Google Chrome vulnerabilities

CVE-2026-19147 [HIGH] CWE-416 CVE-2026-19147: Use after free in Aura in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker w Use after free in Aura in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-17650 [HIGH] CWE-416 CVE-2026-17650: Use after free in Compositing in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who Use after free in Compositing in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-17723 [HIGH] CWE-416 CVE-2026-17723: Use after free in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker Use after free in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-15120 [HIGH] CWE-416 CVE-2026-15120: Use after free in Core in Google Chrome on Windows prior to 150.0.7871.115 allowed a remote attacker Use after free in Core in Google Chrome on Windows prior to 150.0.7871.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-12437 [HIGH] CWE-416 CVE-2026-12437: Use after free in WebShare in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote atta Use after free in WebShare in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-106363 [HIGH] CWE-862 CVE-2026-106363: Missing authorization in FullScreen in Google Chrome prior to 155.0.8059.39 allowed a remote attacke Missing authorization in FullScreen in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-10894 [HIGH] CWE-416 CVE-2026-10894: Use after free in Printing in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacke Use after free in Printing in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-10908 [HIGH] CWE-416 CVE-2026-10908: Use after free in FullScreen in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote att Use after free in FullScreen in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-8530 [HIGH] CWE-416 CVE-2026-8530: Use after free in Network in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attac Use after free in Network in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-14427 [HIGH] CWE-122 CVE-2026-14427: Heap buffer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who h Heap buffer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-9993 [HIGH] CWE-416 CVE-2026-9993: Use after free in Views in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had c Use after free in Views in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted PDF file. (Chromium security severity: High)

CVE-2010-3729 [CRITICAL] CWE-190 CVE-2010-3729: The SPDY protocol implementation in Google Chrome before 6.0.472.62 does not properly manage buffers The SPDY protocol implementation in Google Chrome before 6.0.472.62 does not properly manage buffers, which might allow remote attackers to execute arbitrary code via unspecified vectors.

CVE-2011-1302 [CRITICAL] CWE-787 CVE-2011-1302: Heap-based buffer overflow in the GPU process in Google Chrome before 10.0.648.205 allows remote att Heap-based buffer overflow in the GPU process in Google Chrome before 10.0.648.205 allows remote attackers to execute arbitrary code via unknown vectors.

CVE-2026-7346 [HIGH] CWE-119 CVE-2026-7346: Inappropriate implementation in Tint in Google Chrome prior to 147.0.7727.138 allowed a remote attac Inappropriate implementation in Tint in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

CVE-2017-5053 [CRITICAL] CWE-125 CVE-2017-5053: An out-of-bounds read in V8 in Google Chrome prior to 57.0.2987.133 for Linux, Windows, and Mac, and An out-of-bounds read in V8 in Google Chrome prior to 57.0.2987.133 for Linux, Windows, and Mac, and 57.0.2987.132 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page, related to Array.prototype.indexOf.

CVE-2026-14122 [HIGH] CWE-20 CVE-2026-14122: Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Windows prior to 15 Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-11231 [HIGH] CWE-94 CVE-2026-11231: Inappropriate implementation in Safe Browsing in Google Chrome on Mac prior to 149.0.7827.53 allowed Inappropriate implementation in Safe Browsing in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a malicious file. (Chromium security severity: Low)

CVE-2021-21216 [MEDIUM] CWE-290 CVE-2021-21216: Inappropriate implementation in Autofill in Google Chrome prior to 90.0.4430.72 allowed a remote att Inappropriate implementation in Autofill in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to spoof security UI via a crafted HTML page.

CVE-2020-6522 [CRITICAL] CVE-2020-6522: Inappropriate implementation in external protocol handlers in Google Chrome prior to 84.0.4147.89 al Inappropriate implementation in external protocol handlers in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.

CVE-2011-3961 [CRITICAL] CWE-362 CVE-2011-3961: Race condition in Google Chrome before 17.0.963.46 allows remote attackers to execute arbitrary code Race condition in Google Chrome before 17.0.963.46 allows remote attackers to execute arbitrary code via vectors that trigger a crash of a utility process.