Google vulnerabilities
Published CVEs affecting Google products: 4489 record(s), with severity, exploitation and fixes.
Chrome 3803Android 627Mcp Toolbox For Databases 14MCP Toolbox for Databases (googleapis/mcp-toolbox) 6Mcp-toolbox 5SAM 3gVisor 2Chrome-devtools-mcp 2OSV-SCALIBR 2Android Xr 2Go-attestation 2Keras 2Libjxl 2Nest 1Common Expression Language 1A2ui/web Core 1Tink Java 1Agent Development Kit (ADK) for Python 1Tink-Android 1Google-ADK 1Turbinia 1Langfun 1Android Wear 1Cel-go 1Site Kit by Google 1Protobuf-javascript (aka Google-protobuf Npm Package) 1Mcp-toolbox-sdk-python 1Fuse-archive 1ADK TypeScript (@google/adk) 1Brotli 1Agent Development Kit (ADK) for Java 1Gerrit 1V8 1Libvpx 1Libwebp 1Security Operations Soar 1Nest Wifi Router Firmware 1Nest Wifi Point Firmware 1Nest Wifi Pro Firmware 1Web Designer 1
CVE-2026-14392
Critical · 9.6
CWE-787 Jul 1, 2026
Out-of-bounds Write in Google Chrome
Out of bounds write in Tint in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVE-2026-14391
Medium · 5.3
CWE-190 Jul 1, 2026
Integer overflow in ANGLE in Google Chrome on Windows prior to 150.0.7871.46 allowed a remote...
Integer overflow in ANGLE in Google Chrome on Windows prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-14390
Critical · 9.6
CWE-416 Jul 1, 2026
Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to...
Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVE-2026-14389
High · 8.3
CWE-472 Jul 1, 2026
Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who...
Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-14388
Medium · 6.5
CWE-125 Jul 1, 2026
Out of bounds read in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to...
Out of bounds read in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-14387
Critical · 9.6
CWE-472 Jul 1, 2026
Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to...
Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-14386
Medium · 6.5
CWE-125 Jul 1, 2026
Out of bounds read in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to...
Out of bounds read in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
CVE-2026-14385
High · 8.8
CWE-122 Jul 1, 2026
Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 150.0.7871.46 allowed a remote...
Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 150.0.7871.46 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
CVE-2026-14384
Medium · 6.5
CWE-125 Jul 1, 2026
Out of bounds read in ANGLE in Google Chrome on Windows prior to 150.0.7871.46 allowed a remote...
Out of bounds read in ANGLE in Google Chrome on Windows prior to 150.0.7871.46 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-14383
High · 8.8
CWE-94 Jul 1, 2026
Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote...
Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-14382
Critical · 9.6
CWE-20 Jul 1, 2026
Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46...
Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVE-2026-14381
Medium · 6.5
CWE-290 Jul 1, 2026
Incorrect security UI in WebAppInstalls in Google Chrome prior to 150.0.7871.46 allowed a remote...
Incorrect security UI in WebAppInstalls in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-14156
Medium · 6.5
CWE-862 Jun 30, 2026
Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47...
Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14155
Medium · 6.5
CWE-284 Jun 30, 2026
Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47...
Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14154
Medium · 4.8
CWE-451 Jun 30, 2026
Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed…
Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low)
CVE-2026-14153
Medium · 5.3
CWE-451 Jun 30, 2026
Inappropriate implementation in Glic in Google Chrome prior to 150.0.7871.47 allowed a remote...
Inappropriate implementation in Glic in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14152
Critical · 9.6
CWE-787 Jun 30, 2026
Out of bounds read and write in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote...
Out of bounds read and write in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14151
High · 8.3
CWE-669 Jun 30, 2026
Inappropriate implementation in AI in Google Chrome prior to 150.0.7871.47 allowed a remote...
Inappropriate implementation in AI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14150
Medium · 5.4
CWE-20 Jun 30, 2026
Insufficient validation of untrusted input in Speech in Google Chrome prior to 150.0.7871.47...
Insufficient validation of untrusted input in Speech in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14149
High · 8.8
CWE-416 Jun 30, 2026
Use after free in Audio in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote...
Use after free in Audio in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14148
Medium · 6.5
CWE-843 Jun 30, 2026
Type Confusion in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain...
Type Confusion in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14147
Medium · 6.1
CWE-79 Jun 30, 2026
Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote...
Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14146
Medium · 6.5
CWE-200 Jun 30, 2026
Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote...
Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14145
Medium · 6.1
CWE-79 Jun 30, 2026
Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote...
Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-14144
Medium · 4.2
CWE-451 Jun 30, 2026
Incorrect security UI in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker...
Incorrect security UI in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)