Google Software and search
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in any Google product.
RSS Feeds for Google security vulnerabilities
Create a CVE RSS feed including security vulnerabilities found in Google products with stack.watch. Just hit watch, then grab your custom RSS feed url.
Products by Google Sorted by Most Security Vulnerabilities since 2018
Recent Google Security Advisories
| Advisory | Title | Published |
|---|---|---|
| 2026-08-05 | Chrome Releases: Stable Channel Update for Desktop (version 151.0.7922.75) | August 5, 2026 |
| 2026-08-05 | Chrome Releases: Chrome Stable for iOS Update (version 151) | August 5, 2026 |
| 2026-08-04 | Chrome Releases: August 2026 | August 4, 2026 |
| 2026-08-01 | Android Security Bulletin—August 2026 | August 1, 2026 |
| 2026-07-30 | Chrome Releases: Chrome for Android Update (version 151) | July 30, 2026 |
| 2026-07-29 | Chrome Releases: Stable Channel Update for Desktop (version 151.0.7922.71) | July 29, 2026 |
| 2026-07-28 | Chrome Releases: Chrome Stable for iOS Update (version 151) | July 28, 2026 |
| 2026-07-28 | Chrome Releases: Extended Stable Updates for Desktop (version 150.0.7871.212) | July 28, 2026 |
| 2026-07-24 | Chrome Releases: Stable Channel Update for Desktop (version 150.0.7871.186) | July 24, 2026 |
| 2026-07-22 | Chrome Releases: Chrome Stable for iOS Update (version 151) | July 22, 2026 |
Known Exploited Google Vulnerabilities
The following Google vulnerabilities have recently been marked by CISA as Known to be Exploited by threat actors.
| Title | Description | Added |
|---|---|---|
| Google Chromium V8 Out-of-Bounds Read and Write Vulnerability |
Google Chromium V8 out-of-bounds read and write vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2026-11645 Exploit Probability: 2.2% |
June 9, 2026 |
| Google Dawn Use-After-Free Vulnerability |
Google Dawn contains an use-after-free vulnerability that could allow a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. This vulnerability could affect multiple Chromium-based products including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2026-5281 Exploit Probability: 5.5% |
April 1, 2026 |
| Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerabi |
Google Chromium V8 contains an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2026-3910 Exploit Probability: 2.0% |
March 13, 2026 |
| Google Skia Out-of-Bounds Write Vulnerability |
Google Skia contains an out-of-bounds write vulnerability that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products. CVE-2026-3909 Exploit Probability: 1.6% |
March 13, 2026 |
| Google Chromium CSS Use-After-Free Vulnerability |
Google Chromium CSS contains a use-after-free vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2026-2441 Exploit Probability: 22.0% |
February 17, 2026 |
| Google Chromium Out of Bounds Memory Access Vulnerability |
Google Chromium contains an out of bounds memory access vulnerability in ANGLE that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2025-14174 Exploit Probability: 22.7% |
December 12, 2025 |
| Google Chromium V8 Type Confusion Vulnerability |
Google Chromium V8 contains a type confusion vulnerability that allows for heap corruption. CVE-2025-13223 Exploit Probability: 4.9% |
November 19, 2025 |
| Google Chromium V8 Type Confusion Vulnerability |
Google Chromium contains a type confusion vulnerability in the V8 JavaScript and WebAssembly engine. CVE-2025-10585 Exploit Probability: 5.4% |
September 23, 2025 |
| Google Chromium ANGLE and GPU Improper Input Validation Vulnerability |
Google Chromium contains an improper input validation vulnerability in ANGLE and GPU. This vulnerability could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2025-6558 Exploit Probability: 9.0% |
July 22, 2025 |
| Google Chromium V8 Type Confusion Vulnerability |
Google Chromium V8 contains a type confusion vulnerability that could allow a remote attacker to perform arbitrary read/write via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2025-6554 Exploit Probability: 8.6% |
July 2, 2025 |
| Google Chromium V8 Out-of-Bounds Read and Write Vulnerability |
Google Chromium V8 contains an out-of-bounds read and write vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2025-5419 Exploit Probability: 6.5% |
June 5, 2025 |
| Google Chromium Loader Insufficient Policy Enforcement Vulnerability |
Google Chromium contains an insufficient policy enforcement vulnerability that allows a remote attacker to leak cross-origin data via a crafted HTML page. CVE-2025-4664 Exploit Probability: 5.4% |
May 15, 2025 |
| Google Chromium Mojo Sandbox Escape Vulnerability |
Google Chromium Mojo on Windows contains a sandbox escape vulnerability caused by a logic error, which results from an incorrect handle being provided in unspecified circumstances. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2025-2783 Exploit Probability: 8.4% |
March 27, 2025 |
| Google Chromium V8 Inappropriate Implementation Vulnerability |
Google Chromium V8 contains an inappropriate implementation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2024-7965 Exploit Probability: 17.2% |
August 28, 2024 |
| Google Chromium V8 Type Confusion Vulnerability |
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2024-7971 Exploit Probability: 19.3% |
August 26, 2024 |
| Google Chromium V8 Type Confusion Vulnerability |
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2024-5274 Exploit Probability: 10.0% |
May 28, 2024 |
| Google Chromium V8 Type Confusion Vulnerability |
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. CVE-2024-4947 Exploit Probability: 15.1% |
May 20, 2024 |
| Google Chromium V8 Out-of-Bounds Memory Write Vulnerability |
Google Chromium V8 Engine contains an unspecified out-of-bounds memory write vulnerability via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2024-4761 Exploit Probability: 11.0% |
May 16, 2024 |
| Google Chromium Visuals Use-After-Free Vulnerability |
Google Chromium Visuals contains a use-after-free vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CVE-2024-4671 Exploit Probability: 8.3% |
May 13, 2024 |
| Google Chromium V8 Type Confusion Vulnerability |
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. CVE-2023-4762 Exploit Probability: 38.0% |
February 6, 2024 |
8 known exploited Google vulnerabilities are in the top 5% (95th percentile or greater) of the EPSS exploit probability rankings.
Top 10 Riskiest Google Vulnerabilities
Based on the current exploit probability, these Google vulnerabilities are on CISA's Known Exploited vulnerabilities list (KEV) and are ranked by the current EPSS exploit probability.
| Rank | CVE | EPSS | Vulnerability |
|---|---|---|---|
| 1 | CVE-2023-4863 | 99.7% | Google Chromium Heap-Based Buffer Overflow Vulnerability |
| 2 | CVE-2018-17463 | 84.6% | Google Chromium V8 Remote Code Execution Vulnerability |
| 3 | CVE-2020-6418 | 78.8% | Chromium V8 Type Confusion Vulnerability |
| 4 | CVE-2021-21220 | 69.3% | Chromium V8 Input Validation Vulnerability |
| 5 | CVE-2021-30551 | 64.7% | Chromium V8 Type Confusion Vulnerability |
| 6 | CVE-2021-30632 | 64.5% | Google Chrome Out-of-bounds write |
| 7 | CVE-2019-5786 | 61.5% | Google Chrome Use-After-Free Vulnerability |
| 8 | CVE-2018-6065 | 60.3% | Google Chromium V8 Integer Overflow Vulnerability |
| 9 | CVE-2021-21224 | 56.2% | Chromium V8 JavaScript Engine Remote Code Execution Vulnerability |
| 10 | CVE-2019-5825 | 55.9% | Google Chromium V8 Out-of-Bounds Write Vulnerability |
By the Year
In 2026 there have been 2416 vulnerabilities in Google with an average score of 7.1 out of ten. Last year, in 2025 Google had 720 security vulnerabilities published. That is, 1696 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.05
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 2416 | 7.12 |
| 2025 | 720 | 7.17 |
| 2024 | 1125 | 7.29 |
| 2023 | 1564 | 6.66 |
| 2022 | 1592 | 6.85 |
| 2021 | 1166 | 7.11 |
| 2020 | 1033 | 6.87 |
| 2019 | 858 | 7.33 |
| 2018 | 570 | 7.43 |
It may take a day or so for new Google vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Google Security Vulnerabilities
| CVE | Date | Vulnerability | Products |
|---|---|---|---|
| CVE-2026-15587 | Aug 05, 2026 |
Improper Privilege Management in Google SecOps (Chronicle SOAR) versions prior to 6.3.85 on Google Cloud PlatformImproper Privilege Management in Google SecOps (Chronicle SOAR) versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to escalate privileges to system-level administrative access using a crafted internal authentication header. This vulnerability was patched with version 6.3.85, and no customer action is needed. |
|
| CVE-2026-0163 | Aug 04, 2026 |
Android Kernel VPU UAF Enables Remote Priv EscalationIn multiple functions of vpu_ioctl.c, there is a possible use after free due to a use after free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
Android
|
| CVE-2026-10032 | Aug 04, 2026 |
Critical XSS via window.open() in @a2ui/web_core openUrlThe openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary JavaScript executes in the victim application's browser origin, constituting a stored/reflected XSS with Critical severity. No non-default configuration is required; the Basic Catalog is enabled by default. |
|
| CVE-2026-14541 | Jul 31, 2026 |
Google mcp-toolbox 1.4.0: Auth Bypass & Audience Confusion in OAuth ProviderAn authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mcp-toolbox version 1.4.0. When a Google authService is initialized with mcpEnabled: true but lacks an explicitly defined audience or clientId, the ValidateMCPAuth pipeline for opaque tokens skips audience validation entirely. As a result, the toolbox will accept any valid Google OAuth access tokeneven those minted for unrelated ecosystem applicationsgranting unauthorized clients access to protected tools and data backends. |
|
| CVE-2026-14540 | Jul 31, 2026 |
SSRF in Google mcp-toolbox 0.3.01.4.0 HTTP Source ComponentA Server-Side Request Forgery (SSRF) vulnerability exists in the generic HTTP source and tool components of Google mcp-toolbox versions 0.3.0 through 1.4.0. While the toolbox implements baseline input sanitization for user-controlled parameters, the underlying HTTP client (internal/sources/http/http.go) fails to safely regulate request redirection boundaries. Specifically, the client is initialized without a restrictive CheckRedirect policy hook and lacks target IP validation. An attacker or a malicious data-driven prompt can supply a crafted path parameter that triggers an open redirect or a direct destination swap on the target backend, coercing the mcp-toolbox into blindly following the redirection and making unauthorized requests to internal or arbitrary external endpoints. |
|
| CVE-2026-14539 | Jul 31, 2026 |
