Google Chrome vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Google Chrome: 3829 record(s), with affected versions and fixes.cpe:2.3:a:google:chrome
CVE-2026-13029
High · 7.5
CWE-416 Jun 24, 2026
Use after free in Web Authentication in Google Chrome prior to 149.0.7827.197 allowed an attacker...
Use after free in Web Authentication in Google Chrome prior to 149.0.7827.197 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)
CVE-2026-13028
Critical · 9.6
CWE-416 Jun 24, 2026
Google Chrome WebGL Use-After-Free on Android (CVE-2026-13028)
Use after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-13027
High · 8.8
CWE-416 Jun 24, 2026
Use after free in FileSystem in Google Chrome prior to 149.0.7827.197 allowed a remote attacker...
Use after free in FileSystem in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2026-13026
High · 8.8
CWE-416 Jun 24, 2026
Use after free in Digital Credentials in Google Chrome on Mac prior to 149.0.7827.197 allowed a...
Use after free in Digital Credentials in Google Chrome on Mac prior to 149.0.7827.197 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2026-13025
High · 8.3
CWE-20 Jun 24, 2026
Race in DevTools in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had...
Race in DevTools in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVE-2026-13024
Medium · 4.2
CWE-20 Jun 24, 2026
Insufficient validation of untrusted input in Navigation in Google Chrome prior to 149.0.7827.197...
Insufficient validation of untrusted input in Navigation in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)
CVE-2026-13023
Medium · 5.3
CWE-457 Jun 24, 2026
Uninitialized Use in GPU in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who...
Uninitialized Use in GPU in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
CVE-2026-13022
Medium · 6.5
CWE-346 Jun 24, 2026
Inappropriate implementation in Autofill in Google Chrome prior to 149.0.7827.197 allowed a...
Inappropriate implementation in Autofill in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
CVE-2026-13021
Medium · 4.3
CWE-346 Jun 24, 2026
Inappropriate implementation in DeviceBoundSessionCredentials in Google Chrome prior to 149.0...
Inappropriate implementation in DeviceBoundSessionCredentials in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)
CVE-2026-12469
Medium · 4.3
CWE-457 Jun 17, 2026
Uninitialized Use in GPU in Google Chrome on Android prior to 149.0.7827.155 allowed a remote...
Uninitialized Use in GPU in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
CVE-2026-12468
High · 8.3
CWE-362 Jun 17, 2026
Race in Updater in Google Chrome on Mac prior to 149.0.7827.155 allowed a remote attacker who had...
Race in Updater in Google Chrome on Mac prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVE-2026-12467
High · 8.3
CWE-416 Jun 17, 2026
Use after free in Extensions in Google Chrome prior to 149.0.7827.155 allowed a remote attacker...
Use after free in Extensions in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVE-2026-12466
High · 8.8
CWE-122 Jun 17, 2026
Heap buffer overflow in WebRTC in Google Chrome on Windows prior to 149.0.7827.155 allowed a...
Heap buffer overflow in WebRTC in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
CVE-2026-12465
High · 8.3
CWE-20 Jun 17, 2026
Object lifecycle issue in Metrics in Google Chrome prior to 149.0.7827.155 allowed a remote...
Object lifecycle issue in Metrics in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVE-2026-12464
High · 8.3
CWE-416 Jun 17, 2026
Use after free in Browser in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who...
Use after free in Browser in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVE-2026-12463
Medium · 4.7
CWE-79 Jun 17, 2026
Inappropriate implementation in Views in Google Chrome on Linux prior to 149.0.7827.155 allowed a...
Inappropriate implementation in Views in Google Chrome on Linux prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High)
CVE-2026-12462
High · 7.5
CWE-416 Jun 17, 2026
Use after free in Media in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who...
Use after free in Media in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-12461
Medium · 6.5
CWE-125 Jun 17, 2026
Out of bounds read in WebRTC in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote...
Out of bounds read in WebRTC in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
CVE-2026-12460
Medium · 4.2
CWE-284 Jun 17, 2026
Insufficient policy enforcement in File System Access in Google Chrome prior to 149.0.7827.155...
Insufficient policy enforcement in File System Access in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. (Chromium security severity: High)
CVE-2026-12459
Medium · 6.1
CWE-79 Jun 17, 2026
Inappropriate implementation in Serial in Google Chrome prior to 149.0.7827.155 allowed a remote...
Inappropriate implementation in Serial in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High)
CVE-2026-12458
Low · 3.1
CWE-451 Jun 17, 2026
Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.155 allowed a...
Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
CVE-2026-12457
Medium · 4.2
CWE-693 Jun 17, 2026
Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.155 allowed a...
Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)
CVE-2026-12456
Medium · 4.2
CWE-20 Jun 17, 2026
Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.155 allowed an...
Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.155 allowed an attacker who convinced a user to install a malicious extension to bypass same origin policy via a crafted Chrome Extension. (Chromium security severity: High)
CVE-2026-12455
High · 7.5
CWE-416 Jun 17, 2026
Use after free in Tab Strip in Google Chrome prior to 149.0.7827.155 allowed a remote attacker...
Use after free in Tab Strip in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2026-12454
High · 8.3
CWE-362 Jun 17, 2026
Race in Safe Browsing in Google Chrome on Mac prior to 149.0.7827.155 allowed a remote attacker...
Race in Safe Browsing in Google Chrome on Mac prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)