Google Chrome vulnerabilities
5,831 known vulnerabilities affecting google/chrome.
Total CVEs
5,831
CISA KEV
75
actively exploited
Public exploits
88
Exploited in wild
87
Severity breakdown
CRITICAL498HIGH2799MEDIUM2453LOW79UNKNOWN2
Vulnerabilities
Page 280 of 292
CVE-2018-6132P4MEDIUMCVSS 4.3fixed in 67.0.3396.62≥ unspecified, < 67.0.3396.622019-06-27
CVE-2018-6132 [MEDIUM] CWE-908 CVE-2018-6132: Uninitialized data in WebRTC in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to obt
Uninitialized data in WebRTC in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file.
nvd
CVE-2010-0644P4MEDIUMCVSS 4.3≤ 4.0.249.78v0.2.149.27+45 more2010-02-18
CVE-2010-0644 [MEDIUM] CWE-200 CVE-2010-0644: Google Chrome before 4.0.249.89, when a SOCKS 5 proxy server is configured, sends DNS queries direct
Google Chrome before 4.0.249.89, when a SOCKS 5 proxy server is configured, sends DNS queries directly, which allows remote DNS servers to obtain potentially sensitive information about the identity of a client user via request logging, as demonstrated by a proxy server that was configured for the purpose of anonymity.
nvd
CVE-2021-21147P4MEDIUMCVSS 4.3fixed in 88.0.4324.146≥ unspecified, < 88.0.4324.1462021-02-09
CVE-2021-21147 [MEDIUM] CVE-2021-21147: Inappropriate implementation in Skia in Google Chrome prior to 88.0.4324.146 allowed a local attacke
Inappropriate implementation in Skia in Google Chrome prior to 88.0.4324.146 allowed a local attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
nvd
CVE-2021-38004P4MEDIUMCVSS 4.3fixed in 95.0.4638.69≥ unspecified, < 95.0.4638.692021-11-23
CVE-2021-38004 [MEDIUM] CWE-668 CVE-2021-38004: Insufficient policy enforcement in Autofill in Google Chrome prior to 95.0.4638.69 allowed a remote
Insufficient policy enforcement in Autofill in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
nvd
CVE-2022-1498P4MEDIUMCVSS 4.3fixed in 101.0.4951.41≥ unspecified, < 101.0.4951.412022-07-26
CVE-2022-1498 [MEDIUM] CWE-668 CVE-2022-1498: Inappropriate implementation in HTML Parser in Google Chrome prior to 101.0.4951.41 allowed a remote
Inappropriate implementation in HTML Parser in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
nvd
CVE-2022-2479P4MEDIUMCVSS 4.3fixed in 103.0.5060.134≥ unspecified, < 103.0.5060.1342022-07-28
CVE-2022-2479 [MEDIUM] CWE-20 CVE-2022-2479: Insufficient validation of untrusted input in File in Google Chrome on Android prior to 103.0.5060.1
Insufficient validation of untrusted input in File in Google Chrome on Android prior to 103.0.5060.134 allowed an attacker who convinced a user to install a malicious app to obtain potentially sensitive information from internal file directories via a crafted HTML page.
nvd
CVE-2022-1637P4MEDIUMCVSS 4.3fixed in 101.0.4951.64≥ unspecified, < 101.0.4951.642022-07-26
CVE-2022-1637 [MEDIUM] CWE-668 CVE-2022-1637: Inappropriate implementation in Web Contents in Google Chrome prior to 101.0.4951.64 allowed a remot
Inappropriate implementation in Web Contents in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
nvd
CVE-2021-30630P4MEDIUMCVSS 4.3fixed in 93.0.4577.82≥ unspecified, < 93.0.4577.822021-10-08
CVE-2021-30630 [MEDIUM] CWE-346 CVE-2021-30630: Inappropriate implementation in Blink in Google Chrome prior to 93.0.4577.82 allowed a remote attack
Inappropriate implementation in Blink in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.
nvd
CVE-2019-13667P4MEDIUMCVSS 4.3fixed in 77.0.3865.75≥ unspecified, < 77.0.3865.752019-11-25
CVE-2019-13667 [MEDIUM] CVE-2019-13667: Inappropriate implementation in Omnibox in Google Chrome on iOS prior to 77.0.3865.75 allowed a remo
Inappropriate implementation in Omnibox in Google Chrome on iOS prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
nvd
CVE-2019-13661P4MEDIUMCVSS 4.3fixed in 77.0.3865.75≥ unspecified, < 77.0.3865.752019-11-25
CVE-2019-13661 [MEDIUM] CVE-2019-13661: UI spoofing in Chromium in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof no
UI spoofing in Chromium in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof notifications via a crafted HTML page.
nvd
CVE-2019-13669P4MEDIUMCVSS 4.3fixed in 77.0.3865.75≥ unspecified, < 77.0.3865.752019-11-25
CVE-2019-13669 [MEDIUM] CVE-2019-13669: Incorrect data validation in navigation in Google Chrome prior to 77.0.3865.75 allowed a remote atta
Incorrect data validation in navigation in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
nvd
CVE-2019-13676P4MEDIUMCVSS 4.3fixed in 77.0.3865.75≥ unspecified, < 77.0.3865.752019-11-25
CVE-2019-13676 [MEDIUM] CWE-732 CVE-2019-13676: Insufficient policy enforcement in Chromium in Google Chrome prior to 77.0.3865.75 allowed a remote
Insufficient policy enforcement in Chromium in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
nvd
CVE-2019-13671P4MEDIUMCVSS 4.3fixed in 77.0.3865.75≥ unspecified, < 77.0.3865.752019-11-25
CVE-2019-13671 [MEDIUM] CVE-2019-13671: UI spoofing in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof secur
UI spoofing in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof security UI via a crafted HTML page.
nvd
CVE-2017-5027P4MEDIUMCVSS 4.3≤ 55.0.2883.872017-02-17
CVE-2017-5027 [MEDIUM] CVE-2017-5027: Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Androi
Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to properly enforce unsafe-inline content security policy, which allowed a remote attacker to bypass content security policy via a crafted HTML page.
nvd
CVE-2019-13705P4MEDIUMCVSS 4.3fixed in 78.0.3904.70≥ unspecified, < 78.0.3904.702019-11-25
CVE-2019-13705 [MEDIUM] CWE-269 CVE-2019-13705: Insufficient policy enforcement in extensions in Google Chrome prior to 78.0.3904.70 allowed an atta
Insufficient policy enforcement in extensions in Google Chrome prior to 78.0.3904.70 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension.
nvd
CVE-2022-3660P4MEDIUMCVSS 4.3fixed in 107.0.5304.62≥ unspecified, < 107.0.5304.622022-11-01
CVE-2022-3660 [MEDIUM] CVE-2022-3660: Inappropriate implementation in Full screen mode in Google Chrome on Android prior to 107.0.5304.62
Inappropriate implementation in Full screen mode in Google Chrome on Android prior to 107.0.5304.62 allowed a remote attacker to hide the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2017-15430P4MEDIUMCVSS 4.3fixed in 63.0.3239.84≥ unspecified, < 63.0.3239.842018-08-28
CVE-2017-15430 [MEDIUM] CVE-2017-15430: Insufficient data validation in Chromecast plugin in Google Chrome prior to 63.0.3239.84 allowed a r
Insufficient data validation in Chromecast plugin in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
nvd
CVE-2023-1231P4MEDIUMCVSS 4.3fixed in 111.0.5563.64≥ 111.0.5563.64, < 111.0.5563.642023-03-07
CVE-2023-1231 [MEDIUM] CVE-2023-1231: Inappropriate implementation in Autofill in Google Chrome on Android prior to 111.0.5563.64 allowed
Inappropriate implementation in Autofill in Google Chrome on Android prior to 111.0.5563.64 allowed a remote attacker to potentially spoof the contents of the omnibox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2020-16034P4MEDIUMCVSS 4.3fixed in 87.0.4280.66≥ unspecified, < 87.0.4280.662021-01-08
CVE-2020-16034 [MEDIUM] CVE-2020-16034: Inappropriate implementation in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a local attack
Inappropriate implementation in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a local attacker to bypass policy restrictions via a crafted HTML page.
nvd
CVE-2023-1232P4MEDIUMCVSS 4.3fixed in 111.0.5563.64≥ 111.0.5563.64, < 111.0.5563.642023-03-07
CVE-2023-1232 [MEDIUM] CVE-2023-1232: Insufficient policy enforcement in Resource Timing in Google Chrome prior to 111.0.5563.64 allowed a
Insufficient policy enforcement in Resource Timing in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to obtain potentially sensitive information from API via a crafted HTML page. (Chromium security severity: Low)
nvd