Google Chrome vulnerabilities
3,361 known CVE vulnerabilities in Google Chrome, translated and rated.
- CVE-2023-4362High
Heap buffer overflow in Mojom IDL in Google Chrome prior to version 116.0.5845.96 allowed a remote attacker who compromised the renderer process and gained control of a WebUI process to potentially exploit heap corruption via a crafted HTML page.
- CVE-2023-4357High
Insufficient validation of untrusted input in XML in Google Chrome prior to version 116.0.5845.96 allowed a remote attacker to bypass file access restrictions via a crafted HTML page.
- CVE-2023-3420High
Type Confusion in V8 in Google Chrome prior to version 114.0.5735.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2023-3217High
A use after free vulnerability in WebXR in Google Chrome prior to version 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2023-2136CriticalActively exploited
Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
- CVE-2022-4262HighActively exploited
Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- CVE-2022-4135CriticalActively exploited
Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
- CVE-2022-3723HighActively exploited
Type confusion in V8 in Google Chrome prior to 107.0.5304.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- CVE-2022-3075CriticalActively exploited
Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
- CVE-2022-3038HighActively exploited
A use-after-free vulnerability in the Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2022-2856MediumActively exploited
Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 104.0.5112.101 allowed a remote attacker to arbitrarily browse to a malicious website via a crafted HTML page.
- CVE-2022-2294HighActively exploited
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2022-1364HighActively exploited
Type confusion in V8 Turbofan in Google Chrome prior to 100.0.4896.127 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2022-1096HighActively exploited
Type confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2022-0609HighActively exploited
A use-after-free vulnerability in the Animation component in Google Chrome prior to 98.0.4758.102. A remote attacker can trigger heap corruption via a crafted HTML page.
- CVE-2021-4102HighActively exploited
Use after free in V8 in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2021-38003HighActively exploited
Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2021-38000MediumActively exploited
Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page.
- CVE-2021-37976MediumActively exploited
Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
- CVE-2021-37975HighActively exploited
Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2021-37973CriticalActively exploited
Use-after-free vulnerability in Portals in Google Chrome prior to 94.0.4606.61. A remote attacker who compromised the renderer process could potentially perform a sandbox escape via a crafted HTML page.
- CVE-2021-30633CriticalActively exploited
Use-after-free vulnerability in Indexed DB API in Google Chrome prior to 93.0.4577.82. A remote attacker who compromised the renderer process could potentially perform a sandbox escape via a crafted HTML page.
- CVE-2021-30632HighActively exploited
Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2021-30563HighActively exploited
Type Confusion in V8 in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2021-30554HighActively exploited
Use-after-free in WebGL in Google Chrome prior to 91.0.4472.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2021-30551HighActively exploited
Type confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2021-30533MediumActively exploited
Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions via a crafted iframe.
- CVE-2021-21224HighActively exploited
Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- CVE-2021-21220HighActively exploited
Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2021-21206HighActively exploited
Use after free in Blink in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2021-21193HighActively exploited
A use-after-free vulnerability exists in Blink in Google Chrome prior to 89.0.4389.90. A remote attacker could potentially exploit heap corruption via a crafted HTML page.
- CVE-2021-21166HighActively exploited
A data race vulnerability exists in audio in Google Chrome prior to 89.0.4389.72. A remote attacker could potentially exploit heap corruption via a crafted HTML page.
- CVE-2021-21148HighActively exploited
Google Chrome prior to 88.0.4324.150 contains a heap buffer overflow in V8. A remote attacker could potentially exploit heap corruption via a crafted HTML page.
- CVE-2020-6572HighActively exploited
Use after free in Media in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
- CVE-2020-16017CriticalActively exploited
Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
- CVE-2020-16013HighActively exploited
Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2020-16010CriticalActively exploited
Heap buffer overflow in the UI of Google Chrome on Android prior to 86.0.4240.185. A remote attacker who had compromised the renderer process could potentially perform a sandbox escape via a crafted HTML page.
- CVE-2020-16009HighActively exploited
Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2020-6418HighActively exploited
Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2019-5825MediumActively exploited
Out of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2019-13720HighActively exploited
Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could lead to arbitrary code execution.
- CVE-2019-5786MediumActively exploited
Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.
- CVE-2016-5178Critical
Multiple unspecified vulnerabilities in Google Chrome before version 53.0.2785.143 allow remote attackers to cause a denial of service or possibly have other impact via unknown vectors.
- CVE-2013-6647Critical
A use-after-free vulnerability exists in AnimationController::endAnimationUpdate in Google Chrome, potentially leading to unauthorized memory access.
- CVE-2016-5146Critical
Multiple unspecified vulnerabilities in Google Chrome before version 52.0.2743.116 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
- CVE-2016-1666Critical
Multiple unspecified vulnerabilities in Google Chrome before version 50.0.2661.94 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
- CVE-2016-1662Critical
In Google Chrome before version 50.0.2661.94, there is a vulnerability in gc_callback.cc that does not prevent fallback execution once the Garbage Collection callback has started. This allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact.
- CVE-2016-1659Critical
Multiple unspecified vulnerabilities in Google Chrome before version 50.0.2661.75 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
- CVE-2016-1642Critical
Multiple unspecified vulnerabilities in Google Chrome before version 49.0.2623.75 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
- CVE-2016-1636Critical
The PendingScript::notifyFinished function in Google Chrome before version 49.0.2623.75 relies on memory-cache information about integrity-check occurrences, allowing remote attackers to bypass the Subresource Integrity (SRI) protection mechanism by triggering two loads of the same resource.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS