Google Chrome vulnerabilities
5,831 known vulnerabilities affecting google/chrome.
Total CVEs
5,831
CISA KEV
75
actively exploited
Public exploits
88
Exploited in wild
87
Severity breakdown
CRITICAL498HIGH2799MEDIUM2453LOW79UNKNOWN2
Vulnerabilities
Page 252 of 292
CVE-2026-17843P4MEDIUMCVSS 4.3fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17843 [MEDIUM] CWE-346 CVE-2026-17843: Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacke
Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-14105P4MEDIUMCVSS 4.3fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-14105 [MEDIUM] CWE-346 CVE-2026-14105: Insufficient policy enforcement in Speech in Google Chrome prior to 150.0.7871.47 allowed a remote a
Insufficient policy enforcement in Speech in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-11266P4MEDIUMCVSS 4.3fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-05
CVE-2026-11266 [MEDIUM] CWE-693 CVE-2026-11266: Inappropriate implementation in SafeBrowsing in Google Chrome prior to 149.0.7827.53 allowed a remot
Inappropriate implementation in SafeBrowsing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass Safe Browsing via a malicious file. (Chromium security severity: Low)
nvd
CVE-2026-5911P4MEDIUMCVSS 4.3fixed in 147.0.7727.55≥ 147.0.7727.55, < 147.0.7727.552026-04-08
CVE-2026-5911 [MEDIUM] CWE-693 CVE-2026-5911: Policy bypass in ServiceWorkers in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to
Policy bypass in ServiceWorkers in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-3941P4MEDIUMCVSS 4.3fixed in 146.0.7680.71≥ 146.0.7680.71, < 146.0.7680.712026-03-11
CVE-2026-3941 [MEDIUM] CWE-602 CVE-2026-3941: Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote
Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-17817P4MEDIUMCVSS 4.3fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17817 [MEDIUM] CWE-346 CVE-2026-17817: Inappropriate implementation in ReportingAndNEL in Google Chrome prior to 151.0.7922.72 allowed a re
Inappropriate implementation in ReportingAndNEL in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-17905P4MEDIUMCVSS 4.3fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17905 [MEDIUM] CWE-346 CVE-2026-17905: Inappropriate implementation in SurfaceCapture in Google Chrome prior to 151.0.7922.72 allowed a rem
Inappropriate implementation in SurfaceCapture in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-17833P4MEDIUMCVSS 4.3fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17833 [MEDIUM] CWE-346 CVE-2026-17833: Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote a
Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-17910P4MEDIUMCVSS 4.3fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17910 [MEDIUM] CWE-346 CVE-2026-17910: Insufficient policy enforcement in NFC in Google Chrome on Android prior to 151.0.7922.72 allowed a
Insufficient policy enforcement in NFC in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-17904P4MEDIUMCVSS 4.3fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17904 [MEDIUM] CWE-346 CVE-2026-17904: Insufficient policy enforcement in NFC in Google Chrome on Android prior to 151.0.7922.72 allowed a
Insufficient policy enforcement in NFC in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-17933P4MEDIUMCVSS 4.3fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17933 [MEDIUM] CWE-346 CVE-2026-17933: Inappropriate implementation in DOMStorage in Google Chrome prior to 151.0.7922.72 allowed a remote
Inappropriate implementation in DOMStorage in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-17959P4MEDIUMCVSS 4.3fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17959 [MEDIUM] CWE-346 CVE-2026-17959: Inappropriate implementation in Network in Google Chrome prior to 151.0.7922.72 allowed a remote att
Inappropriate implementation in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-17911P4MEDIUMCVSS 4.3fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17911 [MEDIUM] CWE-346 CVE-2026-17911: Insufficient policy enforcement in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote atta
Insufficient policy enforcement in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-17963P4MEDIUMCVSS 4.3fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17963 [MEDIUM] CWE-346 CVE-2026-17963: Inappropriate implementation in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacke
Inappropriate implementation in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-17977P4MEDIUMCVSS 4.3fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17977 [MEDIUM] CWE-346 CVE-2026-17977: Policy bypass in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross
Policy bypass in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-14039P4MEDIUMCVSS 4.3fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-14039 [MEDIUM] CWE-346 CVE-2026-14039: Insufficient policy enforcement in GetUserMedia in Google Chrome prior to 150.0.7871.47 allowed a re
Insufficient policy enforcement in GetUserMedia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-5906P4MEDIUMCVSS 4.3fixed in 147.0.7727.55≥ 147.0.7727.55, < 147.0.7727.552026-04-08
CVE-2026-5906 [MEDIUM] CWE-451 CVE-2026-5906: Incorrect security UI in Omnibox in Google Chrome on Android prior to 147.0.7727.55 allowed a remote
Incorrect security UI in Omnibox in Google Chrome on Android prior to 147.0.7727.55 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-5900P4MEDIUMCVSS 4.3fixed in 147.0.7727.55≥ 147.0.7727.55, < 147.0.7727.552026-04-08
CVE-2026-5900 [MEDIUM] CWE-693 CVE-2026-5900: Policy bypass in Downloads in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypa
Policy bypass in Downloads in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass of multi-download protections via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-5894P4MEDIUMCVSS 4.3fixed in 147.0.7727.55≥ 147.0.7727.55, < 147.0.7727.552026-04-08
CVE-2026-5894 [MEDIUM] CWE-358 CVE-2026-5894: Inappropriate implementation in PDF in Google Chrome prior to 147.0.7727.55 allowed a remote attacke
Inappropriate implementation in PDF in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-18004P4MEDIUMCVSS 4.3fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-18004 [MEDIUM] CWE-284 CVE-2026-18004: Insufficient policy enforcement in Speech in Google Chrome prior to 151.0.7922.72 allowed a remote a
Insufficient policy enforcement in Speech in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
nvd