Google Chrome vulnerabilities

CVE-2026-11629 [HIGH] CWE-416 CVE-2026-11629: Use after free in Ozone in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potent Use after free in Ozone in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

CVE-2025-8880 [HIGH] CWE-362 CVE-2025-8880: Race in V8 in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to execute arbitrary c Race in V8 in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-4445 [HIGH] CWE-416 CVE-2026-4445: Use after free in WebRTC in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to poten Use after free in WebRTC in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2026-4456 [HIGH] CWE-416 CVE-2026-4456: Use after free in Digital Credentials API in Google Chrome prior to 146.0.7680.153 allowed a remote Use after free in Digital Credentials API in Google Chrome prior to 146.0.7680.153 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-4449 [HIGH] CWE-416 CVE-2026-4449: Use after free in Blink in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potent Use after free in Blink in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2026-4455 [HIGH] CWE-122 CVE-2026-4455: Heap buffer overflow in PDFium in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to Heap buffer overflow in PDFium in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High)

CVE-2026-11664 [HIGH] CWE-416 CVE-2026-11664: Use after free in Payments in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to pot Use after free in Payments in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2026-9961 [HIGH] CWE-416 CVE-2026-9961: Use after free in SurfaceCapture in Google Chrome prior to 148.0.7778.216 allowed a remote attacker Use after free in SurfaceCapture in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2026-11272 [HIGH] CWE-20 CVE-2026-11272: Insufficient validation of untrusted input in Reading List in Google Chrome on iOS prior to 149.0.78 Insufficient validation of untrusted input in Reading List in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-11041 [HIGH] CWE-20 CVE-2026-11041: Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 149.0.7827. Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11304 [HIGH] CWE-416 CVE-2026-11304: Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potent Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: Low)

CVE-2026-10002 [HIGH] CWE-416 CVE-2026-10002: Use after free in PDFium in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to poten Use after free in PDFium in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High)

CVE-2026-17735 [HIGH] CWE-20 CVE-2026-17735: Insufficient validation of untrusted input in BFCache in Google Chrome prior to 151.0.7922.72 allowe Insufficient validation of untrusted input in BFCache in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

CVE-2013-2931 [CRITICAL] CVE-2013-2931: Multiple unspecified vulnerabilities in Google Chrome before 31.0.1650.48 allow attackers to execute Multiple unspecified vulnerabilities in Google Chrome before 31.0.1650.48 allow attackers to execute arbitrary code or possibly have other impact via unknown vectors.

CVE-2026-87618 [HIGH] CWE-706 CVE-2026-87618: Incorrect reference resolution in Storage in Google Chrome on on Windows prior to 153.0.8010.36 allo Incorrect reference resolution in Storage in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-87616 [HIGH] CWE-665 CVE-2026-87616: Improper initialization in Views in Google Chrome on on Windows prior to 153.0.8010.36 allowed a rem Improper initialization in Views in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-79175 [HIGH] CWE-843 CVE-2026-79175: Type confusion in Accessibility in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remo Type confusion in Accessibility in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-79121 [HIGH] CWE-20 CVE-2026-79121: Improper input validation in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote att Improper input validation in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-87524 [HIGH] CWE-416 CVE-2026-87524: Use after free in Core in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attack Use after free in Core in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-87639 [HIGH] CWE-416 CVE-2026-87639: Use after free in WebPackaging in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who Use after free in WebPackaging in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)