Google Chrome vulnerabilities

4,008 known vulnerabilities affecting google/chrome.

Total CVEs

4,008

CISA KEV

actively exploited

Public exploits

Exploited in wild

Severity breakdown

CRITICAL298HIGH2025MEDIUM1626LOW17UNKNOWN42

Vulnerabilities

Page 125 of 201

CVE-2017-5126HIGHCVSS 8.8fixed in 62.0.3202.622018-02-07

CVE-2017-5126 [HIGH] CWE-416 CVE-2017-5126: A use after free in PDFium in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to poten A use after free in PDFium in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.

nvd

CVE-2017-5128HIGHCVSS 8.8fixed in 62.0.3202.622018-02-07

CVE-2017-5128 [HIGH] CWE-119 CVE-2017-5128: Heap buffer overflow in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to po Heap buffer overflow in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, related to WebGL.

nvd

CVE-2017-15391MEDIUMCVSS 6.5fixed in 62.0.3202.622018-02-07

CVE-2017-15391 [MEDIUM] CVE-2017-15391: Insufficient Policy Enforcement in Extensions in Google Chrome prior to 62.0.3202.62 allowed a remot Insufficient Policy Enforcement in Extensions in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to access Extension pages without authorisation via a crafted HTML page.

nvd

CVE-2017-15389MEDIUMCVSS 6.5fixed in 62.0.3202.622018-02-07

CVE-2017-15389 [MEDIUM] CWE-20 CVE-2017-15389: An insufficient watchdog timer in navigation in Google Chrome prior to 62.0.3202.62 allowed a remote An insufficient watchdog timer in navigation in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.

nvd

CVE-2017-15390MEDIUMCVSS 6.5fixed in 62.0.3202.622018-02-07

CVE-2017-15390 [MEDIUM] CWE-20 CVE-2017-15390: Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 62.0.3202.62 allowed a remote a Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.

nvd

CVE-2017-15395MEDIUMCVSS 6.5fixed in 62.0.3202.622018-02-07

CVE-2017-15395 [MEDIUM] CWE-416 CVE-2017-15395: A use after free in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potent A use after free in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, aka an ImageCapture NULL pointer dereference.

nvd

CVE-2017-15394MEDIUMCVSS 6.5fixed in 62.0.3202.622018-02-07

CVE-2017-15394 [MEDIUM] CWE-20 CVE-2017-15394: Insufficient Policy Enforcement in Extensions in Google Chrome prior to 62.0.3202.62 allowed a remot Insufficient Policy Enforcement in Extensions in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform domain spoofing in permission dialogs via IDN homographs in a crafted Chrome Extension.

nvd

CVE-2017-15386MEDIUMCVSS 6.5fixed in 62.0.3202.622018-02-07

CVE-2017-15386 [MEDIUM] CWE-20 CVE-2017-15386: Incorrect implementation in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker t Incorrect implementation in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.

nvd

CVE-2017-5124MEDIUMCVSS 6.1PoCfixed in 62.0.3202.622018-02-07

CVE-2017-5124 [MEDIUM] CWE-79 CVE-2017-5124: Incorrect application of sandboxing in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote Incorrect application of sandboxing in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted MHTML page.

nvd

CVE-2017-15392MEDIUMCVSS 4.3fixed in 62.0.3202.622018-02-07

CVE-2017-15392 [MEDIUM] CWE-20 CVE-2017-15392: Insufficient data validation in V8 in Google Chrome prior to 62.0.3202.62 allowed an attacker who ca Insufficient data validation in V8 in Google Chrome prior to 62.0.3202.62 allowed an attacker who can write to the Windows Registry to potentially exploit heap corruption via a crafted Windows Registry entry, related to PlatformIntegration.

nvd

CVE-2015-1290HIGHCVSS 8.8fixed in 44.0.2403.892018-01-09

CVE-2015-1290 [HIGH] CWE-119 CVE-2015-1290: The Google V8 engine, as used in Google Chrome before 44.0.2403.89 and QtWebEngineCore in Qt before The Google V8 engine, as used in Google Chrome before 44.0.2403.89 and QtWebEngineCore in Qt before 5.5.1, allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a crafted web site.

