Google Chrome vulnerabilities
7,357 known vulnerabilities affecting google/chrome.
Total CVEs
7,357
CISA KEV
77
actively exploited
Public exploits
92
Exploited in wild
89
Severity breakdown
CRITICAL706HIGH3500MEDIUM2993LOW155UNKNOWN3
Vulnerabilities
Page 75 of 368
CVE-2026-113285P3HIGHCVSS 8.8fixed in 156.0.8078.47≥ 156.0.8078.47, < 156.0.8078.472026-10-20
CVE-2026-113285 [HIGH] CWE-119 CVE-2026-113285: Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote at
Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-113134P3HIGHCVSS 8.8fixed in 156.0.8078.47≥ 156.0.8078.47, < 156.0.8078.472026-10-20
CVE-2026-113134 [HIGH] CWE-119 CVE-2026-113134: Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote at
Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-0899P3HIGHCVSS 8.8fixed in 144.0.7559.59fixed in 144.0.7559.60+1 more2026-01-20
CVE-2026-0899 [HIGH] CWE-125 CVE-2026-0899: Out of bounds memory access in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker
Out of bounds memory access in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-113220P3HIGHCVSS 8.8fixed in 156.0.8078.47≥ 156.0.8078.47, < 156.0.8078.472026-10-20
CVE-2026-113220 [HIGH] CWE-119 CVE-2026-113220: Memory corruption in Extensions in Google Chrome on on Android prior to 156.0.8078.47 allowed a remo
Memory corruption in Extensions in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-79142P3HIGHCVSS 8.8fixed in 152.0.7977.65≥ 152.0.7977.65, < 152.0.7977.652026-08-25
CVE-2026-79142 [HIGH] CWE-122 CVE-2026-79142: Buffer overflow in ANGLE in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote atta
Buffer overflow in ANGLE in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-3542P3HIGHCVSS 8.8fixed in 145.0.7632.159fixed in 145.0.7632.160+1 more2026-03-04
CVE-2026-3542 [HIGH] CWE-284 CVE-2026-3542: Inappropriate implementation in WebAssembly in Google Chrome prior to 145.0.7632.159 allowed a remot
Inappropriate implementation in WebAssembly in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2011-0485P3CRITICALCVSS 10.0fixed in 8.0.552.2372011-01-14
CVE-2011-0485 [CRITICAL] CWE-20 CVE-2011-0485: Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 do not properly handle speech data
Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 do not properly handle speech data, which allows remote attackers to execute arbitrary code via unspecified vectors that lead to a "stale pointer."
nvd
CVE-2026-17729P3HIGHCVSS 8.8fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17729 [HIGH] CWE-416 CVE-2026-17729: Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compr
Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-4457P3HIGHCVSS 8.8fixed in 146.0.7680.153≥ 146.0.7680.153, < 146.0.7680.1532026-03-20
CVE-2026-4457 [HIGH] CWE-843 CVE-2026-4457: Type Confusion in V8 in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potential
Type Confusion in V8 in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-3917P3HIGHCVSS 8.8fixed in 146.0.7680.71≥ 146.0.7680.71, < 146.0.7680.712026-03-11
CVE-2026-3917 [HIGH] CWE-416 CVE-2026-3917: Use after free in Agents in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potent
Use after free in Agents in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-19144P3HIGHCVSS 8.8fixed in 151.0.7922.109≥ 151.0.7922.109, < 151.0.7922.1092026-08-06
CVE-2026-19144 [HIGH] CWE-416 CVE-2026-19144: Use after free in HTML in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potenti
Use after free in HTML in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-17886P3HIGHCVSS 8.8fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17886 [HIGH] CWE-416 CVE-2026-17886: Use after free in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to po
Use after free in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-14415P3HIGHCVSS 8.8fixed in 150.0.7871.46≥ 150.0.7871.46, < 150.0.7871.462026-07-01
CVE-2026-14415 [HIGH] CWE-122 CVE-2026-14415: Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker
Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-3540P3HIGHCVSS 8.8fixed in 145.0.7632.159fixed in 145.0.7632.160+1 more2026-03-04
CVE-2026-3540 [HIGH] CWE-125 CVE-2026-3540: Inappropriate implementation in WebAudio in Google Chrome prior to 145.0.7632.159 allowed a remote a
Inappropriate implementation in WebAudio in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-3918P3HIGHCVSS 8.8fixed in 146.0.7680.71≥ 146.0.7680.71, < 146.0.7680.712026-03-11
CVE-2026-3918 [HIGH] CWE-416 CVE-2026-3918: Use after free in WebMCP in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potent
Use after free in WebMCP in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2025-11460P3HIGHCVSS 8.8fixed in 141.0.7390.65≥ 141.0.7390.65, < 141.0.7390.652025-11-06
CVE-2025-11460 [HIGH] CWE-416 CVE-2025-11460: Use after free in Storage in Google Chrome prior to 141.0.7390.65 allowed a remote attacker to execu
Use after free in Storage in Google Chrome prior to 141.0.7390.65 allowed a remote attacker to execute arbitrary code via a crafted video file. (Chromium security severity: High)
nvd
CVE-2021-21125P3HIGHCVSS 8.1fixed in 88.0.4324.96≥ unspecified, < 88.0.4324.962021-02-09
CVE-2021-21125 [HIGH] CWE-59 CVE-2021-21125: Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 88.0.4324.96
Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page.
nvd
CVE-2026-7339P3HIGHCVSS 8.8fixed in 147.0.7727.138≥ 147.0.7727.138, < 147.0.7727.1382026-04-28
CVE-2026-7339 [HIGH] CWE-122 CVE-2026-7339: Heap buffer overflow in WebRTC in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to
Heap buffer overflow in WebRTC in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-79226P3HIGHCVSS 8.8fixed in 152.0.7977.65≥ 152.0.7977.65, < 152.0.7977.652026-08-25
CVE-2026-79226 [HIGH] CWE-269 CVE-2026-79226: Improper privilege management in Regional Capabilities in Google Chrome prior to 152.0.7977.65 allow
Improper privilege management in Regional Capabilities in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)
nvd
CVE-2026-3921P3HIGHCVSS 8.8fixed in 146.0.7680.71≥ 146.0.7680.71, < 146.0.7680.712026-03-11
CVE-2026-3921 [HIGH] CWE-416 CVE-2026-3921: Use after free in TextEncoding in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to
Use after free in TextEncoding in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd