Google Chrome Web browser
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Google Chrome.
Recent Google Chrome Security Advisories
| Advisory | Title | Published |
|---|---|---|
| 2026-11-06 | Chrome Releases: Chrome for Android Update (version 157) | November 6, 2026 |
| 2026-11-05 | Chrome Releases: November 2026 | November 5, 2026 |
| 2026-11-05 | Chrome Releases: Chrome for Android Update (version 157) | November 5, 2026 |
| 2026-11-03 | Chrome Releases: Stable Channel Update for Desktop (version 157) | November 3, 2026 |
| 2026-10-31 | Chrome Releases: Stable Channel Update for Desktop (version 156.0.8078.79) | October 31, 2026 |
| 2026-10-31 | Chrome Releases: Chrome for Android Update (version 156) | October 31, 2026 |
| 2026-10-28 | Chrome Releases: Chrome Stable for iOS Update (version 157) | October 28, 2026 |
| 2026-10-28 | Chrome Releases: Stable Channel Update for Desktop (version 156.0.8078.73) | October 28, 2026 |
| 2026-10-28 | Chrome Releases: Chrome for Android Update (version 156) | October 28, 2026 |
| 2026-10-23 | Chrome Releases: Chrome Stable for iOS Update (version 156) | October 23, 2026 |
Known Exploited Google Chrome Vulnerabilities
The following Google Chrome vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.
| Title | Description | Added |
|---|---|---|
| Google Chrome Skia Integer Overflow Vulnerability |
Google Chrome Skia contains an integer overflow vulnerability. Specific impacts from exploitation are not available at this time. This vulnerability resides in Skia which serves as the graphics engine for Google Chrome and ChromeOS, Android, Flutter, and other products. CVE-2023-2136 Exploit Probability: 5.8% |
April 21, 2023 |
| Google Chrome Use-After-Free Vulnerability |
Google Chrome contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption. CVE-2022-3038 Exploit Probability: 24.9% |
March 30, 2023 |
| Google Chrome Heap Buffer Overflow Vulnerability |
Google Chrome GPU contains a heap buffer overflow vulnerability that allows a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. CVE-2022-4135 Exploit Probability: 31.9% |
November 28, 2022 |
| Google Chrome Intents Insufficient Input Validation Vulnerability |
Google Chrome Intents allows for insufficient validation of untrusted input, causing unknown impacts. CISA will update this description if more information becomes available. CVE-2022-2856 Exploit Probability: 4.6% |
August 18, 2022 |
| Google Chrome Use-After-Free Vulnerability |
Use-after-free in WebAudio in Google Chrome allows a remote attacker to potentially exploit heap corruption. CVE-2019-13720 Exploit Probability: 49.4% |
May 23, 2022 |
| Google Chrome Use-After-Free Vulnerability |
Google Chrome contains a heap use-after-free vulnerability which allows an attacker to potentially perform out of bounds memory access. CVE-2019-5786 Exploit Probability: 61.1% |
May 23, 2022 |
| Google Chrome Use-After-Free Vulnerability |
The vulnerability exists due to a use-after-free error within the Animation component in Google Chrome. CVE-2022-0609 Exploit Probability: 22.4% |
February 15, 2022 |
| Google Chrome Prior to 81.0.4044.92 Use-After-Free Vulnerability |
Use-after-free vulnerability in Media in Google Chrome prior to 81.0.4044.92 allowed a Remote attacker to execute arbitrary code via a crafted HTML page. CVE-2020-6572 Exploit Probability: 10.6% |
January 10, 2022 |
| Google Chrome Browser V8 Arbitrary Code Execution |
Type Confusion in V8 in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-30563 Exploit Probability: 9.0% |
November 3, 2021 |
| Google Chrome FreeType Memory Corruption |
Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2020-15999 Exploit Probability: 63.9% |
November 3, 2021 |
| Google Chrome WebGL Use-After-Free Vulnerability |
Use after free in WebGL in Google Chrome prior to 91.0.4472.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-30554 Exploit Probability: 7.4% |
November 3, 2021 |
| Google Chrome Use-After-Free Vulnerability |
Google Chrome use-after-free error within the V8 browser engine. CVE-2021-37975 Exploit Probability: 34.9% |
November 3, 2021 |
| Google Chrome Use-After-Free Vulnerability |
Use-after-free weakness in Portals, Google's new web page navigation system for Chrome. Successful exploitation can let attackers to execute code. CVE-2021-37973 Exploit Probability: 11.7% |
November 3, 2021 |
| Google Chrome Use-After-Free Vulnerability |
Google Chrome Use-After-Free vulnerability CVE-2021-30633 Exploit Probability: 33.2% |
November 3, 2021 |
| Google Chrome Out-of-bounds write |
Google Chrome out-of-bounds write that allows to execute arbitrary code on the target system. CVE-2021-30632 Exploit Probability: 63.2% |
November 3, 2021 |
| Google Chrome Information Leakage |
Information disclosure in Google Chrome that exists due to excessive data output in core. CVE-2021-37976 Exploit Probability: 19.9% |
November 3, 2021 |
| Google Chrome Site Isolation Component Use-After-Free Remote Code Execution vulnerability |
Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. CVE-2020-16017 Exploit Probability: 2.7% |
November 3, 2021 |
| Google Chrome Heap Buffer Overflow in WebAudio Vulnerability |
Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-21166 Exploit Probability: 24.0% |
November 3, 2021 |
Of the known exploited vulnerabilities above, 3 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings. 11 known exploited Google Chrome vulnerabilities are in the top 5% (95th percentile or greater) of the EPSS exploit probability rankings.
