Google Chrome vulnerabilities

CVE-2019-5870 [CRITICAL] CWE-416 CVE-2019-5870: Use after free in media in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentia Use after free in media in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.

CVE-2017-5059 [HIGH] CWE-843 CVE-2017-5059: Type confusion in Blink in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac, and 58.0 Type confusion in Blink in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac, and 58.0.3029.83 for Android, allowed a remote attacker to potentially obtain code execution via a crafted HTML page.

CVE-2020-6457 [CRITICAL] CWE-416 CVE-2020-6457: Use after free in speech recognizer in Google Chrome prior to 81.0.4044.113 allowed a remote attacke Use after free in speech recognizer in Google Chrome prior to 81.0.4044.113 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.

CVE-2022-2587 [CRITICAL] CWE-787 CVE-2022-2587: Out of bounds write in Chrome OS Audio Server in Google Chrome on Chrome OS prior to 102.0.5005.125 Out of bounds write in Chrome OS Audio Server in Google Chrome on Chrome OS prior to 102.0.5005.125 allowed a remote attacker to potentially exploit heap corruption via crafted audio metadata.

CVE-2017-5088 [HIGH] CWE-125 CVE-2017-5088: Insufficient validation of untrusted input in V8 in Google Chrome prior to 59.0.3071.104 for Mac, Wi Insufficient validation of untrusted input in V8 in Google Chrome prior to 59.0.3071.104 for Mac, Windows, and Linux, and 59.0.3071.117 for Android, allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.

CVE-2018-18356 [HIGH] CWE-190 CVE-2018-18356: An integer overflow in path handling lead to a use after free in Skia in Google Chrome prior to 71.0 An integer overflow in path handling lead to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVE-2021-21107 [CRITICAL] CWE-416 CVE-2021-21107: Use after free in drag and drop in Google Chrome on Linux prior to 87.0.4280.141 allowed a remote at Use after free in drag and drop in Google Chrome on Linux prior to 87.0.4280.141 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

CVE-2021-21142 [CRITICAL] CWE-416 CVE-2021-21142: Use after free in Payments in Google Chrome on Mac prior to 88.0.4324.146 allowed a remote attacker Use after free in Payments in Google Chrome on Mac prior to 88.0.4324.146 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.

CVE-2020-6390 [HIGH] CWE-787 CVE-2020-6390: Out of bounds memory access in streams in Google Chrome prior to 80.0.3987.87 allowed a remote attac Out of bounds memory access in streams in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVE-2026-13831 [HIGH] CWE-416 CVE-2026-13831: Out of bounds read and write in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacke Out of bounds read and write in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2021-38013 [CRITICAL] CWE-787 CVE-2021-38013: Heap buffer overflow in fingerprint recognition in Google Chrome on ChromeOS prior to 96.0.4664.45 a Heap buffer overflow in fingerprint recognition in Google Chrome on ChromeOS prior to 96.0.4664.45 allowed a remote attacker who had compromised a WebUI renderer process to potentially perform a sandbox escape via a crafted HTML page.

CVE-2020-16014 [CRITICAL] CWE-416 CVE-2020-16014: Use after free in PPAPI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had com Use after free in PPAPI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

CVE-2020-16018 [CRITICAL] CWE-416 CVE-2020-16018: Use after free in payments in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had Use after free in payments in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

CVE-2020-6513 [HIGH] CWE-787 CVE-2020-6513: Heap buffer overflow in PDFium in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to p Heap buffer overflow in PDFium in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.

CVE-2017-15412 [HIGH] CWE-416 CVE-2017-15412: Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other pro Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVE-2026-17979 [HIGH] CWE-362 CVE-2026-17979: Race in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary co Race in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-17952 [HIGH] CWE-269 CVE-2026-17952: Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who c Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Low)

CVE-2026-17948 [HIGH] CWE-843 CVE-2026-17948: Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a use Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Low)

CVE-2022-0973 [CRITICAL] CWE-416 CVE-2022-0973: Use after free in Safe Browsing in Google Chrome prior to 99.0.4844.74 allowed a remote attacker to Use after free in Safe Browsing in Google Chrome prior to 99.0.4844.74 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVE-2022-1309 [CRITICAL] CWE-863 CVE-2022-1309: Insufficient policy enforcement in developer tools in Google Chrome prior to 100.0.4896.88 allowed a Insufficient policy enforcement in developer tools in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.