Google Chrome vulnerabilities
7,357 known vulnerabilities affecting google/chrome.
Total CVEs
7,357
CISA KEV
77
actively exploited
Public exploits
92
Exploited in wild
89
Severity breakdown
CRITICAL706HIGH3500MEDIUM2993LOW155UNKNOWN3
Vulnerabilities
Page 72 of 368
CVE-2026-11144P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11144 [HIGH] CWE-416 CVE-2026-11144: Use after free in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute
Use after free in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted video file. (Chromium security severity: Medium)
nvd
CVE-2026-11657P3HIGHCVSS 8.8fixed in 149.0.7827.103≥ 149.0.7827.103, < 149.0.7827.1032026-06-09
CVE-2026-11657 [HIGH] CWE-416 CVE-2026-11657: Use after free in Payments in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker
Use after free in Payments in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-10007P3HIGHCVSS 8.8fixed in 148.0.7778.216fixed in 148.0.7778.215+1 more2026-05-28
CVE-2026-10007 [HIGH] CWE-416 CVE-2026-10007: Use after free in SVG in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute
Use after free in SVG in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-9999P3HIGHCVSS 8.8fixed in 148.0.7778.216≥ 148.0.7778.216, < 148.0.7778.2162026-05-28
CVE-2026-9999 [HIGH] CWE-269 CVE-2026-9999: Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 148.0.7778.216 allowed a remo
Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-8000P3HIGHCVSS 8.8fixed in 148.0.7778.96≥ 148.0.7778.96, < 148.0.7778.962026-05-06
CVE-2026-8000 [HIGH] CWE-20 CVE-2026-8000: Insufficient validation of untrusted input in ChromeDriver in Google Chrome on Windows prior to 148.
Insufficient validation of untrusted input in ChromeDriver in Google Chrome on Windows prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-11673P3HIGHCVSS 8.8fixed in 149.0.7827.103≥ 149.0.7827.103, < 149.0.7827.1032026-06-09
CVE-2026-11673 [HIGH] CWE-416 CVE-2026-11673: Use after free in InterestGroups in Google Chrome prior to 149.0.7827.103 allowed a remote attacker
Use after free in InterestGroups in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-11235P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11235 [HIGH] CWE-20 CVE-2026-11235: Insufficient policy enforcement in Compositing in Google Chrome prior to 149.0.7827.53 allowed a rem
Insufficient policy enforcement in Compositing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-9978P3HIGHCVSS 8.8fixed in 148.0.7778.216fixed in 148.0.7778.215+1 more2026-05-28
CVE-2026-9978 [HIGH] CWE-416 CVE-2026-9978: Use after free in Glic in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute
Use after free in Glic in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-9984P3HIGHCVSS 8.8fixed in 148.0.7778.216≥ 148.0.7778.216, < 148.0.7778.2162026-05-28
CVE-2026-9984 [HIGH] CWE-416 CVE-2026-9984: Use after free in UI in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker t
Use after free in UI in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-10021P3HIGHCVSS 8.8fixed in 148.0.7778.216fixed in 148.0.7778.215+1 more2026-05-28
CVE-2026-10021 [HIGH] CWE-20 CVE-2026-10021: Insufficient validation of untrusted input in USB in Google Chrome prior to 148.0.7778.216 allowed a
Insufficient validation of untrusted input in USB in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-7992P3HIGHCVSS 8.8fixed in 148.0.7778.96≥ 148.0.7778.96, < 148.0.7778.962026-05-06
CVE-2026-7992 [HIGH] CWE-20 CVE-2026-7992: Insufficient validation of untrusted input in UI in Google Chrome on Linux, ChromeOS prior to 148.0.
Insufficient validation of untrusted input in UI in Google Chrome on Linux, ChromeOS prior to 148.0.7778.96 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-7991P3HIGHCVSS 8.8fixed in 148.0.7778.96≥ 148.0.7778.96, < 148.0.7778.962026-05-06
CVE-2026-7991 [HIGH] CWE-416 CVE-2026-7991: Use after free in UI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compr
Use after free in UI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-7995P3HIGHCVSS 8.8fixed in 148.0.7778.96≥ 148.0.7778.96, < 148.0.7778.962026-05-06
CVE-2026-7995 [HIGH] CWE-125 CVE-2026-7995: Out of bounds read in AdFilter in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to
Out of bounds read in AdFilter in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-11201P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11201 [HIGH] CWE-416 CVE-2026-11201: Use after free in ServiceWorker in Google Chrome prior to 149.0.7827.53 allowed an attacker who conv
Use after free in ServiceWorker in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Medium)
nvd
CVE-2026-119268P3HIGHCVSS 8.8fixed in 156.0.8078.79≥ 156.0.8078.79, < 156.0.8078.792026-10-30
CVE-2026-119268 [HIGH] CWE-190 CVE-2026-119268: Integer overflow in Editing in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to pot
Integer overflow in Editing in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-7940P3HIGHCVSS 8.8fixed in 148.0.7778.96≥ 148.0.7778.96, < 148.0.7778.962026-05-06
CVE-2026-7940 [HIGH] CWE-416 CVE-2026-7940: Use after free in V8 in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a use
Use after free in V8 in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Medium)
nvd
CVE-2026-10926P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-10926 [HIGH] CWE-416 CVE-2026-10926: Use after free in Cast in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local netw
Use after free in Cast in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment to execute arbitrary code via malicious network traffic. (Chromium security severity: High)
nvd
CVE-2021-21127P3HIGHCVSS 8.8fixed in 88.0.4324.96≥ unspecified, < 88.0.4324.962021-02-09
CVE-2021-21127 [HIGH] CVE-2021-21127: Insufficient policy enforcement in extensions in Google Chrome prior to 88.0.4324.96 allowed a remot
Insufficient policy enforcement in extensions in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass content security policy via a crafted Chrome Extension.
nvd
CVE-2026-14111P3HIGHCVSS 8.1fixed in 150.0.7871.46≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-14111 [HIGH] CWE-416 CVE-2026-14111: Use after free in WebProtect in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinc
Use after free in WebProtect in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Low)
nvd
CVE-2026-14032P3HIGHCVSS 8.1fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-14032 [HIGH] CWE-416 CVE-2026-14032: Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allowed an attacker who c
Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Low)
nvd