Google Chrome vulnerabilities
5,831 known vulnerabilities affecting google/chrome.
Total CVEs
5,831
CISA KEV
75
actively exploited
Public exploits
88
Exploited in wild
87
Severity breakdown
CRITICAL498HIGH2799MEDIUM2453LOW79UNKNOWN2
Vulnerabilities
Page 272 of 292
CVE-2022-1306P4MEDIUMCVSS 4.3fixed in 100.0.4896.88≥ unspecified, < 100.0.4896.882022-07-25
CVE-2022-1306 [MEDIUM] CWE-290 CVE-2022-1306: Inappropriate implementation in compositing in Google Chrome prior to 100.0.4896.88 allowed a remote
Inappropriate implementation in compositing in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
nvd
CVE-2022-4908P4MEDIUMCVSS 4.3fixed in 107.0.5304.62≥ 107.0.5304.62, < 107.0.5304.622023-07-29
CVE-2022-4908 [MEDIUM] CVE-2022-4908: Inappropriate implementation in iFrame Sandbox in Google Chrome prior to 107.0.5304.62 allowed a rem
Inappropriate implementation in iFrame Sandbox in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2021-37966P4MEDIUMCVSS 4.3fixed in 94.0.4606.54≥ unspecified, < 94.0.4606.542021-10-08
CVE-2021-37966 [MEDIUM] CWE-346 CVE-2021-37966: Inappropriate implementation in Compositing in Google Chrome on Android prior to 94.0.4606.54 allowe
Inappropriate implementation in Compositing in Google Chrome on Android prior to 94.0.4606.54 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
nvd
CVE-2023-1234P4MEDIUMCVSS 4.3fixed in 111.0.5563.64≥ 111.0.5563.64, < 111.0.5563.642023-03-07
CVE-2023-1234 [MEDIUM] CVE-2023-1234: Inappropriate implementation in Intents in Google Chrome on Android prior to 111.0.5563.64 allowed a
Inappropriate implementation in Intents in Google Chrome on Android prior to 111.0.5563.64 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2020-16033P4MEDIUMCVSS 4.3fixed in 87.0.4280.66≥ unspecified, < 87.0.4280.662021-01-08
CVE-2020-16033 [MEDIUM] CWE-1021 CVE-2020-16033: Inappropriate implementation in WebUSB in Google Chrome prior to 87.0.4280.66 allowed a remote attac
Inappropriate implementation in WebUSB in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to spoof security UI via a crafted HTML page.
nvd
CVE-2019-5873P4MEDIUMCVSS 4.3fixed in 77.0.3865.75≥ unspecified, < 77.0.3865.752019-11-25
CVE-2019-5873 [MEDIUM] CVE-2019-5873: Insufficient policy validation in navigation in Google Chrome on iOS prior to 77.0.3865.75 allowed a
Insufficient policy validation in navigation in Google Chrome on iOS prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
nvd
CVE-2022-1495P4MEDIUMCVSS 4.3fixed in 101.0.4951.41≥ unspecified, < 101.0.4951.412022-07-26
CVE-2022-1495 [MEDIUM] CWE-290 CVE-2022-1495: Incorrect security UI in Downloads in Google Chrome on Android prior to 101.0.4951.41 allowed a remo
Incorrect security UI in Downloads in Google Chrome on Android prior to 101.0.4951.41 allowed a remote attacker to spoof the APK downloads dialog via a crafted HTML page.
