Skip to content
CVE Tracker
Google

Google Chrome vulnerabilities

6,067 published CVEs name Google Chrome among the affected products; CISA lists 70 of them as exploited in the wild.

All 6,067 in the listAtom feed of new CVEs
Published CVEs
6,067
Last 12 months
3,966
Critical
543
Known exploited
70

Critical 543High 2,911Medium 2,328Low 152Not scored 133

CVEs per yearBy the year they were published

  1. 2019225
  2. 20194
  3. 202010
  4. 20201
  5. 2023381
  6. 2024260
  7. 2024332
  8. 2024287
  9. 2024234
  10. 2025188
  11. 2025255
  12. 20263,881

Known exploitedNewest addition to KEV first

  • CVE-2026-87491

    Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML…

    Google · Chrome

    ExploitedHigh8.8
  • CVE-2026-85046

    Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.…

    Google · Chrome

    ExploitedHigh8.8
  • CVE-2026-11645

    Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted…

    Google · Chrome

    ExploitedHigh8.8
  • CVE-2026-5281

    Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code…

    Google · Chrome

    ExploitedHigh8.8
  • CVE-2026-3910

    Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted…

    Google · Chrome

    ExploitedHigh8.8
  • CVE-2026-3909

    Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.…

    Google · Chrome

    ExploitedHigh8.8
  • CVE-2026-2441

    Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.…

    Google · Chrome

    ExploitedHigh8.8
  • CVE-2025-14174

    Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a…

    Google · Chrome

    ExploitedHigh8.8
  • CVE-2025-13223

    Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.…

    Google · Chrome

    ExploitedHigh8.8
  • CVE-2025-10585

    Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.…

    Google · Chrome

    ExploitedHigh8.8

Newest CVEs

  • CVE-2026-120930

    Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page.…

    Google · Chrome

    Not scored
  • CVE-2026-120931

    Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via…

    Google · Chrome

    Critical9.6
  • CVE-2026-121141

    Improper input validation in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin…

    Google · Chrome

    Not scored
  • CVE-2026-121195

    Incorrect authorization in TrustedTypes in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page.…

    Google · Chrome

    Not scored
  • CVE-2026-121064

    Improper input validation in Performance in Google Chrome prior to 157.0.8103.38 allowed a local attacker to potentially execute arbitrary code inside the…

    Google · Chrome

    Not scored
  • CVE-2026-121169

    Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy…

    Google · Chrome

    Not scored
  • CVE-2026-121069

    Use after free in Track in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.…

    Google · Chrome

    High8.8
  • CVE-2026-121142

    Incorrect authorization in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy…

    Google · Chrome

    Not scored
  • CVE-2026-121232

    Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a local attacker leveraging social engineering to obtain sensitive information…

    Google · Chrome

    Not scored
  • CVE-2026-121041

    Missing authorization in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page.…

    Google · Chrome

    Not scored

Most common weaknesses

  1. CWE-416 Use after free1,707
  2. CWE-20 Improper input validation644
  3. CWE-787 Out-of-bounds write497
  4. CWE-451 324
  5. CWE-863 Incorrect authorization284
  6. CWE-125 Out-of-bounds read277
  7. CWE-843 Type confusion226
  8. CWE-119 Memory buffer bounds error218
  9. CWE-862 Missing authorization191
  10. CWE-200 Exposure of sensitive information178