Google Chrome vulnerabilities
7,357 known vulnerabilities affecting google/chrome.
Total CVEs
7,357
CISA KEV
77
actively exploited
Public exploits
92
Exploited in wild
89
Severity breakdown
CRITICAL707HIGH3501MEDIUM2993LOW155UNKNOWN1
Vulnerabilities
Page 110 of 368
CVE-2018-6090P3HIGHCVSS 8.8fixed in 66.0.3359.117≥ unspecified, < 66.0.3359.1172018-12-04
CVE-2018-6090 [HIGH] CWE-190 CVE-2018-6090: An integer overflow that lead to a heap buffer-overflow in Skia in Google Chrome prior to 66.0.3359.
An integer overflow that lead to a heap buffer-overflow in Skia in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
nvd
CVE-2026-13794P3HIGHCVSS 7.5fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-13794 [HIGH] CWE-20 CVE-2026-13794: Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Windows prior to 15
Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2020-6461P3CRITICALCVSS 9.6fixed in 81.0.4044.129≥ unspecified, < 81.0.4044.1292020-05-21
CVE-2020-6461 [CRITICAL] CWE-416 CVE-2020-6461: Use after free in storage in Google Chrome prior to 81.0.4044.129 allowed a remote attacker who had
Use after free in storage in Google Chrome prior to 81.0.4044.129 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
nvd
CVE-2021-30571P3CRITICALCVSS 9.6fixed in 92.0.4515.107≥ unspecified, < 92.0.4515.1072021-08-03
CVE-2021-30571 [CRITICAL] CWE-863 CVE-2021-30571: Insufficient policy enforcement in DevTools in Google Chrome prior to 92.0.4515.107 allowed an attac
Insufficient policy enforcement in DevTools in Google Chrome prior to 92.0.4515.107 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted HTML page.
nvd
CVE-2026-78906P3HIGHCVSS 7.5fixed in 152.0.7977.65≥ 152.0.7977.65, < 152.0.7977.652026-08-25
CVE-2026-78906 [HIGH] CWE-362 CVE-2026-78906: Race condition in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potenti
Race condition in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-13925P3HIGHCVSS 7.5fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-13925 [HIGH] CWE-20 CVE-2026-13925: Inappropriate implementation in Downloads in Google Chrome on Windows prior to 150.0.7871.47 allowed
Inappropriate implementation in Downloads in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2021-21107P3CRITICALCVSS 9.6fixed in 87.0.4280.141≥ unspecified, < 87.0.4280.1412021-01-08
CVE-2021-21107 [CRITICAL] CWE-416 CVE-2021-21107: Use after free in drag and drop in Google Chrome on Linux prior to 87.0.4280.141 allowed a remote at
Use after free in drag and drop in Google Chrome on Linux prior to 87.0.4280.141 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
nvd
CVE-2026-17896P3HIGHCVSS 7.5fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17896 [HIGH] CWE-416 CVE-2026-17896: Use after free in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to exec
Use after free in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-14426P3HIGHCVSS 7.5fixed in 150.0.7871.46≥ 150.0.7871.46, < 150.0.7871.462026-07-01
CVE-2026-14426 [HIGH] CWE-416 CVE-2026-14426: Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who convinced
Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-13802P3HIGHCVSS 7.5fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-13802 [HIGH] CWE-416 CVE-2026-13802: Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convin
Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2021-21142P3CRITICALCVSS 9.6fixed in 88.0.4324.146≥ unspecified, < 88.0.4324.1462021-02-09
CVE-2021-21142 [CRITICAL] CWE-416 CVE-2021-21142: Use after free in Payments in Google Chrome on Mac prior to 88.0.4324.146 allowed a remote attacker
Use after free in Payments in Google Chrome on Mac prior to 88.0.4324.146 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
nvd
CVE-2026-13968P3HIGHCVSS 7.5fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-13968 [HIGH] CWE-20 CVE-2026-13968: Insufficient validation of untrusted input in DevTools in Google Chrome prior to 150.0.7871.47 allow
Insufficient validation of untrusted input in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code inside a sandbox via a malicious file. (Chromium security severity: Medium)
nvd
CVE-2026-13807P3HIGHCVSS 7.5fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-13807 [HIGH] CWE-416 CVE-2026-13807: Use after free in Import in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker wh
Use after free in Import in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a malicious file. (Chromium security severity: High)
nvd
CVE-2026-7897P3HIGHCVSS 7.5fixed in 148.0.7778.96≥ 148.0.7778.96, < 148.0.7778.962026-05-06
CVE-2026-7897 [HIGH] CWE-416 CVE-2026-7897: Use after free in Mobile in Google Chrome on iOS prior to 148.0.7778.96 allowed a remote attacker wh
Use after free in Mobile in Google Chrome on iOS prior to 148.0.7778.96 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2026-78901P3HIGHCVSS 7.5fixed in 152.0.7977.65≥ 152.0.7977.65, < 152.0.7977.652026-08-25
CVE-2026-78901 [HIGH] CWE-362 CVE-2026-78901: Race condition in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute ar
Race condition in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-76020P3HIGHCVSS 7.5fixed in 151.0.7922.173≥ 151.0.7922.173, < 151.0.7922.1732026-08-20
CVE-2026-76020 [HIGH] CWE-367 CVE-2026-76020: Race condition in V8 in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to execute a
Race condition in V8 in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-17979P3HIGHCVSS 7.5fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17979 [HIGH] CWE-362 CVE-2026-17979: Race in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary co
Race in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2021-38013P3CRITICALCVSS 9.6fixed in 96.0.4664.45≥ unspecified, < 96.0.4664.452021-12-23
CVE-2021-38013 [CRITICAL] CWE-787 CVE-2021-38013: Heap buffer overflow in fingerprint recognition in Google Chrome on ChromeOS prior to 96.0.4664.45 a
Heap buffer overflow in fingerprint recognition in Google Chrome on ChromeOS prior to 96.0.4664.45 allowed a remote attacker who had compromised a WebUI renderer process to potentially perform a sandbox escape via a crafted HTML page.
nvd
CVE-2021-37981P3CRITICALCVSS 9.6fixed in 95.0.4638.54≥ unspecified, < 95.0.4638.542021-11-02
CVE-2021-37981 [CRITICAL] CWE-787 CVE-2021-37981: Heap buffer overflow in Skia in Google Chrome prior to 95.0.4638.54 allowed a remote attacker who ha
Heap buffer overflow in Skia in Google Chrome prior to 95.0.4638.54 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
nvd
CVE-2026-11641P3HIGHCVSS 7.5fixed in 149.0.7827.103≥ 149.0.7827.103, < 149.0.7827.1032026-06-09
CVE-2026-11641 [HIGH] CWE-416 CVE-2026-11641: Use after free in Bluetooth in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote att
Use after free in Bluetooth in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
nvd