Google Chrome vulnerabilities
5,831 known vulnerabilities affecting google/chrome.
Total CVEs
5,831
CISA KEV
75
actively exploited
Public exploits
88
Exploited in wild
87
Severity breakdown
CRITICAL498HIGH2799MEDIUM2453LOW79UNKNOWN2
Vulnerabilities
Page 161 of 292
CVE-2026-13838P4MEDIUMCVSS 6.5fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-13838 [MEDIUM] CWE-346 CVE-2026-13838: Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacke
Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-13839P4MEDIUMCVSS 6.5fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-13839 [MEDIUM] CWE-346 CVE-2026-13839: Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacke
Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-1504P4MEDIUMCVSS 6.5fixed in 144.0.7559.110≥ 144.0.7559.110, < 144.0.7559.1102026-01-27
CVE-2026-1504 [MEDIUM] CVE-2026-1504: Inappropriate implementation in Background Fetch API in Google Chrome prior to 144.0.7559.110 allowe
Inappropriate implementation in Background Fetch API in Google Chrome prior to 144.0.7559.110 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-15775P4MEDIUMCVSS 6.5fixed in 150.0.7871.125≥ 150.0.7871.125, < 150.0.7871.1252026-07-14
CVE-2026-15775 [MEDIUM] CWE-346 CVE-2026-15775: Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacke
Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-17748P4MEDIUMCVSS 6.5≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17748 [MEDIUM] CWE-346 CVE-2026-17748: Inappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote
Inappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-17975P4MEDIUMCVSS 6.5fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17975 [MEDIUM] CWE-200 CVE-2026-17975: Inappropriate implementation in IME in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote
Inappropriate implementation in IME in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-14002P4MEDIUMCVSS 6.5fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-14002 [MEDIUM] CWE-451 CVE-2026-14002: Inappropriate implementation in Geolocation in Google Chrome prior to 150.0.7871.47 allowed a remote
Inappropriate implementation in Geolocation in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-14082P4MEDIUMCVSS 6.5fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-14082 [MEDIUM] CWE-362 CVE-2026-14082: Race in Storage in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-orig
Race in Storage in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-13988P4MEDIUMCVSS 6.5fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-13988 [MEDIUM] CWE-451 CVE-2026-13988: Inappropriate implementation in Paint in Google Chrome prior to 150.0.7871.47 allowed a remote attac
Inappropriate implementation in Paint in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-11001P4MEDIUMCVSS 6.5fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11001 [MEDIUM] CWE-290 CVE-2026-11001: Inappropriate implementation in Payments in Google Chrome prior to 149.0.7827.53 allowed a remote at
Inappropriate implementation in Payments in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-5881P4MEDIUMCVSS 6.5fixed in 147.0.7727.55≥ 147.0.7727.55, < 147.0.7727.552026-04-08
CVE-2026-5881 [MEDIUM] CWE-284 CVE-2026-5881: Policy bypass in LocalNetworkAccess in Google Chrome prior to 147.0.7727.55 allowed a remote attacke
Policy bypass in LocalNetworkAccess in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-11193P4MEDIUMCVSS 6.5fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11193 [MEDIUM] CWE-284 CVE-2026-11193: Insufficient policy enforcement in Password Manager in Google Chrome prior to 149.0.7827.53 allowed
Insufficient policy enforcement in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-13868P4MEDIUMCVSS 6.5fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-13868 [MEDIUM] CWE-346 CVE-2026-13868: Inappropriate implementation in Network in Google Chrome on Android prior to 150.0.7871.47 allowed a
Inappropriate implementation in Network in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-14381P4MEDIUMCVSS 6.5fixed in 150.0.7871.46≥ 150.0.7871.46, < 150.0.7871.462026-07-01
CVE-2026-14381 [MEDIUM] CWE-290 CVE-2026-14381: Incorrect security UI in WebAppInstalls in Google Chrome prior to 150.0.7871.46 allowed a remote att
Incorrect security UI in WebAppInstalls in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-13881P4MEDIUMCVSS 6.5fixed in 150.0.7871.46≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-13881 [MEDIUM] CWE-346 CVE-2026-13881: Inappropriate implementation in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a rem
Inappropriate implementation in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-14155P4MEDIUMCVSS 6.5fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-14155 [MEDIUM] CWE-284 CVE-2026-14155: Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed
Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-2320P4MEDIUMCVSS 6.5fixed in 145.0.7632.45≥ 145.0.7632.45, < 145.0.7632.452026-02-11
CVE-2026-2320 [MEDIUM] CWE-451 CVE-2026-2320: Inappropriate implementation in File input in Google Chrome prior to 145.0.7632.45 allowed a remote
Inappropriate implementation in File input in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-11069P4MEDIUMCVSS 6.5fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11069 [MEDIUM] CWE-20 CVE-2026-11069: Insufficient validation of untrusted input in Cast in Google Chrome prior to 149.0.7827.53 allowed a
Insufficient validation of untrusted input in Cast in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-17850P4MEDIUMCVSS 6.5fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17850 [MEDIUM] CWE-346 CVE-2026-17850: Inappropriate implementation in Permissions in Google Chrome prior to 151.0.7922.72 allowed a remote
Inappropriate implementation in Permissions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-14404P4MEDIUMCVSS 6.5fixed in 150.0.7871.46≥ 150.0.7871.46, < 150.0.7871.462026-07-01
CVE-2026-14404 [MEDIUM] CWE-451 CVE-2026-14404: Inappropriate implementation in PDFium in Google Chrome prior to 150.0.7871.46 allowed a remote atta
Inappropriate implementation in PDFium in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to perform UI spoofing via a crafted PDF file. (Chromium security severity: Medium)
nvd