Google Chrome vulnerabilities
7,357 known vulnerabilities affecting google/chrome.
Total CVEs
7,357
CISA KEV
77
actively exploited
Public exploits
92
Exploited in wild
89
Severity breakdown
CRITICAL703HIGH3485MEDIUM2989LOW155UNKNOWN25
Vulnerabilities
Page 48 of 368
CVE-2026-110153P3HIGHCVSS 8.8fixed in 155.0.8059.79≥ 155.0.8059.79, < 155.0.8059.792026-10-13
CVE-2026-110153 [HIGH] CWE-416 CVE-2026-110153: Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-110139P3HIGHCVSS 8.8fixed in 155.0.8059.79≥ 155.0.8059.79, < 155.0.8059.792026-10-13
CVE-2026-110139 [HIGH] CWE-416 CVE-2026-110139: Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-110154P3HIGHCVSS 8.8fixed in 155.0.8059.79≥ 155.0.8059.79, < 155.0.8059.792026-10-13
CVE-2026-110154 [HIGH] CWE-416 CVE-2026-110154: Use after free in Canvas in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potent
Use after free in Canvas in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-11279P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-05
CVE-2026-11279 [HIGH] CWE-125 CVE-2026-11279: Out of bounds read in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to
Out of bounds read in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-9896P3HIGHCVSS 8.8fixed in 148.0.7778.216fixed in 148.0.7778.215+1 more2026-05-28
CVE-2026-9896 [HIGH] CWE-787 CVE-2026-9896: Out of bounds write in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to exec
Out of bounds write in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-7957P3HIGHCVSS 8.8fixed in 148.0.7778.96≥ 148.0.7778.96, < 148.0.7778.962026-05-06
CVE-2026-7957 [HIGH] CWE-787 CVE-2026-7957: Out of bounds write in Media in Google Chrome on Mac, iOS prior to 148.0.7778.96 allowed a remote at
Out of bounds write in Media in Google Chrome on Mac, iOS prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-5884P3HIGHCVSS 8.8fixed in 147.0.7727.55≥ 147.0.7727.55, < 147.0.7727.552026-04-08
CVE-2026-5884 [HIGH] CWE-20 CVE-2026-5884: Insufficient validation of untrusted input in Media in Google Chrome prior to 147.0.7727.55 allowed
Insufficient validation of untrusted input in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-118357P3HIGHCVSS 8.8fixed in 156.0.8078.73≥ 156.0.8078.73, < 156.0.8078.732026-10-27
CVE-2026-118357 [HIGH] CWE-416 CVE-2026-118357: Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to po
Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-85049P3HIGHCVSS 8.8fixed in 152.0.7977.82≥ 152.0.7977.82, < 152.0.7977.822026-09-03
CVE-2026-85049 [HIGH] CWE-416 CVE-2026-85049: Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute
Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-11055P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11055 [HIGH] CWE-416 CVE-2026-11055: Use after free in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker
Use after free in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-11173P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11173 [HIGH] CWE-787 CVE-2026-11173: Out of bounds write in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had
Out of bounds write in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-11049P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11049 [HIGH] CWE-416 CVE-2026-11049: Use after free in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker
Use after free in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-11060P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11060 [HIGH] CWE-416 CVE-2026-11060: Use after free in Media in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker
Use after free in Media in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-9957P3HIGHCVSS 8.8fixed in 148.0.7778.216fixed in 148.0.7778.215+1 more2026-05-28
CVE-2026-9957 [HIGH] CWE-416 CVE-2026-9957: Use after free in PDF in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute
Use after free in PDF in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: High)
nvd
CVE-2026-8518P3HIGHCVSS 8.8fixed in 148.0.7778.168≥ 148.0.7778.168, < 148.0.7778.1682026-05-14
CVE-2026-8518 [HIGH] CWE-416 CVE-2026-8518: Use after free in Blink in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execut
Use after free in Blink in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2026-118314P3HIGHCVSS 8.8fixed in 156.0.8078.73≥ 156.0.8078.73, < 156.0.8078.732026-10-27
CVE-2026-118314 [HIGH] CWE-20 CVE-2026-118314: Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remo
Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-118338P3HIGHCVSS 8.8fixed in 156.0.8078.73≥ 156.0.8078.73, < 156.0.8078.732026-10-27
CVE-2026-118338 [HIGH] CWE-416 CVE-2026-118338: Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to pot
Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-118345P3HIGHCVSS 8.8fixed in 156.0.8078.73≥ 156.0.8078.73, < 156.0.8078.732026-10-27
CVE-2026-118345 [HIGH] CWE-416 CVE-2026-118345: Use after free in PDFium in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potent
Use after free in PDFium in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-118346P3HIGHCVSS 8.8fixed in 156.0.8078.73≥ 156.0.8078.73, < 156.0.8078.732026-10-27
CVE-2026-118346 [HIGH] CWE-416 CVE-2026-118346: Use after free in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to p
Use after free in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-110919P3HIGHCVSS 8.8fixed in 155.0.8059.84≥ 155.0.8059.84, < 155.0.8059.842026-10-15
CVE-2026-110919 [HIGH] CWE-416 CVE-2026-110919: Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute ar
Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd