Google Chrome vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Google Chrome: 3751 record(s), with affected versions and fixes.cpe:2.3:a:google:chrome
CVE-2026-95346
Medium · 4.8
CWE-451 Sep 29, 2026
UI misrepresentation in Chromoting in Google Chrome prior to 154.0.8037.57 allowed a…
UI misrepresentation in Chromoting in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via crafted network traffic. (Chromium security severity: Medium)
CVE-2026-95345
High · 8.8
CWE-416 Sep 29, 2026
Use After Free in Google Chrome
Use after free in Actor in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95344
High · 8.0
CWE-367 Sep 29, 2026
TOCTOU Race Condition in Google Chrome
Race condition in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass site isolation via a crafted Chrome extension. (Chromium security severity: Medium)
CVE-2026-95343
High · 8.8
CWE-416 Sep 29, 2026
Use After Free in Google Chrome
Use after free in WebAudio in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-95342
Medium · 4.3
CWE-862 Sep 29, 2026
Missing Authorization in Google Chrome
Missing authorization in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95341
High · 8.3
CWE-20 Sep 29, 2026
Improper Input Validation in Google Chrome
Improper input validation in Desktop in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)
CVE-2026-95340
Medium · 4.3
CWE-863 Sep 29, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in PictureInPicture in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95339
Critical · 9.6
CWE-416 Sep 29, 2026
Use After Free in Google Chrome
Use after free in ServiceWorker in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-95338
High · 8.8
CWE-416 Sep 29, 2026
Use After Free in Google Chrome
Use after free in PDFium in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)
CVE-2026-95337
Medium · 5.4
CWE-451 Sep 29, 2026
UI misrepresentation in Messages in Google Chrome on on Android prior to 154.0.8037.57…
UI misrepresentation in Messages in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95336
Medium · 6.5
CWE-200 Sep 29, 2026
Exposure of Sensitive Information in Google Chrome
Information leak in Transactions Platform in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95335
High · 8.3
CWE-416 Sep 29, 2026
Use After Free in Google Chrome
Use after free in HID in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-95334
High · 8.3
CWE-706 Sep 29, 2026
Use of Incorrectly-Resolved Name or Reference in Google Chrome
Incorrect reference resolution in WebProtect in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95333
High · 8.1
CWE-416 Sep 29, 2026
Use After Free in Google Chrome
Use after free in Metrics in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)
CVE-2026-95332
Medium · 4.7
CWE-457 Sep 29, 2026
Use of Uninitialized Variable in Google Chrome
Use of uninitialized variable in Tint in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95331
Critical · 9.6
CWE-787 Sep 29, 2026
Out-of-bounds Write in Google Chrome
Out of bounds write in ANGLE in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95330
Medium · 6.5
CWE-754 Sep 29, 2026
Improper Check for Unusual or Exceptional Conditions in Google Chrome
Improper state validation in Downloads in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95329
Critical · 9.6
CWE-787 Sep 29, 2026
Out-of-bounds Write in Google Chrome
Out of bounds write in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-95328
Medium · 6.5
CWE-441 Sep 29, 2026
Confused deputy in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed…
Confused deputy in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Low)
CVE-2026-95327
Medium · 6.5
CWE-200 Sep 29, 2026
Exposure of Sensitive Information in Google Chrome
Information leak in Networking in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95326
High · 8.4
CWE-459 Sep 29, 2026
Incomplete cleanup in Bluetooth in Google Chrome prior to 154.0.8037.57 allowed a remote…
Incomplete cleanup in Bluetooth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95325
Critical · 9.6
CWE-416 Sep 29, 2026
Use After Free in Google Chrome
Use after free in ANGLE in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95324
Low · 3.4
CWE-908 Sep 29, 2026
Use of Uninitialized Resource in Google Chrome
Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-95323
Medium · 5.4
CWE-451 Sep 29, 2026
UI misrepresentation in Chromium in Google Chrome on on iOS prior to 154.0.8037.57…
UI misrepresentation in Chromium in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95322
High · 8.3
CWE-787 Sep 29, 2026
Out-of-bounds Write in Google Chrome
Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)