Google Chrome vulnerabilities
7,357 known vulnerabilities affecting google/chrome.
Total CVEs
7,357
CISA KEV
77
actively exploited
Public exploits
92
Exploited in wild
89
Severity breakdown
CRITICAL706HIGH3500MEDIUM2993LOW155UNKNOWN3
Vulnerabilities
Page 62 of 368
CVE-2026-106278P3HIGHCVSS 8.8fixed in 155.0.8059.39≥ 155.0.8059.39, < 155.0.8059.392026-10-06
CVE-2026-106278 [HIGH] CWE-416 CVE-2026-106278: Use after free in Select in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveragin
Use after free in Select in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-106283P3HIGHCVSS 8.8fixed in 155.0.8059.39≥ 155.0.8059.39, < 155.0.8059.392026-10-06
CVE-2026-106283 [HIGH] CWE-416 CVE-2026-106283: Use after free in Streaming in Google Chrome prior to 155.0.8059.39 allowed a remote attacker levera
Use after free in Streaming in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-11683P3HIGHCVSS 8.8fixed in 149.0.7827.103≥ 149.0.7827.103, < 149.0.7827.1032026-06-09
CVE-2026-11683 [HIGH] CWE-416 CVE-2026-11683: Use after free in WebCodecs in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to ex
Use after free in WebCodecs in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-9969P3HIGHCVSS 8.8fixed in 148.0.7778.216fixed in 148.0.7778.215+1 more2026-05-28
CVE-2026-9969 [HIGH] CWE-20 CVE-2026-9969: Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 148.0.7778.216 allowed
Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-7988P3HIGHCVSS 8.8fixed in 148.0.7778.96≥ 148.0.7778.96, < 148.0.7778.962026-05-06
CVE-2026-7988 [HIGH] CWE-843 CVE-2026-7988: Type Confusion in WebRTC in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execut
Type Confusion in WebRTC in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-11117P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11117 [HIGH] CWE-416 CVE-2026-11117: Use after free in Views in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker
Use after free in Views in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-106257P3HIGHCVSS 8.8fixed in 155.0.8059.39≥ 155.0.8059.39, < 155.0.8059.392026-10-06
CVE-2026-106257 [HIGH] CWE-416 CVE-2026-106257: Use after free in HTML in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute
Use after free in HTML in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-106252P3HIGHCVSS 8.8fixed in 155.0.8059.39≥ 155.0.8059.39, < 155.0.8059.392026-10-06
CVE-2026-106252 [HIGH] CWE-697 CVE-2026-106252: Incorrect comparison in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to p
Incorrect comparison in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-5872P3HIGHCVSS 8.8fixed in 147.0.7727.55≥ 147.0.7727.55, < 147.0.7727.552026-04-08
CVE-2026-5872 [HIGH] CWE-416 CVE-2026-5872: Use after free in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute
Use after free in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-5861P3HIGHCVSS 8.8fixed in 147.0.7727.55≥ 147.0.7727.55, < 147.0.7727.552026-04-08
CVE-2026-5861 [HIGH] CWE-416 CVE-2026-5861: Use after free in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute ar
Use after free in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-5879P3HIGHCVSS 8.8fixed in 147.0.7727.55≥ 147.0.7727.55, < 147.0.7727.552026-04-08
CVE-2026-5879 [HIGH] CWE-20 CVE-2026-5879: Insufficient validation of untrusted input in ANGLE in Google Chrome on Mac prior to 147.0.7727.55 a
Insufficient validation of untrusted input in ANGLE in Google Chrome on Mac prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-5866P3HIGHCVSS 8.8fixed in 147.0.7727.55≥ 147.0.7727.55, < 147.0.7727.552026-04-08
CVE-2026-5866 [HIGH] CWE-416 CVE-2026-5866: Use after free in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute
Use after free in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-9995P3HIGHCVSS 8.8fixed in 148.0.7778.216fixed in 148.0.7778.215+1 more2026-05-28
CVE-2026-9995 [HIGH] CWE-416 CVE-2026-9995: Use after free in WebXR in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execut
Use after free in WebXR in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-9976P3HIGHCVSS 8.8fixed in 148.0.7778.216fixed in 148.0.7778.215+1 more2026-05-28
CVE-2026-9976 [HIGH] CWE-94 CVE-2026-9976: Inappropriate implementation in USB in Google Chrome prior to 148.0.7778.216 allowed a remote attack
Inappropriate implementation in USB in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-13850P3HIGHCVSS 8.8fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-13850 [HIGH] CWE-20 CVE-2026-13850: Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.
Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a local attacker to execute arbitrary code inside a sandbox via a malicious file. (Chromium security severity: High)
nvd
CVE-2026-9897P3HIGHCVSS 8.8fixed in 148.0.7778.216fixed in 148.0.7778.215+1 more2026-05-28
CVE-2026-9897 [HIGH] CWE-416 CVE-2026-9897: Use after free in DOM in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute
Use after free in DOM in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-9883P3HIGHCVSS 8.8fixed in 148.0.7778.216fixed in 148.0.7778.215+1 more2026-05-28
CVE-2026-9883 [HIGH] CWE-416 CVE-2026-9883: Use after free in Base in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute
Use after free in Base in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2026-8527P3HIGHCVSS 8.8fixed in 148.0.7778.168≥ 148.0.7778.168, < 148.0.7778.1682026-05-14
CVE-2026-8527 [HIGH] CWE-20 CVE-2026-8527: Insufficient validation of untrusted input in Downloads in Google Chrome prior to 148.0.7778.168 all
Insufficient validation of untrusted input in Downloads in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-5883P3HIGHCVSS 8.8fixed in 147.0.7727.55≥ 147.0.7727.55, < 147.0.7727.552026-04-08
CVE-2026-5883 [HIGH] CWE-416 CVE-2026-5883: Use after free in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute
Use after free in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2021-30573P3HIGHCVSS 8.8fixed in 92.0.4515.107≥ unspecified, < 92.0.4515.1072021-08-03
CVE-2021-30573 [HIGH] CWE-416 CVE-2021-30573: Use after free in GPU in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potential
Use after free in GPU in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
nvd