Google Chrome vulnerabilities
5,831 known vulnerabilities affecting google/chrome.
Total CVEs
5,831
CISA KEV
75
actively exploited
Public exploits
88
Exploited in wild
87
Severity breakdown
CRITICAL498HIGH2799MEDIUM2453LOW79UNKNOWN2
Vulnerabilities
Page 150 of 292
CVE-2026-17805P4MEDIUMCVSS 6.5fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17805 [MEDIUM] CWE-602 CVE-2026-17805: Insufficient policy enforcement in Glic in Google Chrome on Android prior to 151.0.7922.72 allowed a
Insufficient policy enforcement in Glic in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-11658P4MEDIUMCVSS 6.5fixed in 149.0.7827.103≥ 149.0.7827.103, < 149.0.7827.1032026-06-09
CVE-2026-11658 [MEDIUM] CWE-20 CVE-2026-11658: Insufficient validation of untrusted input in Extensions in Google Chrome prior to 149.0.7827.103 al
Insufficient validation of untrusted input in Extensions in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-11020P4MEDIUMCVSS 6.5fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11020 [MEDIUM] CWE-346 CVE-2026-11020: Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote
Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted XML file. (Chromium security severity: Medium)
nvd
CVE-2026-9882P4MEDIUMCVSS 6.5fixed in 148.0.7778.216fixed in 148.0.7778.215+1 more2026-05-28
CVE-2026-9882 [MEDIUM] CWE-472 CVE-2026-9882: Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to leak
Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2026-17743P4MEDIUMCVSS 6.5≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17743 [MEDIUM] CWE-346 CVE-2026-17743: Insufficient policy enforcement in ControlledFrame in Google Chrome prior to 151.0.7922.72 allowed a
Insufficient policy enforcement in ControlledFrame in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-17754P4MEDIUMCVSS 6.5≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17754 [MEDIUM] CWE-346 CVE-2026-17754: Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attac
Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-17787P4MEDIUMCVSS 6.5≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17787 [MEDIUM] CWE-346 CVE-2026-17787: Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote at
Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-11014P4MEDIUMCVSS 6.5fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11014 [MEDIUM] CWE-602 CVE-2026-11014: Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an att
Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to bypass site isolation via a crafted Chrome Extension. (Chromium security severity: Medium)
nvd
CVE-2026-13894P4MEDIUMCVSS 6.5fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-13894 [MEDIUM] CWE-602 CVE-2026-13894: Insufficient policy enforcement in Network in Google Chrome prior to 150.0.7871.47 allowed an attack
Insufficient policy enforcement in Network in Google Chrome prior to 150.0.7871.47 allowed an attacker in a privileged network position to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-17840P4MEDIUMCVSS 6.5fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17840 [MEDIUM] CWE-451 CVE-2026-17840: Incorrect security UI in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker
Incorrect security UI in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-17852P4MEDIUMCVSS 6.5fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17852 [MEDIUM] CWE-346 CVE-2026-17852: Inappropriate implementation in Media Router in Google Chrome prior to 151.0.7922.72 allowed a remot
Inappropriate implementation in Media Router in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-11135P4MEDIUMCVSS 6.5fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11135 [MEDIUM] CWE-284 CVE-2026-11135: Insufficient policy enforcement in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote
Insufficient policy enforcement in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-13990P4MEDIUMCVSS 6.5fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-13990 [MEDIUM] CWE-20 CVE-2026-13990: Insufficient validation of untrusted input in DataTransfer in Google Chrome on Windows prior to 150.
Insufficient validation of untrusted input in DataTransfer in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-5919P4MEDIUMCVSS 6.5fixed in 147.0.7727.55≥ 147.0.7727.55, < 147.0.7727.552026-04-08
CVE-2026-5919 [MEDIUM] CWE-20 CVE-2026-5919: Insufficient validation of untrusted input in WebSockets in Google Chrome prior to 147.0.7727.55 all
Insufficient validation of untrusted input in WebSockets in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-17821P4MEDIUMCVSS 6.5fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17821 [MEDIUM] CWE-602 CVE-2026-17821: Insufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an att
Insufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. (Chromium security severity: Medium)
nvd
CVE-2026-11084P4MEDIUMCVSS 6.5fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11084 [MEDIUM] CWE-346 CVE-2026-11084: Inappropriate implementation in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a r
Inappropriate implementation in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-11083P4MEDIUMCVSS 6.5fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11083 [MEDIUM] CWE-346 CVE-2026-11083: Inappropriate implementation in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a r
Inappropriate implementation in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-11223P4MEDIUMCVSS 6.5fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11223 [MEDIUM] CWE-20 CVE-2026-11223: Insufficient validation of untrusted input in Network in Google Chrome prior to 149.0.7827.53 allowe
Insufficient validation of untrusted input in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-11032P4MEDIUMCVSS 6.5fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11032 [MEDIUM] CWE-346 CVE-2026-11032: Inappropriate implementation in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a r
Inappropriate implementation in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-17846P4MEDIUMCVSS 6.5fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17846 [MEDIUM] CWE-346 CVE-2026-17846: Inappropriate implementation in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a r
Inappropriate implementation in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
nvd