Google Chrome vulnerabilities
7,357 known vulnerabilities affecting google/chrome.
Total CVEs
7,357
CISA KEV
77
actively exploited
Public exploits
92
Exploited in wild
89
Severity breakdown
CRITICAL706HIGH3500MEDIUM2993LOW155UNKNOWN3
Vulnerabilities
Page 76 of 368
CVE-2026-13027P3HIGHCVSS 8.8fixed in 149.0.7827.197≥ 149.0.7827.197, < 149.0.7827.1972026-06-24
CVE-2026-13027 [HIGH] CWE-416 CVE-2026-13027: Use after free in FileSystem in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to p
Use after free in FileSystem in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-7344P3HIGHCVSS 8.8fixed in 147.0.7727.138≥ 147.0.7727.138, < 147.0.7727.1382026-04-28
CVE-2026-7344 [HIGH] CWE-416 CVE-2026-7344: Use after free in Accessibility in Google Chrome on Windows prior to 147.0.7727.138 allowed a remote
Use after free in Accessibility in Google Chrome on Windows prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2026-4444P3HIGHCVSS 8.8fixed in 146.0.7680.153≥ 146.0.7680.153, < 146.0.7680.1532026-03-20
CVE-2026-4444 [HIGH] CWE-121 CVE-2026-4444: Stack buffer overflow in WebRTC in Google Chrome prior to 146.0.7680.153 allowed a remote attacker t
Stack buffer overflow in WebRTC in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit stack corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2025-12907P3HIGHCVSS 8.8fixed in 140.0.7339.80≥ 140.0.7339.80, < 140.0.7339.802025-11-08
CVE-2025-12907 [HIGH] CWE-20 CVE-2025-12907: Insufficient validation of untrusted input in Devtools in Google Chrome prior to 140.0.7339.80 allow
Insufficient validation of untrusted input in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to execute arbitrary code via user action in Devtools. (Chromium security severity: Low)
nvd
CVE-2026-4446P3HIGHCVSS 8.8fixed in 146.0.7680.153≥ 146.0.7680.153, < 146.0.7680.1532026-03-20
CVE-2026-4446 [HIGH] CWE-416 CVE-2026-4446: Use after free in WebRTC in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to poten
Use after free in WebRTC in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-6363P3HIGHCVSS 8.8fixed in 147.0.7727.101≥ 147.0.7727.101, < 147.0.7727.1012026-04-15
CVE-2026-6363 [HIGH] CWE-843 CVE-2026-6363: Type Confusion in V8 in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potential
Type Confusion in V8 in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-3931P3HIGHCVSS 8.8fixed in 146.0.7680.71≥ 146.0.7680.71, < 146.0.7680.712026-03-11
CVE-2026-3931 [HIGH] CWE-122 CVE-2026-3931: Heap buffer overflow in Skia in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to pe
Heap buffer overflow in Skia in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-3922P3HIGHCVSS 8.8fixed in 146.0.7680.71≥ 146.0.7680.71, < 146.0.7680.712026-03-11
CVE-2026-3922 [HIGH] CWE-416 CVE-2026-3922: Use after free in MediaStream in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to p
Use after free in MediaStream in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-3923P3HIGHCVSS 8.8fixed in 146.0.7680.71≥ 146.0.7680.71, < 146.0.7680.712026-03-11
CVE-2026-3923 [HIGH] CWE-416 CVE-2026-3923: Use after free in WebMIDI in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to poten
Use after free in WebMIDI in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-11030P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11030 [HIGH] CWE-416 CVE-2026-11030: Use after free in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to poten
Use after free in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via malicious network traffic. (Chromium security severity: Medium)
nvd
CVE-2026-9923P3HIGHCVSS 8.8fixed in 148.0.7778.216≥ 148.0.7778.216, < 148.0.7778.2162026-05-28
CVE-2026-9923 [HIGH] CWE-416 CVE-2026-9923: Use after free in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potenti
Use after free in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-6359P3HIGHCVSS 8.8fixed in 147.0.7727.101≥ 147.0.7727.101, < 147.0.7727.1012026-04-15
CVE-2026-6359 [HIGH] CWE-416 CVE-2026-6359: Use after free in Video in Google Chrome on Windows prior to 147.0.7727.101 allowed a remote attacke
Use after free in Video in Google Chrome on Windows prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-4454P3HIGHCVSS 8.8fixed in 146.0.7680.153≥ 146.0.7680.153, < 146.0.7680.1532026-03-20
CVE-2026-4454 [HIGH] CWE-416 CVE-2026-4454: Use after free in Network in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to pote
Use after free in Network in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-10015P3HIGHCVSS 8.8fixed in 148.0.7778.216fixed in 148.0.7778.215+1 more2026-05-28
CVE-2026-10015 [HIGH] CWE-472 CVE-2026-10015: Integer overflow in WTF in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execut
Integer overflow in WTF in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-8577P3HIGHCVSS 8.8fixed in 148.0.7778.168≥ 148.0.7778.168, < 148.0.7778.1682026-05-14
CVE-2026-8577 [HIGH] CWE-472 CVE-2026-8577: Integer overflow in Fonts in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to exec
Integer overflow in Fonts in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-95369P3HIGHCVSS 8.8fixed in 154.0.8037.57≥ 154.0.8037.57, < 154.0.8037.572026-09-29
CVE-2026-95369 [HIGH] CWE-841 CVE-2026-95369: Inappropriate implementation in XML in Google Chrome prior to 154.0.8037.57 allowed a remote attacke
Inappropriate implementation in XML in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-9958P3HIGHCVSS 8.8fixed in 148.0.7778.216fixed in 148.0.7778.215+1 more2026-05-28
CVE-2026-9958 [HIGH] CWE-416 CVE-2026-9958: Use after free in PDFium in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to poten
Use after free in PDFium in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High)
nvd
CVE-2026-13884P3HIGHCVSS 8.8fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-13884 [HIGH] CWE-122 CVE-2026-13884: Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a local attacker to e
Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a local attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Medium)
nvd
CVE-2026-8587P3HIGHCVSS 8.8fixed in 148.0.7778.168≥ 148.0.7778.168, < 148.0.7778.1682026-05-14
CVE-2026-8587 [HIGH] CWE-416 CVE-2026-8587: Use after free in Extensions in Google Chrome on Mac prior to 148.0.7778.168 allowed an attacker who
Use after free in Extensions in Google Chrome on Mac prior to 148.0.7778.168 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Medium)
nvd
CVE-2017-5121P3HIGHCVSS 8.8fixed in 61.0.3163.1002017-10-27
CVE-2017-5121 [HIGH] CWE-20 CVE-2017-5121: Inappropriate use of JIT optimisation in V8 in Google Chrome prior to 61.0.3163.100 for Linux, Windo
Inappropriate use of JIT optimisation in V8 in Google Chrome prior to 61.0.3163.100 for Linux, Windows, and Mac allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page, related to the escape analysis phase.
nvd