Google Chrome vulnerabilities

CVE-2012-1846 [CRITICAL] CWE-668 CVE-2012-1846: Google Chrome 17.0.963.66 and earlier allows remote attackers to bypass the sandbox protection mecha Google Chrome 17.0.963.66 and earlier allows remote attackers to bypass the sandbox protection mechanism by leveraging access to a sandboxed process, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012. NOTE: the primary affected product may be clarified later; it was not identified by the researcher, who reportedly stated "it r

CVE-2024-4331 [HIGH] CWE-416 CVE-2024-4331: Use after free in Picture In Picture in Google Chrome prior to 124.0.6367.118 allowed a remote attac Use after free in Picture In Picture in Google Chrome prior to 124.0.6367.118 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2024-3834 [HIGH] CWE-416 CVE-2024-3834: Use after free in Downloads in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to pot Use after free in Downloads in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2026-13872 [CRITICAL] CWE-20 CVE-2026-13872: Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 15 Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to potentially perform a sandbox escape via a malicious file. (Chromium security severity: Medium)

CVE-2014-3177 [CRITICAL] CVE-2014-3177: Google Chrome before 37.0.2062.94 does not properly handle the interaction of extensions, IPC, the s Google Chrome before 37.0.2062.94 does not properly handle the interaction of extensions, IPC, the sync API, and Google V8, which allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-3176.

CVE-2025-7657 [HIGH] CWE-416 CVE-2025-7657: Use after free in WebRTC in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to poten Use after free in WebRTC in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2024-9965 [HIGH] CVE-2024-9965: Insufficient data validation in DevTools in Google Chrome on Windows prior to 130.0.6723.58 allowed Insufficient data validation in DevTools in Google Chrome on Windows prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low)

CVE-2024-12693 [HIGH] CWE-787 CVE-2024-12693: Out of bounds memory access in V8 in Google Chrome prior to 131.0.6778.204 allowed a remote attacker Out of bounds memory access in V8 in Google Chrome prior to 131.0.6778.204 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2025-11756 [HIGH] CWE-416 CVE-2025-11756: Use after free in Safe Browsing in Google Chrome prior to 141.0.7390.107 allowed a remote attacker w Use after free in Safe Browsing in Google Chrome prior to 141.0.7390.107 allowed a remote attacker who had compromised the renderer process to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

CVE-2026-79045 [HIGH] CWE-843 CVE-2026-79045: Type confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging so Type confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-3537 [HIGH] CWE-787 CVE-2026-3537: Object lifecycle issue in PowerVR in Google Chrome on Android prior to 145.0.7632.159 allowed a remo Object lifecycle issue in PowerVR in Google Chrome on Android prior to 145.0.7632.159 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

CVE-2025-12429 [HIGH] CVE-2025-12429: Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)

CVE-2026-113030 [HIGH] CWE-284 CVE-2026-113030: Improper access control in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to p Improper access control in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-7354 [HIGH] CWE-125 CVE-2026-7354: Out of bounds read and write in Angle in Google Chrome prior to 147.0.7727.138 allowed a remote atta Out of bounds read and write in Angle in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-5859 [HIGH] CWE-472 CVE-2026-5859: Integer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to poten Integer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-17784 [HIGH] CWE-416 CVE-2026-17784: Use after free in Audio in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who Use after free in Audio in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-16807 [HIGH] CWE-787 CVE-2026-16807: Out of bounds write in Codecs in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to Out of bounds write in Codecs in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-13938 [HIGH] CWE-472 CVE-2026-13938: Integer overflow in Fonts in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perfo Integer overflow in Fonts in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-13918 [HIGH] CWE-416 CVE-2026-13918: Use after free in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote att Use after free in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-14041 [HIGH] CWE-602 CVE-2026-14041: Insufficient policy enforcement in Serial in Google Chrome prior to 150.0.7871.47 allowed a remote a Insufficient policy enforcement in Serial in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low)