Chrome vulnerabilities and CVEs
Known vulnerabilities affecting Chrome, with exploit availability attached to each one, so you can tell a flaw someone has written code for from one nobody has.
205 vulnerabilities tracked.
- 9.6 Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially…
- 9.6 Use after free in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially…
- 9.6 Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to…
- 9.6 Incorrect reference resolution in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering…
- 9.6 Privilege elevation in Contacts in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute…
- 9.6 Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to…
- 9.6 Use after free in WebXR in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute…
- 9.6 Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to…
- 9.6 Use after free in Views in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to…
- 9.6 Use after free in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside…
- 9.6 Buffer overflow in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox…
- 9.6 Use after free in Navigation in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute…
- 9.6 Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox…
- 9.6 Use after free in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via…
- 9.6 Use after free in WebGPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside…
- 9.6 Buffer overflow in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via…
- 9.6 Out of bounds write in ANGLE in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker to potentially execute…
- 9.6 Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to…
- 9.6 Use after free in PictureInPicture in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to…
- 9.6 Memory corruption in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary…
- 9.6 Use after free in Prerender in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox…
- 9.6 Buffer overflow in Dawn in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary…
- 9.6 Use after free in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the…
- 9.6 Use after free in WebGL in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary…
- 9.6 Memory corruption in ANGLE in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary…
- 9.6 Buffer overflow in Dawn in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the…
- 9.6 UI misrepresentation in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveraging social…
- 9.6 Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a local attacker to bypass system access restrictions via…
- 9.6 Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a local attacker to bypass system access restrictions via…
- 9.6 Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access…
- 9.6 Observable discrepancy in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leak…
- 9.6 Observable discrepancy in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cross-origin data via a…
- 9.6 Missing authorization in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer…
- 9.6 Incorrect authorization in PrintPreview in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information…
- 9.6 Privilege elevation in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass…
- 9.6 UI misrepresentation in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to…
- 9.6 Missing authorization in Internals in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer…
- 9.6 Incorrect calculation in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions…
- 8.8 Cross-site scripting in ReadingMode in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted…
- 8.8 Use after free in Bookmarks in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox…
- 8.8 Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a…
- 8.8 Incorrect authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to…
- 8.8 UI misrepresentation in Mobile in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a…
- 8.8 Missing authorization in Actor in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker to spoof UI elements via a…
- 8.8 Missing authorization in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer…
- 8.8 Missing authorization in Editing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via…
- 8.8 Incorrect authorization in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a…
- 8.8 Incorrect authorization in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a…
- 8.8 Incorrect authorization in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass…
- 8.8 Incorrect authorization in Media in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker who had compromised the…
- 8.8 UI misrepresentation in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof…
- 8.8 UI misrepresentation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML…
- 8.8 UI misrepresentation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof…
- 8.8 Observable discrepancy in Controls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to…
- 8.8 Observable discrepancy in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially leak cross-origin data via…
- 8.8 UI misrepresentation in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI…
- 8.8 Clickjacking in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI…
- 8.8 Use of released resource in ContextMenu in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social…
- 8.8 Incorrect authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leak…
- 8.8 Incorrect authorization in Prompts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to…
Showing the 60 that warrant attention first, of 205. Search the full feed for Chrome.
What this covers
This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that Chrome is free of vulnerabilities.
Query this from an agent over MCP · Check a lockfile by version
Other products tracked here
Android Windows 11 version 26H1 Windows 11 Version 25H2 Windows 11 Version 24H2 Windows Server 2025 Windows Server 2025 (Server Core installation) Windows Server 2022 Windows 10 Version 21H2 Windows Server 2019 (Server Core installation) Windows Server 2019 Windows 10 Version 1809 Windows 10 Version 22H2 macOS Red Hat Enterprise Linux 9 Windows Server 2016 (Server Core installation) Windows Server 2016 n/a Windows 10 Version 1607 Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 8 Windows Server 2012 R2 Windows Server 2012 R2 (Server Core installation) Windows Server 2012 (Server Core installation) Windows Server 2012