Google Chrome vulnerabilities
7,336 known vulnerabilities affecting google/chrome.
Total CVEs
7,336
CISA KEV
77
actively exploited
Public exploits
92
Exploited in wild
89
Severity breakdown
CRITICAL703HIGH3485MEDIUM2986LOW155UNKNOWN7
Vulnerabilities
Page 18 of 367
CVE-2026-95329P3CRITICALCVSS 9.6fixed in 154.0.8037.57≥ 154.0.8037.57, < 154.0.8037.572026-09-29
CVE-2026-95329 [CRITICAL] CWE-787 CVE-2026-95329: Out of bounds write in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote
Out of bounds write in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2026-106239P3CRITICALCVSS 9.6fixed in 155.0.8059.39≥ 155.0.8059.39, < 155.0.8059.392026-10-06
CVE-2026-106239 [CRITICAL] CWE-190 CVE-2026-106239: Integer overflow in WebGL in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote att
Integer overflow in WebGL in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-79026P3CRITICALCVSS 9.6fixed in 152.0.7977.65≥ 152.0.7977.65, < 152.0.7977.652026-08-25
CVE-2026-79026 [CRITICAL] CWE-416 CVE-2026-79026: Use after free in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker lever
Use after free in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)
nvd
CVE-2026-113078P3CRITICALCVSS 9.6fixed in 156.0.8078.47≥ 156.0.8078.47, < 156.0.8078.472026-10-20
CVE-2026-113078 [CRITICAL] CWE-20 CVE-2026-113078: Improper input validation in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote at
Improper input validation in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-110916P3CRITICALCVSS 9.6fixed in 155.0.8059.84≥ 155.0.8059.84, < 155.0.8059.842026-10-15
CVE-2026-110916 [CRITICAL] CWE-20 CVE-2026-110916: Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attack
Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-106419P3CRITICALCVSS 9.6fixed in 155.0.8059.39≥ 155.0.8059.39, < 155.0.8059.392026-10-06
CVE-2026-106419 [CRITICAL] CWE-416 CVE-2026-106419: Use after free in ANGLE in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attac
Use after free in ANGLE in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-106323P3CRITICALCVSS 9.6fixed in 155.0.8059.39≥ 155.0.8059.39, < 155.0.8059.392026-10-06
CVE-2026-106323 [CRITICAL] CWE-862 CVE-2026-106323: Missing authorization in Chrome for iOS in Google Chrome on on iOS prior to 155.0.8059.39 allowed a
Missing authorization in Chrome for iOS in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-91738P3CRITICALCVSS 9.6fixed in 153.0.8010.47≥ 153.0.8010.47, < 153.0.8010.472026-09-15
CVE-2026-91738 [CRITICAL] CWE-20 CVE-2026-91738: Improper input validation in ANGLE in Google Chrome prior to 153.0.8010.47 allowed a remote attacker
Improper input validation in ANGLE in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-118305P3CRITICALCVSS 9.6≥ 156.0.8078.73, < 156.0.8078.732026-10-27
CVE-2026-118305 [CRITICAL] CWE-119 CVE-2026-118305: Memory corruption in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to p
Memory corruption in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-118312P3CRITICALCVSS 9.6≥ 156.0.8078.73, < 156.0.8078.732026-10-27
CVE-2026-118312 [CRITICAL] CWE-119 CVE-2026-118312: Memory corruption in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to pote
Memory corruption in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-118309P3CRITICALCVSS 9.6≥ 156.0.8078.73, < 156.0.8078.732026-10-27
CVE-2026-118309 [CRITICAL] CWE-20 CVE-2026-118309: Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remo
Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-118340P3CRITICALCVSS 9.6≥ 156.0.8078.73, < 156.0.8078.732026-10-27
CVE-2026-118340 [CRITICAL] CWE-119 CVE-2026-118340: Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to poten
Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2011-3026P3MEDIUMCVSS 6.8fixed in 17.0.963.562012-02-16
CVE-2011-3026 [MEDIUM] CWE-190 CVE-2011-3026: Integer overflow in libpng, as used in Google Chrome before 17.0.963.56, allows remote attackers to
Integer overflow in libpng, as used in Google Chrome before 17.0.963.56, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger an integer truncation.
nvd
CVE-2023-5482P3HIGHCVSS 8.8fixed in 119.0.6045.105≥ 119.0.6045.105, < 119.0.6045.1052023-11-01
CVE-2023-5482 [HIGH] CWE-345 CVE-2023-5482: Insufficient data validation in USB in Google Chrome prior to 119.0.6045.105 allowed a remote attack
Insufficient data validation in USB in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-106195P3CRITICALCVSS 9.1fixed in 155.0.8059.39≥ 155.0.8059.39, < 155.0.8059.392026-10-06
CVE-2026-106195 [CRITICAL] CWE-863 CVE-2026-106195: Incorrect authorization in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a re
Incorrect authorization in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)
nvd
CVE-2021-30598P3HIGHCVSS 8.8fixed in 92.0.4515.159≥ unspecified, < 92.0.4515.1592021-08-26
CVE-2021-30598 [HIGH] CWE-843 CVE-2021-30598: Type confusion in V8 in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to execute ar
Type confusion in V8 in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
nvd
CVE-2017-5116P3HIGHCVSS 8.8fixed in 61.0.3163.79fixed in 61.0.3163.812017-10-27
CVE-2017-5116 [HIGH] CWE-843 CVE-2017-5116: Type confusion in V8 in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.31
Type confusion in V8 in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
nvd
CVE-2026-113021P3HIGHCVSS 8.8fixed in 156.0.8078.47≥ 156.0.8078.47, < 156.0.8078.472026-10-20
CVE-2026-113021 [HIGH] CWE-416 CVE-2026-113021: Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker t
Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-113024P3HIGHCVSS 8.8fixed in 156.0.8078.47≥ 156.0.8078.47, < 156.0.8078.472026-10-20
CVE-2026-113024 [HIGH] CWE-416 CVE-2026-113024: Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker t
Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-113043P3HIGHCVSS 8.8fixed in 156.0.8078.47≥ 156.0.8078.47, < 156.0.8078.472026-10-20
CVE-2026-113043 [HIGH] CWE-416 CVE-2026-113043: Use after free in iOSWeb in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker
Use after free in iOSWeb in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd