Google Chrome vulnerabilities
7,357 known vulnerabilities affecting google/chrome.
Total CVEs
7,357
CISA KEV
77
actively exploited
Public exploits
92
Exploited in wild
89
Severity breakdown
CRITICAL706HIGH3500MEDIUM2993LOW155UNKNOWN3
Vulnerabilities
Page 97 of 368
CVE-2024-8362P3HIGHCVSS 8.8fixed in 128.0.6613.119≥ 128.0.6613.119, < 128.0.6613.1192024-09-03
CVE-2024-8362 [HIGH] CWE-416 CVE-2024-8362: Use after free in WebAudio in Google Chrome prior to 128.0.6613.119 allowed a remote attacker to pot
Use after free in WebAudio in Google Chrome prior to 128.0.6613.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2024-10231P3HIGHCVSS 8.8fixed in 130.0.6723.69≥ 130.0.6723.69, < 130.0.6723.692024-10-22
CVE-2024-10231 [HIGH] CWE-843 CVE-2024-10231: Type Confusion in V8 in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to potentiall
Type Confusion in V8 in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2024-8904P3HIGHCVSS 8.8fixed in 129.0.6668.58≥ 129.0.6668.58, < 129.0.6668.582024-09-17
CVE-2024-8904 [HIGH] CWE-843 CVE-2024-8904: Type Confusion in V8 in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to potentiall
Type Confusion in V8 in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2025-3619P3HIGHCVSS 8.8fixed in 135.0.7049.95≥ 135.0.7049.95, < 135.0.7049.952025-04-16
CVE-2025-3619 [HIGH] CWE-122 CVE-2025-3619: Heap buffer overflow in Codecs in Google Chrome on Windows prior to 135.0.7049.95 allowed a remote a
Heap buffer overflow in Codecs in Google Chrome on Windows prior to 135.0.7049.95 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
nvd
CVE-2024-7974P3HIGHCVSS 8.8fixed in 128.0.6613.84≥ 128.0.6613.84, < 128.0.6613.842024-08-21
CVE-2024-7974 [HIGH] CWE-20 CVE-2024-7974: Insufficient data validation in V8 API in Google Chrome prior to 128.0.6613.84 allowed a remote atta
Insufficient data validation in V8 API in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Medium)
nvd
CVE-2026-17677P3HIGHCVSS 8.8fixed in 151.0.7922.72≥ 151.0.7922.72, < 151.0.7922.722026-07-30
CVE-2026-17677 [HIGH] CWE-693 CVE-2026-17677: Inappropriate implementation in ANGLE in Google Chrome on Android prior to 151.0.7922.72 allowed a r
Inappropriate implementation in ANGLE in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2024-9859P3HIGHCVSS 8.8fixed in 126.0.6478.126≥ 126.0.6478.126, < 126.0.6478.1262024-10-11
CVE-2024-9859 [HIGH] CWE-843 CVE-2024-9859: Type confusion in WebAssembly in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to
Type confusion in WebAssembly in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2025-6192P3HIGHCVSS 8.8fixed in 137.0.7151.119≥ 137.0.7151.119, < 137.0.7151.1192025-06-18
CVE-2025-6192 [HIGH] CWE-416 CVE-2025-6192: Use after free in Metrics in Google Chrome prior to 137.0.7151.119 allowed a remote attacker to pote
Use after free in Metrics in Google Chrome prior to 137.0.7151.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2025-0995P3HIGHCVSS 8.8fixed in 133.0.69943.98≥ 133.0.6943.98, < 133.0.6943.982025-02-15
CVE-2025-0995 [HIGH] CWE-416 CVE-2025-0995: Use after free in V8 in Google Chrome prior to 133.0.6943.98 allowed a remote attacker to potentiall
Use after free in V8 in Google Chrome prior to 133.0.6943.98 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2024-3172P3HIGHCVSS 8.8fixed in 121.0.6167.85≥ 121.0.6167.85, < 121.0.6167.852024-07-16
CVE-2024-3172 [HIGH] CWE-20 CVE-2024-3172: Insufficient data validation in DevTools in Google Chrome prior to 121.0.6167.85 allowed a remote at