EOL Dates
Ensure that you are using a supported version of Google Chrome. Here are some end of life, and end of support dates for Google Chrome.
| Release | EOL Date | Status |
|---|---|---|
| 157 | November 17, 2026 |
EOL This Year
Google Chrome 157 will become EOL this year, in November 2026. |
| 156 | November 3, 2026 |
EOL
Google Chrome 156 became EOL in 2026. |
| 155 | October 20, 2026 |
EOL
Google Chrome 155 became EOL in 2026. |
| 154 | October 6, 2026 |
EOL
Google Chrome 154 became EOL in 2026. |
| 153 | September 22, 2026 |
EOL
Google Chrome 153 became EOL in 2026. |
| 152 | September 8, 2026 |
EOL
Google Chrome 152 became EOL in 2026. |
| 151 | August 25, 2026 |
EOL
Google Chrome 151 became EOL in 2026. |
| 150 | July 28, 2026 |
EOL
Google Chrome 150 became EOL in 2026. |
| 149 | June 30, 2026 |
EOL
Google Chrome 149 became EOL in 2026. |
| 148 | June 2, 2026 |
EOL
Google Chrome 148 became EOL in 2026. |
| 147 | May 5, 2026 |
EOL
Google Chrome 147 became EOL in 2026. |
| 146 | April 7, 2026 |
EOL
Google Chrome 146 became EOL in 2026. |
| 145 | March 10, 2026 |
EOL
Google Chrome 145 became EOL in 2026. |
| 144 | February 10, 2026 |
EOL
Google Chrome 144 became EOL in 2026. |
| 143 | January 13, 2026 |
EOL
Google Chrome 143 became EOL in 2026. |
| 142 | December 2, 2025 |
EOL
Google Chrome 142 became EOL in 2025. |
| 141 | October 28, 2025 |
EOL
Google Chrome 141 became EOL in 2025. |
| 140 | September 30, 2025 |
EOL
Google Chrome 140 became EOL in 2025. |
| 139 | September 2, 2025 |
EOL
Google Chrome 139 became EOL in 2025. |
| 138 | August 5, 2025 |
EOL
Google Chrome 138 became EOL in 2025. |
By the Year
In 2026 there have been 3797 vulnerabilities in Google Chrome with an average score of 7.2 out of ten. Last year, in 2025 Chrome had 247 security vulnerabilities published. That is, 3550 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.09.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 3797 | 7.18 |
| 2025 | 247 | 7.10 |
| 2024 | 290 | 7.71 |
| 2023 | 331 | 7.40 |
| 2022 | 356 | 7.95 |
| 2021 | 373 | 7.96 |
| 2020 | 264 | 8.14 |
| 2019 | 353 | 7.34 |
| 2018 | 128 | 7.10 |
It may take a day or so for new Chrome vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Google Chrome Security Vulnerabilities
Google Chrome <156.0.8078.47: Blink Unauthorized Origin Policy Bypass
CVE-2026-120930
5.4 - Medium
- November 03, 2026
Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
AuthZ
Google Chrome Android <156.0.8078.47: OOB Write in WebGL Exposes RCE
CVE-2026-120931
9.6 - Critical
- November 03, 2026
Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Memory Corruption
Chrome Performance Improper Input Validation (<=157.0.8103.38)
CVE-2026-121064
7.8 - High
- November 03, 2026
Improper input validation in Performance in Google Chrome prior to 157.0.8103.38 allowed a local attacker to potentially execute arbitrary code inside the sandbox via a local program. (Chromium security severity: Low)
Improper Input Validation
Google Chrome <157.0.8103.38 Editing Input Validation Bypass
CVE-2026-121141
5.4 - Medium
- November 03, 2026
Improper input validation in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
Improper Input Validation
Chrome DevTools Missing Auth (157.0.8103.38) Bypass Web Origin via Extension
CVE-2026-121169
- November 03, 2026
Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low)
AuthZ
Google Chrome <157.0.8103.38: TrustedTypes Auth Bypass via Crafted HTML
CVE-2026-121195
8.8 - High
- November 03, 2026
Incorrect authorization in TrustedTypes in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
AuthZ
Missing Auth in Chrome 157.0.8103.38 Input, allows info leak
CVE-2026-121041
6.5 - Medium
- November 03, 2026
Missing authorization in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
AuthZ
Chrome Before 157.0.8103.38 UAF in Track Enables Remote Code Exec
CVE-2026-121069
8.8 - High
- November 03, 2026
Use after free in Track in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Dangling pointer
OOB Read in Chrome Animation before v157.0.8103.38
CVE-2026-121093
- November 03, 2026
Out of bounds read in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Out-of-bounds Read
Google Chrome <157.0.8103.38: Network Auth Bypass via Extension
CVE-2026-121142
- November 03, 2026
Incorrect authorization in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low)
AuthZ
Google Chrome <157.0.8103.38: Incorrect Auth in Core (Co-installed App)
