Google Chrome vulnerabilities
7,357 known vulnerabilities affecting google/chrome.
Total CVEs
7,357
CISA KEV
77
actively exploited
Public exploits
92
Exploited in wild
89
Severity breakdown
CRITICAL704HIGH3487MEDIUM2991LOW155UNKNOWN20
Vulnerabilities
Page 49 of 368
CVE-2026-110921P3HIGHCVSS 8.8fixed in 155.0.8059.84≥ 155.0.8059.84, < 155.0.8059.842026-10-15
CVE-2026-110921 [HIGH] CWE-416 CVE-2026-110921: Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute ar
Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-118311P3HIGHCVSS 8.8fixed in 156.0.8078.73≥ 156.0.8078.73, < 156.0.8078.732026-10-27
CVE-2026-118311 [HIGH] CWE-119 CVE-2026-118311: Memory corruption in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to pote
Memory corruption in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-11633P3HIGHCVSS 8.8fixed in 149.0.7827.103≥ 149.0.7827.103, < 149.0.7827.1032026-06-09
CVE-2026-11633 [HIGH] CWE-416 CVE-2026-11633: Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacke
Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code via a malicious peripheral. (Chromium security severity: Critical)
nvd
CVE-2021-30599P3HIGHCVSS 8.8fixed in 92.0.4515.159≥ unspecified, < 92.0.4515.1592021-08-26
CVE-2021-30599 [HIGH] CWE-843 CVE-2021-30599: Type confusion in V8 in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to execute ar
Type confusion in V8 in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
nvd
CVE-2026-7347P3HIGHCVSS 8.1fixed in 147.0.7727.138≥ 147.0.7727.138, < 147.0.7727.1382026-04-28
CVE-2026-7347 [HIGH] CWE-416 CVE-2026-7347: Use after free in Chromoting in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to e
Use after free in Chromoting in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: High)
nvd
CVE-2026-87537P3HIGHCVSS 8.1fixed in 153.0.8010.36≥ 153.0.8010.36, < 153.0.8010.362026-09-09
CVE-2026-87537 [HIGH] CWE-862 CVE-2026-87537: Missing authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacke
Missing authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)
nvd
CVE-2026-10887P3HIGHCVSS 8.1fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-10887 [HIGH] CWE-416 CVE-2026-10887: Use after free in Chromoting in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacke
Use after free in Chromoting in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Critical)
nvd
CVE-2026-13779P3HIGHCVSS 8.1fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-13779 [HIGH] CWE-416 CVE-2026-13779: Use after free in Chromoting in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a remote at
Use after free in Chromoting in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Critical)
nvd
CVE-2026-79263P3HIGHCVSS 8.1fixed in 152.0.7977.65≥ 152.0.7977.65, < 152.0.7977.652026-08-25
CVE-2026-79263 [HIGH] CWE-367 CVE-2026-79263: Race condition in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to ex
Race condition in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via crafted network traffic. (Chromium security severity: Low)
nvd
CVE-2026-95333P3HIGHCVSS 8.1fixed in 154.0.8037.57≥ 154.0.8037.57, < 154.0.8037.572026-09-29
CVE-2026-95333 [HIGH] CWE-416 CVE-2026-95333: Use after free in Metrics in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execu
Use after free in Metrics in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)
nvd
CVE-2022-0290P3CRITICALCVSS 9.6fixed in 97.0.4692.99≥ unspecified, < 97.0.4692.992022-02-12
CVE-2022-0290 [CRITICAL] CWE-416 CVE-2022-0290: Use after free in Site isolation in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to
Use after free in Site isolation in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
nvd
CVE-2023-1529P3CRITICALCVSS 9.8fixed in 111.0.5563.110≥ 111.0.5563.110, < 111.0.5563.1102023-03-21
CVE-2023-1529 [CRITICAL] CWE-787 CVE-2023-1529: Out of bounds memory access in WebHID in Google Chrome prior to 111.0.5563.110 allowed a remote atta
Out of bounds memory access in WebHID in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a malicious HID device. (Chromium security severity: High)
nvd
CVE-2023-4428P3HIGHCVSS 8.1fixed in 116.0.5845.110≥ 116.0.5845.110, < 116.0.5845.1102023-08-23
CVE-2023-4428 [HIGH] CWE-125 CVE-2023-4428: Out of bounds memory access in CSS in Google Chrome prior to 116.0.5845.110 allowed a remote attacke
Out of bounds memory access in CSS in Google Chrome prior to 116.0.5845.110 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2024-2883P3HIGHCVSS 8.8fixed in 123.0.6312.86≥ 123.0.6312.86, < 123.0.6312.862024-03-26
CVE-2024-2883 [HIGH] CWE-416 CVE-2024-2883: Use after free in ANGLE in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to potenti
Use after free in ANGLE in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2025-5280P3HIGHCVSS 8.8fixed in 137.0.7151.55≥ 137.0.7151.55, < 137.0.7151.552025-05-27
CVE-2025-5280 [HIGH] CWE-787 CVE-2025-5280: Out of bounds write in V8 in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to poten
Out of bounds write in V8 in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-17695P3CRITICALCVSS 9.6fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17695 [CRITICAL] CWE-693 CVE-2026-17695: Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 151.0.7922.72 allowed a remot
Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-17701P3CRITICALCVSS 9.6fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17701 [CRITICAL] CWE-125 CVE-2026-17701: Insufficient validation of untrusted input in ANGLE in Google Chrome on Mac prior to 151.0.7922.72 a
Insufficient validation of untrusted input in ANGLE in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-113171P3CRITICALCVSS 9.6fixed in 156.0.8078.47≥ 156.0.8078.47, < 156.0.8078.472026-10-20
CVE-2026-113171 [CRITICAL] CWE-119 CVE-2026-113171: Memory corruption in Prompts in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote
Memory corruption in Prompts in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-95349P3CRITICALCVSS 9.6fixed in 154.0.8037.57≥ 154.0.8037.57, < 154.0.8037.572026-09-29
CVE-2026-95349 [CRITICAL] CWE-122 CVE-2026-95349: Buffer overflow in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote atta
Buffer overflow in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2026-102331P3CRITICALCVSS 9.6fixed in 154.0.8037.92≥ 154.0.8037.92, < 154.0.8037.922026-09-29
CVE-2026-102331 [CRITICAL] CWE-122 CVE-2026-102331: Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote atta
Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
nvd