Google vulnerabilities
Published CVEs affecting Google products: 4436 record(s), with severity, exploitation and fixes.
Chrome 3751Android 627Mcp Toolbox For Databases 14MCP Toolbox for Databases (googleapis/mcp-toolbox) 6Mcp-toolbox 5SAM 3gVisor 2Libjxl 2Keras 2Go-attestation 2OSV-SCALIBR 2Chrome-devtools-mcp 2Android Xr 2Cel-go 1Tink Java 1A2ui/web Core 1Common Expression Language 1Tink-Android 1Google-ADK 1Libvpx 1Turbinia 1Langfun 1Android Wear 1Nest 1Site Kit by Google 1Protobuf-javascript (aka Google-protobuf Npm Package) 1Mcp-toolbox-sdk-python 1Fuse-archive 1V8 1ADK TypeScript (@google/adk) 1Brotli 1Agent Development Kit (ADK) for Java 1Nest Wifi Pro Firmware 1Sentencepiece 1Protobuf 1Clasp 1Gemini-cli 1Run-gemini-cli 1Matter 1Cloud Build 1
CVE-2026-15768
Medium · 6.5
CWE-346 Jul 14, 2026
Insufficient policy enforcement in HTML-in-Canvas in Google Chrome prior to 150.0.7871.125...
Insufficient policy enforcement in HTML-in-Canvas in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)
CVE-2026-15767
High · 8.8
CWE-122 Jul 14, 2026
Heap buffer overflow in libyuv in Google Chrome on Windows prior to 150.0.7871.125 allowed a...
Heap buffer overflow in libyuv in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted video file. (Chromium security severity: High)
CVE-2026-15766
Medium · 6.5
CWE-457 Jul 14, 2026
Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to...
Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
CVE-2026-15765
High · 7.5
CWE-416 Jul 14, 2026
Use after free in Ozone in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who...
Use after free in Ozone in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-15764
High · 7.5
CWE-416 Jul 14, 2026
Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote...
Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-15133
High · 8.8
CWE-416 Jul 8, 2026
Use after free in InterestGroups in Google Chrome prior to 150.0.7871.115 allowed a remote...
Use after free in InterestGroups in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-15132
High · 8.8
CWE-457 Jul 8, 2026
Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to...
Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-15131
Medium · 4.3
CWE-20 Jul 8, 2026
Inappropriate implementation in Navigation in Google Chrome prior to 150.0.7871.115 allowed a...
Inappropriate implementation in Navigation in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-15130
Medium · 4.3
CWE-602 Jul 8, 2026
Insufficient policy enforcement in Navigation in Google Chrome prior to 150.0.7871.115 allowed a...
Insufficient policy enforcement in Navigation in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: High)
CVE-2026-15129
High · 8.8
CWE-416 Jul 8, 2026
Use after free in Views in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to...
Use after free in Views in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-15128
Medium · 6.1
CWE-79 Jul 8, 2026
Inappropriate implementation in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote...
Inappropriate implementation in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High)
CVE-2026-15127
Medium · 6.1
CWE-79 Jul 8, 2026
Inappropriate implementation in WebGL in Google Chrome prior to 150.0.7871.115 allowed a remote...
Inappropriate implementation in WebGL in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High)
CVE-2026-15126
High · 8.8
CWE-416 Jul 8, 2026
Use after free in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to...
Use after free in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-15125
High · 8.8
CWE-863 Jul 8, 2026
Inappropriate implementation in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote...
Inappropriate implementation in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-15124
Medium · 4.3
CWE-20 Jul 8, 2026
Insufficient policy enforcement in Passwords in Google Chrome prior to 150.0.7871.115 allowed a...
Insufficient policy enforcement in Passwords in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)
CVE-2026-15123
High · 8.8
CWE-122 Jul 8, 2026
Inappropriate implementation in DOM in Google Chrome prior to 150.0.7871.115 allowed a remote...
Inappropriate implementation in DOM in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2026-15122
High · 8.3
CWE-20 Jul 8, 2026
Insufficient validation of untrusted input in Codecs in Google Chrome on Windows prior to 150.0...
Insufficient validation of untrusted input in Codecs in Google Chrome on Windows prior to 150.0.7871.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVE-2026-15121
High · 8.8
CWE-416 Jul 8, 2026
Use after free in WebRTC in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to...
Use after free in WebRTC in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-15120
High · 8.3
CWE-416 Jul 8, 2026
Use after free in Core in Google Chrome on Windows prior to 150.0.7871.115 allowed a remote...
Use after free in Core in Google Chrome on Windows prior to 150.0.7871.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVE-2026-15119
High · 8.3
CWE-362 Jul 8, 2026
Race in GetUserMedia in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who had...
Race in GetUserMedia in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVE-2026-15118
High · 8.8
CWE-416 Jul 8, 2026
Use after free in Input in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to...
Use after free in Input in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-15117
High · 7.5
CWE-416 Jul 8, 2026
Use after free in Payments in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who...
Use after free in Payments in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2026-15116
High · 8.8
CWE-416 Jul 8, 2026
Use after free in Actor in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to...
Use after free in Actor in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-15115
Low · 3.3
CWE-20 Jul 8, 2026
Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to...
Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.115 allowed a local attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)
CVE-2026-15114
High · 8.8
CWE-125 Jul 8, 2026
Out-of-bounds Read in Google Chrome
Out of bounds read and write in Codecs in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. (Chromium security severity: High)