Chrome vulnerabilities
CVEs whose affected-version data names the Chrome package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
1665 CVEsRSS
CVE-2026-121197NoneOut of bounds read in ANGLE in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page
Out of bounds read in ANGLE in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-121062NoneIncorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page
Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-121051NoneUI misrepresentation in iOSWeb in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to spoof address bar via a crafted HTML page
UI misrepresentation in iOSWeb in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: High)
CVE-2026-121032NoneOut of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page
Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-121095NoneUninitialized resource in WebGL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page
Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-76028High· 8.8Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page
Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-119264High· 8.8Use after free in Dawn in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page
Use after free in Dawn in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-119260High· 8.8Use after free in Frames in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page
Use after free in Frames in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-119272Medium· 4.3Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page
Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-119271High· 8.8Uninitialized resource in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page
Uninitialized resource in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-119270High· 8.8Incorrect reference resolution in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page
Incorrect reference resolution in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severit…
CVE-2026-119269High· 8.8Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to bypass web origin policy via a crafted HTML page
Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
CVE-2026-76029High· 8.8Improper input validation in Network in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via crafted network traffic
Improper input validation in Network in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via crafted network traffic. (Chromium security severity: High)
CVE-2026-119268High· 8.8Use after free in Editing in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page
Use after free in Editing in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-119267High· 8.8Use after free in DOM in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page
Use after free in DOM in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-119266High· 8.8Incorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page
Incorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromi…
CVE-2026-119265High· 8.8Incorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic
Incorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium secur…
CVE-2026-119263Critical· 9.6Use after free in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page
Use after free in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-119262High· 8.8Out of bounds write in V8 in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page
Out of bounds write in V8 in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-119261Critical· 9.6Buffer overflow in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page
Buffer overflow in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security seve…
CVE-2026-76031High· 8.8Incorrect authorization in Input in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page
Incorrect authorization in Input in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
CVE-2026-76030High· 8.8Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page
Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security s…
CVE-2026-76027Medium· 4.3Information loss in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to obtain cross-origin data via a crafted HTML page
Information loss in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
CVE-2026-76026High· 8.8Origin validation error in Autofill in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to bypass web origin policy via a crafted HTML page
Origin validation error in Autofill in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
CVE-2026-76024Medium· 6.5Use after free in MediaStream in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page
Use after free in MediaStream in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-76025High· 8.8Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page
Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-118344High· 8.8Use after free in Layout in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page
Use after free in Layout in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-118306Critical· 9.6PoCUse after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page
Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-118350High· 8.8Type confusion in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page
Type confusion in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-118348High· 8.8Integer overflow in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page
Integer overflow in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)