Google Chrome vulnerabilities
5,831 known vulnerabilities affecting google/chrome.
Total CVEs
5,831
CISA KEV
75
actively exploited
Public exploits
88
Exploited in wild
87
Severity breakdown
CRITICAL496HIGH2798MEDIUM2448LOW79UNKNOWN10
Vulnerabilities
Page 54 of 292
CVE-2020-6492P3CRITICALCVSS 9.6fixed in 83.0.4103.97≥ unspecified, < 83.0.4103.972021-11-02
CVE-2020-6492 [CRITICAL] CWE-416 CVE-2020-6492: Use after free in ANGLE in Google Chrome prior to 83.0.4103.97 allowed a remote attacker to potentia
Use after free in ANGLE in Google Chrome prior to 83.0.4103.97 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
nvd
CVE-2019-5762P3HIGHCVSS 8.8fixed in 72.0.3626.81≥ unspecified, < 72.0.3626.812019-02-19
CVE-2019-5762 [HIGH] CWE-119 CVE-2019-5762: Inappropriate memory management when caching in PDFium in Google Chrome prior to 72.0.3626.81 allowe
Inappropriate memory management when caching in PDFium in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file.
nvd
CVE-2019-5756P3HIGHCVSS 8.8fixed in 72.0.3626.81≥ unspecified, < 72.0.3626.812019-02-19
CVE-2019-5756 [HIGH] CWE-416 CVE-2019-5756: Inappropriate memory management when caching in PDFium in Google Chrome prior to 72.0.3626.81 allowe
Inappropriate memory management when caching in PDFium in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file.
nvd
CVE-2021-30604P3HIGHCVSS 8.8fixed in 92.0.4515.159≥ unspecified, < 92.0.4515.1592021-08-26
CVE-2021-30604 [HIGH] CWE-416 CVE-2021-30604: Use after free in ANGLE in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to potenti
Use after free in ANGLE in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
nvd
CVE-2021-30591P3HIGHCVSS 8.8fixed in 92.0.4515.131≥ unspecified, < 92.0.4515.1312021-08-26
CVE-2021-30591 [HIGH] CWE-416 CVE-2021-30591: Use after free in File System API in Google Chrome prior to 92.0.4515.131 allowed a remote attacker
Use after free in File System API in Google Chrome prior to 92.0.4515.131 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
nvd
CVE-2018-6120P3HIGHCVSS 8.8fixed in 67.0.3396.62≥ unspecified, < 66.0.3359.1702019-01-09
CVE-2018-6120 [HIGH] CWE-190 CVE-2018-6120: An integer overflow that could lead to an attacker-controlled heap out-of-bounds write in PDFium in
An integer overflow that could lead to an attacker-controlled heap out-of-bounds write in PDFium in Google Chrome prior to 66.0.3359.170 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file.
nvd
CVE-2018-6088P3HIGHCVSS 8.8fixed in 66.0.3359.117≥ unspecified, < 66.0.3359.1172018-12-04
CVE-2018-6088 [HIGH] CWE-20 CVE-2018-6088: An iterator-invalidation bug in PDFium in Google Chrome prior to 66.0.3359.117 allowed a remote atta
An iterator-invalidation bug in PDFium in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file.
