Google vulnerabilities
Published CVEs affecting Google products: 4517 record(s), with severity, exploitation and fixes.
Chrome 3829Android 628Mcp Toolbox For Databases 14MCP Toolbox for Databases (googleapis/mcp-toolbox) 6Mcp-toolbox 5SAM 3Chrome-devtools-mcp 3Libjxl 2Keras 2gVisor 2Android Xr 2Go-attestation 2OSV-SCALIBR 2Turbinia 1Nest 1Tink Java 1A2ui/web Core 1Common Expression Language 1Tink-Android 1Google-ADK 1Agent Development Kit (ADK) for Python 1Woff2 1Langfun 1Android Wear 1Cel-go 1Site Kit by Google 1Protobuf-javascript (aka Google-protobuf Npm Package) 1Mcp-toolbox-sdk-python 1Fuse-archive 1ADK TypeScript (@google/adk) 1Brotli 1Agent Development Kit (ADK) for Java 1Gerrit 1V8 1Libvpx 1Libwebp 1Security Operations Soar 1Nest Wifi Router Firmware 1Nest Wifi Point Firmware 1Nest Wifi Pro Firmware 1
CVE-2026-6316
High · 8.8
CWE-416 Apr 15, 2026
Use after free in Forms in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to...
Use after free in Forms in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-6315
High · 8.8
CWE-416 Apr 15, 2026
Use after free in Permissions in Google Chrome on Android prior to 147.0.7727.101 allowed a...
Use after free in Permissions in Google Chrome on Android prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
CVE-2026-6314
High · 8.3
CWE-787 Apr 15, 2026
Out of bounds write in GPU in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who...
Out of bounds write in GPU in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the GPU process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVE-2026-6313
Low · 3.1
CWE-284 Apr 15, 2026
Insufficient policy enforcement in CORS in Google Chrome prior to 147.0.7727.101 allowed a remote...
Insufficient policy enforcement in CORS in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
CVE-2026-6312
Low · 3.1
CWE-284 Apr 15, 2026
Insufficient policy enforcement in Passwords in Google Chrome prior to 147.0.7727.101 allowed a...
Insufficient policy enforcement in Passwords in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
CVE-2026-6311
High · 8.3
CWE-457 Apr 15, 2026
Uninitialized Use in Accessibility in Google Chrome on Windows prior to 147.0.7727.101 allowed a...
Uninitialized Use in Accessibility in Google Chrome on Windows prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVE-2026-6310
High · 8.3
CWE-416 Apr 15, 2026
Use after free in Dawn in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had...
Use after free in Dawn in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVE-2026-6309
High · 8.3
CWE-416 Apr 15, 2026
Use after free in Viz in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had...
Use after free in Viz in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVE-2026-6308
High · 7.5
CWE-125 Apr 15, 2026
Out of bounds read in Media in Google Chrome prior to 147.0.7727.101 allowed a remote attacker...
Out of bounds read in Media in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
CVE-2026-6307
High · 8.8
CWE-843 Apr 15, 2026
Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to...
Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-6306
High · 8.8
CWE-122 Apr 15, 2026
Heap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed a remote attacker...
Heap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: High)
CVE-2026-6305
High · 8.8
CWE-122 Apr 15, 2026
Heap-based Buffer Overflow in Google Chrome
Heap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: High)
CVE-2026-6304
High · 8.3
CWE-416 Apr 15, 2026
Use after free in Graphite in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who...
Use after free in Graphite in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVE-2026-6303
High · 8.8
CWE-416 Apr 15, 2026
Use after free in Codecs in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to...
Use after free in Codecs in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-6302
High · 8.8
CWE-416 Apr 15, 2026
Use after free in Video in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to...
Use after free in Video in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-6301
High · 8.8
CWE-843 Apr 15, 2026
Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to...
Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-6300
High · 8.8
CWE-416 Apr 15, 2026
Use after free in CSS in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to...
Use after free in CSS in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-6299
High · 8.8
CWE-416 Apr 15, 2026
Use after free in Prerender in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to...
Use after free in Prerender in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-6298
Medium · 4.3
CWE-122 Apr 15, 2026
Heap-based Buffer Overflow in Google Chrome
Heap buffer overflow in Skia in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-6297
High · 8.3
CWE-416 Apr 15, 2026
Use after free in Proxy in Google Chrome prior to 147.0.7727.101 allowed an attacker in a...
Use after free in Proxy in Google Chrome prior to 147.0.7727.101 allowed an attacker in a privileged network position to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-6296
Critical · 9.6
CWE-122 Apr 15, 2026
Google Chrome ANGLE heap buffer overflow (CVE-2026-6296)
Heap buffer overflow in ANGLE in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-5919
Medium · 6.5
CWE-20 Apr 8, 2026
Improper Input Validation in Google Chrome
Insufficient validation of untrusted input in WebSockets in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-5918
Medium · 4.3
CWE-346 Apr 8, 2026
Inappropriate implementation in Navigation in Google Chrome prior to 147.0.7727.55…
Inappropriate implementation in Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-5915
High · 8.1
CWE-20 Apr 8, 2026
Improper Input Validation in Google Chrome
Insufficient validation of untrusted input in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-5914
High · 8.8
CWE-843 Apr 8, 2026
Type Confusion in Google Chrome
Type Confusion in CSS in Google Chrome prior to 147.0.7727.55 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Low)