Google Chrome vulnerabilities

CVE-2026-7963 [HIGH] CWE-693 CVE-2026-7963: Inappropriate implementation in ServiceWorker in Google Chrome prior to 148.0.7778.96 allowed a remo Inappropriate implementation in ServiceWorker in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-9895 [HIGH] CWE-125 CVE-2026-9895: Out of bounds read in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had Out of bounds read in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-9889 [HIGH] CWE-125 CVE-2026-9889: Out of bounds read and write in Dawn in Google Chrome on Android prior to 148.0.7778.216 allowed a r Out of bounds read and write in Dawn in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-8571 [HIGH] CWE-693 CVE-2026-8571: Insufficient policy enforcement in GPU in Google Chrome on Android prior to 148.0.7778.168 allowed a Insufficient policy enforcement in GPU in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-9892 [HIGH] CWE-269 CVE-2026-9892: Inappropriate implementation in Skia in Google Chrome on Android prior to 148.0.7778.216 allowed a r Inappropriate implementation in Skia in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-11682 [HIGH] CWE-20 CVE-2026-11682: Inappropriate implementation in Views in Google Chrome on Linux prior to 149.0.7827.103 allowed a re Inappropriate implementation in Views in Google Chrome on Linux prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-10014 [HIGH] CWE-416 CVE-2026-10014: Use after free in WebMIDI in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attac Use after free in WebMIDI in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-10017 [HIGH] CWE-125 CVE-2026-10017: Out of bounds read in Headless in Google Chrome prior to 148.0.7778.216 allowed a remote attacker wh Out of bounds read in Headless in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-13025 [HIGH] CWE-20 CVE-2026-13025: Race in DevTools in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromi Race in DevTools in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-9977 [HIGH] CWE-20 CVE-2026-9977: Insufficient validation of untrusted input in WebShare in Google Chrome on Android prior to 148.0.77 Insufficient validation of untrusted input in WebShare in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-8520 [HIGH] CWE-362 CVE-2026-8520: Race in Payments in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially p Race in Payments in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-15119 [HIGH] CWE-362 CVE-2026-15119: Race in GetUserMedia in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who had comp Race in GetUserMedia in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2025-0611 [HIGH] CWE-122 CVE-2025-0611: Object corruption in V8 in Google Chrome prior to 132.0.6834.110 allowed a remote attacker to potent Object corruption in V8 in Google Chrome prior to 132.0.6834.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2025-11209 [HIGH] CWE-290 CVE-2025-11209: Inappropriate implementation in Omnibox in Google Chrome on Android prior to 141.0.7390.54 allowed a Inappropriate implementation in Omnibox in Google Chrome on Android prior to 141.0.7390.54 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)

CVE-2025-1915 [HIGH] CWE-22 CVE-2025-1915: Improper Limitation of a Pathname to a Restricted Directory in DevTools in Google Chrome on Windows Improper Limitation of a Pathname to a Restricted Directory in DevTools in Google Chrome on Windows prior to 134.0.6998.35 allowed an attacker who convinced a user to install a malicious extension to bypass file access restrictions via a crafted Chrome Extension. (Chromium security severity: Medium)

CVE-2026-13974 [HIGH] CWE-472 CVE-2026-13974: Integer overflow in Safe Browsing in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote at Integer overflow in Safe Browsing in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a malicious file. (Chromium security severity: Medium)

CVE-2026-14090 [HIGH] CWE-125 CVE-2026-14090: Insufficient validation of untrusted input in CameraCapture in Google Chrome on ChromeOS prior to 15 Insufficient validation of untrusted input in CameraCapture in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-11689 [HIGH] CWE-20 CVE-2026-11689: Insufficient policy enforcement in Passwords in Google Chrome prior to 149.0.7827.103 allowed a remo Insufficient policy enforcement in Passwords in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

CVE-2010-0659 [CRITICAL] CWE-399 CVE-2010-0659: The image decoder in WebKit before r52833, as used in Google Chrome before 4.0.249.78, does not prop The image decoder in WebKit before r52833, as used in Google Chrome before 4.0.249.78, does not properly handle a failure of memory allocation, which allows remote attackers to execute arbitrary code in the Chrome sandbox via a malformed GIF file that specifies a large size.

CVE-2026-5907 [HIGH] CWE-125 CVE-2026-5907: Insufficient data validation in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attac Insufficient data validation in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out of bounds memory read via a crafted video file. (Chromium security severity: Low)