Google Chrome vulnerabilities
3,009 known CVE vulnerabilities in Google Chrome, translated and rated.
- CVE-2021-30633CriticalActively exploited
Use-after-free vulnerability in Indexed DB API in Google Chrome prior to 93.0.4577.82. A remote attacker who compromised the renderer process could potentially perform a sandbox escape via a crafted HTML page.
- CVE-2021-30632HighActively exploited
Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2021-30563HighActively exploited
Type Confusion in V8 in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2021-30554HighActively exploited
Use-after-free in WebGL in Google Chrome prior to 91.0.4472.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2021-30551HighActively exploited
Type confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2021-30533MediumActively exploited
Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions via a crafted iframe.
- CVE-2021-21224HighActively exploited
Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- CVE-2021-21220HighActively exploited
Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2021-21206HighActively exploited
Use after free in Blink in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2021-21193HighActively exploited
A use-after-free vulnerability exists in Blink in Google Chrome prior to 89.0.4389.90. A remote attacker could potentially exploit heap corruption via a crafted HTML page.
- CVE-2021-21166HighActively exploited
A data race vulnerability exists in audio in Google Chrome prior to 89.0.4389.72. A remote attacker could potentially exploit heap corruption via a crafted HTML page.
- CVE-2021-21148HighActively exploited
Google Chrome prior to 88.0.4324.150 contains a heap buffer overflow in V8. A remote attacker could potentially exploit heap corruption via a crafted HTML page.
- CVE-2020-6572HighActively exploited
Use after free in Media in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
- CVE-2020-16017CriticalActively exploited
Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
- CVE-2020-16013HighActively exploited
Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2020-16010CriticalActively exploited
Heap buffer overflow in the UI of Google Chrome on Android prior to 86.0.4240.185. A remote attacker who had compromised the renderer process could potentially perform a sandbox escape via a crafted HTML page.
- CVE-2020-16009HighActively exploited
Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2020-6418HighActively exploited
Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2019-5825MediumActively exploited
Out of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2019-13720HighActively exploited
Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could lead to arbitrary code execution.
- CVE-2019-5786MediumActively exploited
Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.
- CVE-2016-5178Critical
Multiple unspecified vulnerabilities in Google Chrome before version 53.0.2785.143 allow remote attackers to cause a denial of service or possibly have other impact via unknown vectors.
- CVE-2013-6647Critical
A use-after-free vulnerability exists in AnimationController::endAnimationUpdate in Google Chrome, potentially leading to unauthorized memory access.
- CVE-2016-5146Critical
Multiple unspecified vulnerabilities in Google Chrome before version 52.0.2743.116 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
- CVE-2016-1666Critical
Multiple unspecified vulnerabilities in Google Chrome before version 50.0.2661.94 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
- CVE-2016-1662Critical
In Google Chrome before version 50.0.2661.94, there is a vulnerability in gc_callback.cc that does not prevent fallback execution once the Garbage Collection callback has started. This allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact.
- CVE-2016-1659Critical
Multiple unspecified vulnerabilities in Google Chrome before version 50.0.2661.75 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
- CVE-2016-1642Critical
Multiple unspecified vulnerabilities in Google Chrome before version 49.0.2623.75 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
- CVE-2016-1636Critical
The PendingScript::notifyFinished function in Google Chrome before version 49.0.2623.75 relies on memory-cache information about integrity-check occurrences, allowing remote attackers to bypass the Subresource Integrity (SRI) protection mechanism by triggering two loads of the same resource.
- CVE-2016-1635Critical
In Google Chrome before version 49.0.2623.75, there is an issue with object lifetimes and re-entrancy in the OnDocumentElementCreated handling. This can lead to denial of service (use-after-free) or other unspecified impacts.
- CVE-2016-1629Critical
Google Chrome before 48.0.2564.116 allows remote attackers to bypass the Blink Same Origin Policy and a sandbox protection mechanism via unspecified vectors.
- CVE-2026-106427Medium
Confused deputy in Mobile in Google Chrome on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Low)
- CVE-2026-106426High
Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-106425Medium
Missing authorization in BrowserTag in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
- CVE-2026-106424Medium
Information leak in Audio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)
- CVE-2026-106423High
Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-106422Medium
Incorrect authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
- CVE-2026-106421High
Use after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-106420Medium
Incorrect calculation in API in Google Chrome on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Medium)
- CVE-2026-106418Medium
Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: Low)
- CVE-2026-106416Medium
Code injection in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Medium)
- CVE-2026-106415Medium
An information leak vulnerability in Google Chrome prior to 155.0.8059.39 allows a remote attacker to leak sensitive information via a crafted HTML page. Chromium severity: Medium.
- CVE-2026-106413Medium
A race condition in the Browser component in Google Chrome prior to 155.0.8059.39 allows a remote attacker who compromised the renderer process to spoof UI elements via a crafted HTML page. Chromium severity: Low.
- CVE-2026-106412High
A race condition in Core in Google Chrome on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. This is a high severity issue.
- CVE-2026-106411High
A use after free in Parser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This is a high severity issue.
- CVE-2026-106410Medium
A missing authorization vulnerability in the Permissions component in Google Chrome prior to 155.0.8059.39 allows a remote attacker who compromised the renderer process to spoof UI elements via a crafted HTML page. Chromium severity: Medium.
- CVE-2026-106409High
Incorrect reference resolution in WebAppInstalls in Google Chrome on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. This is a medium severity issue.
- CVE-2026-106408Medium
A protection mechanism failure in the Mobile component in Google Chrome on iOS prior to 155.0.8059.39 allows a remote attacker to bypass web origin policy via a crafted HTML page. Chromium severity: Medium.
- CVE-2026-106407Medium
An incorrect authorization vulnerability in the GetUserMedia component in Google Chrome prior to 155.0.8059.39 allows a remote attacker who compromised the renderer process to bypass system access restrictions via a crafted HTML page. Chromium severity: Medium.
- CVE-2026-106406Medium
A missing authorization vulnerability in the Mobile component in Google Chrome on iOS prior to 155.0.8059.39 allows a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. Chromium severity: Medium.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS