CVE Intelligence

Google vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Google products: 4079 record(s), with severity, exploitation and fixes.

Exploited only (KEV) →

CVE-2026-95356 Critical · 9.6 CWE-416 Sep 29, 2026
Use After Free in Google Chrome
Use after free in WindowDialog in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-95355 High · 8.3 CWE-863 Sep 29, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in Navigation in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-95354 High · 8.3 CWE-416 Sep 29, 2026
Use After Free in Google Chrome
Use after free in Verifier in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)
CVE-2026-95353 High · 8.8 CWE-416 Sep 29, 2026
Use After Free in Google Chrome
Use after free in Bindings in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95352 Medium · 5.4 CWE-863 Sep 29, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low)
CVE-2026-95351 High · 8.3 CWE-416 Sep 29, 2026
Use After Free in Google Chrome
Use after free in Views in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-95350 Critical · 9.6 CWE-122 Sep 29, 2026
Heap-based Buffer Overflow in Google Chrome
Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-95349 Critical · 9.6 CWE-122 Sep 29, 2026
Heap-based Buffer Overflow in Google Chrome
Buffer overflow in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-95348 High · 8.3 CWE-416 Sep 29, 2026
Use After Free in Google Chrome
Use after free in Bluetooth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-95347 Critical · 9.6 CWE-416 Sep 29, 2026
Use After Free in Google Chrome
Use after free in Updater in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)
CVE-2026-95346 Medium · 4.8 CWE-451 Sep 29, 2026
UI misrepresentation in Chromoting in Google Chrome prior to 154.0.8037.57 allowed a…
UI misrepresentation in Chromoting in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via crafted network traffic. (Chromium security severity: Medium)
CVE-2026-95345 High · 8.8 CWE-416 Sep 29, 2026
Use After Free in Google Chrome
Use after free in Actor in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95344 High · 8.0 CWE-367 Sep 29, 2026
TOCTOU Race Condition in Google Chrome
Race condition in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass site isolation via a crafted Chrome extension. (Chromium security severity: Medium)
CVE-2026-95343 High · 8.8 CWE-416 Sep 29, 2026
Use After Free in Google Chrome
Use after free in WebAudio in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-95342 Medium · 4.3 CWE-862 Sep 29, 2026
Missing Authorization in Google Chrome
Missing authorization in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95341 High · 8.3 CWE-20 Sep 29, 2026
Improper Input Validation in Google Chrome
Improper input validation in Desktop in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)
CVE-2026-95340 Medium · 4.3 CWE-863 Sep 29, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in PictureInPicture in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95339 Critical · 9.6 CWE-416 Sep 29, 2026
Use After Free in Google Chrome
Use after free in ServiceWorker in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-95338 High · 8.8 CWE-416 Sep 29, 2026
Use After Free in Google Chrome
Use after free in PDFium in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)
CVE-2026-95337 Medium · 5.4 CWE-451 Sep 29, 2026
UI misrepresentation in Messages in Google Chrome on on Android prior to 154.0.8037.57…
UI misrepresentation in Messages in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95336 Medium · 6.5 CWE-200 Sep 29, 2026
Exposure of Sensitive Information in Google Chrome
Information leak in Transactions Platform in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95335 High · 8.3 CWE-416 Sep 29, 2026
Use After Free in Google Chrome
Use after free in HID in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-95334 High · 8.3 CWE-706 Sep 29, 2026
Use of Incorrectly-Resolved Name or Reference in Google Chrome
Incorrect reference resolution in WebProtect in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95333 High · 8.1 CWE-416 Sep 29, 2026
Use After Free in Google Chrome
Use after free in Metrics in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)
CVE-2026-95332 Medium · 4.7 CWE-457 Sep 29, 2026
Use of Uninitialized Variable in Google Chrome
Use of uninitialized variable in Tint in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)