Google Chrome vulnerabilities

CVE-2017-5112 [HIGH] CWE-119 CVE-2017-5112: Heap buffer overflow in WebGL in Google Chrome prior to 61.0.3163.79 for Windows allowed a remote at Heap buffer overflow in WebGL in Google Chrome prior to 61.0.3163.79 for Windows allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

CVE-2021-21215 [MEDIUM] CWE-290 CVE-2021-21215: Inappropriate implementation in Autofill in Google Chrome prior to 90.0.4430.72 allowed a remote att Inappropriate implementation in Autofill in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to spoof security UI via a crafted HTML page.

CVE-2026-13799 [HIGH] CWE-416 CVE-2026-13799: Use after free in QUIC in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentia Use after free in QUIC in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via malicious network traffic. (Chromium security severity: High)

CVE-2026-14032 [HIGH] CWE-416 CVE-2026-14032: Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allowed an attacker who c Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Low)

CVE-2019-13734 [HIGH] CWE-787 CVE-2019-13734: Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to po Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVE-2011-2841 [MEDIUM] CWE-20 CVE-2011-2841: Google Chrome before 14.0.835.163 does not properly perform garbage collection during the processing Google Chrome before 14.0.835.163 does not properly perform garbage collection during the processing of PDF documents, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document.

CVE-2018-6085 [HIGH] CWE-416 CVE-2018-6085: Re-entry of a destructor in Networking Disk Cache in Google Chrome prior to 66.0.3359.117 allowed a Re-entry of a destructor in Networking Disk Cache in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted HTML page.

CVE-2012-5108 [CRITICAL] CWE-362 CVE-2012-5108: Race condition in Google Chrome before 22.0.1229.92 allows remote attackers to execute arbitrary cod Race condition in Google Chrome before 22.0.1229.92 allows remote attackers to execute arbitrary code via vectors related to audio devices.

CVE-2026-0905 [CRITICAL] CWE-200 CVE-2026-0905: Insufficient policy enforcement in Network in Google Chrome prior to 144.0.7559.59 allowed an attack Insufficient policy enforcement in Network in Google Chrome prior to 144.0.7559.59 allowed an attack who obtained a network log file to potentially obtain potentially sensitive information via a network log file. (Chromium security severity: Medium)

CVE-2020-6402 [HIGH] CWE-20 CVE-2020-6402: Insufficient policy enforcement in downloads in Google Chrome on OS X prior to 80.0.3987.87 allowed Insufficient policy enforcement in downloads in Google Chrome on OS X prior to 80.0.3987.87 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension.

CVE-2024-9369 [CRITICAL] CWE-1284 CVE-2024-9369: Insufficient data validation in Mojo in Google Chrome prior to 129.0.6668.89 allowed a remote attack Insufficient data validation in Mojo in Google Chrome prior to 129.0.6668.89 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)

CVE-2026-11037 [CRITICAL] CWE-787 CVE-2026-11037: Out of bounds write in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to p Out of bounds write in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: Medium)

CVE-2026-14416 [CRITICAL] CWE-125 CVE-2026-14416: Out of bounds read in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to pote Out of bounds read in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-9967 [CRITICAL] CWE-787 CVE-2026-9967: Out of bounds write in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to pot Out of bounds write in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-11119 [CRITICAL] CWE-20 CVE-2026-11119: Inappropriate implementation in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a rem Inappropriate implementation in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11167 [CRITICAL] CWE-250 CVE-2026-11167: Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11082 [CRITICAL] CWE-416 CVE-2026-11082: Race in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had com Race in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11029 [CRITICAL] CWE-20 CVE-2026-11029: Insufficient validation of untrusted input in Drag and Drop in Google Chrome on Android prior to 149 Insufficient validation of untrusted input in Drag and Drop in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11112 [CRITICAL] CWE-20 CVE-2026-11112: Insufficient validation of untrusted input in Chromoting in Google Chrome on Linux prior to 149.0.78 Insufficient validation of untrusted input in Chromoting in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted Chrome Extension. (Chromium security severity: Medium)

CVE-2026-11207 [CRITICAL] CWE-20 CVE-2026-11207: Insufficient validation of untrusted input in Autofill in Google Chrome prior to 149.0.7827.53 allow Insufficient validation of untrusted input in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via malicious network traffic. (Chromium security severity: Medium)