Google Chrome vulnerabilities
5,831 known vulnerabilities affecting google/chrome.
Total CVEs
5,831
CISA KEV
75
actively exploited
Public exploits
88
Exploited in wild
87
Severity breakdown
CRITICAL498HIGH2799MEDIUM2453LOW79UNKNOWN2
Vulnerabilities
Page 218 of 292
CVE-2020-6535P4MEDIUMCVSS 6.1fixed in 84.0.4147.89≥ unspecified, < 84.0.4147.892020-07-22
CVE-2020-6535 [MEDIUM] CWE-79 CVE-2020-6535: Insufficient data validation in WebUI in Google Chrome prior to 84.0.4147.89 allowed a remote attack
Insufficient data validation in WebUI in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had compromised the renderer process to inject scripts or HTML into a privileged page via a crafted HTML page.
nvd
CVE-2018-6039P4MEDIUMCVSS 6.1fixed in 64.0.3282.119≥ unspecified, < 64.0.3282.1192018-09-25
CVE-2018-6039 [MEDIUM] CWE-20 CVE-2018-6039: Insufficient data validation in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote at
Insufficient data validation in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user cross-origin data via a crafted Chrome Extension.
nvd
CVE-2018-6046P4MEDIUMCVSS 6.1fixed in 64.0.3282.119≥ unspecified, < 64.0.3282.1192018-09-25
CVE-2018-6046 [MEDIUM] CWE-20 CVE-2018-6046: Insufficient data validation in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote at
Insufficient data validation in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user cross-origin data via a crafted Chrome Extension.
nvd
CVE-2016-1682P4MEDIUMCVSS 6.1≤ 50.0.2661.1022016-06-05
CVE-2016-1682 [MEDIUM] CWE-254 CVE-2016-1682: The ServiceWorkerContainer::registerServiceWorkerImpl function in WebKit/Source/modules/serviceworke
The ServiceWorkerContainer::registerServiceWorkerImpl function in WebKit/Source/modules/serviceworkers/ServiceWorkerContainer.cpp in Blink, as used in Google Chrome before 51.0.2704.63, allows remote attackers to bypass the Content Security Policy (CSP) protection mechanism via a ServiceWorker registration.
nvd
CVE-2023-5480P4MEDIUMCVSS 6.1fixed in 119.0.6045.105≥ 119.0.6045.105, < 119.0.6045.1052023-11-01
CVE-2023-5480 [MEDIUM] CWE-79 CVE-2023-5480: Inappropriate implementation in Payments in Google Chrome prior to 119.0.6045.105 allowed a remote a
Inappropriate implementation in Payments in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to bypass XSS preventions via a malicious file. (Chromium security severity: High)
nvd
CVE-2018-16084P4MEDIUMCVSS 6.1fixed in 69.0.3497.81≥ unspecified, < 69.0.3497.812019-01-09
CVE-2018-16084 [MEDIUM] CWE-79 CVE-2018-16084: The default selected dialog button in CustomHandlers in Google Chrome prior to 69.0.3497.81 allowed
The default selected dialog button in CustomHandlers in Google Chrome prior to 69.0.3497.81 allowed a remote attacker who convinced the user to perform certain operations to open external programs via a crafted HTML page.
nvd
CVE-2022-1494P4MEDIUMCVSS 6.1fixed in 101.0.4951.41≥ unspecified, < 101.0.4951.412022-07-26
CVE-2022-1494 [MEDIUM] CWE-79 CVE-2022-1494: Insufficient data validation in Trusted Types in Google Chrome prior to 101.0.4951.41 allowed a remo
Insufficient data validation in Trusted Types in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass trusted types policy via a crafted HTML page.
