Google Chrome vulnerabilities
5,831 known vulnerabilities affecting google/chrome.
Total CVEs
5,831
CISA KEV
75
actively exploited
Public exploits
88
Exploited in wild
87
Severity breakdown
CRITICAL498HIGH2799MEDIUM2453LOW79UNKNOWN2
Vulnerabilities
Page 193 of 292
CVE-2020-6460P4MEDIUMCVSS 6.5fixed in 81.0.4044.122≥ unspecified, < 81.0.4044.1222020-05-21
CVE-2020-6460 [MEDIUM] CVE-2020-6460: Insufficient data validation in URL formatting in Google Chrome prior to 81.0.4044.122 allowed a rem
Insufficient data validation in URL formatting in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to perform domain spoofing via a crafted domain name.
nvd
CVE-2022-3044P4MEDIUMCVSS 6.5fixed in 105.0.5195.52≥ unspecified, < 105.0.5195.522022-09-26
CVE-2022-3044 [MEDIUM] CWE-693 CVE-2022-3044: Inappropriate implementation in Site Isolation in Google Chrome prior to 105.0.5195.52 allowed a rem
Inappropriate implementation in Site Isolation in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.
nvd
CVE-2022-2860P4MEDIUMCVSS 6.5fixed in 104.0.5112.101≥ unspecified, < 104.0.5112.1012022-09-26
CVE-2022-2860 [MEDIUM] CVE-2022-2860: Insufficient policy enforcement in Cookies in Google Chrome prior to 104.0.5112.101 allowed a remote
Insufficient policy enforcement in Cookies in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to bypass cookie prefix restrictions via a crafted HTML page.
nvd
CVE-2022-1146P4MEDIUMCVSS 6.5fixed in 100.0.4896.60≥ unspecified, < 100.0.4896.602022-07-23
CVE-2022-1146 [MEDIUM] CWE-203 CVE-2022-1146: Inappropriate implementation in Resource Timing in Google Chrome prior to 100.0.4896.60 allowed a re
Inappropriate implementation in Resource Timing in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
nvd
CVE-2022-0803P4MEDIUMCVSS 6.5fixed in 99.0.4844.51≥ unspecified, < 99.0.4844.512022-04-05
CVE-2022-0803 [MEDIUM] CVE-2022-0803: Inappropriate implementation in Permissions in Google Chrome prior to 99.0.4844.51 allowed a remote
Inappropriate implementation in Permissions in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to tamper with the contents of the Omnibox (URL bar) via a crafted HTML page.
nvd
CVE-2022-0113P4MEDIUMCVSS 6.5fixed in 97.0.4692.71≥ unspecified, < 97.0.4692.712022-02-12
CVE-2022-0113 [MEDIUM] CWE-346 CVE-2022-0113: Inappropriate implementation in Blink in Google Chrome prior to 97.0.4692.71 allowed a remote attack
Inappropriate implementation in Blink in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
nvd
CVE-2018-6134P4MEDIUMCVSS 6.5fixed in 67.0.3396.62≥ unspecified, < 67.0.3396.622019-06-27
CVE-2018-6134 [MEDIUM] CWE-200 CVE-2018-6134: Information leak in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to bypass
Information leak in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to bypass no-referrer policy via a crafted HTML page.
