Google Chrome vulnerabilities
7,357 known vulnerabilities affecting google/chrome.
Total CVEs
7,357
CISA KEV
77
actively exploited
Public exploits
92
Exploited in wild
89
Severity breakdown
CRITICAL707HIGH3501MEDIUM2993LOW155UNKNOWN1
Vulnerabilities
Page 125 of 368
CVE-2026-14064P3HIGHCVSS 7.5fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-14064 [HIGH] CWE-416 CVE-2026-14064: Use after free in PageInfo in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attac
Use after free in PageInfo in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-5284P3HIGHCVSS 7.5fixed in 146.0.7680.177≥ 146.0.7680.178, < 146.0.7680.1782026-04-01
CVE-2026-5284 [HIGH] CWE-416 CVE-2026-5284: Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had co
Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-10901P3HIGHCVSS 7.5fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-10901 [HIGH] CWE-416 CVE-2026-10901: Use after free in Passwords in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker
Use after free in Passwords in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2026-13855P3HIGHCVSS 7.5fixed in 150.0.7871.46≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-13855 [HIGH] CWE-416 CVE-2026-13855: Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker w
Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-13283P3HIGHCVSS 7.5fixed in 149.0.7827.201≥ 149.0.7827.201, < 149.0.7827.2012026-06-25
CVE-2026-13283 [HIGH] CWE-416 CVE-2026-13283: Use after free in AdFilter in Google Chrome on Android prior to 149.0.7827.201 allowed a remote atta
Use after free in AdFilter in Google Chrome on Android prior to 149.0.7827.201 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-6319P3HIGHCVSS 7.5fixed in 147.0.7727.101≥ 147.0.7727.101, < 147.0.7727.1012026-04-15
CVE-2026-6319 [HIGH] CWE-416 CVE-2026-6319: Use after free in Payments in Google Chrome on Android prior to 147.0.7727.101 allowed a remote atta
Use after free in Payments in Google Chrome on Android prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-6308P3HIGHCVSS 7.5fixed in 147.0.7727.101≥ 147.0.7727.101, < 147.0.7727.1012026-04-15
CVE-2026-6308 [HIGH] CWE-125 CVE-2026-6308: Out of bounds read in Media in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who c
Out of bounds read in Media in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-9963P3HIGHCVSS 7.5fixed in 148.0.7778.216≥ 148.0.7778.216, < 148.0.7778.2162026-05-28
CVE-2026-9963 [HIGH] CWE-457 CVE-2026-9963: Uninitialized Use in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker w
Uninitialized Use in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-11639P3HIGHCVSS 7.5fixed in 149.0.7827.103≥ 149.0.7827.103, < 149.0.7827.1032026-06-09
CVE-2026-11639 [HIGH] CWE-416 CVE-2026-11639: Use after free in Compositing in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attac
Use after free in Compositing in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2026-102327P3HIGHCVSS 7.5fixed in 154.0.8037.92≥ 154.0.8037.92, < 154.0.8037.922026-09-29
CVE-2026-102327 [HIGH] CWE-863 CVE-2026-102327: Incorrect authorization in WebView in Google Chrome on on Android prior to 154.0.8037.92 allowed a r
Incorrect authorization in WebView in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-9909P3HIGHCVSS 7.5fixed in 148.0.7778.216fixed in 148.0.7778.215+1 more2026-05-28
CVE-2026-9909 [HIGH] CWE-472 CVE-2026-9909: Integer overflow in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had
Integer overflow in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2020-16045P3CRITICALCVSS 9.6fixed in 87.0.4280.66≥ unspecified, < 87.0.4280.662021-01-14
CVE-2020-16045 [CRITICAL] CWE-416 CVE-2020-16045: Use after Free in Payments in Google Chrome on Android prior to 87.0.4280.66 allowed a remote attack
Use after Free in Payments in Google Chrome on Android prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
nvd
CVE-2026-19558P3HIGHCVSS 7.5fixed in 151.0.7922.137≥ 151.0.7922.137, < 151.0.7922.1372026-08-11
CVE-2026-19558 [HIGH] CWE-416 CVE-2026-19558: Use after free in Extensions in Google Chrome prior to 151.0.7922.137 allowed an attacker who convin
Use after free in Extensions in Google Chrome prior to 151.0.7922.137 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: High)
nvd
CVE-2026-19165P3HIGHCVSS 7.5fixed in 151.0.7922.109≥ 151.0.7922.109, < 151.0.7922.1092026-08-06
CVE-2026-19165 [HIGH] CWE-416 CVE-2026-19165: Use after free in Extensions in Google Chrome prior to 151.0.7922.109 allowed an attacker who convin
Use after free in Extensions in Google Chrome prior to 151.0.7922.109 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: High)
nvd
CVE-2026-17898P3HIGHCVSS 7.5fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17898 [HIGH] CWE-416 CVE-2026-17898: Use after free in DevTools in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced
Use after free in DevTools in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Low)
nvd
CVE-2026-11255P3HIGHCVSS 7.5fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-05
CVE-2026-11255 [HIGH] CWE-20 CVE-2026-11255: Insufficient validation of untrusted input in Storage Access API in Google Chrome prior to 149.0.782
Insufficient validation of untrusted input in Storage Access API in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-10005P3HIGHCVSS 7.5fixed in 148.0.7778.215≥ 148.0.7778.216, < 148.0.7778.2162026-05-28
CVE-2026-10005 [HIGH] CWE-416 CVE-2026-10005: Use after free in WebAppInstalls in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote at
Use after free in WebAppInstalls in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2019-5850P3CRITICALCVSS 9.6fixed in 76.0.3809.87≥ unspecified, < 76.0.3809.872019-11-25
CVE-2019-5850 [CRITICAL] CWE-416 CVE-2019-5850: Use after free in offline mode in Google Chrome prior to 76.0.3809.87 allowed a remote attacker who
Use after free in offline mode in Google Chrome prior to 76.0.3809.87 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
nvd
CVE-2026-9956P3HIGHCVSS 7.5fixed in 148.0.7778.216≥ 148.0.7778.216, < 148.0.7778.2162026-05-28
CVE-2026-9956 [HIGH] CWE-416 CVE-2026-9956: Use after free in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker who
Use after free in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-9934P3HIGHCVSS 7.5fixed in 148.0.7778.216≥ 148.0.7778.216, < 148.0.7778.2162026-05-28
CVE-2026-9934 [HIGH] CWE-416 CVE-2026-9934: Use after free in Aura in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who convin
Use after free in Aura in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
nvd