CVE-20XX-?
agent?

Google Chrome CVEs.

Published CVEs affecting Google Chrome, ranked by exploit odds.

49 CVEs · updated 2026-11-11 22:37 UTC

Reset all
  1. CVE-2026-113027

    Type confusion in WebFonts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.6% exploit odds Fix listed
  2. CVE-2026-113192

    Type confusion in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.5% exploit odds Fix listed
  3. CVE-2026-113030

    Use of uninitialized variable in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.5% exploit odds Fix listed
  4. CVE-2026-113012

    Incomplete cleanup in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.5% exploit odds Fix listed
  5. CVE-2026-113193

    Type confusion in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    6.5 MEDIUM 0.5% exploit odds Fix listed
  6. CVE-2026-113034

    Incorrect reference resolution in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.5% exploit odds Fix listed
  7. CVE-2026-113044

    Type confusion in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.5% exploit odds Fix listed
  8. CVE-2026-113165

    Inappropriate implementation in Core in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  9. CVE-2026-121057

    Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  10. CVE-2026-113098

    Type confusion in CacheStorage in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    6.5 MEDIUM 0.4% exploit odds Fix listed
  11. CVE-2026-113175

    Improper input validation in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  12. CVE-2026-121233

    Type confusion in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  13. CVE-2026-121226

    Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  14. CVE-2026-121228

    Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  15. CVE-2026-121218

    Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  16. CVE-2026-121221

    Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  17. CVE-2026-121210

    Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  18. CVE-2026-121137

    Type confusion in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  19. CVE-2026-121094

    Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  20. CVE-2026-121078

    Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  21. CVE-2026-121082

    Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  22. CVE-2026-121068

    Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  23. CVE-2026-118305

    Type confusion in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    9.6 CRITICAL 0.4% exploit odds Fix listed
  24. CVE-2026-121098

    Improper state validation in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.3 HIGH 0.4% exploit odds Fix listed
  25. CVE-2026-113065

    Improper input validation in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted media file. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.4% exploit odds Fix listed
  26. CVE-2026-121224

    Security issue in Desktop in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.1 HIGH 0.3% exploit odds Fix listed
  27. CVE-2026-113078

    Race condition in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    9.6 CRITICAL 0.3% exploit odds Fix listed
  28. CVE-2026-113233

    Race condition in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  29. CVE-2026-113052

    Race condition in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  30. CVE-2026-121234

    Privilege elevation in Contacts in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    9.6 CRITICAL 0.3% exploit odds Fix listed
  31. CVE-2026-121166

    Type confusion in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  32. CVE-2026-110140

    Type confusion in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  33. CVE-2026-121133

    Incorrect reference resolution in Images in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.1 HIGH 0.3% exploit odds Fix listed
  34. CVE-2026-121256

    Use of released resource in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    8.3 HIGH 0.3% exploit odds Fix listed
  35. CVE-2026-113059

    Race condition in Sensor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  36. CVE-2026-121079

    Race condition in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  37. CVE-2026-121048

    Race condition in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  38. CVE-2026-121163

    Improper input validation in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    8.3 HIGH 0.3% exploit odds Fix listed
  39. CVE-2026-118350

    Type confusion in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  40. CVE-2026-118315

    Type confusion in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  41. CVE-2026-110156

    Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.3 HIGH 0.3% exploit odds Fix listed
  42. CVE-2026-119266

    Incorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  43. CVE-2026-118336

    Race condition in Headless in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  44. CVE-2026-118320

    Race condition in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.3% exploit odds Fix listed
  45. CVE-2026-113329

    Race condition in Installer in Google Chrome on on Mac prior to 156.0.8078.47 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Medium)

    Code execution Browser & mail Google Chrome

    6.5 MEDIUM 0.2% exploit odds Fix listed
  46. CVE-2026-76029

    Improper input validation in Network in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via crafted network traffic. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.2% exploit odds Fix listed
  47. CVE-2026-119265

    Incorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)

    Code execution Browser & mail Google Chrome

    8.8 HIGH 0.2% exploit odds Fix listed
  48. CVE-2026-121230

    Race condition in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

    Code execution Browser & mail Google Chrome

    8.3 HIGH 0.2% exploit odds Fix listed
  49. CVE-2026-121064

    Improper input validation in Performance in Google Chrome prior to 157.0.8103.38 allowed a local attacker to potentially execute arbitrary code inside the sandbox via a local program. (Chromium security severity: Low)

    Code execution Browser & mail Google Chrome

    7.8 HIGH 0.1% exploit odds Fix listed

All CVEs affecting Google Chrome that appear in CVE.org and NVD, sorted by how likely they are to be exploited (EPSS), with fix status and timeline.