Google Chrome vulnerabilities
7,357 known vulnerabilities affecting google/chrome.
Total CVEs
7,357
CISA KEV
77
actively exploited
Public exploits
92
Exploited in wild
89
Severity breakdown
CRITICAL706HIGH3500MEDIUM2993LOW155UNKNOWN3
Vulnerabilities
Page 81 of 368
CVE-2026-14024P3HIGHCVSS 8.8fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-14024 [HIGH] CWE-416 CVE-2026-14024: Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker w
Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-14025P3HIGHCVSS 8.8fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-14025 [HIGH] CWE-416 CVE-2026-14025: Use after free in Views in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who
Use after free in Views in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-13928P3HIGHCVSS 8.8fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-13928 [HIGH] CWE-20 CVE-2026-13928: Insufficient validation of untrusted input in Enterprise in Google Chrome prior to 150.0.7871.47 all
Insufficient validation of untrusted input in Enterprise in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-14005P3HIGHCVSS 8.8fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-14005 [HIGH] CWE-416 CVE-2026-14005: Use after free in Omnibox in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attack
Use after free in Omnibox in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-14078P3HIGHCVSS 8.8fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-14078 [HIGH] CWE-20 CVE-2026-14078: Insufficient validation of untrusted input in WebRTC in Google Chrome prior to 150.0.7871.47 allowed
Insufficient validation of untrusted input in WebRTC in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-13835P3HIGHCVSS 8.8fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-13835 [HIGH] CWE-122 CVE-2026-13835: Inappropriate implementation in XML in Google Chrome prior to 150.0.7871.47 allowed a remote attacke
Inappropriate implementation in XML in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-13817P3HIGHCVSS 8.8fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-13817 [HIGH] CWE-20 CVE-2026-13817: Insufficient validation of untrusted input in Glic in Google Chrome prior to 150.0.7871.47 allowed a
Insufficient validation of untrusted input in Glic in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-10907P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-10907 [HIGH] CWE-787 CVE-2026-10907: Out of bounds write in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to po
Out of bounds write in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-87569P3HIGHCVSS 8.8fixed in 153.0.8010.36≥ 153.0.8010.36, < 153.0.8010.362026-09-09
CVE-2026-87569 [HIGH] CWE-862 CVE-2026-87569: Missing authorization in Views in Google Chrome prior to 153.0.8010.36 allowed a remote attacker lev
Missing authorization in Views in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-13825P3HIGHCVSS 8.8fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-13825 [HIGH] CWE-457 CVE-2026-13825: Uninitialized Use in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to poten
Uninitialized Use in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-4461P3HIGHCVSS 8.8fixed in 146.0.7680.153≥ 146.0.7680.153, < 146.0.7680.1532026-03-20
CVE-2026-4461 [HIGH] CVE-2026-4461: Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.153 allowed a remote attacke
Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-12439P3HIGHCVSS 8.8fixed in 149.0.7827.155≥ 149.0.7827.155, < 149.0.7827.1552026-06-17
CVE-2026-12439 [HIGH] CWE-416 CVE-2026-12439: Use after free in Digital Credentials in Google Chrome prior to 149.0.7827.155 allowed a remote atta
Use after free in Digital Credentials in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
cvelistv5nvd
CVE-2026-4441P3HIGHCVSS 8.8fixed in 146.0.7680.153≥ 146.0.7680.153, < 146.0.7680.1532026-03-20
CVE-2026-4441 [HIGH] CWE-416 CVE-2026-4441: Use after free in Base in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potenti
Use after free in Base in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2026-14385P3HIGHCVSS 8.8fixed in 150.0.7871.46≥ 150.0.7871.46, < 150.0.7871.462026-07-01
CVE-2026-14385 [HIGH] CWE-122 CVE-2026-14385: Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 150.0.7871.46 allowed a remote attack
Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 150.0.7871.46 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-3543P3HIGHCVSS 8.8fixed in 145.0.7632.159fixed in 145.0.7632.160+1 more2026-03-04
CVE-2026-3543 [HIGH] CWE-284 CVE-2026-3543: Inappropriate implementation in V8 in Google Chrome prior to 145.0.7632.159 allowed a remote attacke
Inappropriate implementation in V8 in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-7361P3HIGHCVSS 8.8fixed in 147.0.7727.138≥ 147.0.7727.138, < 147.0.7727.1382026-04-28
CVE-2026-7361 [HIGH] CWE-416 CVE-2026-7361: Use after free in iOS in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to potentia
Use after free in iOS in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2026-10989P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-10989 [HIGH] CWE-122 CVE-2026-10989: Inappropriate implementation in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker
Inappropriate implementation in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-10891P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-10891 [HIGH] CWE-416 CVE-2026-10891: Use after free in GFX in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to
Use after free in GFX in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2026-10988P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-10988 [HIGH] CWE-416 CVE-2026-10988: Use after free in Views in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had co
Use after free in Views in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-113128P3HIGHCVSS 8.8fixed in 156.0.8078.47≥ 156.0.8078.47, < 156.0.8078.472026-10-20
CVE-2026-113128 [HIGH] CWE-862 CVE-2026-113128: Missing authorization in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker
Missing authorization in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
nvd