Google Chrome vulnerabilities
5,831 known vulnerabilities affecting google/chrome.
Total CVEs
5,831
CISA KEV
75
actively exploited
Public exploits
88
Exploited in wild
87
Severity breakdown
CRITICAL498HIGH2799MEDIUM2453LOW79UNKNOWN2
Vulnerabilities
Page 251 of 292
CVE-2026-11259P4MEDIUMCVSS 4.3fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-05
CVE-2026-11259 [MEDIUM] CWE-20 CVE-2026-11259: Insufficient validation of untrusted input in Cast in Google Chrome prior to 149.0.7827.53 allowed a
Insufficient validation of untrusted input in Cast in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-11260P4MEDIUMCVSS 4.3fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-05
CVE-2026-11260 [MEDIUM] CWE-693 CVE-2026-11260: Inappropriate implementation in Permissions in Google Chrome prior to 149.0.7827.53 allowed a remote
Inappropriate implementation in Permissions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-11264P4MEDIUMCVSS 4.3fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-05
CVE-2026-11264 [MEDIUM] CWE-693 CVE-2026-11264: Policy bypass in Content Security Policy in Google Chrome prior to 149.0.7827.53 allowed a remote at
Policy bypass in Content Security Policy in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-8566P4MEDIUMCVSS 4.3fixed in 148.0.7778.168≥ 148.0.7778.168, < 148.0.7778.1682026-05-14
CVE-2026-8566 [MEDIUM] CWE-284 CVE-2026-8566: Insufficient policy enforcement in Payments in Google Chrome on Android prior to 148.0.7778.168 allo
Insufficient policy enforcement in Payments in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-8563P4MEDIUMCVSS 4.3fixed in 148.0.7778.168≥ 148.0.7778.168, < 148.0.7778.1682026-05-14
CVE-2026-8563 [MEDIUM] CWE-693 CVE-2026-8563: Insufficient policy enforcement in IFrame Sandbox in Google Chrome on Windows prior to 148.0.7778.16
Insufficient policy enforcement in IFrame Sandbox in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-17781P4MEDIUMCVSS 4.3fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17781 [MEDIUM] CWE-284 CVE-2026-17781: Inappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attack
Inappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. (Chromium security severity: Medium)
nvd
CVE-2026-14123P4MEDIUMCVSS 4.3fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-14123 [MEDIUM] CWE-451 CVE-2026-14123: Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a rem
Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-14128P4MEDIUMCVSS 4.3fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-14128 [MEDIUM] CWE-451 CVE-2026-14128: Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowe
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-14143P4MEDIUMCVSS 4.3fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-14143 [MEDIUM] CWE-451 CVE-2026-14143: Incorrect security UI in Passwords in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote a
Incorrect security UI in Passwords in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-14136P4MEDIUMCVSS 4.3fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-14136 [MEDIUM] CWE-451 CVE-2026-14136: Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.
Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-11302P4MEDIUMCVSS 4.3fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-05
CVE-2026-11302 [MEDIUM] CWE-284 CVE-2026-11302: Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 all
Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-13999P4MEDIUMCVSS 4.3fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-13999 [MEDIUM] CWE-20 CVE-2026-13999: Insufficient validation of untrusted input in Extensions in Google Chrome prior to 150.0.7871.47 all
Insufficient validation of untrusted input in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Medium)
nvd
CVE-2026-8559P4MEDIUMCVSS 4.3fixed in 148.0.7778.168≥ 148.0.7778.168, < 148.0.7778.1682026-05-14
CVE-2026-8559 [MEDIUM] CWE-472 CVE-2026-8559: Integer overflow in Internationalization in Google Chrome on Windows prior to 148.0.7778.168 allowed
Integer overflow in Internationalization in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-14031P4MEDIUMCVSS 4.3fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-14031 [MEDIUM] CWE-451 CVE-2026-14031: Inappropriate implementation in File Input in Google Chrome prior to 150.0.7871.47 allowed a remote
Inappropriate implementation in File Input in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-14077P4MEDIUMCVSS 4.3fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-14077 [MEDIUM] CWE-451 CVE-2026-14077: Inappropriate implementation in Select in Google Chrome on Mac prior to 150.0.7871.47 allowed a remo
Inappropriate implementation in Select in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-17876P4MEDIUMCVSS 4.3fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17876 [MEDIUM] CWE-346 CVE-2026-17876: Inappropriate implementation in Payments in Google Chrome prior to 151.0.7922.72 allowed a remote at
Inappropriate implementation in Payments in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-17885P4MEDIUMCVSS 4.3fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17885 [MEDIUM] CWE-346 CVE-2026-17885: Inappropriate implementation in Paint in Google Chrome prior to 151.0.7922.72 allowed a remote attac
Inappropriate implementation in Paint in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-17895P4MEDIUMCVSS 4.3fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17895 [MEDIUM] CWE-346 CVE-2026-17895: Inappropriate implementation in DataTransfer in Google Chrome prior to 151.0.7922.72 allowed a remot
Inappropriate implementation in DataTransfer in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-17897P4MEDIUMCVSS 4.3fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17897 [MEDIUM] CWE-346 CVE-2026-17897: Inappropriate implementation in ORB in Google Chrome prior to 151.0.7922.72 allowed a remote attacke
Inappropriate implementation in ORB in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-17871P4MEDIUMCVSS 4.3fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17871 [MEDIUM] CWE-346 CVE-2026-17871: Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote a
Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
nvd