Google Chrome vulnerabilities

CVE-2011-3880 [HIGH] CWE-20 CVE-2011-3880: Google Chrome before 15.0.874.102 does not prevent use of an unspecified special character as a deli Google Chrome before 15.0.874.102 does not prevent use of an unspecified special character as a delimiter in HTTP headers, which has unknown impact and remote attack vectors.

CVE-2010-2903 [HIGH] CVE-2010-2903: Google Chrome before 5.0.375.125 performs unexpected truncation and improper eliding of hostnames, w Google Chrome before 5.0.375.125 performs unexpected truncation and improper eliding of hostnames, which has unspecified impact and remote attack vectors.

CVE-2013-0907 [HIGH] CWE-362 CVE-2013-0907: Race condition in Google Chrome before 25.0.1364.152 allows remote attackers to cause a denial of se Race condition in Google Chrome before 25.0.1364.152 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of media threads.

CVE-2012-5111 [HIGH] CVE-2012-5111: Google Chrome before 22.0.1229.92 does not monitor for crashes of Pepper plug-ins, which has unspeci Google Chrome before 22.0.1229.92 does not monitor for crashes of Pepper plug-ins, which has unspecified impact and remote attack vectors.

CVE-2026-13911 [MEDIUM] CWE-20 CVE-2026-13911: Insufficient policy enforcement in Spellcheck in Google Chrome prior to 150.0.7871.47 allowed a remo Insufficient policy enforcement in Spellcheck in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

CVE-2013-0925 [HIGH] CWE-264 CVE-2013-0925: Google Chrome before 26.0.1410.43 does not ensure that an extension has the tabs (aka APIPermission: Google Chrome before 26.0.1410.43 does not ensure that an extension has the tabs (aka APIPermission::kTab) permission before providing a URL to this extension, which has unspecified impact and remote attack vectors.

CVE-2026-13875 [MEDIUM] CWE-20 CVE-2026-13875: Insufficient validation of untrusted input in GPU in Google Chrome on Windows prior to 150.0.7871.47 Insufficient validation of untrusted input in GPU in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-15771 [MEDIUM] CWE-20 CVE-2026-15771: Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 150.0.7871. Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

CVE-2026-13961 [MEDIUM] CWE-20 CVE-2026-13961: Insufficient validation of untrusted input in DevTools in Google Chrome on Windows prior to 150.0.78 Insufficient validation of untrusted input in DevTools in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11005 [MEDIUM] CWE-125 CVE-2026-11005: Out of bounds read in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote atta Out of bounds read in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11004 [MEDIUM] CWE-125 CVE-2026-11004: Out of bounds read in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who ha Out of bounds read in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-13890 [MEDIUM] CWE-125 CVE-2026-13890: Out of bounds read in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker w Out of bounds read in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

CVE-2013-0886 [HIGH] CVE-2013-0886: Google Chrome before 25.0.1364.99 on Mac OS X does not properly implement signal handling for Native Google Chrome before 25.0.1364.99 on Mac OS X does not properly implement signal handling for Native Client (aka NaCl) code, which has unspecified impact and attack vectors.

CVE-2026-14117 [MEDIUM] CWE-20 CVE-2026-14117: Insufficient validation of untrusted input in DevTools in Google Chrome on Windows prior to 150.0.78 Insufficient validation of untrusted input in DevTools in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-8516 [MEDIUM] CWE-20 CVE-2026-8516: Insufficient validation of untrusted input in DataTransfer in Google Chrome prior to 148.0.7778.168 Insufficient validation of untrusted input in DataTransfer in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-3939 [MEDIUM] CWE-284 CVE-2026-3939: Insufficient policy enforcement in PDF in Google Chrome prior to 146.0.7680.71 allowed a remote atta Insufficient policy enforcement in PDF in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted PDF file. (Chromium security severity: Low)

CVE-2012-2871 [MEDIUM] CVE-2012-2871: libxml2 2.9.0-rc1 and earlier, as used in Google Chrome before 21.0.1180.89, does not properly suppo libxml2 2.9.0-rc1 and earlier, as used in Google Chrome before 21.0.1180.89, does not properly support a cast of an unspecified variable during handling of XSL transforms, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document, related to the _xmlNs data structure in include/libxml/tree.h.

CVE-2012-1521 [MEDIUM] CWE-416 CVE-2012-1521: Use-after-free vulnerability in the XML parser in Google Chrome before 18.0.1025.168 allows remote a Use-after-free vulnerability in the XML parser in Google Chrome before 18.0.1025.168 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

CVE-2011-3078 [MEDIUM] CWE-416 CVE-2011-3078: Use-after-free vulnerability in Google Chrome before 18.0.1025.168 allows remote attackers to cause Use-after-free vulnerability in Google Chrome before 18.0.1025.168 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the floating of elements, a different vulnerability than CVE-2011-3081.

CVE-2011-3075 [MEDIUM] CWE-416 CVE-2011-3075: Use-after-free vulnerability in Google Chrome before 18.0.1025.151 allows remote attackers to cause Use-after-free vulnerability in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to style-application commands.