Google Chrome vulnerabilities
7,357 known vulnerabilities affecting google/chrome.
Total CVEs
7,357
CISA KEV
77
actively exploited
Public exploits
92
Exploited in wild
89
Severity breakdown
CRITICAL703HIGH3485MEDIUM2989LOW155UNKNOWN25
Vulnerabilities
Page 44 of 368
CVE-2026-95343P3HIGHCVSS 8.8fixed in 154.0.8037.57≥ 154.0.8037.57, < 154.0.8037.572026-09-29
CVE-2026-95343 [HIGH] CWE-416 CVE-2026-95343: Use after free in WebAudio in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to exec
Use after free in WebAudio in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-4447P3HIGHCVSS 8.8fixed in 146.0.7680.153≥ 146.0.7680.153, < 146.0.7680.1532026-03-20
CVE-2026-4447 [HIGH] CWE-693 CVE-2026-4447: Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.153 allowed a remote attacke
Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-6307P3HIGHCVSS 8.8fixed in 147.0.7727.101≥ 147.0.7727.101, < 147.0.7727.1012026-04-15
CVE-2026-6307 [HIGH] CWE-843 CVE-2026-6307: Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to exe
Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-110148P3HIGHCVSS 8.8fixed in 155.0.8059.79≥ 155.0.8059.79, < 155.0.8059.792026-10-13
CVE-2026-110148 [HIGH] CWE-416 CVE-2026-110148: Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute a
Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2026-110151P3HIGHCVSS 8.8fixed in 155.0.8059.79≥ 155.0.8059.79, < 155.0.8059.792026-10-13
CVE-2026-110151 [HIGH] CWE-416 CVE-2026-110151: Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2026-106374P3HIGHCVSS 8.8fixed in 155.0.8059.39≥ 155.0.8059.39, < 155.0.8059.392026-10-06
CVE-2026-106374 [HIGH] CWE-843 CVE-2026-106374: Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute ar
Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-10991P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-10991 [HIGH] CWE-416 CVE-2026-10991: Use after free in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced
Use after free in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-11046P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11046 [HIGH] CWE-20 CVE-2026-11046: Insufficient validation of untrusted input in Media in Google Chrome prior to 149.0.7827.53 allowed
Insufficient validation of untrusted input in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-11028P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11028 [HIGH] CWE-416 CVE-2026-11028: Use after free in Media in Google Chrome on Linux and ChromeOS prior to 149.0.7827.53 allowed a remo
Use after free in Media in Google Chrome on Linux and ChromeOS prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-10958P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-10958 [HIGH] CWE-416 CVE-2026-10958: Use after free in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote att
Use after free in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-11000P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11000 [HIGH] CWE-416 CVE-2026-11000: Use after free in Fonts in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker t
Use after free in Fonts in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-106204P3HIGHCVSS 8.8fixed in 155.0.8059.39≥ 155.0.8059.39, < 155.0.8059.392026-10-06
CVE-2026-106204 [HIGH] CWE-416 CVE-2026-106204: Use after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute a
Use after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)
nvd
CVE-2026-10945P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-10945 [HIGH] CWE-416 CVE-2026-10945: Use after free in PDF in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convince
Use after free in PDF in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: High)
nvd
CVE-2026-91745P3HIGHCVSS 8.8fixed in 153.0.8010.47≥ 153.0.8010.47, < 153.0.8010.472026-09-15
CVE-2026-91745 [HIGH] CWE-416 CVE-2026-91745: Use after free in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute ar
Use after free in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-11662P3HIGHCVSS 8.8fixed in 149.0.7827.103≥ 149.0.7827.103, < 149.0.7827.1032026-06-09
CVE-2026-11662 [HIGH] CWE-843 CVE-2026-11662: Type Confusion in Bindings in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to exe
Type Confusion in Bindings in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-106341P3HIGHCVSS 8.8fixed in 155.0.8059.39≥ 155.0.8059.39, < 155.0.8059.392026-10-06
CVE-2026-106341 [HIGH] CWE-843 CVE-2026-106341: Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentiall
Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-106347P3HIGHCVSS 8.8fixed in 155.0.8059.39≥ 155.0.8059.39, < 155.0.8059.392026-10-06
CVE-2026-106347 [HIGH] CWE-416 CVE-2026-106347: Use after free in Track in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute
Use after free in Track in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2026-11068P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11068 [HIGH] CWE-416 CVE-2026-11068: Use after free in WebSockets in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to ex
Use after free in WebSockets in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-11054P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11054 [HIGH] CWE-416 CVE-2026-11054: Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execut
Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-9962P3HIGHCVSS 8.8fixed in 148.0.7778.216fixed in 148.0.7778.215+1 more2026-05-28
CVE-2026-9962 [HIGH] CWE-416 CVE-2026-9962: Use after free in WebRTC in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execu
Use after free in WebRTC in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
nvd