Google mcp-toolbox <=1.4.0 HTTP DoS via unbounded memory allocationAn allocation of resources without limits vulnerability in the HTTP handler component of Google mcp-toolbox versions up to and including 1.4.0 allows an unauthenticated attacker to cause a denial of service (DoS). The /mcp endpoint handler reads incoming payloads directly into system memory using an unrestricted buffer loop (io.ReadAll) without applying defensive constraints such as http.MaxBytesReader or pre-read Content-Length enforcement. By submitting a single, massive HTTP request body, an attacker can linearly consume available host memory until the runtime process is terminated by an Out-Of-Memory (OOM) error. |
|
| CVE-2026-14538 | Jul 31, 2026 |
Insecure BigQuery Access via dry-run Bypass in Google mcp-toolbox 0.16.1-1.4.0An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1.4.0 allows an authenticated attacker to bypass allowedDatasets validation checks. The toolbox relies on the BigQuery dry-run API to enforce dataset restrictions, but due to a fail-open logic flaw, it bypasses validation when the API returns an empty array for specialized constructs. This allows the attacker to extract structural DDL schemas for explicitly excluded datasets via INFORMATION_SCHEMA, and access downstream federated row data via EXTERNAL_QUERY connections. |
|
| CVE-2026-14537 | Jul 31, 2026 |
Google mcp-toolbox v1.3.0-1.4.0: Unauth HTTP API Tool InvocationIncorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0 and v1.4.0 allows an unauthenticated attacker to invoke tools protected by the scopeRequired feature via sending tool invocation requests through legacy HTTP endpoints when the --enable-api flag is active. |
|
| CVE-2026-18019 | Jul 30, 2026 |
Chrome Media side-channel leak via HTML before 151.0.7922.72Side-channel information leakage in Media in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-18018 | Jul 30, 2026 |
Chrome Windows Updater UI Spoofing before 151.0.7922.72 (low)Inappropriate implementation in Updater in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform UI spoofing via a malicious file. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-18017 | Jul 30, 2026 |
Use-after-free in Dawn (Chrome <151.0.7922.72) allows code execUse after free in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-18016 | Jul 30, 2026 |
Chrome for iOS UI Spoofing via Insufficient Policy Enforcement <151.0.7922.72Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-18015 | Jul 30, 2026 |
Chrome Mac Tint Sandbox Escape via crafted HTML (pre-151.0.7922.72)Inappropriate implementation in Tint in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-18014 | Jul 30, 2026 |
Chrome DevTools Navigation Restriction Bypass <151.0.7922.72Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a malicious file. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-18013 | Jul 30, 2026 |
Chrome iOS HTML UI Spoofing pre-151.0.7922.72Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-18012 | Jul 30, 2026 |
UEF in PDFium (Chrome <151.0.7922.72) RCE via crafted PDFUse after free in PDFium in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-18011 | Jul 30, 2026 |
Chrome iOS <151.0.7922.72: Mem Leak via Physical AccessInappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a local attacker to obtain potentially sensitive information from process memory via physical access to the device. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-18010 | Jul 30, 2026 |
UI Spoofing via Passwords in Chrome <151.0.7922.72Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via malicious network traffic. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-18009 | Jul 30, 2026 |
Chrome 151.0.7922.72 UI Spoofing via Untrusted Input in PasswordsInsufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via malicious network traffic. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-18008 | Jul 30, 2026 |
Chrome <151.0.7922.72 Settings UI Spoofing via Net TrafficInappropriate implementation in Settings in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via malicious network traffic. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-18007 | Jul 30, 2026 |
Chrome Android UI Spoofing via Input (Chrome<151.0.7922.72)Inappropriate implementation in Input in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-18006 | Jul 30, 2026 |
Chrome Lens UI Spoof via HTML (v<=151.0.7922.72)Inappropriate implementation in Google Lens in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-18005 | Jul 30, 2026 |
WebXR memory leak in Chrome before 151.0.7922.72Inappropriate implementation in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-18004 | Jul 30, 2026 |
Chrome Speech API policy enforcement flaw before 151.0.7922.72Insufficient policy enforcement in Speech in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-18003 | Jul 30, 2026 |
Chrome iOS UI Spoofing <151.0.7922.72 (CVE-2026-18003)Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-18002 | Jul 30, 2026 |
Chrome <151.0.7922.72: Google Lens Input Validation => Sandbox EscapeInsufficient validation of untrusted input in Google Lens in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-18001 | Jul 30, 2026 |
Chrome WebGL Mem Leak CVE-2026-18001 (pre151.0.7922.72)Inappropriate implementation in WebGL in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-18000 | Jul 30, 2026 |
Chrome-Android 151.0.7922.72 USB Policy Enf.Insufficient policy enforcement in USB in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-17999 | Jul 30, 2026 |
Chrome Android PIP Race Prior 151.0.7922.72 Domain SpoofingRace in PictureInPicture in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-17998 | Jul 30, 2026 |
Chrome <151.0.7922.72 UI Spoofing via Malicious ExtensionIncorrect security UI in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-17997 | Jul 30, 2026 |
Chrome Passwords Cross-Origin Leakage pre-151.0.7922.72Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-17996 | Jul 30, 2026 |
CVE-2026-17996: Chrome Mac Browser Navigation Bypass 151.0.7922.71Inappropriate implementation in Browser in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to bypass navigation restrictions via a malicious file. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-17995 | Jul 30, 2026 |
OOB read in Dawn via crafted HTML in Chrome <151.0.7922.72Out of bounds read in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-17994 | Jul 30, 2026 |
Google Chrome Android <151.0.7922.72 Media Navigation Bypass via Crafted HTMLInappropriate implementation in Media in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-17993 | Jul 30, 2026 |
Google Chrome Privilege Escalation via Update Race (Windows <151.0.7922.72)Race in Updater in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-17992 | Jul 30, 2026 |
Uninit Use in Skia for Google Chrome <151.0.7922.72 (Win)Uninitialized Use in Skia in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-17991 | Jul 30, 2026 |
Google Chrome Sandbox Escape via WebRender (v<151.0.7922.72)Insufficient validation of untrusted input in AI in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-17990 | Jul 30, 2026 |
Chrome WebAuthn input validation flaw before v151.0.7922.72Insufficient validation of untrusted input in WebAuthn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted PDF file. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-17989 | Jul 30, 2026 |
Type Confusion in V8 Engine of Google Chrome <151.0.7922.72Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-17988 | Jul 30, 2026 |
Chrome 151.0.7922.72 Nav Bypass via Untrusted InputInsufficient validation of untrusted input in Navigation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-17987 | Jul 30, 2026 |
Google Chrome <151.0.7922.72 Notification sandbox escape (PDF)Insufficient validation of untrusted input in Notifications in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted PDF file. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-17986 | Jul 30, 2026 |
Google Chrome 151.0.7922.72 Bluetooth SO Policy BypassInsufficient policy enforcement in Bluetooth in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-17985 | Jul 30, 2026 |
Google Chrome 151.0.7922.72 or earlier Speech API: Site Isolation BypassInsufficient policy enforcement in Speech in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-17984 | Jul 30, 2026 |
Google Chrome Android Crossorigin Data Leak 151.0.7922.72Inappropriate implementation in Browser in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-17982 | Jul 30, 2026 |
Chrome <=151.0.7922.71 Cast Input Validation Exploit Same-Origin BypassInsufficient validation of untrusted input in Cast in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-17981 | Jul 30, 2026 |
Chrome <151.0.7922.72: Blink XSS-CO Data Leak (CVE-2026-17981)Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-17983 | Jul 30, 2026 |
Google Chrome <151.0.7922.72 UI Spoof via Global Media ControlsInappropriate implementation in Global Media Controls in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-17980 | Jul 30, 2026 |
Chrome Android <151.0.7922.72 Cross-Origin Leak via UI GesturesInappropriate implementation in UI in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-17979 | Jul 30, 2026 |
Race in V8 Engine Pre-151.0.7922.72 Chrome Remote Code ExecRace in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|
| CVE-2026-17978 | Jul 30, 2026 |
Side-Channel Leakage in WebCodecs of Google Chrome v<151.0.7922.72Side-channel information leakage in WebCodecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low) |
Chrome
|