Google Chrome vulnerabilities
5,463 known vulnerabilities affecting google/chrome.
Total CVEs
5,463
CISA KEV
75
actively exploited
Public exploits
88
Exploited in wild
87
Severity breakdown
CRITICAL440HIGH2725MEDIUM2233LOW65
Vulnerabilities
Page 13 of 274
CVE-2026-9879P3HIGHCVSS 8.8fixed in 148.0.7778.216fixed in 148.0.7778.215+1 more2026-05-28
CVE-2026-9879 [HIGH] CWE-787 CVE-2026-9879: Out of bounds write in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to e
Out of bounds write in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2026-11116P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11116 [HIGH] CWE-416 CVE-2026-11116: Use after free in Chromoting in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to ex
Use after free in Chromoting in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Medium)
nvd
CVE-2026-11055P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11055 [HIGH] CWE-416 CVE-2026-11055: Use after free in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker
Use after free in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-11173P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11173 [HIGH] CWE-787 CVE-2026-11173: Out of bounds write in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had
Out of bounds write in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2021-21110P3CRITICALCVSS 9.6fixed in 87.0.4280.141≥ unspecified, < 87.0.4280.1412021-01-08
CVE-2021-21110 [CRITICAL] CWE-416 CVE-2021-21110: Use after free in safe browsing in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to
Use after free in safe browsing in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
nvd
CVE-2026-13787P3HIGHCVSS 8.1fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-13787 [HIGH] CWE-416 CVE-2026-13787: Use after free in Chromoting in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote att
Use after free in Chromoting in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Critical)
nvd
CVE-2026-10887P3HIGHCVSS 8.1fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-10887 [HIGH] CWE-416 CVE-2026-10887: Use after free in Chromoting in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacke
Use after free in Chromoting in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Critical)
nvd
CVE-2024-1284P3CRITICALCVSS 9.8fixed in 121.0.6167.160≥ 121.0.6167.160, < 121.0.6167.1602024-02-07
CVE-2024-1284 [CRITICAL] CWE-416 CVE-2024-1284: Use after free in Mojo in Google Chrome prior to 121.0.6167.160 allowed a remote attacker to potenti
Use after free in Mojo in Google Chrome prior to 121.0.6167.160 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2017-5098P3HIGHCVSS 8.8≤ 60.0.3112.782017-10-27
CVE-2017-5098 [HIGH] CWE-416 CVE-2017-5098: A use after free in V8 in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android a
A use after free in V8 in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
nvd
CVE-2021-21157P3HIGHCVSS 8.8fixed in 88.0.4324.182≥ unspecified, < 88.0.4324.1822021-02-22
CVE-2021-21157 [HIGH] CWE-416 CVE-2021-21157: Use after free in Web Sockets in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote atta
Use after free in Web Sockets in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
nvd
CVE-2025-5068P3HIGHCVSS 8.8fixed in 137.0.7151.68≥ 137.0.7151.68, < 137.0.7151.682025-06-03
CVE-2025-5068 [HIGH] CWE-416 CVE-2025-5068: Use after free in Blink in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potenti
Use after free in Blink in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-13789P3CRITICALCVSS 9.6fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-13789 [CRITICAL] CWE-416 CVE-2026-13789: Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had comp
Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-13798P3CRITICALCVSS 9.6fixed in 150.0.7871.46≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-13798 [CRITICAL] CWE-122 CVE-2026-13798: Heap buffer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker
Heap buffer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-13901P3CRITICALCVSS 9.6fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-13901 [CRITICAL] CWE-20 CVE-2026-13901: Insufficient policy enforcement in Serial in Google Chrome prior to 150.0.7871.47 allowed a remote a
Insufficient policy enforcement in Serial in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-10886P3CRITICALCVSS 9.6fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-10886 [CRITICAL] CWE-416 CVE-2026-10886: Use after free in FileSystem in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to po
Use after free in FileSystem in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2026-6296P3CRITICALCVSS 9.6fixed in 147.0.7727.101≥ 147.0.7727.101, < 147.0.7727.1012026-04-15
CVE-2026-6296 [CRITICAL] CWE-122 CVE-2026-6296: Heap buffer overflow in ANGLE in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to
Heap buffer overflow in ANGLE in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2026-13909P3CRITICALCVSS 9.6fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-13909 [CRITICAL] CWE-693 CVE-2026-13909: Insufficient policy enforcement in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote
Insufficient policy enforcement in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-13843P3CRITICALCVSS 9.6fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-13843 [CRITICAL] CWE-20 CVE-2026-13843: Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.
Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-13846P3CRITICALCVSS 9.6fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-13846 [CRITICAL] CWE-416 CVE-2026-13846: Use after free in USB in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who h
Use after free in USB in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-13792P3CRITICALCVSS 9.6fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-13792 [CRITICAL] CWE-416 CVE-2026-13792: Use after free in Touchbar in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker
Use after free in Touchbar in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
nvd