Google Chrome vulnerabilities
7,336 known vulnerabilities affecting google/chrome.
Total CVEs
7,336
CISA KEV
77
actively exploited
Public exploits
92
Exploited in wild
89
Severity breakdown
CRITICAL703HIGH3485MEDIUM2986LOW155UNKNOWN7
Vulnerabilities
Page 15 of 367
CVE-2025-10891P3HIGHCVSS 8.8fixed in 140.0.7339.207≥ 140.0.7339.207, < 140.0.7339.2072025-09-24
CVE-2025-10891 [HIGH] CWE-472 CVE-2025-10891: Integer overflow in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to potenti
Integer overflow in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-102306P3CRITICALCVSS 9.6fixed in 154.0.8037.92≥ 154.0.8037.92, < 154.0.8037.922026-09-29
CVE-2026-102306 [CRITICAL] CWE-416 CVE-2026-102306: Use after free in Bluetooth in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to pot
Use after free in Bluetooth in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-103628P3CRITICALCVSS 9.6fixed in 154.0.8037.97≥ 154.0.8037.97, < 154.0.8037.972026-10-02
CVE-2026-103628 [CRITICAL] CWE-787 CVE-2026-103628: Out of bounds write in WebGL in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to ex
Out of bounds write in WebGL in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2026-91749P3CRITICALCVSS 9.6fixed in 153.0.8010.47≥ 153.0.8010.47, < 153.0.8010.472026-09-15
CVE-2026-91749 [CRITICAL] CWE-416 CVE-2026-91749: Use after free in Workers in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to poten
Use after free in Workers in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2026-79257P3CRITICALCVSS 9.6fixed in 152.0.7977.65≥ 152.0.7977.65, < 152.0.7977.652026-08-25
CVE-2026-79257 [CRITICAL] CWE-416 CVE-2026-79257: Use after free in Views in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute
Use after free in Views in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-87500P3CRITICALCVSS 9.6fixed in 153.0.8010.36≥ 153.0.8010.36, < 153.0.8010.362026-09-09
CVE-2026-87500 [CRITICAL] CWE-129 CVE-2026-87500: Improper validation of array index in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote
Improper validation of array index in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-106281P3CRITICALCVSS 9.6fixed in 155.0.8059.39≥ 155.0.8059.39, < 155.0.8059.392026-10-06
CVE-2026-106281 [CRITICAL] CWE-416 CVE-2026-106281: Use after free in Tint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentia
Use after free in Tint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-95325P3CRITICALCVSS 9.6fixed in 154.0.8037.57≥ 154.0.8037.57, < 154.0.8037.572026-09-29
CVE-2026-95325 [CRITICAL] CWE-416 CVE-2026-95325: Use after free in ANGLE in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potenti
Use after free in ANGLE in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-91729P3CRITICALCVSS 9.6fixed in 153.0.8010.47≥ 153.0.8010.47, < 153.0.8010.472026-09-15
CVE-2026-91729 [CRITICAL] CWE-416 CVE-2026-91729: Use after free in DigitalCredentials in Google Chrome prior to 153.0.8010.47 allowed a remote attack
Use after free in DigitalCredentials in Google Chrome prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-95299P3CRITICALCVSS 9.6fixed in 154.0.8037.57≥ 154.0.8037.57, < 154.0.8037.572026-09-29
CVE-2026-95299 [CRITICAL] CWE-416 CVE-2026-95299: Use after free in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute a
Use after free in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-11651P3CRITICALCVSS 9.6fixed in 149.0.7827.103≥ 149.0.7827.103, < 149.0.7827.1032026-06-09
CVE-2026-11651 [CRITICAL] CWE-416 CVE-2026-11651: Use after free in Network in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to exec
Use after free in Network in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-91718P3CRITICALCVSS 9.6fixed in 153.0.8010.47≥ 153.0.8010.47, < 153.0.8010.472026-09-15
CVE-2026-91718 [CRITICAL] CWE-416 CVE-2026-91718: Use after free in Core in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute
Use after free in Core in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-93373P3CRITICALCVSS 9.6fixed in 153.0.8010.52≥ 153.0.8010.52, < 153.0.8010.522026-09-17
CVE-2026-93373 [CRITICAL] CWE-416 CVE-2026-93373: Use after free in Extensions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to ex
Use after free in Extensions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)
nvd
CVE-2026-103626P3CRITICALCVSS 9.6fixed in 154.0.8037.97≥ 154.0.8037.97, < 154.0.8037.972026-10-02
CVE-2026-103626 [CRITICAL] CWE-863 CVE-2026-103626: Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.97 allowed
Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-110142P3CRITICALCVSS 9.6fixed in 155.0.8059.79≥ 155.0.8059.79, < 155.0.8059.792026-10-13
CVE-2026-110142 [CRITICAL] CWE-416 CVE-2026-110142: Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to ex
Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-103630P3CRITICALCVSS 9.6fixed in 154.0.8037.97≥ 154.0.8037.97, < 154.0.8037.972026-10-02
CVE-2026-103630 [CRITICAL] CWE-416 CVE-2026-103630: Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute
Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-102309P3CRITICALCVSS 9.6fixed in 154.0.8037.92≥ 154.0.8037.92, < 154.0.8037.922026-09-29
CVE-2026-102309 [CRITICAL] CWE-416 CVE-2026-102309: Use after free in FullScreen in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to ex
Use after free in FullScreen in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-102304P3CRITICALCVSS 9.6fixed in 154.0.8037.92≥ 154.0.8037.92, < 154.0.8037.922026-09-29
CVE-2026-102304 [CRITICAL] CWE-416 CVE-2026-102304: Use after free in Passwords in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to exe
Use after free in Passwords in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-102308P3CRITICALCVSS 9.6fixed in 154.0.8037.92≥ 154.0.8037.92, < 154.0.8037.922026-09-29
CVE-2026-102308 [CRITICAL] CWE-416 CVE-2026-102308: Use after free in Views in Google Chrome prior to 154.0.8037.92 allowed a remote attacker leveraging
Use after free in Views in Google Chrome prior to 154.0.8037.92 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-102316P3CRITICALCVSS 9.6fixed in 154.0.8037.92≥ 154.0.8037.92, < 154.0.8037.922026-09-29
CVE-2026-102316 [CRITICAL] CWE-416 CVE-2026-102316: Use after free in Views in Google Chrome prior to 154.0.8037.92 allowed a remote attacker leveraging
Use after free in Views in Google Chrome prior to 154.0.8037.92 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd