CVE-20XX-?

Google Chrome CVEs.

Published CVEs affecting Google Chrome, ranked by exploit odds.

4,018 CVEs · updated 2026-11-06 02:46 UTC

  1. CVE-2025-14174

    Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

    exploited Memory safety Browser & mail Google Chrome

    8.8 HIGH 55% exploit odds No fix listed
  2. CVE-2026-2441

    Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

    exploited Memory safety Browser & mail Google Chrome

    8.8 HIGH 55% exploit odds No fix listed
  3. CVE-2026-0628

    Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. (Chromium security severity: High)

    Google Chrome

    8.8 HIGH 21% exploit odds No fix listed
  4. CVE-2025-6554

    Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)

    exploited Other Browser & mail Google Chrome

    8.1 HIGH 14% exploit odds Fix listed
  5. CVE-2026-5281

    Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

    exploited Memory safety Browser & mail Google Chrome

    8.8 HIGH 14% exploit odds Fix listed
  6. CVE-2025-5959

    Type Confusion in V8 in Google Chrome prior to 137.0.7151.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

    Google Chrome

    8.8 HIGH 13% exploit odds Fix listed
  7. CVE-2025-6191

    Integer overflow in V8 in Google Chrome prior to 137.0.7151.119 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

    Google Chrome

    8.8 HIGH 12% exploit odds No fix listed
  8. CVE-2025-7656

    Integer overflow in V8 in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

    Google Chrome

    8.8 HIGH 11% exploit odds No fix listed
  9. CVE-2025-6558

    Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

    exploited XSS Browser & mail Google Chrome

    8.8 HIGH 11% exploit odds No fix listed
  10. CVE-2026-8510

    Integer overflow in Skia in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

    Other Browser & mail Google Chrome

    7.5 HIGH 10% exploit odds Fix listed
  11. CVE-2025-2783

    Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High)

    exploited Other Browser & mail Google Chrome

    8.3 HIGH 9% exploit odds No fix listed
  12. CVE-2026-2315

    Inappropriate implementation in WebGPU in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

    Other Browser & mail Google Chrome

    8.8 HIGH 9% exploit odds Fix listed
  13. CVE-2025-10585

    Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

    exploited Other Browser & mail Google Chrome

    9.8 CRITICAL 9% exploit odds Fix listed
  14. CVE-2026-0907

    Incorrect security UI in Split View in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

    Google Chrome

    9.8 CRITICAL 9% exploit odds Fix listed
  15. CVE-2025-10891

    Integer overflow in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

    Google Chrome

    8.8 HIGH 9% exploit odds Fix listed
  16. CVE-2025-0291

    Type Confusion in V8 in Google Chrome prior to 131.0.6778.264 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

    Google Chrome

    8.8 HIGH 8% exploit odds Fix listed
  17. CVE-2025-12428

    Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)

    Google Chrome

    8.8 HIGH 8% exploit odds Fix listed
  18. CVE-2025-5419

    Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

    exploited Memory safety Browser & mail Google Chrome

    8.8 HIGH 7% exploit odds No fix listed
  19. CVE-2025-9478

    Use after free in ANGLE in Google Chrome prior to 139.0.7258.154 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

    Google Chrome

    8.8 HIGH 7% exploit odds Fix listed
  20. CVE-2025-2135

    Type Confusion in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

    Google Chrome

    8.8 HIGH 7% exploit odds No fix listed
  21. CVE-2025-0434

    Out of bounds memory access in V8 in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

    Google Chrome

    8.8 HIGH 6% exploit odds Fix listed
  22. CVE-2026-10886

    Use after free in FileSystem in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

    Memory safety Browser & mail Google Chrome

    9.6 CRITICAL 6% exploit odds Fix listed
  23. CVE-2025-4664

    Insufficient policy enforcement in Loader in Google Chrome prior to 136.0.7103.113 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

    Google Chrome

    4.3 MEDIUM 5% exploit odds No fix listed
  24. CVE-2025-13223

    Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

    exploited Other Browser & mail Google Chrome

    8.8 HIGH 5% exploit odds Fix listed
  25. CVE-2026-2314

    Heap buffer overflow in Codecs in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

    Memory safety Browser & mail Google Chrome

    8.8 HIGH 5% exploit odds Fix listed
  26. CVE-2026-2313

    Use after free in CSS in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

    Memory safety Browser & mail Google Chrome

    8.8 HIGH 5% exploit odds Fix listed
  27. CVE-2025-12036

    Out of bounds memory access in V8 in Google Chrome prior to 141.0.7390.122 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

    Google Chrome

    8.8 HIGH 4% exploit odds Fix listed
  28. CVE-2025-5063

    Use after free in Compositing in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

    Google Chrome

    8.8 HIGH 4% exploit odds No fix listed
  29. CVE-2026-87491

    Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    exploited Memory safety Browser & mail Google Chrome

    8.8 HIGH 4% exploit odds Fix listed
  30. CVE-2025-5068

    Use after free in Blink in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

    Google Chrome

    8.8 HIGH 3% exploit odds No fix listed
  31. CVE-2025-14766

    Out of bounds read and write in V8 in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

    Google Chrome

    8.8 HIGH 3% exploit odds Fix listed
  32. CVE-2025-9132

    Out of bounds write in V8 in Google Chrome prior to 139.0.7258.138 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

    Google Chrome

    8.8 HIGH 3% exploit odds Fix listed
  33. CVE-2025-14765

    Use after free in WebGPU in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

    Google Chrome

    8.8 HIGH 3% exploit odds No fix listed
  34. CVE-2025-5280

    Out of bounds write in V8 in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

    Google Chrome

    8.8 HIGH 3% exploit odds No fix listed
  35. CVE-2026-3910

    Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

    exploited Injection Browser & mail Google Chrome

    8.8 HIGH 3% exploit odds Fix listed
  36. CVE-2026-11645

    Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

    exploited Memory safety Browser & mail Google Chrome

    8.8 HIGH 2% exploit odds Fix listed
  37. CVE-2026-3909

    Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

    exploited Memory safety Browser & mail Google Chrome

    8.8 HIGH 2% exploit odds Fix listed
  38. CVE-2026-85046

    Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    exploited Code execution Browser & mail Google Chrome

    8.8 HIGH 2% exploit odds Fix listed
  39. CVE-2025-2476

    Use after free in Lens in Google Chrome prior to 134.0.6998.117 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

    Google Chrome

    8.8 HIGH 1% exploit odds No fix listed
  40. CVE-2026-10973

    Uninitialized Use in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

    Other Browser & mail Google Chrome

    7.4 HIGH 1.0% exploit odds No fix listed
  41. CVE-2026-9111

    Use after free in WebRTC in Google Chrome on Linux prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

    Memory safety Browser & mail Google Chrome

    8.8 HIGH 0.8% exploit odds Fix listed
  42. CVE-2026-3538

    Integer overflow in Skia in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Critical)

    Other Browser & mail Google Chrome

    8.8 HIGH 0.8% exploit odds Fix listed
  43. CVE-2025-3067

    Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform privilege escalation via a crafted app. (Chromium security severity: Medium)

    Google Chrome

    8.6 HIGH 0.8% exploit odds No fix listed
  44. CVE-2026-3536

    Integer overflow in ANGLE in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Critical)

    Other Browser & mail Google Chrome

    8.8 HIGH 0.7% exploit odds Fix listed
  45. CVE-2026-113303

    Use after free in WebRTC in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

    Memory safety Browser & mail Google Chrome

    8.8 HIGH 0.7% exploit odds Fix listed
  46. CVE-2025-10200

    Use after free in Serviceworker in Google Chrome on Desktop prior to 140.0.7339.127 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

    Google Chrome

    8.8 HIGH 0.6% exploit odds Fix listed
  47. CVE-2025-5283

    Use after free in libvpx in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

    Google Chrome

    5.4 MEDIUM 0.6% exploit odds No fix listed
  48. CVE-2026-1862

    Type Confusion in V8 in Google Chrome prior to 144.0.7559.132 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

    Other Browser & mail Google Chrome

    8.8 HIGH 0.6% exploit odds Fix listed
  49. CVE-2025-0999

    Heap buffer overflow in V8 in Google Chrome prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

    Google Chrome

    8.8 HIGH 0.6% exploit odds No fix listed
  50. CVE-2026-10881

    Out of bounds read and write in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

    Memory safety Browser & mail Google Chrome

    9.6 CRITICAL 0.6% exploit odds Fix listed

All CVEs affecting Google Chrome that appear in CVE.org and NVD, sorted by how likely they are to be exploited (EPSS), with fix status and timeline.