Google Chrome vulnerabilities
7,357 known vulnerabilities affecting google/chrome.
Total CVEs
7,357
CISA KEV
77
actively exploited
Public exploits
92
Exploited in wild
89
Severity breakdown
CRITICAL706HIGH3500MEDIUM2993LOW155UNKNOWN3
Vulnerabilities
Page 73 of 368
CVE-2026-13774P3HIGHCVSS 8.1fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-13774 [HIGH] CWE-416 CVE-2026-13774: Use after free in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinc
Use after free in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Critical)
nvd
CVE-2021-21106P3CRITICALCVSS 9.6fixed in 87.0.4280.141≥ unspecified, < 87.0.4280.1412021-01-08
CVE-2021-21106 [CRITICAL] CWE-416 CVE-2021-21106: Use after free in autofill in Google Chrome prior to 87.0.4280.141 allowed a remote attacker who had
Use after free in autofill in Google Chrome prior to 87.0.4280.141 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
nvd
CVE-2021-21201P3CRITICALCVSS 9.6fixed in 90.0.4430.72≥ unspecified, < 90.0.4430.722021-04-26
CVE-2021-21201 [CRITICAL] CWE-416 CVE-2021-21201: Use after free in permissions in Google Chrome prior to 90.0.4430.72 allowed a remote attacker who h
Use after free in permissions in Google Chrome prior to 90.0.4430.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
nvd
CVE-2011-2841P4MEDIUMCVSS 6.8PoCfixed in 14.0.835.1632011-09-19
CVE-2011-2841 [MEDIUM] CWE-20 CVE-2011-2841: Google Chrome before 14.0.835.163 does not properly perform garbage collection during the processing
Google Chrome before 14.0.835.163 does not properly perform garbage collection during the processing of PDF documents, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document.
nvd
CVE-2026-79152P3CRITICALCVSS 9.8fixed in 152.0.7977.65≥ 152.0.7977.65, < 152.0.7977.652026-08-25
CVE-2026-79152 [CRITICAL] CWE-863 CVE-2026-79152: Incorrect authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed
Incorrect authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to bypass web origin policy via a co-installed app. (Chromium security severity: Low)
nvd
CVE-2026-17691P3CRITICALCVSS 9.6fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17691 [CRITICAL] CWE-787 CVE-2026-17691: Out of bounds write in ANGLE in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote att
Out of bounds write in ANGLE in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-17721P3CRITICALCVSS 9.6fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17721 [CRITICAL] CWE-787 CVE-2026-17721: Out of bounds write in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to po
Out of bounds write in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2017-15407P3HIGHCVSS 8.8fixed in 63.0.3239.842018-08-28
CVE-2017-15407 [HIGH] CWE-787 CVE-2017-15407: Out-of-bounds Write in the QUIC networking stack in Google Chrome prior to 63.0.3239.84 allowed a re
Out-of-bounds Write in the QUIC networking stack in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to gain code execution via a malicious server.
nvd
CVE-2025-4609P3CRITICALCVSS 9.6fixed in 136.0.7103.113≥ 136.0.7103.113, < 136.0.7103.1132025-08-22
CVE-2025-4609 [CRITICAL] CWE-732 CVE-2025-4609: Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 136.0.7103.113 allowed a remote attacker to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)
nvd
CVE-2026-19157P3CRITICALCVSS 9.6fixed in 151.0.7922.109≥ 151.0.7922.109, < 151.0.7922.1092026-08-06
CVE-2026-19157 [CRITICAL] CWE-787 CVE-2026-19157: Out of bounds write in ANGLE in Google Chrome on Android prior to 151.0.7922.109 allowed a remote at
Out of bounds write in ANGLE in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2026-9872P3CRITICALCVSS 9.6fixed in 148.0.7778.216≥ 148.0.7778.216, < 148.0.7778.2162026-05-28
CVE-2026-9872 [CRITICAL] CWE-787 CVE-2026-9872: Out of bounds write in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote atta
Out of bounds write in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2026-3916P3CRITICALCVSS 9.6fixed in 146.0.7680.71≥ 146.0.7680.71, < 146.0.7680.712026-03-11
CVE-2026-3916 [CRITICAL] CWE-125 CVE-2026-3916: Out of bounds read in Web Speech in Google Chrome prior to 146.0.7680.71 allowed a remote attacker t
Out of bounds read in Web Speech in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-18015P3CRITICALCVSS 9.6fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-18015 [CRITICAL] CWE-693 CVE-2026-18015: Inappropriate implementation in Tint in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote
Inappropriate implementation in Tint in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-17727P3CRITICALCVSS 9.6fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17727 [CRITICAL] CWE-787 CVE-2026-17727: Out of bounds write in WebGL in Google Chrome on Android prior to 151.0.7922.72 allowed a remote att
Out of bounds write in WebGL in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-17726P3CRITICALCVSS 9.6fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17726 [CRITICAL] CWE-190 CVE-2026-17726: Integer overflow in WebGL in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attack
Integer overflow in WebGL in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-17713P3CRITICALCVSS 9.6fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17713 [CRITICAL] CWE-20 CVE-2026-17713: Insufficient validation of untrusted input in Accessibility in Google Chrome on Android prior to 151
Insufficient validation of untrusted input in Accessibility in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-14392P3CRITICALCVSS 9.6fixed in 150.0.7871.46≥ 150.0.7871.46, < 150.0.7871.462026-07-01
CVE-2026-14392 [CRITICAL] CWE-787 CVE-2026-14392: Out of bounds write in Tint in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to pot
Out of bounds write in Tint in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-10892P3CRITICALCVSS 9.6fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-10892 [CRITICAL] CWE-787 CVE-2026-10892: Out of bounds write in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attac
Out of bounds write in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2026-17855P3CRITICALCVSS 9.6fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17855 [CRITICAL] CWE-362 CVE-2026-17855: Race in DevTools in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had co
Race in DevTools in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-16419P3CRITICALCVSS 9.6fixed in 150.0.7871.182≥ 150.0.7871.182, < 150.0.7871.1822026-07-21
CVE-2026-16419 [CRITICAL] CWE-125 CVE-2026-16419: Out of bounds read and write in ANGLE in Google Chrome on Android prior to 150.0.7871.182 allowed a
Out of bounds read and write in ANGLE in Google Chrome on Android prior to 150.0.7871.182 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
nvd