Google Chrome vulnerabilities

CVE-2026-11697 [CRITICAL] CWE-20 CVE-2026-11697: Insufficient validation of untrusted input in UI in Google Chrome prior to 149.0.7827.103 allowed a Insufficient validation of untrusted input in UI in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-11293 [CRITICAL] CWE-416 CVE-2026-11293: Use after free in Input in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potenti Use after free in Input in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-11213 [CRITICAL] CWE-20 CVE-2026-11213: Insufficient validation of untrusted input in Reading Mode in Google Chrome prior to 149.0.7827.53 a Insufficient validation of untrusted input in Reading Mode in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

CVE-2023-5996 [HIGH] CWE-416 CVE-2023-5996: Use after free in WebAudio in Google Chrome prior to 119.0.6045.123 allowed a remote attacker to pot Use after free in WebAudio in Google Chrome prior to 119.0.6045.123 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2012-5112 [CRITICAL] CWE-399 CVE-2012-5112: Use-after-free vulnerability in the SVG implementation in WebKit, as used in Google Chrome before 22 Use-after-free vulnerability in the SVG implementation in WebKit, as used in Google Chrome before 22.0.1229.94, allows remote attackers to execute arbitrary code via unspecified vectors.

CVE-2026-14038 [CRITICAL] CWE-20 CVE-2026-14038: Insufficient validation of untrusted input in New Tab Page in Google Chrome prior to 150.0.7871.47 a Insufficient validation of untrusted input in New Tab Page in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-118333 [CRITICAL] CWE-862 CVE-2026-118333: Missing authorization in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to Missing authorization in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)

CVE-2010-1029 [MEDIUM] CWE-399 CVE-2010-1029: Stack consumption vulnerability in the WebCore::CSSSelector function in WebKit, as used in Apple Saf Stack consumption vulnerability in the WebCore::CSSSelector function in WebKit, as used in Apple Safari 4.0.4, Apple Safari on iPhone OS and iPhone OS for iPod touch, and Google Chrome 4.0.249, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a STYLE element composed of a large number of *

CVE-2025-10890 [CRITICAL] CWE-1300 CVE-2025-10890: Side-channel information leakage in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote att Side-channel information leakage in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

CVE-2024-5499 [HIGH] CWE-787 CVE-2024-5499: Out of bounds write in Streams API in Google Chrome prior to 125.0.6422.141 allowed a remote attacke Out of bounds write in Streams API in Google Chrome prior to 125.0.6422.141 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-4673 [HIGH] CWE-122 CVE-2026-4673: Heap buffer overflow in WebAudio in Google Chrome prior to 146.0.7680.165 allowed a remote attacker Heap buffer overflow in WebAudio in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)

CVE-2026-2650 [HIGH] CWE-122 CVE-2026-2650: Heap buffer overflow in Media in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to Heap buffer overflow in Media in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

CVE-2011-3108 [CRITICAL] CWE-399 CVE-2011-3108: Use-after-free vulnerability in Google Chrome before 19.0.1084.52 allows remote attackers to execute Use-after-free vulnerability in Google Chrome before 19.0.1084.52 allows remote attackers to execute arbitrary code via vectors related to the browser cache.

CVE-2012-1845 [CRITICAL] CWE-416 CVE-2012-1845: Use-after-free vulnerability in Google Chrome 17.0.963.66 and earlier allows remote attackers to byp Use-after-free vulnerability in Google Chrome 17.0.963.66 and earlier allows remote attackers to bypass the DEP and ASLR protection mechanisms, and execute arbitrary code, via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012. NOTE: the primary affected product may be clarified later; it was not identified

CVE-2026-113320 [HIGH] CWE-119 CVE-2026-113320: Memory corruption in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote a Memory corruption in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-113145 [HIGH] CWE-119 CVE-2026-113145: Memory corruption in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote Memory corruption in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-113088 [HIGH] CWE-119 CVE-2026-113088: Memory corruption in Mobile in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote a Memory corruption in Mobile in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-5275 [HIGH] CWE-122 CVE-2026-5275: Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 146.0.7680.178 allowed a remote attac Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

CVE-2026-113096 [HIGH] CWE-119 CVE-2026-113096: Memory corruption in Text in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote att Memory corruption in Text in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-17922 [HIGH] CWE-94 CVE-2026-17922: Inappropriate implementation in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote Inappropriate implementation in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low)