CVE-2026-121232
5.1 - Medium
- November 03, 2026
Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Low)
AuthZ
Chrome ANGLE Race Condition <157.0.8103.38 Remote Code Exec
CVE-2026-121230
8.3 - High
- November 03, 2026
Race condition in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Race Condition
Google Chrome <157.0.8103.38 ORBAuth Bypass Site Isolation (CVE-2026-121029)
CVE-2026-121029
- November 03, 2026
Incorrect authorization in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)
AuthZ
Google Chrome <157.0.8103.38 XML State Validation Bypass
CVE-2026-121054
8.8 - High
- November 03, 2026
Improper state validation in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
Improper Check for Unusual or Exceptional Conditions
UA-FREE in Chrome Network (157.0.8103.37)
CVE-2026-121073
9.6 - Critical
- November 03, 2026
Use after free in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Low)
Dangling pointer
Google Chrome <157.0.8103.38: Uncontrolled Recursion in SVG
CVE-2026-121092
8.8 - High
- November 03, 2026
Uncontrolled recursion in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Stack Exhaustion
ORB Resource Exposure Bypass Site Isolation in Chrome <157.0.8103.38
CVE-2026-121175
- November 03, 2026
Improper resource exposure in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)
Exposure of Resource to Wrong Sphere
Google Chrome <157.0.8103.38: Notification UI Spoofing Vulnerability
CVE-2026-121162
5.4 - Medium
- November 03, 2026
UI misrepresentation in Notifications in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
User Interface (UI) Misrepresentation of Critical Information
Google Chrome UI Spoofing before 157.0.8103.38 on Mac
CVE-2026-121045
5.4 - Medium
- November 03, 2026
UI misrepresentation in Browser in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
User Interface (UI) Misrepresentation of Critical Information
Chrome UI Misrepresentation in Passwords before 157.0.8103.38 (CVE-2026-121081)
CVE-2026-121081
5.9 - Medium
- November 03, 2026
UI misrepresentation in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to obtain sensitive information via crafted network traffic. (Chromium security severity: Low)
User Interface (UI) Misrepresentation of Critical Information
Confused Deputy in Chrome WebUI Prior to 157.0.8103.38
CVE-2026-121198
8.8 - High
- November 03, 2026
Confused deputy in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
Confused Deputy
Google Chrome Permissions Auth Bypass <157.0.8103.38 via Crafted HTML
CVE-2026-121225
- November 03, 2026
Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
AuthZ
Chrome Variations Input Validation Flaw 157.0.8103.38 (Remote Bypass)
CVE-2026-121240
- November 03, 2026
Improper input validation in Variations in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)
Improper Input Validation
Race Condition in Chrome Mobile iOS <=157.0.8103.38: Origin Policy Bypass
CVE-2026-121050
8.8 - High
- November 03, 2026
Race condition in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
TOCTTOU
Google Chrome <157.0.8103.38 History Auth Bypass via Crafted HTML (Low)
CVE-2026-121159
- November 03, 2026
Incorrect authorization in History in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
AuthZ
Chrome DevTools Origin Policy Bypass <157.0.8103.38
CVE-2026-121204
8.8 - High
- November 03, 2026
Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
Insufficient Cleanup
CORS Auth Bypass in Chrome <157.0.8103.38
CVE-2026-121205
8.8 - High
- November 03, 2026
Incorrect authorization in CORS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
AuthZ
Google Chrome <157.0.8103.38: WebUI Auth Bypass via Crafted HTML
CVE-2026-121085
- November 03, 2026
Incorrect authorization in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Low)
AuthZ
Google Chrome UI Spoofing via crafted HTML Before 157.0.8103.38
CVE-2026-121206
5.4 - Medium
- November 03, 2026
UI misrepresentation in Isolated in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
User Interface (UI) Misrepresentation of Critical Information
Chrome UI Spoofing via PageInfo UI Misrepresentation Before 157.0.8103.38
CVE-2026-121121
5.4 - Medium
- November 03, 2026
UI misrepresentation in PageInfo in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
User Interface (UI) Misrepresentation of Critical Information
Google Chrome <157.0.8103.38: V8 Missing Auth Bypass of Origin Policy
CVE-2026-121251
