Google Chrome vulnerabilities

CVE-2010-2649 [MEDIUM] CVE-2010-2649: Unspecified vulnerability in Google Chrome before 5.0.375.99 allows remote attackers to cause a deni Unspecified vulnerability in Google Chrome before 5.0.375.99 allows remote attackers to cause a denial of service (application crash) via an invalid image.

CVE-2021-37964 [LOW] CVE-2021-37964: Inappropriate implementation in ChromeOS Networking in Google Chrome on ChromeOS prior to 94.0.4606. Inappropriate implementation in ChromeOS Networking in Google Chrome on ChromeOS prior to 94.0.4606.54 allowed an attacker with a rogue wireless access point to to potentially carryout a wifi impersonation attack via a crafted ONC file.

CVE-2017-5081 [LOW] CWE-20 CVE-2017-5081: Lack of verification of an extension's locale folder in Google Chrome prior to 59.0.3071.86 for Mac, Lack of verification of an extension's locale folder in Google Chrome prior to 59.0.3071.86 for Mac, Windows, and Linux, and 59.0.3071.92 for Android, allowed an attacker with local write access to modify extensions by modifying extension files.

CVE-2019-13762 [LOW] CWE-667 CVE-2019-13762: Insufficient policy enforcement in downloads in Google Chrome on Windows prior to 79.0.3945.79 allow Insufficient policy enforcement in downloads in Google Chrome on Windows prior to 79.0.3945.79 allowed a local attacker to spoof downloaded files via local code.

CVE-2026-13942 [LOW] CWE-20 CVE-2026-13942: Inappropriate implementation in Video Capture in Google Chrome on ChromeOS prior to 150.0.7871.47 al Inappropriate implementation in Video Capture in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a local attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-13955 [LOW] CWE-20 CVE-2026-13955: Insufficient validation of untrusted input in CustomTabs in Google Chrome on Android prior to 150.0. Insufficient validation of untrusted input in CustomTabs in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to perform UI spoofing via a malicious file. (Chromium security severity: Medium)

CVE-2024-6996 [LOW] CWE-362 CVE-2024-6996: Race in Frames in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a use Race in Frames in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-7949 [LOW] CWE-125 CVE-2026-7949: Out of bounds read in Skia in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had Out of bounds read in Skia in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted Chrome Extension. (Chromium security severity: Medium)

CVE-2026-3929 [LOW] CWE-1300 CVE-2026-3929: Side-channel information leakage in ResourceTiming in Google Chrome prior to 146.0.7680.71 allowed a Side-channel information leakage in ResourceTiming in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-8017 [LOW] CWE-1300 CVE-2026-8017: Side-channel information leakage in Media in Google Chrome prior to 148.0.7778.96 allowed a remote a Side-channel information leakage in Media in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-9991 [LOW] CWE-200 CVE-2026-9991: Inappropriate implementation in Media in Google Chrome on Windows prior to 148.0.7778.216 allowed a Inappropriate implementation in Media in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

CVE-2026-9959 [LOW] CWE-362 CVE-2026-9959: Race in WebRTC in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker to leak Race in WebRTC in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

CVE-2026-7351 [LOW] CWE-362 CVE-2026-7351: Race in MHTML in Google Chrome prior to 147.0.7727.138 allowed an attacker who convinced a user to i Race in MHTML in Google Chrome prior to 147.0.7727.138 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. (Chromium security severity: High)

CVE-2018-6053 [LOW] CWE-200 CVE-2018-6053: Inappropriate implementation in New Tab Page in Google Chrome prior to 64.0.3282.119 allowed a local Inappropriate implementation in New Tab Page in Google Chrome prior to 64.0.3282.119 allowed a local attacker to view website thumbnail images after clearing browser data via a crafted HTML page.

CVE-2019-13679 [LOW] CWE-732 CVE-2019-13679: Insufficient policy enforcement in PDFium in Google Chrome prior to 77.0.3865.75 allowed a remote at Insufficient policy enforcement in PDFium in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to show print dialogs via a crafted PDF file.

CVE-2022-4923 [LOW] CVE-2022-4923: Inappropriate implementation in Omnibox in Google Chrome prior to 99.0.4844.51 allowed an attacker i Inappropriate implementation in Omnibox in Google Chrome prior to 99.0.4844.51 allowed an attacker in a privileged network position to perform a man-in-the-middle attack via malicious network traffic. (Chromium security severity: Low)

CVE-2026-18011 [LOW] CWE-200 CVE-2026-18011: Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowe Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a local attacker to obtain potentially sensitive information from process memory via physical access to the device. (Chromium security severity: Low)

CVE-2011-2784 [LOW] CWE-200 CVE-2011-2784: Google Chrome before 13.0.782.107 allows remote attackers to obtain sensitive information via a requ Google Chrome before 13.0.782.107 allows remote attackers to obtain sensitive information via a request for the GL program log, which reveals a local path in an unspecified log entry.

CVE-2026-12440 [CRITICAL] CWE-416 CVE-2026-12440: Use after free in DigitalCredentials in Google Chrome on Windows prior to 149 Use after free in DigitalCredentials in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-12443 [HIGH] CWE-416 CVE-2026-12443: Use after free in Web Authentication in Google Chrome prior to 149 Use after free in Web Authentication in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)