nvd
CVE-2021-38020P4MEDIUMCVSS 4.3fixed in 96.0.4664.45≥ unspecified, < 96.0.4664.452021-12-23
CVE-2021-38020 [MEDIUM] CVE-2021-38020: Insufficient policy enforcement in contacts picker in Google Chrome on Android prior to 96.0.4664.45
Insufficient policy enforcement in contacts picker in Google Chrome on Android prior to 96.0.4664.45 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
nvd
CVE-2019-13674P4MEDIUMCVSS 4.3fixed in 77.0.3865.75≥ unspecified, < 77.0.3865.752019-11-25
CVE-2019-13674 [MEDIUM] CVE-2019-13674: IDN spoofing in Omnibox in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform
IDN spoofing in Omnibox in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
nvd
CVE-2023-4363P4MEDIUMCVSS 4.3fixed in 116.0.5845.96≥ 116.0.5845.96, < 116.0.5845.962023-08-15
CVE-2023-4363 [MEDIUM] CVE-2023-4363: Inappropriate implementation in WebShare in Google Chrome on Android prior to 116.0.5845.96 allowed
Inappropriate implementation in WebShare in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker to spoof the contents of a dialog URL via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2019-13675P4MEDIUMCVSS 4.3fixed in 77.0.3865.75≥ unspecified, < 77.0.3865.752019-11-25
CVE-2019-13675 [MEDIUM] CWE-20 CVE-2019-13675: Insufficient data validation in extensions in Google Chrome prior to 77.0.3865.75 allowed a remote a
Insufficient data validation in extensions in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to disable extensions via a crafted HTML page.
nvd
CVE-2019-5861P4MEDIUMCVSS 4.3fixed in 76.0.3809.87≥ unspecified, < 76.0.3809.872019-11-25
CVE-2019-5861 [MEDIUM] CWE-1021 CVE-2019-5861: Insufficient data validation in Blink in Google Chrome prior to 76.0.3809.87 allowed a remote attack
Insufficient data validation in Blink in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to bypass anti-clickjacking policy via a crafted HTML page.
nvd
CVE-2023-3736P4MEDIUMCVSS 4.3fixed in 115.0.5790.98≥ 115.0.5790.98, < 115.0.5790.982023-08-01
CVE-2023-3736 [MEDIUM] CVE-2023-3736: Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 115.0.5790.98 allow
Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 115.0.5790.98 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2019-13659P4MEDIUMCVSS 4.3fixed in 77.0.3865.75≥ unspecified, < 77.0.3865.752019-11-25
CVE-2019-13659 [MEDIUM] CVE-2019-13659: IDN spoofing in Omnibox in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform
IDN spoofing in Omnibox in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
nvd
CVE-2019-13663P4MEDIUMCVSS 4.3fixed in 77.0.3865.75≥ unspecified, < 77.0.3865.752019-11-25
CVE-2019-13663 [MEDIUM] CVE-2019-13663: IDN spoofing in Omnibox in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform
IDN spoofing in Omnibox in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
nvd
CVE-2019-13681P4MEDIUMCVSS 4.3fixed in 77.0.3865.75≥ unspecified, < 77.0.3865.752019-11-25
CVE-2019-13681 [MEDIUM] CWE-732 CVE-2019-13681: Insufficient data validation in downloads in Google Chrome prior to 77.0.3865.75 allowed a remote at
Insufficient data validation in downloads in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass download restrictions via a crafted HTML page.
nvd
CVE-2022-3447P4MEDIUMCVSS 4.3fixed in 106.0.5249.119≥ unspecified, < 106.0.5249.1192022-11-09
CVE-2022-3447 [MEDIUM] CWE-125 CVE-2022-3447: Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 106.0.5249.119 allo
Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 106.0.5249.119 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2019-5875P4MEDIUMCVSS 4.3fixed in 77.0.3865.75≥ unspecified, < 77.0.3865.752019-11-25
CVE-2019-5875 [MEDIUM] CVE-2019-5875: Insufficient data validation in downloads in Google Chrome prior to 77.0.3865.75 allowed a remote at
Insufficient data validation in downloads in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
nvd
CVE-2019-13691P4MEDIUMCVSS 4.3fixed in 77.0.3865.75≥ unspecified, < 77.0.3865.752019-11-25
CVE-2019-13691 [MEDIUM] CVE-2019-13691: Insufficient validation of untrusted input in navigation in Google Chrome prior to 77.0.3865.75 allo
Insufficient validation of untrusted input in navigation in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
nvd
CVE-2023-0141P4MEDIUMCVSS 4.3fixed in 109.0.5414.74≥ unspecified, < 109.0.5414.742023-01-10
CVE-2023-0141 [MEDIUM] CWE-693 CVE-2023-0141: Insufficient policy enforcement in CORS in Google Chrome prior to 109.0.5414.74 allowed a remote att
Insufficient policy enforcement in CORS in Google Chrome prior to 109.0.5414.74 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
nvd