Google Chrome vulnerabilities

3,975 known vulnerabilities affecting google/chrome.

Total CVEs

3,975

CISA KEV

actively exploited

Public exploits

Exploited in wild

Severity breakdown

CRITICAL297HIGH2024MEDIUM1626LOW17UNKNOWN11

Vulnerabilities

Page 96 of 199

CVE-2020-6417HIGHCVSS 7.8fixed in 80.0.3987.87≥ unspecified, < 80.0.3987.872020-02-11

CVE-2020-6417 [HIGH] CVE-2020-6417: Inappropriate implementation in installer in Google Chrome prior to 80.0.3987.87 allowed a local att Inappropriate implementation in installer in Google Chrome prior to 80.0.3987.87 allowed a local attacker to execute arbitrary code via a crafted registry entry.

nvd

CVE-2020-6398HIGHCVSS 8.8fixed in 80.0.3987.87≥ unspecified, < 80.0.3987.872020-02-11

CVE-2020-6398 [HIGH] CWE-908 CVE-2020-6398: Use of uninitialized data in PDFium in Google Chrome prior to 80.0.3987.87 allowed a remote attacker Use of uninitialized data in PDFium in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.

nvd

CVE-2020-6387HIGHCVSS 8.8fixed in 80.0.3987.87≥ unspecified, < 80.0.3987.872020-02-11

CVE-2020-6387 [HIGH] CWE-787 CVE-2020-6387: Out of bounds write in WebRTC in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to po Out of bounds write in WebRTC in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted video stream.

nvd

CVE-2020-6389HIGHCVSS 8.8fixed in 80.0.3987.87≥ unspecified, < 80.0.3987.872020-02-11

CVE-2020-6389 [HIGH] CWE-787 CVE-2020-6389: Out of bounds write in WebRTC in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to po Out of bounds write in WebRTC in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted video stream.

nvd

CVE-2020-6416HIGHCVSS 8.8fixed in 80.0.3987.87≥ unspecified, < 80.0.3987.872020-02-11

CVE-2020-6416 [HIGH] CWE-20 CVE-2020-6416: Insufficient data validation in streams in Google Chrome prior to 80.0.3987.87 allowed a remote atta Insufficient data validation in streams in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

nvd

CVE-2020-6413HIGHCVSS 8.8fixed in 80.0.3987.87≥ unspecified, < 80.0.3987.872020-02-11

CVE-2020-6413 [HIGH] CVE-2020-6413: Inappropriate implementation in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attack Inappropriate implementation in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass HTML validators via a crafted HTML page.

nvd

CVE-2020-6379HIGHCVSS 8.8fixed in 79.0.3945.130≥ unspecified, < 79.0.3945.1302020-02-11

CVE-2020-6379 [HIGH] CWE-416 CVE-2020-6379: Use after free in V8 in Google Chrome prior to 79.0.3945.130 allowed a remote attacker to potentiall Use after free in V8 in Google Chrome prior to 79.0.3945.130 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

nvd

CVE-2020-6378HIGHCVSS 8.8fixed in 79.0.3945.130≥ unspecified, < 79.0.3945.1302020-02-11

CVE-2020-6378 [HIGH] CWE-416 CVE-2020-6378: Use after free in speech in Google Chrome prior to 79.0.3945.130 allowed a remote attacker to potent Use after free in speech in Google Chrome prior to 79.0.3945.130 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

nvd

CVE-2020-6385HIGHCVSS 8.8fixed in 80.0.3987.87≥ unspecified, < 80.0.3987.872020-02-11

CVE-2020-6385 [HIGH] CWE-754 CVE-2020-6385: Insufficient policy enforcement in storage in Google Chrome prior to 80.0.3987.87 allowed a remote a Insufficient policy enforcement in storage in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass site isolation via a crafted HTML page.

nvd

CVE-2020-6415HIGHCVSS 8.8fixed in 80.0.3987.87≥ unspecified, < 80.0.3987.872020-02-11

CVE-2020-6415 [HIGH] CWE-787 CVE-2020-6415: Inappropriate implementation in JavaScript in Google Chrome prior to 80.0.3987.87 allowed a remote a Inappropriate implementation in JavaScript in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

nvd

CVE-2020-6414HIGHCVSS 8.8fixed in 80.0.3987.87≥ unspecified, < 80.0.3987.872020-02-11

CVE-2020-6414 [HIGH] CVE-2020-6414: Insufficient policy enforcement in Safe Browsing in Google Chrome prior to 80.0.3987.87 allowed a re Insufficient policy enforcement in Safe Browsing in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.

nvd

CVE-2020-6410HIGHCVSS 8.8fixed in 80.0.3987.87≥ unspecified, < 80.0.3987.872020-02-11

CVE-2020-6410 [HIGH] CVE-2020-6410: Insufficient policy enforcement in navigation in Google Chrome prior to 80.0.3987.87 allowed a remot Insufficient policy enforcement in navigation in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to confuse the user via a crafted domain name.

nvd

CVE-2020-6388HIGHCVSS 8.8fixed in 80.0.3987.87≥ unspecified, < 80.0.3987.872020-02-11

CVE-2020-6388 [HIGH] CWE-362 CVE-2020-6388: Out of bounds access in WebAudio in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to Out of bounds access in WebAudio in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

nvd

CVE-2020-6406HIGHCVSS 8.8fixed in 80.0.3987.87≥ unspecified, < 80.0.3987.872020-02-11

CVE-2020-6406 [HIGH] CWE-416 CVE-2020-6406: Use after free in audio in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentia Use after free in audio in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

nvd

CVE-2020-6409HIGHCVSS 8.8fixed in 80.0.3987.87≥ unspecified, < 80.0.3987.872020-02-11

CVE-2020-6409 [HIGH] CVE-2020-6409: Inappropriate implementation in Omnibox in Google Chrome prior to 80.0.3987.87 allowed a remote atta Inappropriate implementation in Omnibox in Google Chrome prior to 80.0.3987.87 allowed a remote attacker who convinced the user to enter a URI to bypass navigation restrictions via a crafted domain name.

nvd

CVE-2020-6390HIGHCVSS 8.8fixed in 80.0.3987.87≥ unspecified, < 80.0.3987.872020-02-11

CVE-2020-6390 [HIGH] CWE-787 CVE-2020-6390: Out of bounds memory access in streams in Google Chrome prior to 80.0.3987.87 allowed a remote attac Out of bounds memory access in streams in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

nvd

CVE-2020-6382HIGHCVSS 8.8fixed in 80.0.3987.87≥ unspecified, < 80.0.3987.872020-02-11

CVE-2020-6382 [HIGH] CWE-843 CVE-2020-6382: Type confusion in JavaScript in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to pot Type confusion in JavaScript in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

nvd

CVE-2020-6395MEDIUMCVSS 6.5fixed in 80.0.3987.87≥ unspecified, < 80.0.3987.872020-02-11

CVE-2020-6395 [MEDIUM] CWE-125 CVE-2020-6395: Out of bounds read in JavaScript in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to Out of bounds read in JavaScript in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

nvd

CVE-2020-6403MEDIUMCVSS 4.3fixed in 80.0.3987.87≥ unspecified, < 80.0.3987.872020-02-11

CVE-2020-6403 [MEDIUM] CVE-2020-6403: Incorrect implementation in Omnibox in Google Chrome on iOS prior to 80.0.3987.87 allowed a remote a Incorrect implementation in Omnibox in Google Chrome on iOS prior to 80.0.3987.87 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.

nvd

CVE-2020-6393MEDIUMCVSS 6.5fixed in 80.0.3987.87≥ unspecified, < 80.0.3987.872020-02-11

CVE-2020-6393 [MEDIUM] CWE-862 CVE-2020-6393: Insufficient policy enforcement in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote att Insufficient policy enforcement in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

nvd

← Previous96 / 199Next →