Google Chrome vulnerabilities
7,357 known vulnerabilities affecting google/chrome.
Total CVEs
7,357
CISA KEV
77
actively exploited
Public exploits
92
Exploited in wild
89
Severity breakdown
CRITICAL706HIGH3500MEDIUM2993LOW155UNKNOWN3
Vulnerabilities
Page 59 of 368
CVE-2026-113060P3HIGHCVSS 8.8fixed in 156.0.8078.47≥ 156.0.8078.47, < 156.0.8078.472026-10-20
CVE-2026-113060 [HIGH] CWE-20 CVE-2026-113060: Improper input validation in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote atta
Improper input validation in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-113175P3HIGHCVSS 8.8fixed in 156.0.8078.47≥ 156.0.8078.47, < 156.0.8078.472026-10-20
CVE-2026-113175 [HIGH] CWE-20 CVE-2026-113175: Improper input validation in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote att
Improper input validation in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-113219P3HIGHCVSS 8.8fixed in 156.0.8078.47≥ 156.0.8078.47, < 156.0.8078.472026-10-20
CVE-2026-113219 [HIGH] CWE-119 CVE-2026-113219: Memory corruption in Contacts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to e
Memory corruption in Contacts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-113266P3HIGHCVSS 8.8fixed in 156.0.8078.47≥ 156.0.8078.47, < 156.0.8078.472026-10-20
CVE-2026-113266 [HIGH] CWE-119 CVE-2026-113266: Memory corruption in ANGLE in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote at
Memory corruption in ANGLE in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-17751P3HIGHCVSS 8.8fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17751 [HIGH] CWE-269 CVE-2026-17751: Inappropriate implementation in AdFilter in Google Chrome prior to 151.0.7922.72 allowed a remote at
Inappropriate implementation in AdFilter in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-8509P3HIGHCVSS 8.8fixed in 148.0.7778.168≥ 148.0.7778.168, < 148.0.7778.1682026-05-14
CVE-2026-8509 [HIGH] CWE-122 CVE-2026-8509: Heap buffer overflow in WebML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to
Heap buffer overflow in WebML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2026-9118P3HIGHCVSS 8.8fixed in 148.0.7778.178≥ 148.0.7778.179, < 148.0.7778.1792026-05-20
CVE-2026-9118 [HIGH] CWE-416 CVE-2026-9118: Use after free in XR in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker t
Use after free in XR in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-12442P3HIGHCVSS 8.8fixed in 149.0.7827.155≥ 149.0.7827.155, < 149.0.7827.1552026-06-17
CVE-2026-12442 [HIGH] CWE-416 CVE-2026-12442: Use after free in Passwords in Google Chrome on Android prior to 149.0.7827.155 allowed a remote att
Use after free in Passwords in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
cvelistv5nvd
CVE-2026-5286P3HIGHCVSS 8.8fixed in 146.0.7680.177≥ 146.0.7680.178, < 146.0.7680.1782026-04-01
CVE-2026-5286 [HIGH] CWE-416 CVE-2026-5286: Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute
Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-10954P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-10954 [HIGH] CWE-416 CVE-2026-10954: Use after free in Actor in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute
Use after free in Actor in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-10902P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-10902 [HIGH] CWE-416 CVE-2026-10902: Use after free in Ozone in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute
Use after free in Ozone in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2026-10895P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-10895 [HIGH] CWE-416 CVE-2026-10895: Use after free in Ozone in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute
Use after free in Ozone in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2026-113029P3HIGHCVSS 8.8fixed in 156.0.8078.47≥ 156.0.8078.47, < 156.0.8078.472026-10-20
CVE-2026-113029 [HIGH] CWE-284 CVE-2026-113029: Improper access control in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker t
Improper access control in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-7355P3HIGHCVSS 8.8fixed in 147.0.7727.138≥ 147.0.7727.138, < 147.0.7727.1382026-04-28
CVE-2026-7355 [HIGH] CWE-416 CVE-2026-7355: Use after free in Media in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execut
Use after free in Media in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-7342P3HIGHCVSS 8.8fixed in 147.0.7727.138≥ 147.0.7727.138, < 147.0.7727.1382026-04-28
CVE-2026-7342 [HIGH] CWE-416 CVE-2026-7342: Use after free in WebView in Google Chrome on Android prior to 147.0.7727.138 allowed a remote attac
Use after free in WebView in Google Chrome on Android prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-13805P3HIGHCVSS 8.8fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-13805 [HIGH] CWE-416 CVE-2026-13805: Use after free in GFX in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to ex
Use after free in GFX in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-13038P3HIGHCVSS 8.8fixed in 149.0.7827.197≥ 149.0.7827.197, < 149.0.7827.1972026-06-24
CVE-2026-13038 [HIGH] CWE-416 CVE-2026-13038: Use after free in Autofill in Google Chrome on Windows prior to 149.0.7827.197 allowed a remote atta
Use after free in Autofill in Google Chrome on Windows prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2026-76018P3HIGHCVSS 8.8fixed in 151.0.7922.173≥ 151.0.7922.173, < 151.0.7922.1732026-08-20
CVE-2026-76018 [HIGH] CWE-250 CVE-2026-76018: Privilege elevation in Import in Google Chrome prior to 151.0.7922.173 allowed a remote attacker lev
Privilege elevation in Import in Google Chrome prior to 151.0.7922.173 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted file. (Chromium security severity: High)
nvd
CVE-2026-7335P3HIGHCVSS 8.8fixed in 147.0.7727.138≥ 147.0.7727.138, < 147.0.7727.1382026-04-28
CVE-2026-7335 [HIGH] CWE-416 CVE-2026-7335: Use after free in media in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execut
Use after free in media in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-7356P3HIGHCVSS 8.8fixed in 147.0.7727.138≥ 147.0.7727.138, < 147.0.7727.1382026-04-28
CVE-2026-7356 [HIGH] CWE-416 CVE-2026-7356: Use after free in Navigation in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to e
Use after free in Navigation in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
nvd