Google vulnerabilities
Published CVEs affecting Google products: 4517 record(s), with severity, exploitation and fixes.
Chrome 3829Android 628Mcp Toolbox For Databases 14MCP Toolbox for Databases (googleapis/mcp-toolbox) 6Mcp-toolbox 5SAM 3Chrome-devtools-mcp 3Libjxl 2Keras 2gVisor 2Android Xr 2Go-attestation 2OSV-SCALIBR 2Turbinia 1Nest 1Tink Java 1A2ui/web Core 1Common Expression Language 1Tink-Android 1Google-ADK 1Agent Development Kit (ADK) for Python 1Woff2 1Langfun 1Android Wear 1Cel-go 1Site Kit by Google 1Protobuf-javascript (aka Google-protobuf Npm Package) 1Mcp-toolbox-sdk-python 1Fuse-archive 1ADK TypeScript (@google/adk) 1Brotli 1Agent Development Kit (ADK) for Java 1Gerrit 1V8 1Libvpx 1Libwebp 1Security Operations Soar 1Nest Wifi Router Firmware 1Nest Wifi Point Firmware 1Nest Wifi Pro Firmware 1
CVE-2026-11098
Medium · 5.3
CWE-20 Jun 4, 2026
Improper Input Validation in Google Chrome
Insufficient validation of untrusted input in GPU in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11097
Medium · 6.5
CWE-474 Jun 4, 2026
Inappropriate implementation in WebView in Google Chrome on Android prior to…
Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11096
Medium · 6.5
CWE-125 Jun 4, 2026
Out-of-bounds Read in Google Chrome
Out of bounds read in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11095
Critical · 9.6
CWE-20 Jun 4, 2026
Google Chrome Codecs improper input validation with possible sandbox escape
Insufficient validation of untrusted input in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11094
Critical · 9.6
CWE-416 Jun 4, 2026
Google Chrome Use-After-Free in Codecs Component on Windows
Use after free in Codecs in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11093
Medium · 6.5
CWE-20 Jun 4, 2026
Improper Input Validation in Google Chrome
Inappropriate implementation in Printing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11092
High · 8.8
CWE-602 Jun 4, 2026
Insufficient policy enforcement in DevTools in Google Chrome prior to 149.0.7827.53…
Insufficient policy enforcement in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to perform privilege escalation via a crafted Chrome Extension. (Chromium security severity: Medium)
CVE-2026-11091
High · 8.8
CWE-125 Jun 4, 2026
Out-of-bounds Read in Google Chrome
Inappropriate implementation in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11090
Medium · 6.5
CWE-457 Jun 4, 2026
Use of Uninitialized Variable in Google Chrome
Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11089
Medium · 6.5
CWE-457 Jun 4, 2026
Use of Uninitialized Variable in Google Chrome
Uninitialized Use in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11088
Critical · 9.6
CWE-472 Jun 4, 2026
Google Chrome ANGLE Integer Overflow Enabling Possible Sandbox Escape (CVE-2026-11088)
Integer overflow in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11087
Medium · 6.5
CWE-457 Jun 4, 2026
Use of Uninitialized Variable in Google Chrome
Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11086
High · 8.8
CWE-20 Jun 4, 2026
Improper Input Validation in Google Chrome
Inappropriate implementation in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11085
High · 8.8
CWE-472 Jun 4, 2026
Integer overflow in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a…
Integer overflow in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11084
Medium · 6.5
CWE-346 Jun 4, 2026
Inappropriate implementation in Password Manager in Google Chrome prior to 149.0.7827.53…
Inappropriate implementation in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11083
Medium · 6.5
CWE-346 Jun 4, 2026
Inappropriate implementation in Password Manager in Google Chrome prior to 149.0.7827.53…
Inappropriate implementation in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11082
Critical · 9.6
CWE-416 Jun 4, 2026
Google Chrome for Android GPU race condition enabling possible sandbox escape
Race in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11081
Medium · 6.5
CWE-346 Jun 4, 2026
Inappropriate implementation in Canvas in Google Chrome prior to 149.0.7827.53 allowed a…
Inappropriate implementation in Canvas in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11080
High · 8.8
CWE-416 Jun 4, 2026
Use After Free in Google Chrome
Use after free in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11079
High · 8.8
CWE-20 Jun 4, 2026
Improper Input Validation in Google Chrome
Insufficient validation of untrusted input in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform an out of bounds memory write via a crafted video file. (Chromium security severity: Medium)
CVE-2026-11078
Medium · 6.5
CWE-20 Jun 4, 2026
Improper Input Validation in Google Chrome
Inappropriate implementation in FileSystem in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11077
High · 8.8
CWE-125 Jun 4, 2026
Out-of-bounds Read in Google Chrome
Bad cast in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11076
High · 8.8
CWE-843 Jun 4, 2026
Type Confusion in Google Chrome
Type Confusion in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11075
Medium · 6.5
CWE-125 Jun 4, 2026
Out-of-bounds Read in Google Chrome
Out of bounds read in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-11074
High · 8.8
CWE-416 Jun 4, 2026
Use After Free in Google Chrome
Use after free in WebRTC in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Medium)