Google Chrome vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Google Chrome: 3829 record(s), with affected versions and fixes.cpe:2.3:a:google:chrome
CVE-2026-11178
Medium · 4.3
CWE-346 Jun 4, 2026
Insufficient policy enforcement in WebView in Google Chrome on Android prior to…
Insufficient policy enforcement in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11177
High · 8.8
CWE-416 Jun 4, 2026
Use After Free in Google Chrome
Use after free in Omnibox in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11176
Medium · 6.5
CWE-346 Jun 4, 2026
Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a…
Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11175
High · 8.8
CWE-451 Jun 4, 2026
Incorrect security UI in Messages in Google Chrome on Android prior to 149.0.7827.53…
Incorrect security UI in Messages in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11174
Medium · 5.3
CWE-693 Jun 4, 2026
Inappropriate implementation in Site Isolation in Google Chrome prior to 149.0.7827.53…
Inappropriate implementation in Site Isolation in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11173
High · 8.8
CWE-787 Jun 4, 2026
Out-of-bounds Write in Google Chrome
Out of bounds write in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11172
High · 8.8
CWE-451 Jun 4, 2026
Incorrect security UI in Contact Picker in Google Chrome on Android prior to…
Incorrect security UI in Contact Picker in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11171
High · 8.8
CWE-472 Jun 4, 2026
Integer overflow in Blink in Google Chrome prior to 149.0.7827.53 allowed a remote…
Integer overflow in Blink in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11170
High · 8.1
CWE-693 Jun 4, 2026
Inappropriate implementation in Chromoting in Google Chrome on Linux prior to…
Inappropriate implementation in Chromoting in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to perform OS-level privilege escalation via malicious network traffic. (Chromium security severity: Medium)
CVE-2026-11169
High · 8.1
CWE-91 Jun 4, 2026
XML Injection in Google Chrome
Inappropriate implementation in XML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted XML file. (Chromium security severity: Medium)
CVE-2026-11168
Medium · 6.5
CWE-200 Jun 4, 2026
Exposure of Sensitive Information in Google Chrome
Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11167
Critical · 9.6
CWE-250 Jun 4, 2026
Google Chrome Android WebView Sandbox Escape via Inappropriate Implementation
Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11166
Medium · 6.8
CWE-79 Jun 4, 2026
Cross-site Scripting (XSS) in Google Chrome
Inappropriate implementation in SVG in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11165
Critical · 9.6
CWE-416 Jun 4, 2026
Google Chrome on iOS: use after free in WebMIDI
Use after free in WebMIDI in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11164
High · 8.8
CWE-416 Jun 4, 2026
Use After Free in Google Chrome
Use after free in Blink in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11163
Critical · 9.6
CWE-416 Jun 4, 2026
Google Chrome for Android Messages use-after-free with possible sandbox escape
Use after free in Messages in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11162
Medium · 4.3
CWE-200 Jun 4, 2026
Exposure of Sensitive Information in Google Chrome
Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11161
Medium · 4.3
CWE-346 Jun 4, 2026
Inappropriate implementation in DataTransfer in Google Chrome prior to 149.0.7827.53…
Inappropriate implementation in DataTransfer in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11160
Medium · 6.5
CWE-125 Jun 4, 2026
Out-of-bounds Read in Google Chrome
Out of bounds read in Input in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11159
Medium · 4.3
CWE-457 Jun 4, 2026
Use of Uninitialized Variable in Google Chrome
Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11158
High · 8.6
CWE-20 Jun 4, 2026
Improper Input Validation in Google Chrome
Insufficient validation of untrusted input in Downloads in Google Chrome on Mac prior to 149.0.7827.53 allowed a local attacker to potentially perform a sandbox escape via a crafted AppleScript command. (Chromium security severity: Medium)
CVE-2026-11157
Medium · 5.4
CWE-94 Jun 4, 2026
Code Injection in Google Chrome
Script injection in Accessibility in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to inject arbitrary scripts or HTML (UXSS) via a crafted Chrome Extension. (Chromium security severity: Medium)
CVE-2026-11156
Medium · 4.3
CWE-352 Jun 4, 2026
Cross-Site Request Forgery (CSRF) in Google Chrome
Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11155
Medium · 4.3
CWE-352 Jun 4, 2026
Cross-Site Request Forgery (CSRF) in Google Chrome
Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11154
High · 7.5
CWE-416 Jun 4, 2026
Use After Free in Google Chrome
Use after free in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)