Google Chrome vulnerabilities

CVE-2026-91728 [CRITICAL] CWE-190 CVE-2026-91728: Integer overflow in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute Integer overflow in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-87654 [CRITICAL] CWE-122 CVE-2026-87654: Buffer overflow in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote atta Buffer overflow in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-79189 [CRITICAL] CWE-787 CVE-2026-79189: Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to po Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-79138 [CRITICAL] CWE-787 CVE-2026-79138: Out of bounds write in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote Out of bounds write in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-87621 [CRITICAL] CWE-787 CVE-2026-87621: Out of bounds write in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote Out of bounds write in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-106329 [CRITICAL] CWE-863 CVE-2026-106329: Incorrect authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attac Incorrect authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-106372 [CRITICAL] CWE-863 CVE-2026-106372: Incorrect authorization in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to p Incorrect authorization in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-95311 [CRITICAL] CWE-590 CVE-2026-95311: Free of non-heap memory in Fonts in Google Chrome prior to 154.0.8037.57 allowed a remote attacker l Free of non-heap memory in Fonts in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-106414 [CRITICAL] CWE-20 CVE-2026-106414: Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remo Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-106417 [CRITICAL] CWE-190 CVE-2026-106417: Integer overflow in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to poten Integer overflow in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-110159 [CRITICAL] CWE-863 CVE-2026-110159: Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local attacker Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)

CVE-2026-118321 [CRITICAL] CWE-20 CVE-2026-118321: Improper input validation in Core in Google Chrome on on Android prior to 156.0.8078.73 allowed a re Improper input validation in Core in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-118342 [CRITICAL] CWE-787 CVE-2026-118342: Out of bounds write in Editing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to Out of bounds write in Editing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2013-6166 [MEDIUM] CWE-352 CVE-2013-6166: Google Chrome before 29 sends HTTP Cookie headers without first validating that they have the requir Google Chrome before 29 sends HTTP Cookie headers without first validating that they have the required character-set restrictions, which allows remote attackers to conduct the equivalent of a persistent Logout CSRF attack via a crafted parameter that forces a web application to set a malformed cookie within an HTTP response.

CVE-2026-85043 [CRITICAL] CWE-459 CVE-2026-85043: Incomplete cleanup in Network in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to b Incomplete cleanup in Network in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: High)

CVE-2012-2897 [HIGH] CWE-119 CVE-2012-2897: The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT, as used by Google Chrome before 22.0.1229.79 and other programs, do not properly handle objects in memory, which allows remote attackers t

CVE-2026-79058 [CRITICAL] CWE-862 CVE-2026-79058: Missing authorization in Passwords in Google Chrome prior to 152.0.7977.65 allowed a remote attacker Missing authorization in Passwords in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-9111 [HIGH] CWE-416 CVE-2026-9111: Use after free in WebRTC in Google Chrome on Linux prior to 148.0.7778.179 allowed a remote attacker Use after free in WebRTC in Google Chrome on Linux prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-78905 [HIGH] CWE-843 CVE-2026-78905: Type confusion in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potenti Type confusion in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-12443 [HIGH] CWE-416 CVE-2026-12443: Use after free in Web Authentication in Google Chrome prior to 149.0.7827.155 allowed a remote attac Use after free in Web Authentication in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)