Google Chrome vulnerabilities and fixes
Exploited and high-severity Google Chrome vulnerabilities tracked by VulnFeed, with CVSS and EPSS scores, affected versions and fixes.
- 8.8CVE-2026-76026Memory corruption in Autofill in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a craFix availableGoogle Chrome
1 min read - 8.8CVE-2026-76028Use after free in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafFix availableGoogle Chrome
1 min read - 8.8CVE-2026-76029Memory corruption in Network in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandboFix availableGoogle Chrome
1 min read - 8.8CVE-2026-76030Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sanFix availableGoogle Chrome
1 min read - 8.8CVE-2026-76031Use after free in Input in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HFix availableGoogle Chrome
1 min read - 8.8CVE-2026-119271Use after free in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTFix availableGoogle Chrome
1 min read - 8.8CVE-2026-76025Use after free in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafFix availableGoogle Chrome
1 min read - 9.6CVE-2026-119263Memory corruption in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outsideFix availableGoogle Chrome
1 min read - 8.8CVE-2026-119264Memory corruption in Dawn in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox vFix availableGoogle Chrome
1 min read - 8.8CVE-2026-119265Memory corruption in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox Fix availableGoogle Chrome
1 min read - 8.8CVE-2026-119266Use after free in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox viaFix availableGoogle Chrome
1 min read - 8.8CVE-2026-119267Memory corruption in DOM in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox viFix availableGoogle Chrome
1 min read - 8.8CVE-2026-119268Integer overflow in Editing in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandboxFix availableGoogle Chrome
1 min read - 8.8CVE-2026-119269Use after free in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HFix availableGoogle Chrome
1 min read - 8.8CVE-2026-119270Improper input validation in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code insiFix availableGoogle Chrome
1 min read - 8.8CVE-2026-119260Use after free in Frames in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted Fix availableGoogle Chrome
1 min read - 9.6CVE-2026-119261Improper input validation in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the Fix availableGoogle Chrome
1 min read - 8.8CVE-2026-119262Improper input validation in V8 in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sanFix availableGoogle Chrome
1 min read - 9.3CVE-2026-118337Improper access control in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin policy via a crafted HTML pageFix availableGoogle Chrome
1 min read - 9.3CVE-2026-118333Missing authorization in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin policy via a crafted HTML page.Fix availableGoogle Chrome
1 min read - 8.8CVE-2026-118335Improper input validation in Metrics in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary codeFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113264Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code insideFix availableGoogle Chrome
1 min read - 8.3CVE-2026-113212Memory corruption in PDF in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially via a crafted HTML page.Fix availableGoogle Chrome
1 min read - 8.8CVE-2026-113013Incorrect authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitivFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113039Use after free in Bookmarks in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113083Missing authorization in Actor in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker to spoof UI elements via a co-installed Fix availableGoogle Chrome
1 min read - 8.8CVE-2026-113088UI misrepresentation in Mobile in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTMLFix availableGoogle Chrome
1 min read - 8.8CVE-2026-112996Incorrect authorization in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML pagFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113046UI misrepresentation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page.Fix availableGoogle Chrome
1 min read - 8.8CVE-2026-113067UI misrepresentation in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elementFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113074Incorrect authorization in Media in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer procFix availableGoogle Chrome
1 min read - 8.8CVE-2026-112994UI misrepresentation in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements vFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113063Clickjacking in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via crFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113085Information leak in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted HTML page.Fix availableGoogle Chrome
1 min read - 8.8CVE-2026-113107Missing authorization in Media in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer procesFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113036Incorrect authorization in HTML in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page.Fix availableGoogle Chrome
1 min read - 8.8CVE-2026-113061Improper input validation in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass systFix availableGoogle Chrome
1 min read - 8.8CVE-2026-112998Use after free in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox viFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113021Incorrect authorization in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain seFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113017Use after free in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113024Confused deputy in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML pagFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113025UI misrepresentation in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to spoof UI eFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113080UI misrepresentation in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted Chrome extFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113029Out of bounds write in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentiallyFix availableGoogle Chrome
1 min read - 9.6CVE-2026-113023Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a craFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113048Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system accFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113004Type confusion in Sync in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted file.Fix availableGoogle Chrome
1 min read - 8.8CVE-2026-113027Type confusion in WebFonts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox Fix availableGoogle Chrome
1 min read - 9.6CVE-2026-113056Observable discrepancy in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cross-origin data via a crafted HTFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113103Race condition in WebProtect in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged Fix availableGoogle Chrome
1 min read - 8.8CVE-2026-113015Incorrect authorization in Workers in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypasFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113091Information leak in PerformanceAPIs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information viFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113052Race condition in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a Fix availableGoogle Chrome
