Google Chrome vulnerabilities

CVE-2026-11056 [CRITICAL] CWE-20 CVE-2026-11056: Insufficient validation of untrusted input in SiteIsolation in Google Chrome on Windows prior to 149 Insufficient validation of untrusted input in SiteIsolation in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11165 [CRITICAL] CWE-416 CVE-2026-11165: Use after free in WebMIDI in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker t Use after free in WebMIDI in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11131 [CRITICAL] CWE-416 CVE-2026-11131: Use after free in Autofill in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attac Use after free in Autofill in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11063 [CRITICAL] CWE-20 CVE-2026-11063: Insufficient validation of untrusted input in WebNN in Google Chrome on Windows prior to 149.0.7827. Insufficient validation of untrusted input in WebNN in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-17709 [CRITICAL] CWE-362 CVE-2026-17709: Race in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had c Race in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-17711 [CRITICAL] CWE-362 CVE-2026-17711: Race in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had c Race in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-7908 [CRITICAL] CWE-416 CVE-2026-7908: Use after free in Fullscreen in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to po Use after free in Fullscreen in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-14423 [CRITICAL] CWE-843 CVE-2026-14423: Type Confusion in Tint in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentia Type Confusion in Tint in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-7910 [CRITICAL] CWE-416 CVE-2026-7910: Use after free in Views in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had co Use after free in Views in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

CVE-2026-11070 [CRITICAL] CWE-20 CVE-2026-11070: Insufficient validation of untrusted input in Chromoting in Google Chrome on Windows prior to 149.0. Insufficient validation of untrusted input in Chromoting in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the network process to potentially perform a sandbox escape via malicious network traffic. (Chromium security severity: Medium)

CVE-2026-11697 [CRITICAL] CWE-20 CVE-2026-11697: Insufficient validation of untrusted input in UI in Google Chrome prior to 149.0.7827.103 allowed a Insufficient validation of untrusted input in UI in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-11293 [CRITICAL] CWE-416 CVE-2026-11293: Use after free in Input in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potenti Use after free in Input in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-11213 [CRITICAL] CWE-20 CVE-2026-11213: Insufficient validation of untrusted input in Reading Mode in Google Chrome prior to 149.0.7827.53 a Insufficient validation of untrusted input in Reading Mode in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

CVE-2023-5996 [HIGH] CWE-416 CVE-2023-5996: Use after free in WebAudio in Google Chrome prior to 119.0.6045.123 allowed a remote attacker to pot Use after free in WebAudio in Google Chrome prior to 119.0.6045.123 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2012-5112 [CRITICAL] CWE-399 CVE-2012-5112: Use-after-free vulnerability in the SVG implementation in WebKit, as used in Google Chrome before 22 Use-after-free vulnerability in the SVG implementation in WebKit, as used in Google Chrome before 22.0.1229.94, allows remote attackers to execute arbitrary code via unspecified vectors.

CVE-2011-3108 [CRITICAL] CWE-399 CVE-2011-3108: Use-after-free vulnerability in Google Chrome before 19.0.1084.52 allows remote attackers to execute Use-after-free vulnerability in Google Chrome before 19.0.1084.52 allows remote attackers to execute arbitrary code via vectors related to the browser cache.

CVE-2024-5499 [HIGH] CWE-787 CVE-2024-5499: Out of bounds write in Streams API in Google Chrome prior to 125.0.6422.141 allowed a remote attacke Out of bounds write in Streams API in Google Chrome prior to 125.0.6422.141 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-2650 [HIGH] CWE-122 CVE-2026-2650: Heap buffer overflow in Media in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to Heap buffer overflow in Media in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-13967 [HIGH] CWE-843 CVE-2026-13967: Heap buffer overflow in V8 in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to exec Heap buffer overflow in V8 in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2025-13224 [HIGH] CWE-843 CVE-2025-13224: Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potential Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)