Google Chrome vulnerabilities

CVEs per yearBy the year they were published

1. 2018111
2. 2019354
3. 2020259
4. 2021354
5. 2022357
6. 2023297
7. 2024259
8. 2025195
9. 20263,881

Known exploitedNewest addition to KEV first

• CVE-2026-87491

  Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML…

  Google · Chrome

  ExploitedHigh8.8
• CVE-2026-85046

  Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.…

  Google · Chrome

  ExploitedHigh8.8
• CVE-2026-11645

  Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted…

  Google · Chrome

  ExploitedHigh8.8
• CVE-2026-5281

  Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code…

  Google · Chrome

  ExploitedHigh8.8
• CVE-2026-3910

  Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted…

  Google · Chrome

  ExploitedHigh8.8
• CVE-2026-3909

  Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.…

  Google · Chrome

  ExploitedHigh8.8
• CVE-2026-2441

  Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.…

  Google · Chrome

  ExploitedHigh8.8
• CVE-2025-14174

  Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a…

  Google · Chrome

  ExploitedHigh8.8
• CVE-2025-13223

  Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.…

  Google · Chrome

  ExploitedHigh8.8
• CVE-2025-10585

  Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.…

  Google · Chrome

  ExploitedHigh8.8

Newest CVEs

• CVE-2026-120930

  Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page.…

  Google · Chrome

  Medium5.4
• CVE-2026-120931

  Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via…

  Google · Chrome

  Critical9.6
• CVE-2026-121141

  Improper input validation in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin…

  Google · Chrome

  Medium5.4
• CVE-2026-121195

  Incorrect authorization in TrustedTypes in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page.…

  Google · Chrome

  High8.8
• CVE-2026-121064

  Improper input validation in Performance in Google Chrome prior to 157.0.8103.38 allowed a local attacker to potentially execute arbitrary code inside the…

  Google · Chrome

  High7.8
• CVE-2026-121169

  Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy…

  Google · Chrome

  Not scored
• CVE-2026-121069

  Use after free in Track in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.…

  Google · Chrome

  High8.8
• CVE-2026-121142

  Incorrect authorization in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy…

  Google · Chrome

  Not scored
• CVE-2026-121232

  Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a local attacker leveraging social engineering to obtain sensitive information…

  Google · Chrome

  Medium5.1
• CVE-2026-121041

  Missing authorization in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page.…

  Google · Chrome

  Medium6.5