1 min read - 8.8CVE-2026-113053Incorrect authorization in Cookies in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to byFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113086Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to execute arbitrarFix availableGoogle Chrome
1 min read - 9.6CVE-2026-113089Incorrect authorization in PrintPreview in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafteFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113008Race condition in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process andFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113096UI misrepresentation in Text in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process Fix availableGoogle Chrome
1 min read - 8.8CVE-2026-113062Missing authorization in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass web Fix availableGoogle Chrome
1 min read - 8.8CVE-2026-113065Improper input validation in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside theFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113100Use of uninitialized variable in Audio in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandboxFix availableGoogle Chrome
1 min read - 8.8CVE-2026-112997Information leak in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via a crafted HTML page.Fix availableGoogle Chrome
1 min read - 8.8CVE-2026-113030Use of uninitialized variable in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox viaFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113037Use after free in WebSockets in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113028Use of uninitialized variable in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandboxFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113087Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to execute arbitrary code insiFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113099Confused deputy in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveraging social engineering to obtain sensFix availableGoogle Chrome
1 min read - 9.6CVE-2026-113007Incorrect calculation in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113075Origin validation error in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113090UI misrepresentation in Interstitials in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elemFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113001Incorrect authorization in Workers in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML paFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113064Race condition in OptimizationGuide in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via a crafted HTMLFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113106Type confusion in Skia in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113032Improper input validation in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveraging social engineering to bFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113031Uninitialized resource in Media in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer proceFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113049Information leak in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain cross-orFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113081Use after free in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a craFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113016Race condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access rFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113041Race condition in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain cross-origin data viFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113043Use after free in iOSWeb in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via Fix availableGoogle Chrome
1 min read - 8.8CVE-2026-113073Incomplete cleanup in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page.Fix availableGoogle Chrome
1 min read - 8.8CVE-2026-113076Race condition in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass systFix availableGoogle Chrome
1 min read - 9.6CVE-2026-113084Incorrect authorization in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass systeFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113042Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass systemFix availableGoogle Chrome
1 min read - 9.6CVE-2026-112992Observable discrepancy in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page.Fix availableGoogle Chrome
1 min read - 8.8CVE-2026-112995Observable discrepancy in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted HTFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113071Use of insufficiently random values in Notifications in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof UI elemeFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113009UI misrepresentation in WindowControlsOverlay in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to potenFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113060UI misrepresentation in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed an adjacent attacker leveraging social engineering to spoof UI elemeFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113059Race condition in Sensor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially exeFix availableGoogle Chrome
1 min read - 8.8CVE-2026-112999Incorrect authorization in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted HTFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113003Memory corruption in HID in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox vFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113005Missing authorization in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveFix availableGoogle Chrome
1 min read - 9.6CVE-2026-113014Missing authorization in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113108Information loss in Script in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page.Fix availableGoogle Chrome
1 min read - 8.8CVE-2026-113105Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to byFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113033Use after free in Streaming in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandboxFix availableGoogle Chrome
1 min read - 9.6CVE-2026-113078Race condition in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentiallFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113011Incorrect authorization in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a local attacker who had compromised the rFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113034Incorrect reference resolution in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer procesFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113094Inappropriate implementation in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypaFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113006Incorrect authorization in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions into a prFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113018Missing authorization in IME in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass siteFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113069Missing authorization in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113022Incorrect authorization in PDFium in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted PDF fileFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113079UI misrepresentation in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to spFix availableGoogle Chrome
1 min read - 8.8CVE-2026-113055UI misrepresentation in FullScreen in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted Fix availableGoogle Chrome
1 min read - 8.8CVE-2026-113068UI misrepresentation in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted HTML page.Fix availableGoogle Chrome
1 min read