Google Chrome vulnerabilities
7,357 known vulnerabilities affecting google/chrome.
Total CVEs
7,357
CISA KEV
77
actively exploited
Public exploits
92
Exploited in wild
89
Severity breakdown
CRITICAL703HIGH3485MEDIUM2989LOW155UNKNOWN25
Vulnerabilities
Page 45 of 368
CVE-2026-11147P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11147 [HIGH] CWE-416 CVE-2026-11147: Use after free in WebML in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker
Use after free in WebML in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-14108P3HIGHCVSS 8.8fixed in 150.0.7871.46≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-14108 [HIGH] CWE-416 CVE-2026-14108: Use after free in PDFium in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execut
Use after free in PDFium in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Low)
nvd
CVE-2026-7902P3HIGHCVSS 8.8fixed in 148.0.7778.96≥ 148.0.7778.96, < 148.0.7778.962026-05-06
CVE-2026-7902 [HIGH] CWE-787 CVE-2026-7902: Out of bounds memory access in V8 in Google Chrome prior to 148.0.7778.96 allowed a remote attacker
Out of bounds memory access in V8 in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-118331P3HIGHCVSS 8.8fixed in 156.0.8078.73≥ 156.0.8078.73, < 156.0.8078.732026-10-27
CVE-2026-118331 [HIGH] CWE-20 CVE-2026-118331: Improper input validation in FileAPI in Google Chrome prior to 156.0.8078.73 allowed a remote attack
Improper input validation in FileAPI in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2026-118348P3HIGHCVSS 8.8fixed in 156.0.8078.73≥ 156.0.8078.73, < 156.0.8078.732026-10-27
CVE-2026-118348 [HIGH] CWE-20 CVE-2026-118348: Improper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker
Improper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2026-102321P3HIGHCVSS 8.8fixed in 154.0.8037.92≥ 154.0.8037.92, < 154.0.8037.922026-09-29
CVE-2026-102321 [HIGH] CWE-843 CVE-2026-102321: Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute ar
Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-95345P3HIGHCVSS 8.8fixed in 154.0.8037.57≥ 154.0.8037.57, < 154.0.8037.572026-09-29
CVE-2026-95345 [HIGH] CWE-416 CVE-2026-95345: Use after free in Actor in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute
Use after free in Actor in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-91736P3HIGHCVSS 8.8fixed in 153.0.8010.47≥ 153.0.8010.47, < 153.0.8010.472026-09-15
CVE-2026-91736 [HIGH] CWE-416 CVE-2026-91736: Use after free in DOM in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute a
Use after free in DOM in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-91737P3HIGHCVSS 8.8fixed in 153.0.8010.47≥ 153.0.8010.47, < 153.0.8010.472026-09-15
CVE-2026-91737 [HIGH] CWE-416 CVE-2026-91737: Use after free in PDF in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute a
Use after free in PDF in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-7980P3HIGHCVSS 8.8fixed in 148.0.7778.96≥ 148.0.7778.96, < 148.0.7778.962026-05-06
CVE-2026-7980 [HIGH] CWE-416 CVE-2026-7980: Use after free in WebAudio in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to exec
Use after free in WebAudio in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-7987P3HIGHCVSS 8.8fixed in 148.0.7778.96≥ 148.0.7778.96, < 148.0.7778.962026-05-06
CVE-2026-7987 [HIGH] CWE-416 CVE-2026-7987: Use after free in WebRTC in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execut
Use after free in WebRTC in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-7928P3HIGHCVSS 8.8fixed in 148.0.7778.96≥ 148.0.7778.96, < 148.0.7778.962026-05-06
CVE-2026-7928 [HIGH] CWE-416 CVE-2026-7928: Use after free in WebRTC in Google Chrome on Windows prior to 148.0.7778.96 allowed a remote attacke
Use after free in WebRTC in Google Chrome on Windows prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-106207P3HIGHCVSS 8.8fixed in 155.0.8059.39≥ 155.0.8059.39, < 155.0.8059.392026-10-06
CVE-2026-106207 [HIGH] CWE-367 CVE-2026-106207: Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute ar
Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-106383P3HIGHCVSS 8.8fixed in 155.0.8059.39≥ 155.0.8059.39, < 155.0.8059.392026-10-06
CVE-2026-106383 [HIGH] CWE-416 CVE-2026-106383: Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute
Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-95286P3HIGHCVSS 8.8fixed in 154.0.8037.57≥ 154.0.8037.57, < 154.0.8037.572026-09-29
CVE-2026-95286 [HIGH] CWE-843 CVE-2026-95286: Type confusion in Bindings in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to exec
Type confusion in Bindings in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-6318P3HIGHCVSS 8.8fixed in 147.0.7727.101≥ 147.0.7727.101, < 147.0.7727.1012026-04-15
CVE-2026-6318 [HIGH] CWE-416 CVE-2026-6318: Use after free in Codecs in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execu
Use after free in Codecs in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-10978P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-10978 [HIGH] CWE-416 CVE-2026-10978: Use after free in Chromoting in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote att
Use after free in Chromoting in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: High)
nvd
CVE-2026-102328P3HIGHCVSS 8.8fixed in 154.0.8037.92≥ 154.0.8037.92, < 154.0.8037.922026-09-29
CVE-2026-102328 [HIGH] CWE-843 CVE-2026-102328: Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute ar
Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-106349P3HIGHCVSS 8.8fixed in 155.0.8059.39≥ 155.0.8059.39, < 155.0.8059.392026-10-06
CVE-2026-106349 [HIGH] CWE-416 CVE-2026-106349: Use after free in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute ar
Use after free in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-106335P3HIGHCVSS 8.8fixed in 155.0.8059.39≥ 155.0.8059.39, < 155.0.8059.392026-10-06
CVE-2026-106335 [HIGH] CWE-416 CVE-2026-106335: Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute
Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd