Google Chrome vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Google Chrome: 3829 record(s), with affected versions and fixes.cpe:2.3:a:google:chrome
CVE-2026-11153
Critical · 9.1
CWE-1300 Jun 4, 2026
Google Chrome Forms side-channel cross-origin data leak
Side-channel information leakage in Forms in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11152
Critical · 9.6
CWE-416 Jun 4, 2026
Google Chrome Dawn use-after-free flaw with possible sandbox escape
Object lifecycle issue in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11151
High · 7.5
CWE-20 Jun 4, 2026
Improper Input Validation in Google Chrome
Insufficient validation of untrusted input in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11150
Medium · 6.1
CWE-79 Jun 4, 2026
Cross-site Scripting (XSS) in Google Chrome
Inappropriate implementation in XML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11149
High · 7.5
CWE-20 Jun 4, 2026
Improper Input Validation in Google Chrome
Insufficient validation of untrusted input in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11148
Medium · 6.5
CWE-352 Jun 4, 2026
Cross-Site Request Forgery (CSRF) in Google Chrome
Inappropriate implementation in Payments in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11147
High · 8.8
CWE-416 Jun 4, 2026
Use After Free in Google Chrome
Use after free in WebML in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11146
Critical · 9.6
CWE-20 Jun 4, 2026
Google Chrome Chromoting improper input validation leading to possible sandbox escape
Insufficient validation of untrusted input in Chromoting in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11145
Medium · 5.3
CWE-362 Jun 4, 2026
Race Condition in Google Chrome
Race in Geolocation in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11144
High · 8.8
CWE-416 Jun 4, 2026
Use After Free in Google Chrome
Use after free in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted video file. (Chromium security severity: Medium)
CVE-2026-11143
Medium · 6.5
CWE-122 Jun 4, 2026
Heap-based Buffer Overflow in Google Chrome
Out of bounds read in Extensions in Google Chrome on Linux prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Chrome Extension. (Chromium security severity: Medium)
CVE-2026-11142
Medium · 6.5
CWE-639 Jun 4, 2026
Authorization Bypass Through User-Controlled Key (IDOR) in Google Chrome
Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11141
Medium · 6.5
CWE-457 Jun 4, 2026
Use of Uninitialized Variable in Google Chrome
Uninitialized Use in Audio in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11140
Medium · 6.5
CWE-20 Jun 4, 2026
Improper Input Validation in Google Chrome
Out of bounds read in Chromecast in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11139
Medium · 6.5
CWE-352 Jun 4, 2026
Cross-Site Request Forgery (CSRF) in Google Chrome
Inappropriate implementation in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11138
Medium · 6.5
CWE-457 Jun 4, 2026
Use of Uninitialized Variable in Google Chrome
Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11137
Medium · 6.5
CWE-457 Jun 4, 2026
Use of Uninitialized Variable in Google Chrome
Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11136
High · 8.8
CWE-416 Jun 4, 2026
Use After Free in Google Chrome
Use after free in Canvas in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11135
Medium · 6.5
CWE-284 Jun 4, 2026
Improper Access Control in Google Chrome
Insufficient policy enforcement in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11134
Medium · 6.5
CWE-352 Jun 4, 2026
Cross-Site Request Forgery (CSRF) in Google Chrome
Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11133
Medium · 6.5
CWE-346 Jun 4, 2026
Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed…
Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11132
Medium · 6.5
CWE-346 Jun 4, 2026
Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed…
Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11131
Critical · 9.6
CWE-416 Jun 4, 2026
Google Chrome for Android Autofill Use-After-Free Sandbox Escape
Use after free in Autofill in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11130
High · 8.8
CWE-416 Jun 4, 2026
Use After Free in Google Chrome
Use after free in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11129
Medium · 6.5
CWE-352 Jun 4, 2026
Cross-Site Request Forgery (CSRF) in Google Chrome
Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)