Google Chrome vulnerabilities

CVE-2016-1656 [HIGH] CWE-284 CVE-2016-1656: The download implementation in Google Chrome before 50.0.2661.75 on Android allows remote attackers The download implementation in Google Chrome before 50.0.2661.75 on Android allows remote attackers to bypass intended pathname restrictions via unspecified vectors.

CVE-2019-13689 [HIGH] CWE-59 CVE-2019-13689: Inappropriate implementation in OS in Google Chrome on ChromeOS prior to 75.0.3770.80 allowed a remo Inappropriate implementation in OS in Google Chrome on ChromeOS prior to 75.0.3770.80 allowed a remote attacker to perform arbitrary read/write via a malicious file. (Chromium security severity: Critical)

CVE-2026-13863 [HIGH] CWE-20 CVE-2026-13863: Insufficient validation of untrusted input in CustomTabs in Google Chrome on Android prior to 150.0. Insufficient validation of untrusted input in CustomTabs in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: Medium)

CVE-2026-13927 [HIGH] CWE-20 CVE-2026-13927: Insufficient validation of untrusted input in UI in Google Chrome on Android prior to 150.0.7871.47 Insufficient validation of untrusted input in UI in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: Medium)

CVE-2022-1485 [HIGH] CWE-416 CVE-2022-1485: Use after free in File System API in Google Chrome prior to 101.0.4951.41 allowed a remote attacker Use after free in File System API in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVE-2026-10942 [HIGH] CWE-20 CVE-2026-10942: Inappropriate implementation in UI in Google Chrome on Windows prior to 149.0.7827.53 allowed a loca Inappropriate implementation in UI in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: High)

CVE-2026-7913 [HIGH] CWE-693 CVE-2026-7913: Insufficient policy enforcement in DevTools in Google Chrome on Android prior to 148.0.7778.96 allow Insufficient policy enforcement in DevTools in Google Chrome on Android prior to 148.0.7778.96 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: High)

CVE-2026-7990 [HIGH] CWE-20 CVE-2026-7990: Insufficient validation of untrusted input in Updater in Google Chrome on Windows prior to 148.0.777 Insufficient validation of untrusted input in Updater in Google Chrome on Windows prior to 148.0.7778.96 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: Medium)

CVE-2011-3045 [HIGH] CVE-2011-3045: Integer signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as Integer signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as used in Google Chrome before 17.0.963.83 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file, a different vulnerability than CVE-2011-3026.

CVE-2020-16021 [HIGH] CWE-362 CVE-2020-16021: Race in image burner in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker wh Race in image burner in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker who had compromised the browser process to perform OS-level privilege escalation via a malicious file.

CVE-2010-0657 [CRITICAL] CVE-2010-0657: Google Chrome before 4.0.249.78 on Windows does not perform the expected encoding, escaping, and quo Google Chrome before 4.0.249.78 on Windows does not perform the expected encoding, escaping, and quoting for the URL in the --app argument in a desktop shortcut, which allows user-assisted remote attackers to execute arbitrary programs or obtain sensitive information by tricking a user into creating a crafted shortcut.

CVE-2010-1502 [CRITICAL] CVE-2010-1502: Unspecified vulnerability in Google Chrome before 4.1.249.1059 allows remote attackers to access loc Unspecified vulnerability in Google Chrome before 4.1.249.1059 allows remote attackers to access local files via vectors related to "developer tools."

CVE-2026-10976 [HIGH] CWE-457 CVE-2026-10976: Uninitialized Use in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtai Uninitialized Use in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

CVE-2010-2296 [CRITICAL] CWE-264 CVE-2010-2296: The implementation of unspecified DOM methods in Google Chrome before 5.0.375.70 allows remote attac The implementation of unspecified DOM methods in Google Chrome before 5.0.375.70 allows remote attackers to bypass the Same Origin Policy via unknown vectors.

CVE-2010-4206 [HIGH] CWE-787 CVE-2010-4206: Array index error in the FEBlend::apply function in WebCore/platform/graphics/filters/FEBlend.cpp in Array index error in the FEBlend::apply function in WebCore/platform/graphics/filters/FEBlend.cpp in WebKit, as used in Google Chrome before 7.0.517.44, webkitgtk before 1.2.6, and other products, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted SVG document, related to effects in the application of

CVE-2026-11115 [HIGH] CWE-416 CVE-2026-11115: Use after free in Updater in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacke Use after free in Updater in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: Medium)

CVE-2016-1655 [HIGH] CVE-2016-1655: Google Chrome before 50.0.2661.75 does not properly consider that frame removal may occur during cal Google Chrome before 50.0.2661.75 does not properly consider that frame removal may occur during callback execution, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted extension.

CVE-2016-1644 [HIGH] CVE-2016-1644: WebKit/Source/core/layout/LayoutObject.cpp in Blink, as used in Google Chrome before 49.0.2623.87, d WebKit/Source/core/layout/LayoutObject.cpp in Blink, as used in Google Chrome before 49.0.2623.87, does not properly restrict relayout scheduling, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted HTML document.

CVE-2016-1678 [HIGH] CWE-119 CVE-2016-1678: objects.cc in Google V8 before 5.0.71.32, as used in Google Chrome before 51.0.2704.63, does not pro objects.cc in Google V8 before 5.0.71.32, as used in Google Chrome before 51.0.2704.63, does not properly restrict lazy deoptimization, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JavaScript code.

CVE-2016-1681 [HIGH] CWE-119 CVE-2016-1681: Heap-based buffer overflow in the opj_j2k_read_SPCod_SPCoc function in j2k.c in OpenJPEG, as used in Heap-based buffer overflow in the opj_j2k_read_SPCod_SPCoc function in j2k.c in OpenJPEG, as used in PDFium in Google Chrome before 51.0.2704.63, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document.