Google Chrome vulnerabilities
7,357 known vulnerabilities affecting google/chrome.
Total CVEs
7,357
CISA KEV
77
actively exploited
Public exploits
92
Exploited in wild
89
Severity breakdown
CRITICAL706HIGH3500MEDIUM2993LOW155UNKNOWN3
Vulnerabilities
Page 71 of 368
CVE-2026-11074P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11074 [HIGH] CWE-416 CVE-2026-11074: Use after free in WebRTC in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker
Use after free in WebRTC in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-10923P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-10923 [HIGH] CWE-416 CVE-2026-10923: Use after free in WebAppInstalls in Google Chrome on Android prior to 149.0.7827.53 allowed a local
Use after free in WebAppInstalls in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to execute arbitrary code via a malicious file. (Chromium security severity: High)
nvd
CVE-2026-5868P3HIGHCVSS 8.8fixed in 147.0.7727.55≥ 147.0.7727.55, < 147.0.7727.552026-04-08
CVE-2026-5868 [HIGH] CWE-122 CVE-2026-5868: Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 147.0.7727.55 allowed a remote attack
Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-6305P3HIGHCVSS 8.8fixed in 147.0.7727.101≥ 147.0.7727.101, < 147.0.7727.1012026-04-15
CVE-2026-6305 [HIGH] CWE-122 CVE-2026-6305: Heap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to
Heap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: High)
nvd
CVE-2026-6306P3HIGHCVSS 8.8fixed in 147.0.7727.101≥ 147.0.7727.101, < 147.0.7727.1012026-04-15
CVE-2026-6306 [HIGH] CWE-122 CVE-2026-6306: Heap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to
Heap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: High)
nvd
CVE-2026-4440P3HIGHCVSS 8.8fixed in 146.0.7680.153≥ 146.0.7680.153, < 146.0.7680.1532026-03-20
CVE-2026-4440 [HIGH] CWE-125 CVE-2026-4440: Out of bounds read and write in WebGL in Google Chrome prior to 146.0.7680.153 allowed a remote atta
Out of bounds read and write in WebGL in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2026-110155P3HIGHCVSS 8.8fixed in 155.0.8059.79≥ 155.0.8059.79, < 155.0.8059.792026-10-13
CVE-2026-110155 [HIGH] CWE-122 CVE-2026-110155: Buffer overflow in PDFium in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execu
Buffer overflow in PDFium in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-6315P3HIGHCVSS 8.8fixed in 147.0.7727.101≥ 147.0.7727.101, < 147.0.7727.1012026-04-15
CVE-2026-6315 [HIGH] CWE-416 CVE-2026-6315: Use after free in Permissions in Google Chrome on Android prior to 147.0.7727.101 allowed a remote a
Use after free in Permissions in Google Chrome on Android prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-5870P3HIGHCVSS 8.8fixed in 147.0.7727.55≥ 147.0.7727.55, < 147.0.7727.552026-04-08
CVE-2026-5870 [HIGH] CWE-472 CVE-2026-5870: Integer overflow in Skia in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execut
Integer overflow in Skia in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-110914P3HIGHCVSS 8.8fixed in 155.0.8059.84≥ 155.0.8059.84, < 155.0.8059.842026-10-15
CVE-2026-110914 [HIGH] CWE-119 CVE-2026-110914: Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to po
Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-10922P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-10922 [HIGH] CWE-20 CVE-2026-10922: Insufficient validation of untrusted input in DevTools in Google Chrome prior to 149.0.7827.53 allow
Insufficient validation of untrusted input in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass same origin policy via malicious network traffic. (Chromium security severity: High)
nvd
CVE-2026-9928P3HIGHCVSS 8.8fixed in 148.0.7778.216≥ 148.0.7778.216, < 148.0.7778.2162026-05-28
CVE-2026-9928 [HIGH] CWE-125 CVE-2026-9928: Out of bounds read in ANGLE in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote att
Out of bounds read in ANGLE in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-8529P3HIGHCVSS 8.8fixed in 148.0.7778.168≥ 148.0.7778.168, < 148.0.7778.1682026-05-14
CVE-2026-8529 [HIGH] CWE-122 CVE-2026-8529: Heap buffer overflow in Codecs in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to
Heap buffer overflow in Codecs in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted video file. (Chromium security severity: High)
nvd
CVE-2026-110166P3HIGHCVSS 8.8fixed in 155.0.8059.79≥ 155.0.8059.79, < 155.0.8059.792026-10-13
CVE-2026-110166 [HIGH] CWE-122 CVE-2026-110166: Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to ex
Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-79230P3HIGHCVSS 8.8fixed in 152.0.7977.65≥ 152.0.7977.65, < 152.0.7977.652026-08-25
CVE-2026-79230 [HIGH] CWE-20 CVE-2026-79230: Improper input validation in ANGLE in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remot
Improper input validation in ANGLE in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-12007P3HIGHCVSS 8.8fixed in 149.0.7827.115≥ 149.0.7827.115, < 149.0.7827.1152026-06-11
CVE-2026-12007 [HIGH] CWE-416 CVE-2026-12007: Use after free in Core in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker
Use after free in Core in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2026-11171P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11171 [HIGH] CWE-472 CVE-2026-11171: Integer overflow in Blink in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execu
Integer overflow in Blink in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-9968P3HIGHCVSS 8.8fixed in 148.0.7778.216fixed in 148.0.7778.215+1 more2026-05-28
CVE-2026-9968 [HIGH] CWE-472 CVE-2026-9968: Integer overflow in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute
Integer overflow in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-8555P3HIGHCVSS 8.8fixed in 148.0.7778.168≥ 148.0.7778.168, < 148.0.7778.1682026-05-14
CVE-2026-8555 [HIGH] CWE-416 CVE-2026-8555: Use after free in GTK in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker
Use after free in GTK in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-8532P3HIGHCVSS 8.8fixed in 148.0.7778.168≥ 148.0.7778.168, < 148.0.7778.1682026-05-14
CVE-2026-8532 [HIGH] CWE-472 CVE-2026-8532: Integer overflow in XML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execut
Integer overflow in XML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
nvd