Google Chrome vulnerabilities
7,357 known vulnerabilities affecting google/chrome.
Total CVEs
7,357
CISA KEV
77
actively exploited
Public exploits
92
Exploited in wild
89
Severity breakdown
CRITICAL703HIGH3485MEDIUM2989LOW155UNKNOWN25
Vulnerabilities
Page 28 of 368
CVE-2026-118356P3HIGHCVSS 8.8fixed in 156.0.8078.73≥ 156.0.8078.73, < 156.0.8078.732026-10-27
CVE-2026-118356 [HIGH] CWE-416 CVE-2026-118356: Use after free in WTF in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute a
Use after free in WTF in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-118341P3HIGHCVSS 8.8fixed in 156.0.8078.73≥ 156.0.8078.73, < 156.0.8078.732026-10-27
CVE-2026-118341 [HIGH] CWE-416 CVE-2026-118341: Use after free in Modularization in Google Chrome prior to 156.0.8078.73 allowed a remote attacker t
Use after free in Modularization in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-118351P3HIGHCVSS 8.8fixed in 156.0.8078.73≥ 156.0.8078.73, < 156.0.8078.732026-10-27
CVE-2026-118351 [HIGH] CWE-119 CVE-2026-118351: Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execu
Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-118352P3HIGHCVSS 8.8fixed in 156.0.8078.73≥ 156.0.8078.73, < 156.0.8078.732026-10-27
CVE-2026-118352 [HIGH] CWE-119 CVE-2026-118352: Memory corruption in Cache in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to pote
Memory corruption in Cache in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-118313P3HIGHCVSS 8.8fixed in 156.0.8078.73≥ 156.0.8078.73, < 156.0.8078.732026-10-27
CVE-2026-118313 [HIGH] CWE-416 CVE-2026-118313: Use after free in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute
Use after free in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2021-21110P3CRITICALCVSS 9.6fixed in 87.0.4280.141≥ unspecified, < 87.0.4280.1412021-01-08
CVE-2021-21110 [CRITICAL] CWE-416 CVE-2021-21110: Use after free in safe browsing in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to
Use after free in safe browsing in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
nvd
CVE-2026-79194P3HIGHCVSS 8.1fixed in 152.0.7977.65≥ 152.0.7977.65, < 152.0.7977.652026-08-25
CVE-2026-79194 [HIGH] CWE-416 CVE-2026-79194: Use after free in Chromoting in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote
Use after free in Chromoting in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)
nvd
CVE-2026-79027P3HIGHCVSS 8.1fixed in 152.0.7977.65≥ 152.0.7977.65, < 152.0.7977.652026-08-25
CVE-2026-79027 [HIGH] CWE-416 CVE-2026-79027: Use after free in WebRTC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execut
Use after free in WebRTC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via crafted network traffic. (Chromium security severity: High)
nvd
CVE-2026-13787P3HIGHCVSS 8.1fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-13787 [HIGH] CWE-416 CVE-2026-13787: Use after free in Chromoting in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote att
Use after free in Chromoting in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Critical)
nvd
CVE-2021-21124P3CRITICALCVSS 9.6fixed in 88.0.4324.96≥ unspecified, < 88.0.4324.962021-02-09
CVE-2021-21124 [CRITICAL] CWE-416 CVE-2021-21124: Potential user after free in Speech Recognizer in Google Chrome on Android prior to 88.0.4324.96 all
Potential user after free in Speech Recognizer in Google Chrome on Android prior to 88.0.4324.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
nvd
CVE-2014-3188P3CRITICALCVSS 10.0≤ 38.0.2125.72014-10-08
CVE-2014-3188 [CRITICAL] CWE-94 CVE-2014-3188: Google Chrome before 38.0.2125.101 and Chrome OS before 38.0.2125.101 do not properly handle the int
Google Chrome before 38.0.2125.101 and Chrome OS before 38.0.2125.101 do not properly handle the interaction of IPC and Google V8, which allows remote attackers to execute arbitrary code via vectors involving JSON data, related to improper parsing of an escaped index by ParseJsonObject in json-parser.h.
nvd
CVE-2024-1284P3CRITICALCVSS 9.8fixed in 121.0.6167.160≥ 121.0.6167.160, < 121.0.6167.1602024-02-07
CVE-2024-1284 [CRITICAL] CWE-416 CVE-2024-1284: Use after free in Mojo in Google Chrome prior to 121.0.6167.160 allowed a remote attacker to potenti
Use after free in Mojo in Google Chrome prior to 121.0.6167.160 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2024-4558P3CRITICALCVSS 9.6fixed in 124.0.6367.155≥ 124.0.6367.155, < 124.0.6367.1552024-05-07
CVE-2024-4558 [CRITICAL] CWE-416 CVE-2024-4558: Use after free in ANGLE in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potent
Use after free in ANGLE in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2021-21157P3HIGHCVSS 8.8fixed in 88.0.4324.182≥ unspecified, < 88.0.4324.1822021-02-22
CVE-2021-21157 [HIGH] CWE-416 CVE-2021-21157: Use after free in Web Sockets in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote atta
Use after free in Web Sockets in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
nvd
CVE-2025-5068P3HIGHCVSS 8.8fixed in 137.0.7151.68≥ 137.0.7151.68, < 137.0.7151.682025-06-03
CVE-2025-5068 [HIGH] CWE-416 CVE-2025-5068: Use after free in Blink in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potenti
Use after free in Blink in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-10881P3CRITICALCVSS 9.6fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-10881 [CRITICAL] CWE-125 CVE-2026-10881: Out of bounds read and write in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attac
Out of bounds read and write in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2026-6296P3CRITICALCVSS 9.6fixed in 147.0.7727.101≥ 147.0.7727.101, < 147.0.7727.1012026-04-15
CVE-2026-6296 [CRITICAL] CWE-122 CVE-2026-6296: Heap buffer overflow in ANGLE in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to
Heap buffer overflow in ANGLE in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2026-17697P3CRITICALCVSS 9.6fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17697 [CRITICAL] CWE-843 CVE-2026-17697: Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potenti
Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-95281P3CRITICALCVSS 9.6fixed in 154.0.8037.57≥ 154.0.8037.57, < 154.0.8037.572026-09-29
CVE-2026-95281 [CRITICAL] CWE-122 CVE-2026-95281: Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote atta
Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2026-17671P3CRITICALCVSS 9.6fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17671 [CRITICAL] CWE-20 CVE-2026-17671: Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 151.0.7922.72 allowed
Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
nvd