Insufficient data validation in DevTools in Google Chrome prior to 121.0.6167.85 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2025-8292P3HIGHCVSS 8.8fixed in 138.0.7204.183≥ 138.0.7204.183, < 138.0.7204.1832025-07-30
CVE-2025-8292 [HIGH] CWE-416 CVE-2025-8292: Use after free in Media Stream in Google Chrome prior to 138.0.7204.183 allowed a remote attacker to
Use after free in Media Stream in Google Chrome prior to 138.0.7204.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2025-13631P3HIGHCVSS 8.8fixed in 143.0.7499.40≥ 143.0.7499.41, < 143.0.7499.412025-12-02
CVE-2025-13631 [HIGH] CVE-2025-13631: Inappropriate implementation in Google Updater in Google Chrome on Mac prior to 143.0.7499.41 allowe
Inappropriate implementation in Google Updater in Google Chrome on Mac prior to 143.0.7499.41 allowed a remote attacker to perform privilege escalation via a crafted file. (Chromium security severity: High)
nvd
CVE-2025-5958P3HIGHCVSS 8.8fixed in 137.0.7151.103≥ 137.0.7151.103, < 137.0.7151.1032025-06-11
CVE-2025-5958 [HIGH] CWE-416 CVE-2025-5958: Use after free in Media in Google Chrome prior to 137.0.7151.103 allowed a remote attacker to potent
Use after free in Media in Google Chrome prior to 137.0.7151.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2025-8010P3HIGHCVSS 8.8fixed in 138.0.7204.168≥ 138.0.7204.168, < 138.0.7204.1682025-07-22
CVE-2025-8010 [HIGH] CWE-843 CVE-2025-8010: Type Confusion in V8 in Google Chrome prior to 138.0.7204.168 allowed a remote attacker to potential
Type Confusion in V8 in Google Chrome prior to 138.0.7204.168 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2025-10501P3HIGHCVSS 8.8fixed in 140.0.7339.185≥ 140.0.7339.185, < 140.0.7339.1852025-09-24
CVE-2025-10501 [HIGH] CWE-416 CVE-2025-10501: Use after free in WebRTC in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to poten
Use after free in WebRTC in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2025-8011P3HIGHCVSS 8.8fixed in 138.0.7204.168≥ 138.0.7204.168, < 138.0.7204.1682025-07-22
CVE-2025-8011 [HIGH] CWE-843 CVE-2025-8011: Type Confusion in V8 in Google Chrome prior to 138.0.7204.168 allowed a remote attacker to potential
Type Confusion in V8 in Google Chrome prior to 138.0.7204.168 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2025-10500P3HIGHCVSS 8.8fixed in 140.0.7339.185≥ 140.0.7339.185, < 140.0.7339.1852025-09-24
CVE-2025-10500 [HIGH] CWE-416 CVE-2025-10500: Use after free in Dawn in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potenti
Use after free in Dawn in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvd
CVE-2025-13720P3HIGHCVSS 8.8fixed in 143.0.7499.40fixed in 143.0.7499.41+1 more2025-12-02
CVE-2025-13720 [HIGH] CWE-704 CVE-2025-13720: Bad cast in Loader in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had comprom
Bad cast in Loader in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
nvd
CVE-2025-13638P3HIGHCVSS 8.8fixed in 143.0.7499.40≥ 143.0.7499.41, < 143.0.7499.412025-12-02
CVE-2025-13638 [HIGH] CWE-416 CVE-2025-13638: Use after free in Media Stream in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to
Use after free in Media Stream in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)
nvd
CVE-2026-12448P3HIGHCVSS 8.8fixed in 149.0.7827.155≥ 149.0.7827.155, < 149.0.7827.1552026-06-17
CVE-2026-12448 [HIGH] CWE-269 CVE-2026-12448: Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.155 allowed
Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: High)
cvelistv5nvd