Google Chrome vulnerabilities
5,831 known vulnerabilities affecting google/chrome.
Total CVEs
5,831
CISA KEV
75
actively exploited
Public exploits
88
Exploited in wild
87
Severity breakdown
CRITICAL498HIGH2799MEDIUM2453LOW79UNKNOWN2
Vulnerabilities
Page 260 of 292
CVE-2023-5853P4MEDIUMCVSS 4.3fixed in 119.0.6045.105≥ 119.0.6045.105, < 119.0.6045.1052023-11-01
CVE-2023-5853 [MEDIUM] CWE-346 CVE-2023-5853: Incorrect security UI in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacke
Incorrect security UI in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2023-2464P4MEDIUMCVSS 4.3fixed in 113.0.5672.63≥ 113.0.5672.63, < 113.0.5672.632023-05-03
CVE-2023-2464 [MEDIUM] CVE-2023-2464: Inappropriate implementation in PictureInPicture in Google Chrome prior to 113.0.5672.63 allowed an
Inappropriate implementation in PictureInPicture in Google Chrome prior to 113.0.5672.63 allowed an attacker who convinced a user to install a malicious extension to perform an origin spoof in the security UI via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2022-4184P4MEDIUMCVSS 4.3fixed in 108.0.5359.71≥ unspecified, < 108.0.5359.712022-11-30
CVE-2022-4184 [MEDIUM] CVE-2022-4184: Insufficient policy enforcement in Autofill in Google Chrome prior to 108.0.5359.71 allowed a remote
Insufficient policy enforcement in Autofill in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass autofill restrictions via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2023-5859P4MEDIUMCVSS 4.3fixed in 119.0.6045.105≥ 119.0.6045.105, < 119.0.6045.1052023-11-01
CVE-2023-5859 [MEDIUM] CWE-346 CVE-2023-5859: Incorrect security UI in Picture In Picture in Google Chrome prior to 119.0.6045.105 allowed a remot
Incorrect security UI in Picture In Picture in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform domain spoofing via a crafted local HTML page. (Chromium security severity: Low)
nvd
CVE-2023-4908P4MEDIUMCVSS 4.3fixed in 117.0.5938.62≥ 117.0.5938.62, < 117.0.5938.622023-09-12
CVE-2023-4908 [MEDIUM] CVE-2023-4908: Inappropriate implementation in Picture in Picture in Google Chrome prior to 117.0.5938.62 allowed a
Inappropriate implementation in Picture in Picture in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2023-4909P4MEDIUMCVSS 4.3fixed in 117.0.5938.62≥ 117.0.5938.62, < 117.0.5938.622023-09-12
CVE-2023-4909 [MEDIUM] CVE-2023-4909: Inappropriate implementation in Interstitials in Google Chrome prior to 117.0.5938.62 allowed a remo
Inappropriate implementation in Interstitials in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2023-3734P4MEDIUMCVSS 4.3fixed in 115.0.5790.98≥ 115.0.5790.98, < 115.0.5790.982023-08-01
CVE-2023-3734 [MEDIUM] CVE-2023-3734: Inappropriate implementation in Picture In Picture in Google Chrome prior to 115.0.5790.98 allowed a
Inappropriate implementation in Picture In Picture in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2022-3317P4MEDIUMCVSS 4.3fixed in 106.0.5249.62≥ unspecified, < 106.0.5249.622022-11-01
CVE-2022-3317 [MEDIUM] CVE-2022-3317: Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 106.0.524
Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 106.0.5249.62 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2024-3843P4MEDIUMCVSS 4.3fixed in 124.0.6367.60≥ 124.0.6367.60, < 124.0.6367.602024-04-17
CVE-2024-3843 [MEDIUM] CWE-290 CVE-2024-3843: Insufficient data validation in Downloads in Google Chrome prior to 124.0.6367.60 allowed a remote a
Insufficient data validation in Downloads in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2023-3735P4MEDIUMCVSS 4.3fixed in 115.0.5790.98≥ 115.0.5790.98, < 115.0.5790.982023-08-01
CVE-2023-3735 [MEDIUM] CWE-838 CVE-2023-3735: Inappropriate implementation in Web API Permission Prompts in Google Chrome prior to 115.0.5790.98 a
Inappropriate implementation in Web API Permission Prompts in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2023-3733P4MEDIUMCVSS 4.3fixed in 115.0.5790.98≥ 115.0.5790.98, < 115.0.5790.982023-08-01
CVE-2023-3733 [MEDIUM] CVE-2023-3733: Inappropriate implementation in WebApp Installs in Google Chrome prior to 115.0.5790.98 allowed a re
Inappropriate implementation in WebApp Installs in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2022-1488P4MEDIUMCVSS 4.3fixed in 101.0.4951.41≥ unspecified, < 101.0.4951.412022-07-26
CVE-2022-1488 [MEDIUM] CWE-668 CVE-2022-1488: Inappropriate implementation in Extensions API in Google Chrome prior to 101.0.4951.41 allowed an at
Inappropriate implementation in Extensions API in Google Chrome prior to 101.0.4951.41 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension.
