Google Chrome vulnerabilities
5,831 known vulnerabilities affecting google/chrome.
Total CVEs
5,831
CISA KEV
75
actively exploited
Public exploits
88
Exploited in wild
87
Severity breakdown
CRITICAL498HIGH2799MEDIUM2453LOW79UNKNOWN2
Vulnerabilities
Page 174 of 292
CVE-2026-3935P4MEDIUMCVSS 6.5fixed in 146.0.7680.71≥ 146.0.7680.71, < 146.0.7680.712026-03-11
CVE-2026-3935 [MEDIUM] CWE-451 CVE-2026-3935: Incorrect security UI in WebAppInstalls in Google Chrome prior to 146.0.7680.71 allowed a remote att
Incorrect security UI in WebAppInstalls in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-12024P4MEDIUMCVSS 6.5fixed in 149.0.7827.115≥ 149.0.7827.115, < 149.0.7827.1152026-06-11
CVE-2026-12024 [MEDIUM] CWE-346 CVE-2026-12024: Insufficient policy enforcement in DevTools in Google Chrome prior to 149.0.7827.115 allowed a remot
Insufficient policy enforcement in DevTools in Google Chrome prior to 149.0.7827.115 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-11225P4MEDIUMCVSS 6.5fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11225 [MEDIUM] CWE-451 CVE-2026-11225: Inappropriate implementation in WebUI in Google Chrome prior to 149.0.7827.53 allowed a remote attac
Inappropriate implementation in WebUI in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via a crafted domain name. (Chromium security severity: Low)
nvd
CVE-2026-11215P4MEDIUMCVSS 6.5fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11215 [MEDIUM] CWE-451 CVE-2026-11215: Inappropriate implementation in Cronet in Google Chrome on Android prior to 149.0.7827.53 allowed a
Inappropriate implementation in Cronet in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via a crafted domain name. (Chromium security severity: Medium)
nvd
CVE-2026-17841P4MEDIUMCVSS 6.5fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17841 [MEDIUM] CWE-362 CVE-2026-17841: Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to p
Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-17822P4MEDIUMCVSS 6.5fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17822 [MEDIUM] CWE-362 CVE-2026-17822: Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to p
Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-11217P4MEDIUMCVSS 6.5fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11217 [MEDIUM] CWE-346 CVE-2026-11217: Inappropriate implementation in Fenced Frames in Google Chrome prior to 149.0.7827.53 allowed a remo
Inappropriate implementation in Fenced Frames in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-11278P4MEDIUMCVSS 6.5fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-05
CVE-2026-11278 [MEDIUM] CWE-346 CVE-2026-11278: Inappropriate implementation in CustomTabs in Google Chrome on Android prior to 149.0.7827.53 allowe
Inappropriate implementation in CustomTabs in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-13022P4MEDIUMCVSS 6.5fixed in 149.0.7827.197≥ 149.0.7827.197, < 149.0.7827.1972026-06-24
CVE-2026-13022 [MEDIUM] CWE-346 CVE-2026-13022: Inappropriate implementation in Autofill in Google Chrome prior to 149.0.7827.197 allowed a remote a
Inappropriate implementation in Autofill in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-11148P4MEDIUMCVSS 6.5fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11148 [MEDIUM] CWE-352 CVE-2026-11148: Inappropriate implementation in Payments in Google Chrome on Android prior to 149.0.7827.53 allowed
Inappropriate implementation in Payments in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2022-2164P4MEDIUMCVSS 6.3fixed in 103.0.5060.53≥ unspecified, < 103.0.5060.532022-07-28
CVE-2022-2164 [MEDIUM] CVE-2022-2164: Inappropriate implementation in Extensions API in Google Chrome prior to 103.0.5060.53 allowed an at
Inappropriate implementation in Extensions API in Google Chrome prior to 103.0.5060.53 allowed an attacker who convinced a user to install a malicious extension to bypass discretionary access control via a crafted HTML page.
nvd
CVE-2024-3175P4MEDIUMCVSS 6.3fixed in 120.0.6099.62≥ 120.0.6099.62, < 120.0.6099.622024-07-16
CVE-2024-3175 [MEDIUM] CWE-1287 CVE-2024-3175: Insufficient data validation in Extensions in Google Chrome prior to 120.0.6099.62 allowed a remote
Insufficient data validation in Extensions in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to perform privilege escalation via a crafted Chrome Extension. (Chromium security severity: Low)
nvd
CVE-2026-11184P4MEDIUMCVSS 6.3fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11184 [MEDIUM] CWE-602 CVE-2026-11184: Insufficient policy enforcement in Actor in Google Chrome prior to 149.0.7827.53 allowed a remote at
Insufficient policy enforcement in Actor in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-7977P4MEDIUMCVSS 6.3fixed in 148.0.7778.96≥ 148.0.7778.96, < 148.0.7778.962026-05-06
CVE-2026-7977 [MEDIUM] CWE-269 CVE-2026-7977: Inappropriate implementation in Canvas in Google Chrome prior to 148.0.7778.96 allowed a remote atta
Inappropriate implementation in Canvas in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-11187P4MEDIUMCVSS 6.3fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11187 [MEDIUM] CWE-284 CVE-2026-11187: Inappropriate implementation in Glic in Google Chrome prior to 149.0.7827.53 allowed a remote attack
Inappropriate implementation in Glic in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-11181P4MEDIUMCVSS 6.3fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11181 [MEDIUM] CWE-346 CVE-2026-11181: Inappropriate implementation in Media Session in Google Chrome prior to 149.0.7827.53 allowed a remo
Inappropriate implementation in Media Session in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-9989P4MEDIUMCVSS 6.3fixed in 148.0.7778.216fixed in 148.0.7778.215+1 more2026-05-28
CVE-2026-9989 [MEDIUM] CWE-346 CVE-2026-9989: Inappropriate implementation in Media in Google Chrome prior to 148.0.7778.216 allowed a remote atta
Inappropriate implementation in Media in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to bypass same origin policy via a crafted video file. (Chromium security severity: High)
nvd
CVE-2014-1713P4HIGHCVSS 7.5fixed in 33.0.1750.152fixed in 33.0.1750.1542014-03-16
CVE-2014-1713 [HIGH] CWE-416 CVE-2014-1713: Use-after-free vulnerability in the AttributeSetter function in bindings/templates/attributes.cpp in
Use-after-free vulnerability in the AttributeSetter function in bindings/templates/attributes.cpp in the bindings in Blink, as used in Google Chrome before 33.0.1750.152 on OS X and Linux and before 33.0.1750.154 on Windows, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving the document.
nvd
CVE-2026-14062P4MEDIUMCVSS 5.9fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-14062 [MEDIUM] CWE-200 CVE-2026-14062: Inappropriate implementation in Views in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed an
Inappropriate implementation in Views in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Chrome Extension. (Chromium security severity: Low)
nvd
CVE-2026-14406P4MEDIUMCVSS 5.9fixed in 150.0.7871.46≥ 150.0.7871.46, < 150.0.7871.462026-07-01
CVE-2026-14406 [MEDIUM] CWE-125 CVE-2026-14406: Out of bounds read in V8 in Google Chrome prior to 150.0.7871.46 allowed an attacker who convinced a
Out of bounds read in V8 in Google Chrome prior to 150.0.7871.46 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Chrome Extension. (Chromium security severity: Medium)
nvd