nvd
CVE-2024-7024P3CRITICALCVSS 9.6fixed in 126.0.6478.54≥ 126.0.6478.54, < 126.0.6478.542024-09-23
CVE-2024-7024 [CRITICAL] CWE-787 CVE-2024-7024: Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker
Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2019-25154P3CRITICALCVSS 9.6fixed in 77.0.3865.75≥ 77.0.3865.75, < 77.0.3865.752024-07-16
CVE-2019-25154 [CRITICAL] CVE-2019-25154: Inappropriate implementation in iframe in Google Chrome prior to 77.0.3865.75 allowed a remote attac
Inappropriate implementation in iframe in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-14397P3CRITICALCVSS 9.6fixed in 150.0.7871.46≥ 150.0.7871.46, < 150.0.7871.462026-07-01
CVE-2026-14397 [CRITICAL] CWE-787 CVE-2026-14397: Out of bounds write in ANGLE in Google Chrome on Mac prior to 150.0.7871.46 allowed a remote attacke
Out of bounds write in ANGLE in Google Chrome on Mac prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-9875P3CRITICALCVSS 9.6fixed in 148.0.7778.216≥ 148.0.7778.216, < 148.0.7778.2162026-05-28
CVE-2026-9875 [CRITICAL] CWE-125 CVE-2026-9875: Out of bounds read in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote att
Out of bounds read in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2021-4057P3HIGHCVSS 8.8fixed in 96.0.4664.93≥ unspecified, < 96.0.4664.932021-12-23
CVE-2021-4057 [HIGH] CWE-416 CVE-2021-4057: Use after free in file API in Google Chrome prior to 96.0.4664.93 allowed a remote attacker who had
Use after free in file API in Google Chrome prior to 96.0.4664.93 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
nvd
CVE-2015-1233P3HIGHCVSS 7.5≤ 41.0.2272.1022015-04-01
CVE-2015-1233 [HIGH] CWE-17 CVE-2015-1233: Google Chrome before 41.0.2272.118 does not properly handle the interaction of IPC, the Gamepad API,
Google Chrome before 41.0.2272.118 does not properly handle the interaction of IPC, the Gamepad API, and Google V8, which allows remote attackers to execute arbitrary code via unspecified vectors.
nvd
CVE-2021-30513P3HIGHCVSS 8.8fixed in 90.0.4430.212≥ unspecified, < 90.0.4430.2122021-06-04
CVE-2021-30513 [HIGH] CWE-843 CVE-2021-30513: Type confusion in V8 in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentiall
Type confusion in V8 in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
nvd
CVE-2021-30601P3HIGHCVSS 8.8fixed in 92.0.4515.159≥ unspecified, < 92.0.4515.1592021-08-26
CVE-2021-30601 [HIGH] CWE-416 CVE-2021-30601: Use after free in Extensions API in Google Chrome prior to 92.0.4515.159 allowed an attacker who con
Use after free in Extensions API in Google Chrome prior to 92.0.4515.159 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
nvd
CVE-2022-3656P3HIGHCVSS 8.8fixed in 107.0.5304.62≥ unspecified, < 107.0.5304.622022-11-01
CVE-2022-3656 [HIGH] CWE-20 CVE-2022-3656: Insufficient data validation in File System in Google Chrome prior to 107.0.5304.62 allowed a remote
Insufficient data validation in File System in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to bypass file system restrictions via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2020-15962P3HIGHCVSS 8.8fixed in 85.0.4183.121≥ unspecified, < 85.0.4183.1212020-09-21
CVE-2020-15962 [HIGH] CVE-2020-15962: Insufficient policy validation in serial in Google Chrome prior to 85.0.4183.121 allowed a remote at
Insufficient policy validation in serial in Google Chrome prior to 85.0.4183.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.
nvd
CVE-2022-2415P3HIGHCVSS 8.8fixed in 103.0.5060.53≥ unspecified, < 103.0.5060.532022-07-28
CVE-2022-2415 [HIGH] CWE-787 CVE-2022-2415: Heap buffer overflow in WebGL in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to p
Heap buffer overflow in WebGL in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
nvd
CVE-2022-1134P3HIGHCVSS 8.8fixed in 100.0.4896.60≥ unspecified, < 100.0.4896.602022-07-23
CVE-2022-1134 [HIGH] CWE-843 CVE-2022-1134: Type confusion in V8 in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to potentiall
Type confusion in V8 in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
nvd
CVE-2018-17457P3HIGHCVSS 8.8fixed in 69.0.3497.81≥ unspecified, < 69.0.3497.812019-01-09
CVE-2018-17457 [HIGH] CWE-416 CVE-2018-17457: An object lifecycle issue in Blink could lead to a use after free in WebAudio in Google Chrome prior
An object lifecycle issue in Blink could lead to a use after free in WebAudio in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
nvd