Google Chrome vulnerabilities
5,831 known vulnerabilities affecting google/chrome.
Total CVEs
5,831
CISA KEV
75
actively exploited
Public exploits
88
Exploited in wild
87
Severity breakdown
CRITICAL498HIGH2799MEDIUM2453LOW79UNKNOWN2
Vulnerabilities
Page 159 of 292
CVE-2026-11105P4MEDIUMCVSS 6.5fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11105 [MEDIUM] CWE-20 CVE-2026-11105: Insufficient validation of untrusted input in WebUI in Google Chrome prior to 149.0.7827.53 allowed
Insufficient validation of untrusted input in WebUI in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-11096P4MEDIUMCVSS 6.5fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11096 [MEDIUM] CWE-125 CVE-2026-11096: Out of bounds read in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to ob
Out of bounds read in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-13793P4MEDIUMCVSS 6.5fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-13793 [MEDIUM] CWE-346 CVE-2026-13793: Insufficient policy enforcement in SVG in Google Chrome prior to 150.0.7871.47 allowed a remote atta
Insufficient policy enforcement in SVG in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-13913P4MEDIUMCVSS 6.5fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-13913 [MEDIUM] CWE-346 CVE-2026-13913: Insufficient policy enforcement in Autofill in Google Chrome on iOS prior to 150.0.7871.47 allowed a
Insufficient policy enforcement in Autofill in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-13840P4MEDIUMCVSS 6.5fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-13840 [MEDIUM] CWE-346 CVE-2026-13840: Insufficient policy enforcement in Canvas in Google Chrome prior to 150.0.7871.47 allowed a remote a
Insufficient policy enforcement in Canvas in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-17992P4MEDIUMCVSS 6.5fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17992 [MEDIUM] CWE-457 CVE-2026-17992: Uninitialized Use in Skia in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attack
Uninitialized Use in Skia in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-17968P4MEDIUMCVSS 6.5fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17968 [MEDIUM] CWE-457 CVE-2026-17968: Uninitialized Use in WebXR in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attac
Uninitialized Use in WebXR in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-14100P4MEDIUMCVSS 6.5fixed in 150.0.7871.46≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-14100 [MEDIUM] CWE-20 CVE-2026-14100: Insufficient data validation in NetworkCache in Google Chrome prior to 150.0.7871.47 allowed a remot
Insufficient data validation in NetworkCache in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-14098P4MEDIUMCVSS 6.5fixed in 150.0.7871.46≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-14098 [MEDIUM] CWE-200 CVE-2026-14098: Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacke
Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-14071P4MEDIUMCVSS 6.5fixed in 150.0.7871.46≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-14071 [MEDIUM] CWE-1300 CVE-2026-14071: Side-channel information leakage in WebAudio in Google Chrome prior to 150.0.7871.47 allowed a remot
Side-channel information leakage in WebAudio in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-9908P4MEDIUMCVSS 6.5fixed in 148.0.7778.216≥ 148.0.7778.216, < 148.0.7778.2162026-05-28
CVE-2026-9908 [MEDIUM] CWE-125 CVE-2026-9908: Out of bounds read in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to ob
Out of bounds read in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-11284P4MEDIUMCVSS 6.5fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-05
CVE-2026-11284 [MEDIUM] CWE-1300 CVE-2026-11284: Side-channel information leakage in PerformanceAPIs in Google Chrome prior to 149.0.7827.53 allowed
Side-channel information leakage in PerformanceAPIs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-5885P4MEDIUMCVSS 6.5fixed in 147.0.7727.55≥ 147.0.7727.55, < 147.0.7727.552026-04-08
CVE-2026-5885 [MEDIUM] CWE-20 CVE-2026-5885: Insufficient validation of untrusted input in WebML in Google Chrome on Windows prior to 147.0.7727.
Insufficient validation of untrusted input in WebML in Google Chrome on Windows prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-12026P4MEDIUMCVSS 6.5fixed in 149.0.7827.115≥ 149.0.7827.115, < 149.0.7827.1152026-06-11
CVE-2026-12026 [MEDIUM] CWE-125 CVE-2026-12026: Out of bounds read in Video in Google Chrome on ChromeOS prior to 149.0.7827.115 allowed a remote at
Out of bounds read in Video in Google Chrome on ChromeOS prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-6364P4MEDIUMCVSS 6.5fixed in 147.0.7727.101≥ 147.0.7727.101, < 147.0.7727.1012026-04-15
CVE-2026-6364 [MEDIUM] CWE-125 CVE-2026-6364: Out of bounds read in Skia in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to obt
Out of bounds read in Skia in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted file. (Chromium security severity: Medium)
nvd
CVE-2026-11287P4MEDIUMCVSS 6.5fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-05
CVE-2026-11287 [MEDIUM] CWE-20 CVE-2026-11287: Insufficient policy enforcement in Navigation in Google Chrome on Android prior to 149.0.7827.53 all
Insufficient policy enforcement in Navigation in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-17892P4MEDIUMCVSS 6.5fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17892 [MEDIUM] CWE-200 CVE-2026-17892: Inappropriate implementation in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attac
Inappropriate implementation in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-13826P4MEDIUMCVSS 6.5fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-13826 [MEDIUM] CWE-346 CVE-2026-13826: Inappropriate implementation in Autofill in Google Chrome on Android prior to 150.0.7871.47 allowed
Inappropriate implementation in Autofill in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-13887P4MEDIUMCVSS 6.5fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-13887 [MEDIUM] CWE-346 CVE-2026-13887: Inappropriate implementation in NFC in Google Chrome on Android prior to 150.0.7871.47 allowed a rem
Inappropriate implementation in NFC in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-14096P4MEDIUMCVSS 6.5fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-14096 [MEDIUM] CWE-200 CVE-2026-14096: Inappropriate implementation in Input in Google Chrome on Android prior to 150.0.7871.47 allowed a r
Inappropriate implementation in Input in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
nvd