Google Chrome vulnerabilities

CVE-2026-91716 [CRITICAL] CWE-416 CVE-2026-91716: Use after free in Auth in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute Use after free in Auth in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-91710 [CRITICAL] CWE-416 CVE-2026-91710: Use after free in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker t Use after free in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-118306 [CRITICAL] CWE-119 CVE-2026-118306: Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-118310 [CRITICAL] CWE-20 CVE-2026-118310: Improper input validation in Views in Google Chrome on on Windows prior to 156.0.8078.73 allowed a r Improper input validation in Views in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-118316 [CRITICAL] CWE-20 CVE-2026-118316: Improper input validation in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to Improper input validation in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-118332 [CRITICAL] CWE-20 CVE-2026-118332: Improper input validation in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote at Improper input validation in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-118355 [CRITICAL] CWE-20 CVE-2026-118355: Improper input validation in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attack Improper input validation in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2021-21121 [CRITICAL] CWE-416 CVE-2021-21121: Use after free in Omnibox in Google Chrome on Linux prior to 88.0.4324.96 allowed a remote attacker Use after free in Omnibox in Google Chrome on Linux prior to 88.0.4324.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.

CVE-2026-17666 [CRITICAL] CWE-325 CVE-2026-17666: Cryptographic Flaw in Enterprise in Google Chrome prior to 151.0.7922.72 allowed an attacker in a pr Cryptographic Flaw in Enterprise in Google Chrome prior to 151.0.7922.72 allowed an attacker in a privileged network position to bypass discretionary access control via malicious network traffic. (Chromium security severity: High)

CVE-2026-8510 [HIGH] CWE-472 CVE-2026-8510: Integer overflow in Skia in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attack Integer overflow in Skia in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

CVE-2025-0434 [HIGH] CWE-122 CVE-2025-0434: Out of bounds memory access in V8 in Google Chrome prior to 132.0.6834.83 allowed a remote attacker Out of bounds memory access in V8 in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2024-12382 [HIGH] CWE-416 CVE-2024-12382: Use after free in Translate in Google Chrome prior to 131.0.6778.139 allowed a remote attacker to po Use after free in Translate in Google Chrome prior to 131.0.6778.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2024-12381 [HIGH] CWE-843 CVE-2024-12381: Type Confusion in V8 in Google Chrome prior to 131.0.6778.139 allowed a remote attacker to potential Type Confusion in V8 in Google Chrome prior to 131.0.6778.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2021-30625 [HIGH] CWE-416 CVE-2021-30625: Use after free in Selection API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who Use after free in Selection API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who convinced the user the visit a malicious website to potentially exploit heap corruption via a crafted HTML page.

CVE-2025-12036 [HIGH] CWE-125 CVE-2025-12036: Out of bounds memory access in V8 in Google Chrome prior to 141.0.7390.122 allowed a remote attacker Out of bounds memory access in V8 in Google Chrome prior to 141.0.7390.122 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

CVE-2018-6056 [HIGH] CWE-704 CVE-2018-6056: Type confusion could lead to a heap out-of-bounds write in V8 in Google Chrome prior to 64.0.3282.16 Type confusion could lead to a heap out-of-bounds write in V8 in Google Chrome prior to 64.0.3282.168 allowing a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

CVE-2025-14766 [HIGH] CWE-125 CVE-2025-14766: Out of bounds read and write in V8 in Google Chrome prior to 143.0.7499.147 allowed a remote attacke Out of bounds read and write in V8 in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2025-4052 [CRITICAL] CWE-838 CVE-2025-4052: Inappropriate implementation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote at Inappropriate implementation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-0906 [CRITICAL] CWE-451 CVE-2026-0906: Incorrect security UI in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker Incorrect security UI in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-78948 [CRITICAL] CWE-122 CVE-2026-78948: Buffer overflow in WebGL in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execut Buffer overflow in WebGL in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)