Google Chrome vulnerabilities

CVE-2025-0443 [HIGH] CWE-79 CVE-2025-0443: Insufficient data validation in Extensions in Google Chrome prior to 132.0.6834.83 allowed a remote Insufficient data validation in Extensions in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)

CVE-2025-4050 [HIGH] CWE-787 CVE-2025-4050: Out of bounds memory access in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote att Out of bounds memory access in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

CVE-2024-8639 [HIGH] CWE-416 CVE-2024-8639: Use after free in Autofill in Google Chrome on Android prior to 128.0.6613.137 allowed a remote atta Use after free in Autofill in Google Chrome on Android prior to 128.0.6613.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2024-9959 [HIGH] CWE-416 CVE-2024-9959: Use after free in DevTools in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who had Use after free in DevTools in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Medium)

CVE-2025-1918 [HIGH] CWE-125 CVE-2025-1918: Out of bounds read in PDFium in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to po Out of bounds read in PDFium in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to potentially perform out of bounds memory access via a crafted PDF file. (Chromium security severity: Medium)

CVE-2025-1914 [HIGH] CWE-125 CVE-2025-1914: Out of bounds read in V8 in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to perfor Out of bounds read in V8 in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

CVE-2022-4452 [HIGH] CVE-2022-4452: Insufficient data validation in crosvm in Google Chrome prior to 107.0.5304.62 allowed a remote atta Insufficient data validation in crosvm in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2025-2137 [HIGH] CWE-125 CVE-2025-2137: Out of bounds read in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to perfor Out of bounds read in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)

CVE-2024-3176 [HIGH] CWE-787 CVE-2024-3176: Out of bounds write in SwiftShader in Google Chrome prior to 117.0.5938.62 allowed a remote attacker Out of bounds write in SwiftShader in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)

CVE-2025-0762 [HIGH] CWE-416 CVE-2025-0762: Use after free in DevTools in Google Chrome prior to 132.0.6834.159 allowed a remote attacker to pot Use after free in DevTools in Google Chrome prior to 132.0.6834.159 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Medium)

CVE-2024-3168 [HIGH] CWE-416 CVE-2024-3168: Use after free in DevTools in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to pote Use after free in DevTools in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-106225 [HIGH] CWE-862 CVE-2026-106225: Missing authorization in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker Missing authorization in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVE-2025-8879 [HIGH] CWE-122 CVE-2025-8879: Heap buffer overflow in libaom in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to Heap buffer overflow in libaom in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to potentially exploit heap corruption via a curated set of gestures. (Chromium security severity: High)

CVE-2025-12725 [HIGH] CWE-125 CVE-2025-12725: Out of bounds read in WebGPU in Google Chrome on Android prior to 142.0.7444.137 allowed a remote at Out of bounds read in WebGPU in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)

CVE-2025-8882 [HIGH] CWE-416 CVE-2025-8882: Use after free in Aura in Google Chrome prior to 139.0.7258.127 allowed a remote attacker who convin Use after free in Aura in Google Chrome prior to 139.0.7258.127 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11071 [HIGH] CWE-416 CVE-2026-11071: Use after free in Base in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker wh Use after free in Base in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

CVE-2024-3173 [HIGH] CWE-345 CVE-2024-3173: Insufficient data validation in Updater in Google Chrome prior to 120.0.6099.62 allowed a remote att Insufficient data validation in Updater in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: High)

CVE-2026-95362 [HIGH] CWE-352 CVE-2026-95362: Cross-site request forgery in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote atta Cross-site request forgery in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVE-2011-1300 [CRITICAL] CWE-189 CVE-2011-1300: The Program::getActiveUniformMaxLength function in libGLESv2/Program.cpp in libGLESv2.dll in the Web The Program::getActiveUniformMaxLength function in libGLESv2/Program.cpp in libGLESv2.dll in the WebGLES library in Almost Native Graphics Layer Engine (ANGLE), as used in Mozilla Firefox 4.x before 4.0.1 on Windows and in the GPU process in Google Chrome before 10.0.648.205 on Windows, allows remote attackers to execute arbitrary code via unspecifi

CVE-2026-7930 [HIGH] CWE-20 CVE-2026-7930: Insufficient validation of untrusted input in Cookies in Google Chrome prior to 148.0.7778.96 allowe Insufficient validation of untrusted input in Cookies in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)