8.8 - High
- November 03, 2026
Missing authorization in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
AuthZ
UAF in Chrome Browser <157.0.8103.38
CVE-2026-121189
9.6 - Critical
- November 03, 2026
Use after free in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Dangling pointer
Chrome 157 Forms Info Leak (pre-157.0.8103.38)
CVE-2026-121130
5.3 - Medium
- November 03, 2026
Observable discrepancy in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
Side Channel Attack
Chrome <157 DevTools Auth Bypass via Extension CVE-2026-121101
CVE-2026-121101
- November 03, 2026
Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions into a privileged page via a crafted Chrome extension. (Chromium security severity: Low)
AuthZ
Chrome Mobile Android <157.0.8103.38 UI Misrep Spoof via Crafted HTML
CVE-2026-121165
5.4 - Medium
- November 03, 2026
UI misrepresentation in Mobile in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
User Interface (UI) Misrepresentation of Critical Information
Chrome <157.0.8103.38: DevTools Missing Auth, Bypass Site Isolation via crafted extension
CVE-2026-121253
- November 03, 2026
Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass site isolation via a crafted Chrome extension. (Chromium security severity: Low)
AuthZ
Chrome UI Spoofing via Incorrect Auth <157.0.8103.38
CVE-2026-121172
5.4 - Medium
- November 03, 2026
Incorrect authorization in Isolated in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
AuthZ
Google Chrome DevTools Access Bypass <157.0.8103.38
CVE-2026-121055
- November 03, 2026
Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Low)
Insufficient Cleanup
Chrome Network Component XSS via Input Validation (before 157.0.8103.38)
CVE-2026-121236
8.8 - High
- November 03, 2026
Improper input validation in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
Improper Input Validation
Authorization Bypass via Crafted HTML in Google Chrome <157.0.8103.38
CVE-2026-121252
8.8 - High
- November 03, 2026
Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
AuthZ
Google Chrome <157.0.8103.38: CORS Discrepancy Enables CrossOrigin Leak
CVE-2026-121138
6.5 - Medium
- November 03, 2026
Observable discrepancy in CORS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low)
Side Channel Attack
Google Chrome <157.0.8103.38: HID Authorization Bypass via Crafted HTML
CVE-2026-121111
- November 03, 2026
Incorrect authorization in HID in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
AuthZ
Chrome DevTools Resource Exposure 157.0.8103.38 Arbitrary Code HTML
CVE-2026-121168
8.8 - High
- November 03, 2026
Improper resource exposure in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Exposure of Resource to Wrong Sphere
Chrome Payments UI Spoofing Prior 157.0.8103.38
CVE-2026-121043
5.4 - Medium
- November 03, 2026
UI misrepresentation in Payments in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
User Interface (UI) Misrepresentation of Critical Information
Info Leak: Chrome Paint (pre 157.0.8103.38)
CVE-2026-121235
6.5 - Medium
- November 03, 2026
Information leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
Information Disclosure
Incorrect Auth in WebAppInstalls (Chrome <157.0.8103.38) spoof address bar
CVE-2026-121046
- November 03, 2026
Incorrect authorization in WebAppInstalls in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page. (Chromium security severity: Low)
AuthZ
Chrome <157.0.8103.38: Form Auth Bypass via Crafted HTML
CVE-2026-121222
8.8 - High
- November 03, 2026
Incorrect authorization in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
AuthZ
Chrome ServiceWorker Info Leak before 157.0.8103.38
CVE-2026-121125
5.3 - Medium
- November 03, 2026
Information leak in ServiceWorker in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
Information Disclosure
Illegal Authorization in Google Chrome Chromoting <157.0.8103.38
CVE-2026-121157
- November 03, 2026
Incorrect authorization in Chromoting in Google Chrome prior to 157.0.8103.38 allowed a local attacker to bypass system access restrictions via a local program. (Chromium security severity: Low)
AuthZ
Info Leak via Frames in Google Chrome <157.0.8103.38
CVE-2026-121243
6.5 - Medium
- November 03, 2026
Information leak in Frames in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
Information Disclosure
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Google Chrome or by Google? Click the Watch button to subscribe.
