Google Chrome vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Google Chrome: 3751 record(s), with affected versions and fixes.cpe:2.3:a:google:chrome
CVE-2026-95296
Medium · 4.3
CWE-862 Sep 29, 2026
Missing Authorization in Google Chrome
Missing authorization in Core in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95295
Medium · 4.6
CWE-200 Sep 29, 2026
Exposure of Sensitive Information in Google Chrome
Information leak in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a local attacker to leak sensitive information via physical access. (Chromium security severity: Medium)
CVE-2026-95294
Medium · 5.4
CWE-451 Sep 29, 2026
UI misrepresentation in Browser in Google Chrome prior to 154.0.8037.57 allowed a remote…
UI misrepresentation in Browser in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95293
Medium · 4.7
CWE-908 Sep 29, 2026
Use of Uninitialized Resource in Google Chrome
Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-95292
Medium · 4.8
CWE-863 Sep 29, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in Safebrowsing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)
CVE-2026-95291
Medium · 5.4
CWE-451 Sep 29, 2026
UI misrepresentation in SecurityIndicators in Google Chrome on on iOS prior to…
UI misrepresentation in SecurityIndicators in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: High)
CVE-2026-95290
Medium · 5.4
CWE-862 Sep 29, 2026
Missing Authorization in Google Chrome
Missing authorization in NFC in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95289
Medium · 4.3
CWE-863 Sep 29, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in Scroll in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95288
Medium · 5.4
CWE-451 Sep 29, 2026
UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed…
UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95287
Medium · 5.4
CWE-862 Sep 29, 2026
Missing Authorization in Google Chrome
Missing authorization in Navigation in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95286
High · 8.8
CWE-843 Sep 29, 2026
Type Confusion in Google Chrome
Type confusion in Bindings in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-95285
High · 8.4
CWE-862 Sep 29, 2026
Missing Authorization in Google Chrome
Missing authorization in WebView in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95284
Critical · 9.6
CWE-122 Sep 29, 2026
Heap-based Buffer Overflow in Google Chrome
Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-95283
Critical · 9.6
CWE-122 Sep 29, 2026
Heap-based Buffer Overflow in Google Chrome
Buffer overflow in Tint in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-95282
High · 8.8
CWE-416 Sep 29, 2026
Use After Free in Google Chrome
Use after free in Platform in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-95281
Critical · 9.6
CWE-122 Sep 29, 2026
Heap-based Buffer Overflow in Google Chrome
Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-95280
High · 7.5
CWE-362 Sep 29, 2026
Race Condition in Google Chrome
Race condition in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-95279
Medium · 5.4
CWE-451 Sep 29, 2026
UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.8037.57…
UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95278
High · 8.4
CWE-862 Sep 29, 2026
Missing Authorization in Google Chrome
Missing authorization in WakeLock in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95277
Critical · 9.6
CWE-416 Sep 29, 2026
Use After Free in Google Chrome
Use after free in Views in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-95276
High · 8.3
CWE-20 Sep 29, 2026
Improper Input Validation in Google Chrome
Improper input validation in Themes in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code inside the sandbox via crafted network traffic. (Chromium security severity: Medium)
CVE-2026-95275
Medium · 6.5
CWE-706 Sep 29, 2026
Use of Incorrectly-Resolved Name or Reference in Google Chrome
Incorrect reference resolution in MediaStream in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95274
High · 8.3
CWE-116 Sep 29, 2026
Improper Encoding or Escaping of Output in Google Chrome
Improper output encoding in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-13018
Medium · 4.3
CWE-20 Sep 28, 2026
Improper Input Validation in Google Chrome
Insufficient validation of untrusted input in Codecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially perform out of bounds memory access via a crafted video file. (Chromium security severity: Low)
CVE-2026-93387
Medium · 4.3
CWE-754 Sep 17, 2026
Improper Check for Unusual or Exceptional Conditions in Google Chrome
Improper state validation in Skia in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)