153≥ 146.0.7680.153, < 146.0.7680.1532026-03-20
CVE-2026-4462 [HIGH] CWE-125 CVE-2026-4462: Out of bounds read in Blink in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to pe
Out of bounds read in Blink in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-11085P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11085 [HIGH] CWE-472 CVE-2026-11085: Integer overflow in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker
Integer overflow in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2025-12432P3HIGHCVSS 8.8fixed in 142.0.7444.59≥ 142.0.7444.59, < 142.0.7444.592025-11-10
CVE-2025-12432 [HIGH] CWE-362 CVE-2025-12432: Race in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit
Race in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-11172P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11172 [HIGH] CWE-451 CVE-2026-11172: Incorrect security UI in Contact Picker in Google Chrome on Android prior to 149.0.7827.53 allowed a
Incorrect security UI in Contact Picker in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-11175P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11175 [HIGH] CWE-451 CVE-2026-11175: Incorrect security UI in Messages in Google Chrome on Android prior to 149.0.7827.53 allowed a remot
Incorrect security UI in Messages in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-11202P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11202 [HIGH] CWE-20 CVE-2026-11202: Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowe
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-11179P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11179 [HIGH] CWE-284 CVE-2026-11179: Inappropriate implementation in ORB in Google Chrome prior to 149.0.7827.53 allowed a remote attacke
Inappropriate implementation in ORB in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
nvd