nvd
CVE-2022-4188P4MEDIUMCVSS 4.3fixed in 108.0.5359.71≥ unspecified, < 108.0.5359.712022-11-30
CVE-2022-4188 [MEDIUM] CWE-74 CVE-2022-4188: Insufficient validation of untrusted input in CORS in Google Chrome on Android prior to 108.0.5359.7
Insufficient validation of untrusted input in CORS in Google Chrome on Android prior to 108.0.5359.71 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2022-1872P4MEDIUMCVSS 4.3fixed in 102.0.5005.61≥ unspecified, < 102.0.5005.612022-07-27
CVE-2022-1872 [MEDIUM] CVE-2022-1872: Insufficient policy enforcement in Extensions API in Google Chrome prior to 102.0.5005.61 allowed an
Insufficient policy enforcement in Extensions API in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to bypass downloads policy via a crafted HTML page.
nvd
CVE-2022-1871P4MEDIUMCVSS 4.3fixed in 102.0.5005.61≥ unspecified, < 102.0.5005.612022-07-27
CVE-2022-1871 [MEDIUM] CVE-2022-1871: Insufficient policy enforcement in File System API in Google Chrome prior to 102.0.5005.61 allowed a
Insufficient policy enforcement in File System API in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to bypass file system policy via a crafted HTML page.
nvd
CVE-2022-4183P4MEDIUMCVSS 4.3fixed in 108.0.5359.71≥ unspecified, < 108.0.5359.712022-11-30
CVE-2022-4183 [MEDIUM] CVE-2022-4183: Insufficient policy enforcement in Popup Blocker in Google Chrome prior to 108.0.5359.71 allowed a r
Insufficient policy enforcement in Popup Blocker in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2021-4321P4MEDIUMCVSS 4.3fixed in 91.0.4472.77≥ 91.0.4472.77, < 91.0.4472.772023-07-29
CVE-2021-4321 [MEDIUM] CVE-2021-4321: Policy bypass in Blink in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass co
Policy bypass in Blink in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2022-3316P4MEDIUMCVSS 4.3fixed in 106.0.5249.62≥ unspecified, < 106.0.5249.622022-11-01
CVE-2022-3316 [MEDIUM] CVE-2022-3316: Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 106.0.5249.62
Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to bypass security feature via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2023-3738P4MEDIUMCVSS 4.3fixed in 115.0.5790.98≥ 115.0.5790.98, < 115.0.5790.982023-08-01
CVE-2023-3738 [MEDIUM] CVE-2023-3738: Inappropriate implementation in Autofill in Google Chrome prior to 115.0.5790.98 allowed a remote at
Inappropriate implementation in Autofill in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2022-3661P4MEDIUMCVSS 4.3fixed in 107.0.5304.62≥ unspecified, < 107.0.5304.622022-11-01
CVE-2022-3661 [MEDIUM] CWE-20 CVE-2022-3661: Insufficient data validation in Extensions in Google Chrome prior to 107.0.5304.62 allowed a remote
Insufficient data validation in Extensions in Google Chrome prior to 107.0.5304.62 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted Chrome extension. (Chromium security severity: Low)
nvd