Google Chrome vulnerabilities

CVE-2026-12462 [HIGH] CWE-416 CVE-2026-12462: Use after free in Media in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had c Use after free in Media in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-9901 [HIGH] CWE-416 CVE-2026-9901: Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had c Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

CVE-2019-5770 [HIGH] CWE-125 CVE-2019-5770: Insufficient input validation in WebGL in Google Chrome prior to 72.0.3626.81 allowed a remote attac Insufficient input validation in WebGL in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

CVE-2026-17948 [HIGH] CWE-843 CVE-2026-17948: Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a use Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Low)

CVE-2026-11632 [HIGH] CWE-416 CVE-2026-11632: Use after free in TabStrip in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who co Use after free in TabStrip in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-87608 [HIGH] CWE-295 CVE-2026-87608: Improper certificate validation in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote at Improper certificate validation in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: Low)

CVE-2026-17952 [HIGH] CWE-269 CVE-2026-17952: Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who c Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Low)

CVE-2020-6505 [CRITICAL] CWE-416 CVE-2020-6505: Use after free in speech in Google Chrome prior to 83.0.4103.106 allowed a remote attacker to potent Use after free in speech in Google Chrome prior to 83.0.4103.106 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.

CVE-2026-85045 [HIGH] CWE-367 CVE-2026-85045: Race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute ar Race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-95280 [HIGH] CWE-362 CVE-2026-95280: Race condition in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute ar Race condition in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2022-0973 [CRITICAL] CWE-416 CVE-2022-0973: Use after free in Safe Browsing in Google Chrome prior to 99.0.4844.74 allowed a remote attacker to Use after free in Safe Browsing in Google Chrome prior to 99.0.4844.74 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVE-2026-10022 [HIGH] CWE-843 CVE-2026-10022: Type Confusion in V8 in Google Chrome prior to 148.0.7778.216 allowed an attacker who convinced a us Type Confusion in V8 in Google Chrome prior to 148.0.7778.216 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Medium)

CVE-2022-0097 [CRITICAL] CVE-2022-0097: Inappropriate implementation in DevTools in Google Chrome prior to 97.0.4692.71 allowed an attacker Inappropriate implementation in DevTools in Google Chrome prior to 97.0.4692.71 allowed an attacker who convinced a user to install a malicious extension to to potentially allow extension to escape the sandbox via a crafted HTML page.

CVE-2018-17466 [HIGH] CWE-125 CVE-2018-17466: Incorrect texture handling in Angle in Google Chrome prior to 70.0.3538.67 allowed a remote attacker Incorrect texture handling in Angle in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

CVE-2017-5130 [HIGH] CWE-787 CVE-2017-5130: An integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in Google Chrome prior to 62.0.3 An integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in Google Chrome prior to 62.0.3202.62 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted XML file.

CVE-2020-10531 [HIGH] CWE-190 CVE-2020-10531: An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An int An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp.

CVE-2020-6515 [HIGH] CWE-416 CVE-2020-6515: Use after free in tab strip in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to pote Use after free in tab strip in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVE-2020-6427 [HIGH] CWE-787 CVE-2020-6427: Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potenti Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVE-2020-6422 [HIGH] CWE-787 CVE-2020-6422: Use after free in WebGL in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potenti Use after free in WebGL in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVE-2023-7012 [CRITICAL] CWE-20 CVE-2023-7012: Insufficient data validation in Permission Prompts in Google Chrome prior to 117.0.5938.62 allowed a Insufficient data validation in Permission Prompts in Google Chrome prior to 117.0.5938.62 allowed an attacker who convinced a user to install a malicious app to potentially perform a sandbox escape via a malicious file. (Chromium security severity: Medium)