Google vulnerabilities
Published CVEs affecting Google products: 4077 record(s), with severity, exploitation and fixes.
Chrome 3398Android 627Mcp Toolbox For Databases 14MCP Toolbox for Databases (googleapis/mcp-toolbox) 6Mcp-toolbox 5Go-attestation 2Libjxl 2Keras 2gVisor 2OSV-SCALIBR 2Chrome-devtools-mcp 2Android Xr 2V8 1Guava 1Google Devices 1Nest 1Tink Java 1A2ui/web Core 1Common Expression Language 1Tink-Android 1Google-ADK 1Libvpx 1Turbinia 1Langfun 1Android Wear 1Cel-go 1Site Kit by Google 1Protobuf-javascript (aka Google-protobuf Npm Package) 1Mcp-toolbox-sdk-python 1Fuse-archive 1Nest Wifi Pro Firmware 1Clasp 1Sentencepiece 1Protobuf 1Cloud Build 1Gemini-cli 1Run-gemini-cli 1Matter 1Web Designer 1Gerrit 1
CVE-2026-95304
High · 8.8
CWE-787 Sep 29, 2026
Out-of-bounds Write in Google Chrome
Out of bounds write in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-95303
Medium · 6.5
CWE-459 Sep 29, 2026
Incomplete cleanup in SmartCard in Google Chrome prior to 154.0.8037.57 allowed a remote…
Incomplete cleanup in SmartCard in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95302
Low · 2.9
CWE-863 Sep 29, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in WebAPKs in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker to obtain cross-origin data via a co-installed app. (Chromium security severity: Medium)
CVE-2026-95301
High · 8.1
CWE-862 Sep 29, 2026
Missing Authorization in Google Chrome
Missing authorization in Extensions in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)
CVE-2026-95300
Medium · 4.8
CWE-862 Sep 29, 2026
Missing Authorization in Google Chrome
Missing authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium)
CVE-2026-95299
Critical · 9.6
CWE-416 Sep 29, 2026
Use After Free in Google Chrome
Use after free in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-95298
High · 7.8
CWE-416 Sep 29, 2026
Use After Free in Google Chrome
Use after free in Browser in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially execute arbitrary code outside the sandbox via UI Interaction. (Chromium security severity: High)
CVE-2026-95297
Medium · 6.5
CWE-862 Sep 29, 2026
Missing Authorization in Google Chrome
Missing authorization in Contextual Tasks in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95296
Medium · 4.3
CWE-862 Sep 29, 2026
Missing Authorization in Google Chrome
Missing authorization in Core in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95295
Medium · 4.6
CWE-200 Sep 29, 2026
Exposure of Sensitive Information in Google Chrome
Information leak in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a local attacker to leak sensitive information via physical access. (Chromium security severity: Medium)
CVE-2026-95294
Medium · 5.4
CWE-451 Sep 29, 2026
UI misrepresentation in Browser in Google Chrome prior to 154.0.8037.57 allowed a remote…
UI misrepresentation in Browser in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95293
Medium · 4.7
CWE-908 Sep 29, 2026
Use of Uninitialized Resource in Google Chrome
Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-95292
Medium · 4.8
CWE-863 Sep 29, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in Safebrowsing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)
CVE-2026-95291
Medium · 5.4
CWE-451 Sep 29, 2026
UI misrepresentation in SecurityIndicators in Google Chrome on on iOS prior to…
UI misrepresentation in SecurityIndicators in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: High)
CVE-2026-95290
Medium · 5.4
CWE-862 Sep 29, 2026
Missing Authorization in Google Chrome
Missing authorization in NFC in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95289
Medium · 4.3
CWE-863 Sep 29, 2026
Incorrect Authorization in Google Chrome
Incorrect authorization in Scroll in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95288
Medium · 5.4
CWE-451 Sep 29, 2026
UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed…
UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95287
Medium · 5.4
CWE-862 Sep 29, 2026
Missing Authorization in Google Chrome
Missing authorization in Navigation in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-95286
High · 8.8
CWE-843 Sep 29, 2026
Type Confusion in Google Chrome
Type confusion in Bindings in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-95285
High · 8.4
CWE-862 Sep 29, 2026
Missing Authorization in Google Chrome
Missing authorization in WebView in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-95284
Critical · 9.6
CWE-122 Sep 29, 2026
Heap-based Buffer Overflow in Google Chrome
Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-95283
Critical · 9.6
CWE-122 Sep 29, 2026
Heap-based Buffer Overflow in Google Chrome
Buffer overflow in Tint in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-95282
High · 8.8
CWE-416 Sep 29, 2026
Use After Free in Google Chrome
Use after free in Platform in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-95281
Critical · 9.6
CWE-122 Sep 29, 2026
Heap-based Buffer Overflow in Google Chrome
Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-95280
High · 7.5
CWE-362 Sep 29, 2026
Race Condition in Google Chrome
Race condition in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)