Google Chrome vulnerabilities
5,831 known vulnerabilities affecting google/chrome.
Total CVEs
5,831
CISA KEV
75
actively exploited
Public exploits
88
Exploited in wild
87
Severity breakdown
CRITICAL498HIGH2799MEDIUM2453LOW79UNKNOWN2
Vulnerabilities
Page 173 of 292
CVE-2026-5291P4MEDIUMCVSS 6.5fixed in 146.0.7680.177≥ 146.0.7680.178, < 146.0.7680.1782026-04-01
CVE-2026-5291 [MEDIUM] CWE-200 CVE-2026-5291: Inappropriate implementation in WebGL in Google Chrome prior to 146.0.7680.178 allowed a remote atta
Inappropriate implementation in WebGL in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-9981P4MEDIUMCVSS 6.5fixed in 148.0.7778.216fixed in 148.0.7778.215+1 more2026-05-28
CVE-2026-9981 [MEDIUM] CWE-200 CVE-2026-9981: Inappropriate implementation in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attac
Inappropriate implementation in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-9996P4MEDIUMCVSS 6.5fixed in 148.0.7778.216≥ 148.0.7778.216, < 148.0.7778.2162026-05-28
CVE-2026-9996 [MEDIUM] CWE-125 CVE-2026-9996: Out of bounds read in WebRTC in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attack
Out of bounds read in WebRTC in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-5276P4MEDIUMCVSS 6.5fixed in 146.0.7680.177≥ 146.0.7680.178, < 146.0.7680.1782026-04-01
CVE-2026-5276 [MEDIUM] CWE-693 CVE-2026-5276: Insufficient policy enforcement in WebUSB in Google Chrome prior to 146.0.7680.178 allowed a remote
Insufficient policy enforcement in WebUSB in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-11106P4MEDIUMCVSS 6.5fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11106 [MEDIUM] CWE-352 CVE-2026-11106: Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attac
Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-3934P4MEDIUMCVSS 6.5fixed in 146.0.7680.71≥ 146.0.7680.71, < 146.0.7680.712026-03-11
CVE-2026-3934 [MEDIUM] CWE-284 CVE-2026-3934: Insufficient policy enforcement in ChromeDriver in Google Chrome prior to 146.0.7680.71 allowed a re
Insufficient policy enforcement in ChromeDriver in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-18005P4MEDIUMCVSS 6.5fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-18005 [MEDIUM] CWE-200 CVE-2026-18005: Inappropriate implementation in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attac
Inappropriate implementation in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-18001P4MEDIUMCVSS 6.5fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-18001 [MEDIUM] CWE-200 CVE-2026-18001: Inappropriate implementation in WebGL in Google Chrome prior to 151.0.7922.72 allowed a remote attac
Inappropriate implementation in WebGL in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-14081P4MEDIUMCVSS 6.5fixed in 150.0.7871.46≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-14081 [MEDIUM] CWE-602 CVE-2026-14081: Insufficient policy enforcement in DevTools in Google Chrome prior to 150.0.7871.47 allowed an attac
Insufficient policy enforcement in DevTools in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Chrome Extension. (Chromium security severity: Low)
nvd
CVE-2026-11176P4MEDIUMCVSS 6.5fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11176 [MEDIUM] CWE-346 CVE-2026-11176: Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attac
Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-11139P4MEDIUMCVSS 6.5fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11139 [MEDIUM] CWE-352 CVE-2026-11139: Inappropriate implementation in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attac
Inappropriate implementation in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-11200P4MEDIUMCVSS 6.5fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11200 [MEDIUM] CWE-346 CVE-2026-11200: Inappropriate implementation in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote atta
Inappropriate implementation in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-11129P4MEDIUMCVSS 6.5fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11129 [MEDIUM] CWE-352 CVE-2026-11129: Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote
Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-11134P4MEDIUMCVSS 6.5fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11134 [MEDIUM] CWE-352 CVE-2026-11134: Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attac
Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-11222P4MEDIUMCVSS 6.5fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11222 [MEDIUM] CWE-451 CVE-2026-11222: Incorrect security UI in Tab Strip in Google Chrome prior to 149.0.7827.53 allowed a remote attacker
Incorrect security UI in Tab Strip in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-11183P4MEDIUMCVSS 6.5fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11183 [MEDIUM] CWE-125 CVE-2026-11183: Out of bounds read in GWP-ASan in Google Chrome prior to 149.0.7827.53 allowed a local attacker to o
Out of bounds read in GWP-ASan in Google Chrome prior to 149.0.7827.53 allowed a local attacker to obtain potentially sensitive information from process memory via a malicious file. (Chromium security severity: Medium)
nvd
CVE-2026-11127P4MEDIUMCVSS 6.5fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11127 [MEDIUM] CWE-358 CVE-2026-11127: Inappropriate implementation in WebAPKs in Google Chrome on Android prior to 149.0.7827.53 allowed a
Inappropriate implementation in WebAPKs in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via a crafted WebAPK. (Chromium security severity: Medium)
nvd
CVE-2026-11036P4MEDIUMCVSS 6.5fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11036 [MEDIUM] CWE-346 CVE-2026-11036: Inappropriate implementation in DOM in Google Chrome prior to 149.0.7827.53 allowed a remote attacke
Inappropriate implementation in DOM in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-11081P4MEDIUMCVSS 6.5fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11081 [MEDIUM] CWE-346 CVE-2026-11081: Inappropriate implementation in Canvas in Google Chrome prior to 149.0.7827.53 allowed a remote atta
Inappropriate implementation in Canvas in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-11214P4MEDIUMCVSS 6.5fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11214 [MEDIUM] CWE-346 CVE-2026-11214: Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowe
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
nvd