Google vulnerabilities
Published CVEs affecting Google products: 4517 record(s), with severity, exploitation and fixes.
Chrome 3829Android 628Mcp Toolbox For Databases 14MCP Toolbox for Databases (googleapis/mcp-toolbox) 6Mcp-toolbox 5SAM 3Chrome-devtools-mcp 3Libjxl 2Keras 2gVisor 2Android Xr 2Go-attestation 2OSV-SCALIBR 2Turbinia 1Nest 1Tink Java 1A2ui/web Core 1Common Expression Language 1Tink-Android 1Google-ADK 1Agent Development Kit (ADK) for Python 1Woff2 1Langfun 1Android Wear 1Cel-go 1Site Kit by Google 1Protobuf-javascript (aka Google-protobuf Npm Package) 1Mcp-toolbox-sdk-python 1Fuse-archive 1ADK TypeScript (@google/adk) 1Brotli 1Agent Development Kit (ADK) for Java 1Gerrit 1V8 1Libvpx 1Libwebp 1Security Operations Soar 1Nest Wifi Router Firmware 1Nest Wifi Point Firmware 1Nest Wifi Pro Firmware 1
CVE-2026-11174
Medium · 5.3
CWE-693 Jun 4, 2026
Inappropriate implementation in Site Isolation in Google Chrome prior to 149.0.7827.53…
Inappropriate implementation in Site Isolation in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11173
High · 8.8
CWE-787 Jun 4, 2026
Out-of-bounds Write in Google Chrome
Out of bounds write in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11172
High · 8.8
CWE-451 Jun 4, 2026
Incorrect security UI in Contact Picker in Google Chrome on Android prior to…
Incorrect security UI in Contact Picker in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11171
High · 8.8
CWE-472 Jun 4, 2026
Integer overflow in Blink in Google Chrome prior to 149.0.7827.53 allowed a remote…
Integer overflow in Blink in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11170
High · 8.1
CWE-693 Jun 4, 2026
Inappropriate implementation in Chromoting in Google Chrome on Linux prior to…
Inappropriate implementation in Chromoting in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to perform OS-level privilege escalation via malicious network traffic. (Chromium security severity: Medium)
CVE-2026-11169
High · 8.1
CWE-91 Jun 4, 2026
XML Injection in Google Chrome
Inappropriate implementation in XML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted XML file. (Chromium security severity: Medium)
CVE-2026-11168
Medium · 6.5
CWE-200 Jun 4, 2026
Exposure of Sensitive Information in Google Chrome
Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11167
Critical · 9.6
CWE-250 Jun 4, 2026
Google Chrome Android WebView Sandbox Escape via Inappropriate Implementation
Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11166
Medium · 6.8
CWE-79 Jun 4, 2026
Cross-site Scripting (XSS) in Google Chrome
Inappropriate implementation in SVG in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11165
Critical · 9.6
CWE-416 Jun 4, 2026
Google Chrome on iOS: use after free in WebMIDI
Use after free in WebMIDI in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11164
High · 8.8
CWE-416 Jun 4, 2026
Use After Free in Google Chrome
Use after free in Blink in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11163
Critical · 9.6
CWE-416 Jun 4, 2026
Google Chrome for Android Messages use-after-free with possible sandbox escape
Use after free in Messages in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11162
Medium · 4.3
CWE-200 Jun 4, 2026
Exposure of Sensitive Information in Google Chrome
Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11161
Medium · 4.3
CWE-346 Jun 4, 2026
Inappropriate implementation in DataTransfer in Google Chrome prior to 149.0.7827.53…
Inappropriate implementation in DataTransfer in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11160
Medium · 6.5
CWE-125 Jun 4, 2026
Out-of-bounds Read in Google Chrome
Out of bounds read in Input in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11159
Medium · 4.3
CWE-457 Jun 4, 2026
Use of Uninitialized Variable in Google Chrome
Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11158
High · 8.6
CWE-20 Jun 4, 2026
Improper Input Validation in Google Chrome
Insufficient validation of untrusted input in Downloads in Google Chrome on Mac prior to 149.0.7827.53 allowed a local attacker to potentially perform a sandbox escape via a crafted AppleScript command. (Chromium security severity: Medium)
CVE-2026-11157
Medium · 5.4
CWE-94 Jun 4, 2026
Code Injection in Google Chrome
Script injection in Accessibility in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to inject arbitrary scripts or HTML (UXSS) via a crafted Chrome Extension. (Chromium security severity: Medium)
CVE-2026-11156
Medium · 4.3
CWE-352 Jun 4, 2026
Cross-Site Request Forgery (CSRF) in Google Chrome
Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11155
Medium · 4.3
CWE-352 Jun 4, 2026
Cross-Site Request Forgery (CSRF) in Google Chrome
Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11154
High · 7.5
CWE-416 Jun 4, 2026
Use After Free in Google Chrome
Use after free in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11153
Critical · 9.1
CWE-1300 Jun 4, 2026
Google Chrome Forms side-channel cross-origin data leak
Side-channel information leakage in Forms in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11152
Critical · 9.6
CWE-416 Jun 4, 2026
Google Chrome Dawn use-after-free flaw with possible sandbox escape
Object lifecycle issue in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11151
High · 7.5
CWE-20 Jun 4, 2026
Improper Input Validation in Google Chrome
Insufficient validation of untrusted input in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11150
Medium · 6.1
CWE-79 Jun 4, 2026
Cross-site Scripting (XSS) in Google Chrome
Inappropriate implementation in XML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)