Google Chrome vulnerabilities

CVE-2026-12034 [HIGH] CWE-20 CVE-2026-12034: Insufficient validation of untrusted input in Linux Toolkit Theming in Google Chrome on Linux prior Insufficient validation of untrusted input in Linux Toolkit Theming in Google Chrome on Linux prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)

CVE-2026-11679 [HIGH] CWE-416 CVE-2026-11679: Use after free in Codecs in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attack Use after free in Codecs in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-9988 [HIGH] CWE-416 CVE-2026-9988: Use after free in WebRTC in Google Chrome on Linux prior to 148.0.7778.216 allowed a remote attacker Use after free in WebRTC in Google Chrome on Linux prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2010-0645 [CRITICAL] CWE-189 CVE-2010-0645: Multiple integer overflows in factory.cc in Google V8 before r3560, as used in Google Chrome before Multiple integer overflows in factory.cc in Google V8 before r3560, as used in Google Chrome before 4.0.249.89, allow remote attackers to execute arbitrary code in the Chrome sandbox via crafted use of JavaScript arrays.

CVE-2026-76019 [HIGH] CWE-863 CVE-2026-76019: Incorrect authorization in Workers in Google Chrome prior to 151.0.7922.173 allowed a remote attacke Incorrect authorization in Workers in Google Chrome prior to 151.0.7922.173 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)

CVE-2026-19153 [HIGH] CWE-20 CVE-2026-19153: Insufficient validation of untrusted input in Workers in Google Chrome prior to 151.0.7922.109 allow Insufficient validation of untrusted input in Workers in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

CVE-2026-17686 [HIGH] CWE-20 CVE-2026-17686: Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allo Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

CVE-2026-13806 [HIGH] CWE-20 CVE-2026-13806: Insufficient validation of untrusted input in Accessibility in Google Chrome prior to 150.0.7871.47 Insufficient validation of untrusted input in Accessibility in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

CVE-2026-87499 [HIGH] CWE-863 CVE-2026-87499: Incorrect authorization in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker Incorrect authorization in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

CVE-2026-11011 [HIGH] CWE-602 CVE-2026-11011: Insufficient policy enforcement in Password Manager in Google Chrome prior to 149.0.7827.53 allowed Insufficient policy enforcement in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87505 [HIGH] CWE-863 CVE-2026-87505: Incorrect authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attac Incorrect authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. (Chromium security severity: Medium)

CVE-2024-2886 [HIGH] CWE-416 CVE-2024-2886: Use after free in WebCodecs in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to per Use after free in WebCodecs in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)

CVE-2013-2870 [CRITICAL] CWE-399 CVE-2013-2870: Use-after-free vulnerability in Google Chrome before 28.0.1500.71 allows remote servers to execute a Use-after-free vulnerability in Google Chrome before 28.0.1500.71 allows remote servers to execute arbitrary code via crafted response traffic after a URL request.

CVE-2018-17462 [CRITICAL] CWE-416 CVE-2018-17462: Incorrect refcounting in AppCache in Google Chrome prior to 70.0.3538.67 allowed a remote attacker t Incorrect refcounting in AppCache in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to perform a sandbox escape via a crafted HTML page.

CVE-2020-15961 [CRITICAL] CVE-2020-15961: Insufficient policy validation in extensions in Google Chrome prior to 85.0.4183.121 allowed an atta Insufficient policy validation in extensions in Google Chrome prior to 85.0.4183.121 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension.

CVE-2020-15963 [CRITICAL] CVE-2020-15963: Insufficient policy enforcement in extensions in Google Chrome prior to 85.0.4183.121 allowed an att Insufficient policy enforcement in extensions in Google Chrome prior to 85.0.4183.121 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension.

CVE-2026-79216 [HIGH] CWE-122 CVE-2026-79216: Buffer overflow in Blink in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had c Buffer overflow in Blink in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-79139 [HIGH] CWE-20 CVE-2026-79139: Improper input validation in Media in Google Chrome on on Windows prior to 152.0.7977.65 allowed a r Improper input validation in Media in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-79083 [HIGH] CWE-841 CVE-2026-79083: Improper enforcement of behavioral workflow in Media in Google Chrome prior to 152.0.7977.65 allowed Improper enforcement of behavioral workflow in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-14409 [HIGH] CWE-693 CVE-2026-14409: Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)