nvd
CVE-2024-3841P4MEDIUMCVSS 6.1fixed in 124.0.6367.60≥ 124.0.6367.60, < 124.0.6367.602024-04-17
CVE-2024-3841 [MEDIUM] CWE-79 CVE-2024-3841: Insufficient data validation in Browser Switcher in Google Chrome prior to 124.0.6367.60 allowed a r
Insufficient data validation in Browser Switcher in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to inject scripts or HTML into a privileged page via a malicious file. (Chromium security severity: Medium)
nvd
CVE-2022-3863P4MEDIUMCVSS 6.1fixed in 100.0.4896.75≥ unspecified, < 100.0.4896.752023-01-02
CVE-2022-3863 [MEDIUM] CWE-416 CVE-2022-3863: Use after free in Browser History in Google Chrome prior to 100.0.4896.75 allowed a remote attacker
Use after free in Browser History in Google Chrome prior to 100.0.4896.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chrome security severity: High)
nvd
CVE-2005-4900P4MEDIUMCVSS 5.9≤ 47.0.2526.1112016-10-14
CVE-2005-4900 [MEDIUM] CWE-326 CVE-2005-4900: SHA-1 is not collision resistant, which makes it easier for context-dependent attackers to conduct s
SHA-1 is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attacks, as demonstrated by attacks on the use of SHA-1 in TLS 1.2. NOTE: this CVE exists to provide a common identifier for referencing this SHA-1 issue; the existence of an identifier is not, by itself, a technology recommendation.
nvd
CVE-2026-17962P4MEDIUMCVSS 6.1fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17962 [MEDIUM] CWE-79 CVE-2026-17962: Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attac
Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-14001P4MEDIUMCVSS 6.1fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-14001 [MEDIUM] CWE-79 CVE-2026-14001: Inappropriate implementation in Network in Google Chrome prior to 150.0.7871.47 allowed a remote att
Inappropriate implementation in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-14000P4MEDIUMCVSS 6.1fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-14000 [MEDIUM] CWE-79 CVE-2026-14000: Inappropriate implementation in XML in Google Chrome prior to 150.0.7871.47 allowed a remote attacke
Inappropriate implementation in XML in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-11122P4MEDIUMCVSS 6.1fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11122 [MEDIUM] CWE-358 CVE-2026-11122: Inappropriate implementation in Keyboard in Google Chrome prior to 149.0.7827.53 allowed a remote at
Inappropriate implementation in Keyboard in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-11186P4MEDIUMCVSS 6.1fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11186 [MEDIUM] CWE-79 CVE-2026-11186: Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacke
Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-11150P4MEDIUMCVSS 6.1fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11150 [MEDIUM] CWE-79 CVE-2026-11150: Inappropriate implementation in XML in Google Chrome prior to 149.0.7827.53 allowed a remote attacke
Inappropriate implementation in XML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-15128P4MEDIUMCVSS 6.1fixed in 150.0.7871.115≥ 150.0.7871.115, < 150.0.7871.1152026-07-08
CVE-2026-15128 [MEDIUM] CWE-79 CVE-2026-15128: Inappropriate implementation in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote atta
Inappropriate implementation in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-15127P4MEDIUMCVSS 6.1fixed in 150.0.7871.115≥ 150.0.7871.115, < 150.0.7871.1152026-07-08
CVE-2026-15127 [MEDIUM] CWE-79 CVE-2026-15127: Inappropriate implementation in WebGL in Google Chrome prior to 150.0.7871.115 allowed a remote atta
Inappropriate implementation in WebGL in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2020-6412P4MEDIUMCVSS 5.4fixed in 80.0.3987.87≥ unspecified, < 80.0.3987.872020-02-11
CVE-2020-6412 [MEDIUM] CWE-20 CVE-2020-6412: Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 80.0.3987.87 allowed
Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
nvd
CVE-2020-6411P4MEDIUMCVSS 5.4fixed in 80.0.3987.87≥ unspecified, < 80.0.3987.872020-02-11
CVE-2020-6411 [MEDIUM] CWE-20 CVE-2020-6411: Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 80.0.3987.87 allowed
Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
nvd