Google Chrome vulnerabilities

CVE-2026-11124 [HIGH] CWE-122 CVE-2026-11124: Integer overflow in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potent Integer overflow in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11248 [HIGH] CWE-693 CVE-2026-11248: Inappropriate implementation in Google Lens in Google Chrome prior to 149.0.7827.53 allowed a remote Inappropriate implementation in Google Lens in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-11080 [HIGH] CWE-416 CVE-2026-11080: Use after free in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attack Use after free in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11188 [HIGH] CWE-416 CVE-2026-11188: Use after free in USB in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker t Use after free in USB in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-11295 [HIGH] CWE-269 CVE-2026-11295: Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-5908 [HIGH] CWE-472 CVE-2026-5908: Integer overflow in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to poten Integer overflow in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. (Chromium security severity: Low)

CVE-2026-5910 [HIGH] CWE-472 CVE-2026-5910: Integer overflow in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to poten Integer overflow in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. (Chromium security severity: Low)

CVE-2026-5909 [HIGH] CWE-472 CVE-2026-5909: Integer overflow in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to poten Integer overflow in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. (Chromium security severity: Low)

CVE-2026-12035 [HIGH] CWE-416 CVE-2026-12035: Use after free in Views in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacke Use after free in Views in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2026-5914 [HIGH] CWE-843 CVE-2026-5914: Type Confusion in CSS in Google Chrome prior to 147.0.7727.55 allowed an attacker who convinced a us Type Confusion in CSS in Google Chrome prior to 147.0.7727.55 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Low)

CVE-2026-12018 [HIGH] CWE-269 CVE-2026-12018: Inappropriate implementation in Mojo in Google Chrome on Windows prior to 149.0.7827.115 allowed a l Inappropriate implementation in Mojo in Google Chrome on Windows prior to 149.0.7827.115 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: High)

CVE-2011-1807 [CRITICAL] CWE-787 CVE-2011-1807: Google Chrome before 11.0.696.71 does not properly handle blobs, which allows remote attackers to ex Google Chrome before 11.0.696.71 does not properly handle blobs, which allows remote attackers to execute arbitrary code via unspecified vectors that trigger an out-of-bounds write.

CVE-2026-17653 [HIGH] CWE-416 CVE-2026-17653: Use after free in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had com Use after free in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-79256 [HIGH] CWE-610 CVE-2026-79256: Externally controlled reference in WebView in Google Chrome on on Android prior to 152.0.7977.65 all Externally controlled reference in WebView in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87481 [HIGH] CWE-863 CVE-2026-87481: Incorrect authorization in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a r Incorrect authorization in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-106247 [HIGH] CWE-122 CVE-2026-106247: Buffer overflow in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had c Buffer overflow in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-106292 [HIGH] CWE-122 CVE-2026-106292: Buffer overflow in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had c Buffer overflow in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-95274 [HIGH] CWE-116 CVE-2026-95274: Improper output encoding in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attack Improper output encoding in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-106412 [HIGH] CWE-367 CVE-2026-106412: Race condition in Core in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker w Race condition in Core in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-106426 [HIGH] CWE-362 CVE-2026-106426: Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potenti Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)