Google Chrome vulnerabilities

CVE-2026-87572 [HIGH] CWE-74 CVE-2026-87572: Injection in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had comp Injection in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-79247 [HIGH] CWE-416 CVE-2026-79247: Use after free in Chromoting in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote Use after free in Chromoting in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)

CVE-2026-95276 [HIGH] CWE-20 CVE-2026-95276: Improper input validation in Themes in Google Chrome prior to 154.0.8037.57 allowed a remote attacke Improper input validation in Themes in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code inside the sandbox via crafted network traffic. (Chromium security severity: Medium)

CVE-2017-5112 [HIGH] CWE-119 CVE-2017-5112: Heap buffer overflow in WebGL in Google Chrome prior to 61.0.3163.79 for Windows allowed a remote at Heap buffer overflow in WebGL in Google Chrome prior to 61.0.3163.79 for Windows allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

CVE-2026-95341 [HIGH] CWE-20 CVE-2026-95341: Improper input validation in Desktop in Google Chrome prior to 154.0.8037.57 allowed a remote attack Improper input validation in Desktop in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)

CVE-2026-110156 [HIGH] CWE-706 CVE-2026-110156: Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 155.0.8059.79 allow Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)

CVE-2026-106409 [HIGH] CWE-706 CVE-2026-106409: Incorrect reference resolution in WebAppInstalls in Google Chrome on on Mac prior to 155.0.8059.39 a Incorrect reference resolution in WebAppInstalls in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)

CVE-2011-1301 [CRITICAL] CWE-416 CVE-2011-1301: Use-after-free vulnerability in the GPU process in Google Chrome before 10.0.648.205 allows remote a Use-after-free vulnerability in the GPU process in Google Chrome before 10.0.648.205 allows remote attackers to execute arbitrary code via unknown vectors.

CVE-2021-21215 [MEDIUM] CWE-290 CVE-2021-21215: Inappropriate implementation in Autofill in Google Chrome prior to 90.0.4430.72 allowed a remote att Inappropriate implementation in Autofill in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to spoof security UI via a crafted HTML page.

CVE-2026-9964 [HIGH] CWE-416 CVE-2026-9964: Use after free in Bluetooth in Google Chrome on Mac prior to 148.0.7778.216 allowed an attacker who Use after free in Bluetooth in Google Chrome on Mac prior to 148.0.7778.216 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: High)

CVE-2026-106271 [HIGH] CWE-862 CVE-2026-106271: Missing authorization in Workers in Google Chrome prior to 155.0.8059.39 allowed a remote attacker w Missing authorization in Workers in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. (Chromium security severity: Medium)

CVE-2020-16025 [CRITICAL] CWE-787 CVE-2020-16025: Heap buffer overflow in clipboard in Google Chrome prior to 87.0.4280.66 allowed a remote attacker w Heap buffer overflow in clipboard in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

CVE-2020-16024 [CRITICAL] CWE-787 CVE-2020-16024: Heap buffer overflow in UI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had Heap buffer overflow in UI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

CVE-2019-13734 [HIGH] CWE-787 CVE-2019-13734: Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to po Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVE-2020-6493 [CRITICAL] CWE-416 CVE-2020-6493: Use after free in WebAuthentication in Google Chrome prior to 83.0.4103.97 allowed a remote attacker Use after free in WebAuthentication in Google Chrome prior to 83.0.4103.97 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

CVE-2018-6085 [HIGH] CWE-416 CVE-2018-6085: Re-entry of a destructor in Networking Disk Cache in Google Chrome prior to 66.0.3359.117 allowed a Re-entry of a destructor in Networking Disk Cache in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted HTML page.

CVE-2018-6087 [HIGH] CWE-416 CVE-2018-6087: A use-after-free in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to A use-after-free in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

CVE-2012-5108 [CRITICAL] CWE-362 CVE-2012-5108: Race condition in Google Chrome before 22.0.1229.92 allows remote attackers to execute arbitrary cod Race condition in Google Chrome before 22.0.1229.92 allows remote attackers to execute arbitrary code via vectors related to audio devices.

CVE-2022-2852 [HIGH] CWE-416 CVE-2022-2852: Use after free in FedCM in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potent Use after free in FedCM in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVE-2024-3157 [CRITICAL] CWE-787 CVE-2024-3157: Out of bounds memory access in Compositing in Google Chrome prior to 123.0.6312.122 allowed a remote Out of bounds memory access in Compositing in Google Chrome prior to 123.0.6312.122 allowed a remote attacker who had compromised the GPU process to potentially perform a sandbox escape via specific UI gestures. (Chromium security severity: High)