nvd

CVE-2017-1000460MEDIUMCVSS 6.5≤ 56.0.29242018-01-03

CVE-2017-1000460 [MEDIUM] CWE-476 CVE-2017-1000460: In line libavcodec/h264dec.c:500 in libav(v13_dev0), ffmpeg(n3.4), chromium(56 prior Feb 13, 2017), In line libavcodec/h264dec.c:500 in libav(v13_dev0), ffmpeg(n3.4), chromium(56 prior Feb 13, 2017), the return value of init_get_bits is ignored and get_ue_golomb(&gb) is called on an uninitialized get_bits context, which causes a NULL deref exception.

nvd

CVE-2017-5053CRITICALCVSS 9.6fixed in 57.0.2987.133fixed in 57.0.2987.1322017-10-27

CVE-2017-5053 [CRITICAL] CWE-125 CVE-2017-5053: An out-of-bounds read in V8 in Google Chrome prior to 57.0.2987.133 for Linux, Windows, and Mac, and An out-of-bounds read in V8 in Google Chrome prior to 57.0.2987.133 for Linux, Windows, and Mac, and 57.0.2987.132 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page, related to Array.prototype.indexOf.

nvd

CVE-2017-5121HIGHCVSS 8.8fixed in 61.0.3163.1002017-10-27

CVE-2017-5121 [HIGH] CWE-20 CVE-2017-5121: Inappropriate use of JIT optimisation in V8 in Google Chrome prior to 61.0.3163.100 for Linux, Windo Inappropriate use of JIT optimisation in V8 in Google Chrome prior to 61.0.3163.100 for Linux, Windows, and Mac allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page, related to the escape analysis phase.

nvd

CVE-2017-5091HIGHCVSS 8.8fixed in 60.0.3112.782017-10-27

CVE-2017-5091 [HIGH] CWE-416 CVE-2017-5091: A use after free in IndexedDB in Google Chrome prior to 60.0.3112.78 for Linux, Android, Windows, an A use after free in IndexedDB in Google Chrome prior to 60.0.3112.78 for Linux, Android, Windows, and Mac allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

nvd

CVE-2017-5057HIGHCVSS 8.8fixed in 58.0.3029.81fixed in 58.0.3029.832017-10-27

CVE-2017-5057 [HIGH] CWE-843 CVE-2017-5057: Type confusion in PDFium in Google Chrome prior to 58.0.3029.81 for Mac, Windows, and Linux, and 58. Type confusion in PDFium in Google Chrome prior to 58.0.3029.81 for Mac, Windows, and Linux, and 58.0.3029.83 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file.

nvd

CVE-2017-5098HIGHCVSS 8.8≤ 60.0.3112.782017-10-27

CVE-2017-5098 [HIGH] CWE-416 CVE-2017-5098: A use after free in V8 in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android a A use after free in V8 in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

nvd

CVE-2017-5055HIGHCVSS 8.8fixed in 57.0.2987.1332017-10-27

CVE-2017-5055 [HIGH] CWE-125 CVE-2017-5055: A use after free in printing in Google Chrome prior to 57.0.2987.133 for Linux and Windows allowed a A use after free in printing in Google Chrome prior to 57.0.2987.133 for Linux and Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

nvd

CVE-2017-5092HIGHCVSS 8.8fixed in 60.0.3112.782017-10-27

CVE-2017-5092 [HIGH] CWE-20 CVE-2017-5092: Insufficient validation of untrusted input in PPAPI Plugins in Google Chrome prior to 60.0.3112.78 f Insufficient validation of untrusted input in PPAPI Plugins in Google Chrome prior to 60.0.3112.78 for Windows allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.

nvd

CVE-2017-5097HIGHCVSS 8.8≤ 60.0.3112.762017-10-27

CVE-2017-5097 [HIGH] CWE-20 CVE-2017-5097: Insufficient validation of untrusted input in Skia in Google Chrome prior to 60.0.3112.78 for Linux Insufficient validation of untrusted input in Skia in Google Chrome prior to 60.0.3112.78 for Linux allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

nvd

← Previous125 / 201Next →