CVE-20XX-?

Google Chrome CVEs.

Published CVEs affecting Google Chrome, ranked by exploit odds.

244 CVEs · updated 2026-11-06 06:52 UTC

Reset all
  1. CVE-2025-5959

    Type Confusion in V8 in Google Chrome prior to 137.0.7151.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 13% exploit odds Fix listed
  2. CVE-2026-85046

    Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    exploited Code execution Browser & mail Google Chrome

    8.8 HIGH 2% exploit odds Fix listed
  3. CVE-2026-78904

    Type confusion in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    9.6 CRITICAL 0.6% exploit odds Fix listed
  4. CVE-2026-78905

    Type confusion in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.6% exploit odds Fix listed
  5. CVE-2026-113027

    Type confusion in WebFonts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.6% exploit odds Fix listed
  6. CVE-2026-16420

    Type Confusion in WebAudio in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.6% exploit odds Fix listed
  7. CVE-2026-106240

    Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.6% exploit odds Fix listed
  8. CVE-2026-16421

    Inappropriate implementation in WebAudio in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.5% exploit odds Fix listed
  9. CVE-2026-5865

    Type Confusion in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.5% exploit odds Fix listed
  10. CVE-2026-78935

    Use of uninitialized variable in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

    Code execution Browser & mail Google Chrome

    9.6 CRITICAL 0.5% exploit odds Fix listed
  11. CVE-2026-78985

    Incorrect reference resolution in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    9.6 CRITICAL 0.5% exploit odds Fix listed
  12. CVE-2026-87529

    Numeric truncation error in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    9.6 CRITICAL 0.5% exploit odds Fix listed
  13. CVE-2026-87547

    Incorrect reference resolution in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    9.6 CRITICAL 0.5% exploit odds Fix listed
  14. CVE-2026-14405

    Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

    Code execution Browser & mail Google Chrome

    9.6 CRITICAL 0.5% exploit odds Fix listed
  15. CVE-2026-78938

    Type confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.5% exploit odds Fix listed
  16. CVE-2026-84326

    Uninitialized resource in V8 in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.5% exploit odds Fix listed
  17. CVE-2026-14431

    Type Confusion in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.5% exploit odds Fix listed
  18. CVE-2026-15776

    Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.5% exploit odds Fix listed
  19. CVE-2026-8517

    Object lifecycle issue in WebShare in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.5% exploit odds Fix listed
  20. CVE-2026-13967

    Heap buffer overflow in V8 in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.5% exploit odds Fix listed
  21. CVE-2026-13794

    Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    7.5 HIGH 0.5% exploit odds No fix listed
  22. CVE-2026-113012

    Incomplete cleanup in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.5% exploit odds Fix listed
  23. CVE-2026-113030

    Use of uninitialized variable in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.5% exploit odds Fix listed
  24. CVE-2026-113192

    Type confusion in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.5% exploit odds Fix listed
  25. CVE-2026-87528

    Type confusion in Rust in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    9.6 CRITICAL 0.5% exploit odds Fix listed
  26. CVE-2026-87613

    Incorrect reference resolution in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    9.0 CRITICAL 0.5% exploit odds Fix listed
  27. CVE-2026-113034

    Incorrect reference resolution in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.5% exploit odds Fix listed
  28. CVE-2026-76035

    Inappropriate implementation in Media in Google Chrome on on Mac prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    9.6 CRITICAL 0.5% exploit odds Fix listed
  29. CVE-2026-78900

    Improper input validation in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    9.6 CRITICAL 0.5% exploit odds Fix listed
  30. CVE-2026-79111

    Improper input validation in Dawn in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    9.6 CRITICAL 0.5% exploit odds Fix listed
  31. CVE-2026-85047

    Improper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    9.6 CRITICAL 0.5% exploit odds Fix listed
  32. CVE-2026-87470

    Improper quantity validation in Tint in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    9.6 CRITICAL 0.5% exploit odds Fix listed
  33. CVE-2026-113044

    Type confusion in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.5% exploit odds Fix listed
  34. CVE-2026-10904

    Inappropriate implementation in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.5% exploit odds Fix listed
  35. CVE-2026-17725

    Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.5% exploit odds Fix listed
  36. CVE-2026-17989

    Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.5% exploit odds Fix listed
  37. CVE-2026-76038

    Type confusion in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.5% exploit odds Fix listed
  38. CVE-2026-76047

    Type confusion in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.5% exploit odds Fix listed
  39. CVE-2026-76023

    Improper resource control in Linux Toolkit Theming in Google Chrome prior to 151.0.7922.173 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.5% exploit odds Fix listed
  40. CVE-2026-78956

    Type confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.5% exploit odds Fix listed
  41. CVE-2026-79209

    Type confusion in Animation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.5% exploit odds Fix listed
  42. CVE-2026-79227

    Type confusion in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.5% exploit odds Fix listed
  43. CVE-2026-79236

    Type confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.5% exploit odds Fix listed
  44. CVE-2026-85051

    Type confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.5% exploit odds Fix listed
  45. CVE-2026-87612

    Type confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.5% exploit odds Fix listed
  46. CVE-2026-87636

    Type confusion in XML in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.5% exploit odds Fix listed
  47. CVE-2026-15132

    Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.5% exploit odds Fix listed
  48. CVE-2026-17712

    Race in Skia in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  49. CVE-2026-91731

    Type confusion in Compositing in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  50. CVE-2026-91741

    Type confusion in CacheStorage in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed

All CVEs affecting Google Chrome that appear in CVE.org and NVD, sorted by how likely they are to be exploited (EPSS), with fix status and timeline.