CVE Intelligence

Google vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Google products: 4436 record(s), with severity, exploitation and fixes.

Exploited only (KEV) →

CVE-2026-15768 Medium · 6.5 CWE-346 Jul 14, 2026
Insufficient policy enforcement in HTML-in-Canvas in Google Chrome prior to 150.0.7871.125...
Insufficient policy enforcement in HTML-in-Canvas in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)
CVE-2026-15767 High · 8.8 CWE-122 Jul 14, 2026
Heap buffer overflow in libyuv in Google Chrome on Windows prior to 150.0.7871.125 allowed a...
Heap buffer overflow in libyuv in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted video file. (Chromium security severity: High)
CVE-2026-15766 Medium · 6.5 CWE-457 Jul 14, 2026
Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to...
Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
CVE-2026-15765 High · 7.5 CWE-416 Jul 14, 2026
Use after free in Ozone in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who...
Use after free in Ozone in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-15764 High · 7.5 CWE-416 Jul 14, 2026
Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote...
Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-15133 High · 8.8 CWE-416 Jul 8, 2026
Use after free in InterestGroups in Google Chrome prior to 150.0.7871.115 allowed a remote...
Use after free in InterestGroups in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-15132 High · 8.8 CWE-457 Jul 8, 2026
Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to...
Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-15131 Medium · 4.3 CWE-20 Jul 8, 2026
Inappropriate implementation in Navigation in Google Chrome prior to 150.0.7871.115 allowed a...
Inappropriate implementation in Navigation in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-15130 Medium · 4.3 CWE-602 Jul 8, 2026
Insufficient policy enforcement in Navigation in Google Chrome prior to 150.0.7871.115 allowed a...
Insufficient policy enforcement in Navigation in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: High)
CVE-2026-15129 High · 8.8 CWE-416 Jul 8, 2026
Use after free in Views in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to...
Use after free in Views in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-15128 Medium · 6.1 CWE-79 Jul 8, 2026
Inappropriate implementation in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote...
Inappropriate implementation in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High)
CVE-2026-15127 Medium · 6.1 CWE-79 Jul 8, 2026
Inappropriate implementation in WebGL in Google Chrome prior to 150.0.7871.115 allowed a remote...
Inappropriate implementation in WebGL in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High)
CVE-2026-15126 High · 8.8 CWE-416 Jul 8, 2026
Use after free in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to...
Use after free in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-15125 High · 8.8 CWE-863 Jul 8, 2026
Inappropriate implementation in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote...
Inappropriate implementation in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-15124 Medium · 4.3 CWE-20 Jul 8, 2026
Insufficient policy enforcement in Passwords in Google Chrome prior to 150.0.7871.115 allowed a...
Insufficient policy enforcement in Passwords in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)
CVE-2026-15123 High · 8.8 CWE-122 Jul 8, 2026
Inappropriate implementation in DOM in Google Chrome prior to 150.0.7871.115 allowed a remote...
Inappropriate implementation in DOM in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2026-15122 High · 8.3 CWE-20 Jul 8, 2026
Insufficient validation of untrusted input in Codecs in Google Chrome on Windows prior to 150.0...
Insufficient validation of untrusted input in Codecs in Google Chrome on Windows prior to 150.0.7871.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVE-2026-15121 High · 8.8 CWE-416 Jul 8, 2026
Use after free in WebRTC in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to...
Use after free in WebRTC in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-15120 High · 8.3 CWE-416 Jul 8, 2026
Use after free in Core in Google Chrome on Windows prior to 150.0.7871.115 allowed a remote...
Use after free in Core in Google Chrome on Windows prior to 150.0.7871.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVE-2026-15119 High · 8.3 CWE-362 Jul 8, 2026
Race in GetUserMedia in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who had...
Race in GetUserMedia in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVE-2026-15118 High · 8.8 CWE-416 Jul 8, 2026
Use after free in Input in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to...
Use after free in Input in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-15117 High · 7.5 CWE-416 Jul 8, 2026
Use after free in Payments in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who...
Use after free in Payments in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2026-15116 High · 8.8 CWE-416 Jul 8, 2026
Use after free in Actor in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to...
Use after free in Actor in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-15115 Low · 3.3 CWE-20 Jul 8, 2026
Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to...
Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.115 allowed a local attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)
CVE-2026-15114 High · 8.8 CWE-125 Jul 8, 2026
Out-of-bounds Read in Google Chrome
Out of bounds read and write in Codecs in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. (Chromium security severity: High)