nvd
CVE-2017-5014P4MEDIUMCVSS 6.3≤ 55.0.2883.872017-02-17
CVE-2017-5014 [MEDIUM] CWE-119 CVE-2017-5014: Heap buffer overflow during image processing in Skia in Google Chrome prior to 56.0.2924.76 for Linu
Heap buffer overflow during image processing in Skia in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
nvd
CVE-2022-0462P4MEDIUMCVSS 6.5fixed in 98.0.4758.80≥ unspecified, < 98.0.4758.802022-04-05
CVE-2022-0462 [MEDIUM] CVE-2022-0462: Inappropriate implementation in Scroll in Google Chrome prior to 98.0.4758.80 allowed a remote attac
Inappropriate implementation in Scroll in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
nvd
CVE-2017-5028P4MEDIUMCVSS 6.5fixed in 56.0.2924.76≥ unspecified, < 56.0.2924.762019-06-27
CVE-2017-5028 [MEDIUM] CWE-20 CVE-2017-5028: Insufficient data validation in V8 in Google Chrome prior to 56.0.2924.76 allowed a remote attacker
Insufficient data validation in V8 in Google Chrome prior to 56.0.2924.76 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
nvd
CVE-2021-38022P4MEDIUMCVSS 6.5fixed in 96.0.4664.45≥ unspecified, < 96.0.4664.452021-12-23
CVE-2021-38022 [MEDIUM] CVE-2021-38022: Inappropriate implementation in WebAuthentication in Google Chrome prior to 96.0.4664.45 allowed a r
Inappropriate implementation in WebAuthentication in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
nvd
CVE-2022-1501P4MEDIUMCVSS 6.5fixed in 101.0.4951.41≥ unspecified, < 101.0.4951.412022-07-26
CVE-2022-1501 [MEDIUM] CWE-668 CVE-2022-1501: Inappropriate implementation in iframe in Google Chrome prior to 101.0.4951.41 allowed a remote atta
Inappropriate implementation in iframe in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
nvd
CVE-2018-6142P4MEDIUMCVSS 6.5fixed in 67.0.3396.62≥ unspecified, < 67.0.3396.622019-06-27
CVE-2018-6142 [MEDIUM] CWE-125 CVE-2018-6142: Array bounds check failure in V8 in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to
Array bounds check failure in V8 in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file.
nvd
CVE-2021-38019P4MEDIUMCVSS 6.5fixed in 96.0.4664.45≥ unspecified, < 96.0.4664.452021-12-23
CVE-2021-38019 [MEDIUM] CWE-670 CVE-2021-38019: Insufficient policy enforcement in CORS in Google Chrome prior to 96.0.4664.45 allowed a remote atta
Insufficient policy enforcement in CORS in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
nvd
CVE-2021-38009P4MEDIUMCVSS 6.5fixed in 96.0.4664.45≥ unspecified, < 96.0.4664.452021-12-23
CVE-2021-38009 [MEDIUM] CWE-203 CVE-2021-38009: Inappropriate implementation in cache in Google Chrome prior to 96.0.4664.45 allowed a remote attack
Inappropriate implementation in cache in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
nvd
CVE-2021-21164P4MEDIUMCVSS 6.5fixed in 89.0.4389.72≥ unspecified, < 89.0.4389.722021-03-09
CVE-2021-21164 [MEDIUM] CWE-346 CVE-2021-21164: Insufficient data validation in Chrome on iOS in Google Chrome on iOS prior to 89.0.4389.72 allowed
Insufficient data validation in Chrome on iOS in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
nvd
CVE-2020-16027P4MEDIUMCVSS 6.5fixed in 87.0.4280.66≥ unspecified, < 87.0.4280.662021-01-08
CVE-2020-16027 [MEDIUM] CWE-862 CVE-2020-16027: Insufficient policy enforcement in developer tools in Google Chrome prior to 87.0.4280.66 allowed an
Insufficient policy enforcement in developer tools in Google Chrome prior to 87.0.4280.66 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from the user's disk via a crafted Chrome Extension.
nvd
CVE-2021-37989P4MEDIUMCVSS 6.5fixed in 95.0.4638.54≥ unspecified, < 95.0.4638.542021-11-02
CVE-2021-37989 [MEDIUM] CVE-2021-37989: Inappropriate implementation in Blink in Google Chrome prior to 95.0.4638.54 allowed a remote attack
Inappropriate implementation in Blink in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to abuse content security policy via a crafted HTML page.
nvd
CVE-2022-0111P4MEDIUMCVSS 6.5fixed in 97.0.4692.71≥ unspecified, < 97.0.4692.712022-02-12
CVE-2022-0111 [MEDIUM] CWE-346 CVE-2022-0111: Inappropriate implementation in Navigation in Google Chrome prior to 97.0.4692.71 allowed a remote a
Inappropriate implementation in Navigation in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to incorrectly set origin via a crafted HTML page.
nvd
CVE-2021-37994P4MEDIUMCVSS 6.5fixed in 95.0.4638.54≥ unspecified, < 95.0.4638.542021-11-02
CVE-2021-37994 [MEDIUM] CVE-2021-37994: Inappropriate implementation in iFrame Sandbox in Google Chrome prior to 95.0.4638.54 allowed a remo
Inappropriate implementation in iFrame Sandbox in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
nvd