Google Chrome vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Google Chrome: 3751 record(s), with affected versions and fixes.cpe:2.3:a:google:chrome
CVE-2026-93386
Medium · 5.4
CWE-451 Sep 17, 2026
UI misrepresentation in WebAppInstalls in Google Chrome prior to 153.0.8010.52 allowed a…
UI misrepresentation in WebAppInstalls in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-93385
Medium · 6.5
CWE-200 Sep 17, 2026
Exposure of Sensitive Information in Google Chrome
Information leak in Paint in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-93384
Low · 3.7
CWE-918 Sep 17, 2026
Server-Side Request Forgery (SSRF) in Google Chrome
Server-side request forgery in Omnibox in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium)
CVE-2026-93383
Medium · 4.3
CWE-200 Sep 17, 2026
Exposure of Sensitive Information in Google Chrome
Information leak in Permissions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-93382
High · 8.8
CWE-416 Sep 17, 2026
Use After Free in Google Chrome
Use after free in PDFium in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-93381
High · 8.8
CWE-122 Sep 17, 2026
Heap-based Buffer Overflow in Google Chrome
Buffer overflow in PDFium in Google Chrome on on Windows prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)
CVE-2026-93380
Low · 3.1
CWE-367 Sep 17, 2026
TOCTOU Race Condition in Google Chrome
Race condition in FileSystem in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-93379
Medium · 4.3
CWE-863 Sep 17, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in ORB in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-93378
Low · 3.1
CWE-862 Sep 17, 2026
Missing Authorization in Google Chrome
Missing authorization in Storage in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. (Chromium security severity: Medium)
CVE-2026-93377
High · 8.8
CWE-843 Sep 17, 2026
Type Confusion in Google Chrome
Type confusion in V8 in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-93376
Medium · 6.3
CWE-125 Sep 17, 2026
Out-of-bounds Read in Google Chrome
Out of bounds read in DataTransfer in Google Chrome prior to 153.0.8010.52 allowed a local attacker leveraging social engineering to read memory outside the sandbox via a local program. (Chromium security severity: Medium)
CVE-2026-93375
High · 8.1
CWE-706 Sep 17, 2026
Use of Incorrectly-Resolved Name or Reference in Google Chrome
Incorrect reference resolution in Tracing in Google Chrome on on Windows prior to 153.0.8010.52 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)
CVE-2026-93374
Critical · 9.6
CWE-416 Sep 17, 2026
Use After Free in Google Chrome
Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-93373
Critical · 9.6
CWE-416 Sep 17, 2026
Use After Free in Google Chrome
Use after free in Extensions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)
CVE-2026-93372
Critical · 9.6
CWE-121 Sep 17, 2026
Stack-based Buffer Overflow in Google Chrome
Buffer overflow in WebGL in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-91749
Critical · 9.6
CWE-416 Sep 15, 2026
Use After Free in Google Chrome
Use after free in Workers in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-91748
High · 8.3
CWE-367 Sep 15, 2026
TOCTOU Race Condition in Google Chrome
Race condition in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via UI Interaction. (Chromium security severity: High)
CVE-2026-91747
Low · 3.1
CWE-416 Sep 15, 2026
Use After Free in Google Chrome
Use after free in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
CVE-2026-91746
Medium · 4.3
CWE-190 Sep 15, 2026
Integer Overflow or Wraparound in Google Chrome
Integer overflow in Compositing in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
CVE-2026-91745
High · 8.8
CWE-416 Sep 15, 2026
Use After Free in Google Chrome
Use after free in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-91744
Medium · 5.3
CWE-367 Sep 15, 2026
TOCTOU Race Condition in Google Chrome
Race condition in PlatformIntegration in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)
CVE-2026-91743
High · 8.3
CWE-367 Sep 15, 2026
TOCTOU Race Condition in Google Chrome
Race condition in Core in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-91742
Medium · 4.8
CWE-441 Sep 15, 2026
Confused deputy in PriceTracking in Google Chrome on on iOS prior to 153.0.8010.47…
Confused deputy in PriceTracking in Google Chrome on on iOS prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions into a privileged page via crafted network traffic. (Chromium security severity: Medium)
CVE-2026-91741
High · 8.8
CWE-843 Sep 15, 2026
Type Confusion in Google Chrome
Type confusion in CacheStorage in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-91740
Medium · 4.3
CWE-908 Sep 15, 2026
Use of Uninitialized Resource in Google Chrome
Uninitialized resource in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)