Google Chrome vulnerabilities

CVE-2026-11171 [HIGH] CWE-472 CVE-2026-11171: Integer overflow in Blink in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execu Integer overflow in Blink in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-9968 [HIGH] CWE-472 CVE-2026-9968: Integer overflow in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute Integer overflow in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-8532 [HIGH] CWE-472 CVE-2026-8532: Integer overflow in XML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execut Integer overflow in XML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-17922 [HIGH] CWE-94 CVE-2026-17922: Inappropriate implementation in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote Inappropriate implementation in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-8000 [HIGH] CWE-20 CVE-2026-8000: Insufficient validation of untrusted input in ChromeDriver in Google Chrome on Windows prior to 148. Insufficient validation of untrusted input in ChromeDriver in Google Chrome on Windows prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-15118 [HIGH] CWE-416 CVE-2026-15118: Use after free in Input in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execut Use after free in Input in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-11235 [HIGH] CWE-20 CVE-2026-11235: Insufficient policy enforcement in Compositing in Google Chrome prior to 149.0.7827.53 allowed a rem Insufficient policy enforcement in Compositing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-9984 [HIGH] CWE-416 CVE-2026-9984: Use after free in UI in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker t Use after free in UI in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

CVE-2026-10021 [HIGH] CWE-20 CVE-2026-10021: Insufficient validation of untrusted input in USB in Google Chrome prior to 148.0.7778.216 allowed a Insufficient validation of untrusted input in USB in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-9999 [HIGH] CWE-269 CVE-2026-9999: Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 148.0.7778.216 allowed a remo Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-17881 [HIGH] CWE-416 CVE-2026-17881: Integer overflow in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execu Integer overflow in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-7992 [HIGH] CWE-20 CVE-2026-7992: Insufficient validation of untrusted input in UI in Google Chrome on Linux, ChromeOS prior to 148.0. Insufficient validation of untrusted input in UI in Google Chrome on Linux, ChromeOS prior to 148.0.7778.96 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-7991 [HIGH] CWE-416 CVE-2026-7991: Use after free in UI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compr Use after free in UI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-7995 [HIGH] CWE-125 CVE-2026-7995: Out of bounds read in AdFilter in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to Out of bounds read in AdFilter in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11201 [HIGH] CWE-416 CVE-2026-11201: Use after free in ServiceWorker in Google Chrome prior to 149.0.7827.53 allowed an attacker who conv Use after free in ServiceWorker in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Medium)

CVE-2026-7940 [HIGH] CWE-416 CVE-2026-7940: Use after free in V8 in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a use Use after free in V8 in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Medium)

CVE-2026-10926 [HIGH] CWE-416 CVE-2026-10926: Use after free in Cast in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local netw Use after free in Cast in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment to execute arbitrary code via malicious network traffic. (Chromium security severity: High)

CVE-2026-10888 [HIGH] CWE-416 CVE-2026-10888: Use after free in Cast Streaming in Google Chrome prior to 149.0.7827.53 allowed an attacker on the Use after free in Cast Streaming in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment to execute arbitrary code via malicious network traffic. (Chromium security severity: Critical)

CVE-2010-1029 [MEDIUM] CWE-399 CVE-2010-1029: Stack consumption vulnerability in the WebCore::CSSSelector function in WebKit, as used in Apple Saf Stack consumption vulnerability in the WebCore::CSSSelector function in WebKit, as used in Apple Safari 4.0.4, Apple Safari on iPhone OS and iPhone OS for iPod touch, and Google Chrome 4.0.249, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a STYLE element composed of a large number of *

CVE-2021-21127 [HIGH] CVE-2021-21127: Insufficient policy enforcement in extensions in Google Chrome prior to 88.0.4324.96 allowed a remot Insufficient policy enforcement in extensions in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass content security policy via a crafted Chrome Extension.