Google Chrome vulnerabilities

CVE-2026-9110 [MEDIUM] CWE-451 CVE-2026-9110: Inappropriate implementation in UI in Google Chrome on Windows prior to 148.0.7778.179 allowed a rem Inappropriate implementation in UI in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-17659 [MEDIUM] CWE-693 CVE-2026-17659: Inappropriate implementation in SiteIsolation in Google Chrome prior to 151.0.7922.72 allowed a remo Inappropriate implementation in SiteIsolation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

CVE-2026-17747 [MEDIUM] CWE-20 CVE-2026-17747: Insufficient validation of untrusted input in Payments in Google Chrome on Android prior to 151.0.79 Insufficient validation of untrusted input in Payments in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-7952 [MEDIUM] CWE-693 CVE-2026-7952: Insufficient policy enforcement in Extensions in Google Chrome prior to 148.0.7778.96 allowed a remo Insufficient policy enforcement in Extensions in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-13957 [MEDIUM] CWE-79 CVE-2026-13957: Incorrect security UI in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who Incorrect security UI in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-8021 [MEDIUM] CWE-94 CVE-2026-8021: Script injection in UI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who convinc Script injection in UI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-17724 [MEDIUM] CWE-362 CVE-2026-17724: Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to i Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High)

CVE-2017-5025 [MEDIUM] CWE-119 CVE-2017-5025: FFmpeg in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, failed to perform proper b FFmpeg in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, failed to perform proper bounds checking, which allowed a remote attacker to potentially exploit heap corruption via a crafted video file.

CVE-2017-5024 [MEDIUM] CWE-119 CVE-2017-5024: FFmpeg in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, failed to perform proper b FFmpeg in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, failed to perform proper bounds checking, which allowed a remote attacker to potentially exploit heap corruption via a crafted video file.

CVE-2012-2825 [MEDIUM] CWE-20 CVE-2012-2825: The XSL implementation in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denia The XSL implementation in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service (incorrect read operation) via unspecified vectors.

CVE-2011-3234 [MEDIUM] CWE-125 CVE-2011-3234: Google Chrome before 14.0.835.163 does not properly handle boxes, which allows remote attackers to c Google Chrome before 14.0.835.163 does not properly handle boxes, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

CVE-2011-0984 [MEDIUM] CWE-125 CVE-2011-0984: Google Chrome before 9.0.597.94 does not properly handle plug-ins, which allows remote attackers to Google Chrome before 9.0.597.94 does not properly handle plug-ins, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

CVE-2019-5860 [MEDIUM] CWE-416 CVE-2019-5860: Use after free in PDFium in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potenti Use after free in PDFium in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.

CVE-2011-1465 [MEDIUM] CVE-2011-1465: The SPDY implementation in net/http/http_network_transaction.cc in Google Chrome before 11.0.696.14 The SPDY implementation in net/http/http_network_transaction.cc in Google Chrome before 11.0.696.14 drains the bodies from SPDY responses, which might allow remote SPDY servers to cause a denial of service (application exit) by canceling a stream.

CVE-2011-3893 [MEDIUM] CWE-125 CVE-2011-3893: Google Chrome before 15.0.874.120 does not properly implement the MKV and Vorbis media handlers, whi Google Chrome before 15.0.874.120 does not properly implement the MKV and Vorbis media handlers, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

CVE-2019-13707 [MEDIUM] CWE-20 CVE-2019-13707: Insufficient validation of untrusted input in intents in Google Chrome on Android prior to 78.0.3904 Insufficient validation of untrusted input in intents in Google Chrome on Android prior to 78.0.3904.70 allowed a local attacker to leak files via a crafted application.

CVE-2011-0483 [MEDIUM] CWE-704 CVE-2011-0483: Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 do not properly perform a cast of Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 do not properly perform a cast of an unspecified variable during handling of video, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

CVE-2011-1691 [MEDIUM] CWE-476 CVE-2011-1691: The counterToCSSValue function in CSSComputedStyleDeclaration.cpp in the Cascading Style Sheets (CSS The counterToCSSValue function in CSSComputedStyleDeclaration.cpp in the Cascading Style Sheets (CSS) implementation in WebCore in WebKit before r82222, as used in Google Chrome before 11.0.696.43 and other products, does not properly handle access to the (1) counterIncrement and (2) counterReset attributes of CSSStyleDeclaration data provided by a ge

CVE-2013-0888 [MEDIUM] CWE-125 CVE-2013-0888: Skia, as used in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Skia, as used in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service (out-of-bounds read) via vectors related to a "user gesture check for dangerous file downloads."

CVE-2011-1113 [MEDIUM] CWE-125 CVE-2011-1113: Google Chrome before 9.0.597.107 on 64-bit Linux platforms does not properly perform pickle deserial Google Chrome before 9.0.597.107 on 64-bit Linux platforms does not properly perform pickle deserialization, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.