Google Chrome vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Google Chrome: 3829 record(s), with affected versions and fixes.cpe:2.3:a:google:chrome
CVE-2026-11077
High · 8.8
CWE-125 Jun 4, 2026
Out-of-bounds Read in Google Chrome
Bad cast in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11076
High · 8.8
CWE-843 Jun 4, 2026
Type Confusion in Google Chrome
Type Confusion in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11075
Medium · 6.5
CWE-125 Jun 4, 2026
Out-of-bounds Read in Google Chrome
Out of bounds read in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11074
High · 8.8
CWE-416 Jun 4, 2026
Use After Free in Google Chrome
Use after free in WebRTC in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11073
Medium · 6.5
CWE-416 Jun 4, 2026
Use After Free in Google Chrome
Use after free in WebGL in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11072
High · 7.8
CWE-416 Jun 4, 2026
Use After Free in Google Chrome
Use after free in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to execute arbitrary code via a malicious file. (Chromium security severity: Medium)
CVE-2026-11071
High · 8.8
CWE-416 Jun 4, 2026
Use After Free in Google Chrome
Use after free in Base in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11070
Critical · 9.6
CWE-20 Jun 4, 2026
Google Chrome Chromoting Input Validation Flaw Enabling Sandbox Escape
Insufficient validation of untrusted input in Chromoting in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the network process to potentially perform a sandbox escape via malicious network traffic. (Chromium security severity: Medium)
CVE-2026-11069
Medium · 6.5
CWE-20 Jun 4, 2026
Improper Input Validation in Google Chrome
Insufficient validation of untrusted input in Cast in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11068
High · 8.8
CWE-416 Jun 4, 2026
Use After Free in Google Chrome
Use after free in WebSockets in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11067
Medium · 6.5
CWE-457 Jun 4, 2026
Use of Uninitialized Variable in Google Chrome
Uninitialized Use in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11066
Critical · 9.6
CWE-20 Jun 4, 2026
Google Chrome ANGLE Input Validation Flaw Enabling Possible Sandbox Escape
Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11065
Critical · 9.6
CWE-416 Jun 4, 2026
Google Chrome ANGLE use-after-free enabling possible sandbox escape
Use after free in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11064
Medium · 6.5
CWE-457 Jun 4, 2026
Use of Uninitialized Variable in Google Chrome
Race in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11063
Critical · 9.6
CWE-20 Jun 4, 2026
Google Chrome WebNN Input Validation Flaw Enabling Sandbox Escape
Insufficient validation of untrusted input in WebNN in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11062
Medium · 4.3
CWE-602 Jun 4, 2026
Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53…
Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. (Chromium security severity: Medium)
CVE-2026-11061
Critical · 9.6
CWE-125 Jun 4, 2026
Google Chrome ANGLE Type Confusion Allowing Possible Sandbox Escape (CVE-2026-11061)
Type Confusion in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11060
High · 8.8
CWE-416 Jun 4, 2026
Use After Free in Google Chrome
Use after free in Media in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11059
High · 8.8
CWE-416 Jun 4, 2026
Use After Free in Google Chrome
Use after free in Blink in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11058
High · 7.5
CWE-472 Jun 4, 2026
Integer overflow in CredentialProvider in Google Chrome on Windows prior to…
Integer overflow in CredentialProvider in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform OS-level privilege escalation via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11057
Medium · 6.5
CWE-457 Jun 4, 2026
Use of Uninitialized Variable in Google Chrome
Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11056
Critical · 9.6
CWE-20 Jun 4, 2026
Google Chrome SiteIsolation Sandbox Escape via Insufficient Input Validation
Insufficient validation of untrusted input in SiteIsolation in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11055
High · 8.8
CWE-416 Jun 4, 2026
Use After Free in Google Chrome
Use after free in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11054
High · 8.8
CWE-416 Jun 4, 2026
Use After Free in Google Chrome
Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11052
Critical · 9.6
CWE-843 Jun 4, 2026
Google Chrome GPU type confusion enabling sandbox escape on Windows
Type Confusion in GPU in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)