Google Chrome vulnerabilities

CVE-2024-0333 [MEDIUM] CVE-2024-0333: Insufficient data validation in Extensions in Google Chrome prior to 120.0.6099.216 allowed an attac Insufficient data validation in Extensions in Google Chrome prior to 120.0.6099.216 allowed an attacker in a privileged network position to install a malicious extension via a crafted HTML page. (Chromium security severity: High)

CVE-2026-11701 [MEDIUM] CWE-20 CVE-2026-11701: Inappropriate implementation in Guest View in Google Chrome prior to 149.0.7827.103 allowed a remote Inappropriate implementation in Guest View in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-13977 [MEDIUM] CWE-79 CVE-2026-13977: Inappropriate implementation in HTMLParser in Google Chrome prior to 150.0.7871.47 allowed a remote Inappropriate implementation in HTMLParser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)

CVE-2012-2892 [MEDIUM] CVE-2012-2892: Unspecified vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to bypass the Unspecified vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to bypass the pop-up blocker via unknown vectors.

CVE-2026-7939 [MEDIUM] CWE-79 CVE-2026-7939: Inappropriate implementation in SanitizerAPI in Google Chrome prior to 148.0.7778.96 allowed a remot Inappropriate implementation in SanitizerAPI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)

CVE-2025-6556 [MEDIUM] CWE-288 CVE-2025-6556: Insufficient policy enforcement in Loader in Google Chrome prior to 138.0.7204.49 allowed a remote a Insufficient policy enforcement in Loader in Google Chrome prior to 138.0.7204.49 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)

CVE-2011-3102 [MEDIUM] CWE-189 CVE-2011-3102: Off-by-one error in libxml2, as used in Google Chrome before 19.0.1084.46 and other products, allows Off-by-one error in libxml2, as used in Google Chrome before 19.0.1084.46 and other products, allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via unknown vectors.

CVE-2026-9971 [MEDIUM] CWE-79 CVE-2026-9971: Inappropriate implementation in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote Inappropriate implementation in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High)

CVE-2026-8019 [MEDIUM] CWE-451 CVE-2026-8019: Insufficient policy enforcement in WebApp in Google Chrome prior to 148.0.7778.96 allowed a remote a Insufficient policy enforcement in WebApp in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

CVE-2025-12905 [MEDIUM] CWE-346 CVE-2025-12905: Inappropriate implementation in Downloads in Google Chrome on Windows prior to 140.0.7339.80 allowed Inappropriate implementation in Downloads in Google Chrome on Windows prior to 140.0.7339.80 allowed a remote attacker to bypass Mark of the Web via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-11243 [MEDIUM] CWE-346 CVE-2026-11243: Inappropriate implementation in Downloads in Google Chrome prior to 149.0.7827.53 allowed a remote a Inappropriate implementation in Downloads in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-11232 [MEDIUM] CWE-451 CVE-2026-11232: Inappropriate implementation in TabGroups in Google Chrome prior to 149.0.7827.53 allowed a remote a Inappropriate implementation in TabGroups in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via malicious network traffic. (Chromium security severity: Low)

CVE-2010-1500 [HIGH] CVE-2010-1500: Google Chrome before 4.1.249.1059 does not properly support forms, which has unknown impact and atta Google Chrome before 4.1.249.1059 does not properly support forms, which has unknown impact and attack vectors, related to a "type confusion error."

CVE-2026-8008 [MEDIUM] CWE-451 CVE-2026-8008: Inappropriate implementation in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attacker Inappropriate implementation in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low)

CVE-2026-8006 [MEDIUM] CWE-451 CVE-2026-8006: Insufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attac Insufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low)

CVE-2013-0838 [HIGH] CWE-264 CVE-2013-0838: Google Chrome before 24.0.1312.52 on Linux uses weak permissions for shared memory segments, which h Google Chrome before 24.0.1312.52 on Linux uses weak permissions for shared memory segments, which has unspecified impact and attack vectors.

CVE-2012-5154 [HIGH] CWE-189 CVE-2012-5154: Integer overflow in Google Chrome before 24.0.1312.52 on Windows allows attackers to cause a denial Integer overflow in Google Chrome before 24.0.1312.52 on Windows allows attackers to cause a denial of service or possibly have unspecified other impact via vectors related to allocation of shared memory.

CVE-2015-1229 [MEDIUM] CWE-19 CVE-2015-1229: net/http/proxy_client_socket.cc in Google Chrome before 41.0.2272.76 does not properly handle a 407 net/http/proxy_client_socket.cc in Google Chrome before 41.0.2272.76 does not properly handle a 407 (aka Proxy Authentication Required) HTTP status code accompanied by a Set-Cookie header, which allows remote proxy servers to conduct cookie-injection attacks via a crafted response.

CVE-2026-13030 [MEDIUM] CWE-457 CVE-2026-13030: Uninitialized Use in GPU in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attack Uninitialized Use in GPU in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

CVE-2026-11145 [MEDIUM] CWE-362 CVE-2026-11145: Race in Geolocation in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to Race in Geolocation in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)