Google Chrome vulnerabilities
7,336 known vulnerabilities affecting google/chrome.
Total CVEs
7,336
CISA KEV
77
actively exploited
Public exploits
92
Exploited in wild
89
Severity breakdown
CRITICAL691HIGH3450MEDIUM2986LOW155UNKNOWN54
Vulnerabilities
Page 9 of 367
CVE-2025-12428P2HIGHCVSS 8.8fixed in 142.0.7444.59≥ 142.0.7444.59, < 142.0.7444.592025-11-10
CVE-2025-12428 [HIGH] CWE-843 CVE-2025-12428: Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform ar
Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2018-6129P3MEDIUMCVSS 6.5PoCfixed in 67.0.3396.62≥ unspecified, < 67.0.3396.622019-06-27
CVE-2018-6129 [MEDIUM] CWE-125 CVE-2018-6129: Out of bounds array access in WebRTC in Google Chrome prior to 67.0.3396.62 allowed a remote attacke
Out of bounds array access in WebRTC in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.
nvd
CVE-2023-3215P3HIGHCVSS 8.8fixed in 114.0.5735.133≥ 114.0.5735.133, < 114.0.5735.1332023-06-13
CVE-2023-3215 [HIGH] CWE-416 CVE-2023-3215: Use after free in WebRTC in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to poten
Use after free in WebRTC in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2023-3217P3HIGHCVSS 8.8fixed in 114.0.5735.133≥ 114.0.5735.133, < 114.0.5735.1332023-06-13
CVE-2023-3217 [HIGH] CWE-416 CVE-2023-3217: Use after free in WebXR in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potent
Use after free in WebXR in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-2314P3HIGHCVSS 8.8fixed in 145.0.7632.45≥ 145.0.7632.45, < 145.0.7632.452026-02-11
CVE-2026-2314 [HIGH] CWE-122 CVE-2026-2314: Heap buffer overflow in Codecs in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to
Heap buffer overflow in Codecs in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-2313P3HIGHCVSS 8.8fixed in 145.0.7632.45≥ 145.0.7632.45, < 145.0.7632.452026-02-11
CVE-2026-2313 [HIGH] CWE-416 CVE-2026-2313: Use after free in CSS in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potential
Use after free in CSS in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2017-5124P3MEDIUMCVSS 6.1PoCfixed in 62.0.3202.622018-02-07
CVE-2017-5124 [MEDIUM] CWE-79 CVE-2017-5124: Incorrect application of sandboxing in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote
Incorrect application of sandboxing in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted MHTML page.
nvd
CVE-2026-87544P3CRITICALCVSS 9.8fixed in 153.0.8010.36≥ 153.0.8010.36, < 153.0.8010.362026-09-09
CVE-2026-87544 [CRITICAL] CWE-863 CVE-2026-87544: Incorrect authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attac
Incorrect authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-87512P3CRITICALCVSS 9.6fixed in 153.0.8010.36≥ 153.0.8010.36, < 153.0.8010.362026-09-09
CVE-2026-87512 [CRITICAL] CWE-416 CVE-2026-87512: Use after free in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attac
Use after free in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2023-4068P3HIGHCVSS 8.1fixed in 115.0.5790.170≥ 115.0.5790.170, < 115.0.5790.1702023-08-03
CVE-2023-4068 [HIGH] CWE-843 CVE-2023-4068: Type Confusion in V8 in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to perform a
Type Confusion in V8 in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2024-6779P3CRITICALCVSS 9.6fixed in 126.0.6478.182≥ 126.0.6478.182, < 126.0.6478.1822024-07-16
CVE-2024-6779 [CRITICAL] CWE-787 CVE-2024-6779: Out of bounds memory access in V8 in Google Chrome prior to 126.0.6478.182 allowed a remote attacker
Out of bounds memory access in V8 in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2025-0291P3HIGHCVSS 8.8fixed in 131.0.6778.264≥ 131.0.6778.264, < 131.0.6778.2642025-01-08
CVE-2025-0291 [HIGH] CWE-843 CVE-2025-0291: Type Confusion in V8 in Google Chrome prior to 131.0.6778.264 allowed a remote attacker to execute a
Type Confusion in V8 in Google Chrome prior to 131.0.6778.264 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2018-6130P3MEDIUMCVSS 6.5PoCfixed in 67.0.3396.62≥ unspecified, < 67.0.3396.622019-06-27
CVE-2018-6130 [MEDIUM] CWE-125 CVE-2018-6130: Incorrect handling of object lifetimes in WebRTC in Google Chrome prior to 67.0.3396.62 allowed a re
Incorrect handling of object lifetimes in WebRTC in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.
nvd
CVE-2024-2173P3HIGHCVSS 8.8fixed in 122.0.6261.111≥ 122.0.6261.111, < 122.0.6261.1112024-03-06
CVE-2024-2173 [HIGH] CWE-787 CVE-2024-2173: Out of bounds memory access in V8 in Google Chrome prior to 122.0.6261.111 allowed a remote attacker
Out of bounds memory access in V8 in Google Chrome prior to 122.0.6261.111 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2026-87613P3CRITICALCVSS 9.0fixed in 153.0.8010.36≥ 153.0.8010.36, < 153.0.8010.362026-09-09
CVE-2026-87613 [CRITICAL] CWE-706 CVE-2026-87613: Incorrect reference resolution in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remot
Incorrect reference resolution in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)
nvd
CVE-2026-84324P2CRITICALCVSS 9.0fixed in 152.0.7977.75≥ 152.0.7977.75, < 152.0.7977.752026-09-02
CVE-2026-84324 [CRITICAL] CWE-416 CVE-2026-84324: Use after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute
Use after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)
nvd
CVE-2022-4906P3HIGHCVSS 8.8fixed in 108.0.5359.71≥ 108.0.5359.71, < 108.0.5359.712023-07-29
CVE-2022-4906 [HIGH] CVE-2022-4906: Inappropriate implementation in Blink in Google Chrome prior to 108.0.5359.71 allowed a remote attac
Inappropriate implementation in Blink in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2024-3156P3HIGHCVSS 8.8fixed in 123.0.6312.105≥ 123.0.6312.105, < 123.0.6312.1052024-04-06
CVE-2024-3156 [HIGH] CWE-125 CVE-2024-3156: Inappropriate implementation in V8 in Google Chrome prior to 123.0.6312.105 allowed a remote attacke
Inappropriate implementation in V8 in Google Chrome prior to 123.0.6312.105 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2024-2174P3HIGHCVSS 8.8fixed in 122.0.6261.111≥ 122.0.6261.111, < 122.0.6261.1112024-03-06
CVE-2024-2174 [HIGH] CWE-787 CVE-2024-2174: Inappropriate implementation in V8 in Google Chrome prior to 122.0.6261.111 allowed a remote attacke
Inappropriate implementation in V8 in Google Chrome prior to 122.0.6261.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2025-6191P3HIGHCVSS 8.8fixed in 137.0.7151.119≥ 137.0.7151.119, < 137.0.7151.1192025-06-18
CVE-2025-6191 [HIGH] CWE-472 CVE-2025-6191: Integer overflow in V8 in Google Chrome prior to 137.0.7151.119 allowed a remote attacker to potenti
Integer overflow in V8 in Google Chrome prior to 137.0.7151.119 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
nvd