Google Chrome vulnerabilities
7,357 known vulnerabilities affecting google/chrome.
Total CVEs
7,357
CISA KEV
77
actively exploited
Public exploits
92
Exploited in wild
89
Severity breakdown
CRITICAL706HIGH3500MEDIUM2993LOW155UNKNOWN3
Vulnerabilities
Page 64 of 368
CVE-2026-7984P3HIGHCVSS 8.8fixed in 148.0.7778.96≥ 148.0.7778.96, < 148.0.7778.962026-05-06
CVE-2026-7984 [HIGH] CWE-416 CVE-2026-7984: Use after free in ReadingMode in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who
Use after free in ReadingMode in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-7901P3HIGHCVSS 8.8fixed in 148.0.7778.96≥ 148.0.7778.96, < 148.0.7778.962026-05-06
CVE-2026-7901 [HIGH] CWE-416 CVE-2026-7901: Use after free in ANGLE in Google Chrome on Mac prior to 148.0.7778.96 allowed a remote attacker to
Use after free in ANGLE in Google Chrome on Mac prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-7906P3HIGHCVSS 8.8fixed in 148.0.7778.96≥ 148.0.7778.96, < 148.0.7778.962026-05-06
CVE-2026-7906 [HIGH] CWE-416 CVE-2026-7906: Use after free in SVG in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute a
Use after free in SVG in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-7921P3HIGHCVSS 8.8fixed in 148.0.7778.96≥ 148.0.7778.96, < 148.0.7778.962026-05-06
CVE-2026-7921 [HIGH] CWE-416 CVE-2026-7921: Use after free in Passwords in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to exe
Use after free in Passwords in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-7938P3HIGHCVSS 8.8fixed in 148.0.7778.96≥ 148.0.7778.96, < 148.0.7778.962026-05-06
CVE-2026-7938 [HIGH] CWE-416 CVE-2026-7938: Use after free in CSS in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute a
Use after free in CSS in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-7974P3HIGHCVSS 8.8fixed in 148.0.7778.96≥ 148.0.7778.96, < 148.0.7778.962026-05-06
CVE-2026-7974 [HIGH] CWE-416 CVE-2026-7974: Use after free in Blink in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute
Use after free in Blink in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-118354P3HIGHCVSS 8.8fixed in 156.0.8078.73≥ 156.0.8078.73, < 156.0.8078.732026-10-27
CVE-2026-118354 [HIGH] CWE-20 CVE-2026-118354: Improper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker
Improper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-118335P3HIGHCVSS 8.8≥ 156.0.8078.73, < 156.0.8078.732026-10-27
CVE-2026-118335 [HIGH] CWE-20 CVE-2026-118335: Improper input validation in Metrics in Google Chrome on on Mac prior to 156.0.8078.73 allowed a rem
Improper input validation in Metrics in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-118315P3HIGHCVSS 8.8fixed in 156.0.8078.73≥ 156.0.8078.73, < 156.0.8078.732026-10-27
CVE-2026-118315 [HIGH] CWE-20 CVE-2026-118315: Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker t
Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-118343P3HIGHCVSS 8.8fixed in 156.0.8078.73≥ 156.0.8078.73, < 156.0.8078.732026-10-27
CVE-2026-118343 [HIGH] CWE-20 CVE-2026-118343: Improper input validation in ReadingList in Google Chrome prior to 156.0.8078.73 allowed a remote at
Improper input validation in ReadingList in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-110168P3HIGHCVSS 8.8fixed in 155.0.8059.79≥ 155.0.8059.79, < 155.0.8059.792026-10-13
CVE-2026-110168 [HIGH] CWE-416 CVE-2026-110168: Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute ar
Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-110169P3HIGHCVSS 8.8fixed in 155.0.8059.79≥ 155.0.8059.79, < 155.0.8059.792026-10-13
CVE-2026-110169 [HIGH] CWE-416 CVE-2026-110169: Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute ar
Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-110164P3HIGHCVSS 8.8fixed in 155.0.8059.79≥ 155.0.8059.79, < 155.0.8059.792026-10-13
CVE-2026-110164 [HIGH] CWE-416 CVE-2026-110164: Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potential
Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-110171P3HIGHCVSS 8.8fixed in 155.0.8059.79≥ 155.0.8059.79, < 155.0.8059.792026-10-13
CVE-2026-110171 [HIGH] CWE-416 CVE-2026-110171: Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-110172P3HIGHCVSS 8.8fixed in 155.0.8059.79≥ 155.0.8059.79, < 155.0.8059.792026-10-13
CVE-2026-110172 [HIGH] CWE-416 CVE-2026-110172: Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-110167P3HIGHCVSS 8.8fixed in 155.0.8059.79≥ 155.0.8059.79, < 155.0.8059.792026-10-13
CVE-2026-110167 [HIGH] CWE-416 CVE-2026-110167: Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-95380P3HIGHCVSS 8.8fixed in 154.0.8037.57≥ 154.0.8037.57, < 154.0.8037.572026-09-29
CVE-2026-95380 [HIGH] CWE-843 CVE-2026-95380: Type confusion in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging so
Type confusion in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-10888P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-10888 [HIGH] CWE-416 CVE-2026-10888: Use after free in Cast Streaming in Google Chrome prior to 149.0.7827.53 allowed an attacker on the
Use after free in Cast Streaming in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment to execute arbitrary code via malicious network traffic. (Chromium security severity: Critical)
nvd
CVE-2026-11646P3HIGHCVSS 8.8fixed in 149.0.7827.103≥ 149.0.7827.103, < 149.0.7827.1032026-06-09
CVE-2026-11646 [HIGH] CWE-416 CVE-2026-11646: Use after free in ViewTransitions in Google Chrome prior to 149.0.7827.103 allowed a remote attacker
Use after free in ViewTransitions in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-11637P3HIGHCVSS 8.8fixed in 149.0.7827.103≥ 149.0.7827.103, < 149.0.7827.1032026-06-09
CVE-2026-11637 [HIGH] CWE-416 CVE-2026-11637: Use after free in Views in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to
Use after free in Views in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
nvd