Google Chrome vulnerabilities
7,357 known vulnerabilities affecting google/chrome.
Total CVEs
7,357
CISA KEV
77
actively exploited
Public exploits
92
Exploited in wild
89
Severity breakdown
CRITICAL706HIGH3500MEDIUM2993LOW155UNKNOWN3
Vulnerabilities
Page 82 of 368
CVE-2026-15114P3HIGHCVSS 8.8fixed in 150.0.7871.115≥ 150.0.7871.115, < 150.0.7871.1152026-07-08
CVE-2026-15114 [HIGH] CWE-125 CVE-2026-15114: Out of bounds read and write in Codecs in Google Chrome prior to 150.0.7871.115 allowed a remote att
Out of bounds read and write in Codecs in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. (Chromium security severity: High)
nvd
CVE-2026-13783P3HIGHCVSS 8.8fixed in 150.0.7871.46≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-13783 [HIGH] CWE-416 CVE-2026-13783: Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convin
Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2026-13784P3HIGHCVSS 8.8fixed in 150.0.7871.46≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-13784 [HIGH] CWE-416 CVE-2026-13784: Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convin
Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2026-13777P3HIGHCVSS 8.8fixed in 150.0.7871.46≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-13777 [HIGH] CWE-20 CVE-2026-13777: Insufficient validation of untrusted input in iOSWeb in Google Chrome on iOS prior to 150.0.7871.47
Insufficient validation of untrusted input in iOSWeb in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2026-14099P3HIGHCVSS 8.8fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-14099 [HIGH] CWE-416 CVE-2026-14099: Use after free in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote att
Use after free in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-14084P3HIGHCVSS 8.8fixed in 150.0.7871.47≥ 150.0.7871.47, < 150.0.7871.472026-06-30
CVE-2026-14084 [HIGH] CWE-20 CVE-2026-14084: Insufficient validation of untrusted input in Chromoting in Google Chrome prior to 150.0.7871.47 all
Insufficient validation of untrusted input in Chromoting in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via malicious network traffic. (Chromium security severity: Low)
nvd
CVE-2026-13026P3HIGHCVSS 8.8fixed in 149.0.7827.197≥ 149.0.7827.197, < 149.0.7827.1972026-06-24
CVE-2026-13026 [HIGH] CWE-416 CVE-2026-13026: Use after free in Digital Credentials in Google Chrome on Mac prior to 149.0.7827.197 allowed a remo
Use after free in Digital Credentials in Google Chrome on Mac prior to 149.0.7827.197 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-4463P3HIGHCVSS 8.8fixed in 146.0.7680.153≥ 146.0.7680.153, < 146.0.7680.1532026-03-20
CVE-2026-4463 [HIGH] CWE-122 CVE-2026-4463: Heap buffer overflow in WebRTC in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to
Heap buffer overflow in WebRTC in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-10952P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-10952 [HIGH] CWE-416 CVE-2026-10952: Use after free in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote att
Use after free in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-10951P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-10951 [HIGH] CWE-416 CVE-2026-10951: Use after free in Autofill in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker
Use after free in Autofill in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-87570P3HIGHCVSS 8.8fixed in 153.0.8010.36≥ 153.0.8010.36, < 153.0.8010.362026-09-09
CVE-2026-87570 [HIGH] CWE-863 CVE-2026-87570: Incorrect authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remote at
Incorrect authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted file. (Chromium security severity: Medium)
nvd
CVE-2026-3920P3HIGHCVSS 8.8fixed in 146.0.7680.71≥ 146.0.7680.71, < 146.0.7680.712026-03-11
CVE-2026-3920 [HIGH] CWE-125 CVE-2026-3920: Out of bounds memory access in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attack
Out of bounds memory access in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-10932P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-10932 [HIGH] CWE-416 CVE-2026-10932: Use after free in UI in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to
Use after free in UI in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-4448P3HIGHCVSS 8.8fixed in 146.0.7680.153≥ 146.0.7680.153, < 146.0.7680.1532026-03-20
CVE-2026-4448 [HIGH] CWE-122 CVE-2026-4448: Heap buffer overflow in ANGLE in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to
Heap buffer overflow in ANGLE in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-4450P3HIGHCVSS 8.8fixed in 146.0.7680.153≥ 146.0.7680.153, < 146.0.7680.1532026-03-20
CVE-2026-4450 [HIGH] CWE-787 CVE-2026-4450: Out of bounds write in V8 in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to pote
Out of bounds write in V8 in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-11191P3HIGHCVSS 8.8fixed in 149.0.7827.53≥ 149.0.7827.53, < 149.0.7827.532026-06-04
CVE-2026-11191 [HIGH] CWE-125 CVE-2026-11191: Out of bounds memory access in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attack
Out of bounds memory access in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-6358P3HIGHCVSS 8.8fixed in 147.0.7727.101≥ 147.0.7727.101, < 147.0.7727.1012026-04-15
CVE-2026-6358 [HIGH] CWE-416 CVE-2026-6358: Use after free in XR in Google Chrome on Android prior to 147.0.7727.101 allowed a remote attacker t
Use after free in XR in Google Chrome on Android prior to 147.0.7727.101 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2026-4442P3HIGHCVSS 8.8fixed in 146.0.7680.153≥ 146.0.7680.153, < 146.0.7680.1532026-03-20
CVE-2026-4442 [HIGH] CWE-122 CVE-2026-4442: Heap buffer overflow in CSS in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to po
Heap buffer overflow in CSS in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-113057P3HIGHCVSS 8.8fixed in 156.0.8078.47≥ 156.0.8078.47, < 156.0.8078.472026-10-20
CVE-2026-113057 [HIGH] CWE-284 CVE-2026-113057: Improper access control in ComputePressure in Google Chrome prior to 156.0.8078.47 allowed a remote
Improper access control in ComputePressure in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2026-9940P3HIGHCVSS 8.8fixed in 148.0.7778.216≥ 148.0.7778.216, < 148.0.7778.2162026-05-28
CVE-2026-9940 [HIGH] CWE-122 CVE-2026-9940: Heap buffer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to
Heap buffer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd