Google Chrome Web browser
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Google Chrome.
Recent Google Chrome Security Advisories
| Advisory | Title | Published |
|---|---|---|
| 2026-07-30 | Chrome Releases: Chrome for Android Update (version 151) | July 30, 2026 |
| 2026-07-29 | Chrome Releases: Stable Channel Update for Desktop (version 151.0.7922.71) | July 29, 2026 |
| 2026-07-28 | Chrome Releases: Chrome Stable for iOS Update (version 151) | July 28, 2026 |
| 2026-07-28 | Chrome Releases: Extended Stable Updates for Desktop (version 150.0.7871.212) | July 28, 2026 |
| 2026-07-24 | Chrome Releases: Stable Channel Update for Desktop (version 150.0.7871.186) | July 24, 2026 |
| 2026-07-22 | Chrome Releases: Chrome Stable for iOS Update (version 151) | July 22, 2026 |
| 2026-07-22 | Chrome Releases: Chrome for Android Update (version 150) | July 22, 2026 |
| 2026-07-22 | Chrome Releases: Stable Channel Update for Desktop (version 150.0.7871.181) | July 22, 2026 |
| 2026-07-17 | Chrome Releases: Stable Channel Update for Desktop (version 150.0.7871.128) | July 17, 2026 |
| 2026-07-17 | Chrome Releases: Chrome for Android Update (version 150) | July 17, 2026 |
Known Exploited Google Chrome Vulnerabilities
The following Google Chrome vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.
| Title | Description | Added |
|---|---|---|
| Google Chrome Skia Integer Overflow Vulnerability |
Google Chrome Skia contains an integer overflow vulnerability. Specific impacts from exploitation are not available at this time. This vulnerability resides in Skia which serves as the graphics engine for Google Chrome and ChromeOS, Android, Flutter, and other products. CVE-2023-2136 Exploit Probability: 5.8% |
April 21, 2023 |
| Google Chrome Use-After-Free Vulnerability |
Google Chrome contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption. CVE-2022-3038 Exploit Probability: 24.7% |
March 30, 2023 |
| Google Chrome Heap Buffer Overflow Vulnerability |
Google Chrome GPU contains a heap buffer overflow vulnerability that allows a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. CVE-2022-4135 Exploit Probability: 31.9% |
November 28, 2022 |
| Google Chrome Intents Insufficient Input Validation Vulnerability |
Google Chrome Intents allows for insufficient validation of untrusted input, causing unknown impacts. CISA will update this description if more information becomes available. CVE-2022-2856 Exploit Probability: 4.5% |
August 18, 2022 |
| Google Chrome Use-After-Free Vulnerability |
Use-after-free in WebAudio in Google Chrome allows a remote attacker to potentially exploit heap corruption. CVE-2019-13720 Exploit Probability: 49.1% |
May 23, 2022 |
| Google Chrome Use-After-Free Vulnerability |
Google Chrome contains a heap use-after-free vulnerability which allows an attacker to potentially perform out of bounds memory access. CVE-2019-5786 Exploit Probability: 61.5% |
May 23, 2022 |
| Google Chrome Use-After-Free Vulnerability |
The vulnerability exists due to a use-after-free error within the Animation component in Google Chrome. CVE-2022-0609 Exploit Probability: 21.8% |
February 15, 2022 |
| Google Chrome Prior to 81.0.4044.92 Use-After-Free Vulnerability |
Use-after-free vulnerability in Media in Google Chrome prior to 81.0.4044.92 allowed a Remote attacker to execute arbitrary code via a crafted HTML page. CVE-2020-6572 Exploit Probability: 10.6% |
January 10, 2022 |
| Google Chrome Browser V8 Arbitrary Code Execution |
Type Confusion in V8 in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-30563 Exploit Probability: 8.9% |
November 3, 2021 |
| Google Chrome FreeType Memory Corruption |
Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2020-15999 Exploit Probability: 50.6% |
November 3, 2021 |
| Google Chrome WebGL Use-After-Free Vulnerability |
Use after free in WebGL in Google Chrome prior to 91.0.4472.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-30554 Exploit Probability: 7.4% |
November 3, 2021 |
| Google Chrome Use-After-Free Vulnerability |
Google Chrome use-after-free error within the V8 browser engine. CVE-2021-37975 Exploit Probability: 34.9% |
November 3, 2021 |
| Google Chrome Use-After-Free Vulnerability |
Use-after-free weakness in Portals, Google's new web page navigation system for Chrome. Successful exploitation can let attackers to execute code. CVE-2021-37973 Exploit Probability: 11.7% |
November 3, 2021 |
| Google Chrome Use-After-Free Vulnerability |
Google Chrome Use-After-Free vulnerability CVE-2021-30633 Exploit Probability: 32.7% |
November 3, 2021 |
| Google Chrome Out-of-bounds write |
Google Chrome out-of-bounds write that allows to execute arbitrary code on the target system. CVE-2021-30632 Exploit Probability: 64.5% |
November 3, 2021 |
| Google Chrome Information Leakage |
Information disclosure in Google Chrome that exists due to excessive data output in core. CVE-2021-37976 Exploit Probability: 19.9% |
November 3, 2021 |
| Google Chrome Site Isolation Component Use-After-Free Remote Code Execution vulnerability |
Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. CVE-2020-16017 Exploit Probability: 2.7% |
November 3, 2021 |
| Google Chrome Heap Buffer Overflow in WebAudio Vulnerability |
Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-21166 Exploit Probability: 23.8% |
November 3, 2021 |
Of the known exploited vulnerabilities above, 2 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings. 11 known exploited Google Chrome vulnerabilities are in the top 5% (95th percentile or greater) of the EPSS exploit probability rankings.
EOL Dates
Ensure that you are using a supported version of Google Chrome. Here are some end of life, and end of support dates for Google Chrome.
| Release | EOL Date | Status |
|---|---|---|
| 151 | July 28, 2026 |
EOL
Google Chrome 151 became EOL in 2026. |
| 150 | July 28, 2026 |
EOL
Google Chrome 150 became EOL in 2026. |
| 149 | June 30, 2026 |
EOL
Google Chrome 149 became EOL in 2026. |
| 148 | June 2, 2026 |
EOL
Google Chrome 148 became EOL in 2026. |
| 147 | May 5, 2026 |
EOL
Google Chrome 147 became EOL in 2026. |
| 146 | April 7, 2026 |
EOL
Google Chrome 146 became EOL in 2026. |
| 145 | March 10, 2026 |
EOL
Google Chrome 145 became EOL in 2026. |
| 144 | February 10, 2026 |
EOL
Google Chrome 144 became EOL in 2026. |
| 143 | January 13, 2026 |
EOL
Google Chrome 143 became EOL in 2026. |
| 142 | December 2, 2025 |
EOL
Google Chrome 142 became EOL in 2025. |
| 141 | October 28, 2025 |
EOL
Google Chrome 141 became EOL in 2025. |
| 140 | September 30, 2025 |
EOL
Google Chrome 140 became EOL in 2025. |
| 139 | September 2, 2025 |
EOL
Google Chrome 139 became EOL in 2025. |
| 138 | August 5, 2025 |
EOL
Google Chrome 138 became EOL in 2025. |
| 137 | June 24, 2025 |
EOL
Google Chrome 137 became EOL in 2025. |
| 136 | May 27, 2025 |
EOL
Google Chrome 136 became EOL in 2025. |
| 135 | April 29, 2025 |
EOL
Google Chrome 135 became EOL in 2025. |
| 134 | April 1, 2025 |
EOL
Google Chrome 134 became EOL in 2025. |
| 133 | March 4, 2025 |
EOL
Google Chrome 133 became EOL in 2025. |
| 132 | February 4, 2025 |
EOL
Google Chrome 132 became EOL in 2025. |
By the Year
In 2026 there have been 2079 vulnerabilities in Google Chrome with an average score of 7.1 out of ten. Last year, in 2025 Chrome had 247 security vulnerabilities published. That is, 1832 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.01.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 2079 | 7.11 |
| 2025 | 247 | 7.10 |
| 2024 | 290 | 7.70 |
| 2023 | 331 | 7.40 |
| 2022 | 356 | 7.95 |
| 2021 | 373 | 7.96 |
| 2020 | 264 | 8.02 |
| 2019 | 353 | 7.34 |
| 2018 | 127 | 7.10 |
It may take a day or so for new Chrome vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Google Chrome Security Vulnerabilities
Chrome Media side-channel leak via HTML before 151.0.7922.72
CVE-2026-18019
4.3 - Medium
- July 30, 2026
Side-channel information leakage in Media in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
Improper Protection Against Physical Side Channels
Chrome Windows Updater UI Spoofing before 151.0.7922.72 (low)
CVE-2026-18018
4 - Medium
- July 30, 2026
Inappropriate implementation in Updater in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform UI spoofing via a malicious file. (Chromium security severity: Low)
User Interface (UI) Misrepresentation of Critical Information
Use-after-free in Dawn (Chrome <151.0.7922.72) allows code exec
CVE-2026-18017
8.8 - High
- July 30, 2026
Use after free in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)
Dangling pointer
Chrome for iOS UI Spoofing via Insufficient Policy Enforcement <151.0.7922.72
CVE-2026-18016
4.3 - Medium
- July 30, 2026
Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
Origin Validation Error
Chrome Mac Tint Sandbox Escape via crafted HTML (pre-151.0.7922.72)
CVE-2026-18015
9.6 - Critical
- July 30, 2026
Inappropriate implementation in Tint in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)
Protection Mechanism Failure
Chrome DevTools Navigation Restriction Bypass <151.0.7922.72
CVE-2026-18014
6.5 - Medium
- July 30, 2026
Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a malicious file. (Chromium security severity: Low)
Improper Input Validation
Chrome iOS HTML UI Spoofing pre-151.0.7922.72
CVE-2026-18013
4.3 - Medium
- July 30, 2026
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
User Interface (UI) Misrepresentation of Critical Information
UEF in PDFium (Chrome <151.0.7922.72) RCE via crafted PDF
CVE-2026-18012
8.8 - High
- July 30, 2026
Use after free in PDFium in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Low)
Dangling pointer
Chrome iOS <151.0.7922.72: Mem Leak via Physical Access
CVE-2026-18011
2.4 - Low
- July 30, 2026
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a local attacker to obtain potentially sensitive information from process memory via physical access to the device. (Chromium security severity: Low)
Information Disclosure
UI Spoofing via Passwords in Chrome <151.0.7922.72
CVE-2026-18010
4.3 - Medium
- July 30, 2026
Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via malicious network traffic. (Chromium security severity: Low)
User Interface (UI) Misrepresentation of Critical Information
Chrome 151.0.7922.72 UI Spoofing via Untrusted Input in Passwords
CVE-2026-18009
4.3 - Medium
- July 30, 2026
Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via malicious network traffic. (Chromium security severity: Low)
Improper Input Validation
Chrome <151.0.7922.72 Settings UI Spoofing via Net Traffic
CVE-2026-18008
4.3 - Medium
- July 30, 2026
Inappropriate implementation in Settings in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via malicious network traffic. (Chromium security severity: Low)
User Interface (UI) Misrepresentation of Critical Information
Chrome Android UI Spoofing via Input (Chrome<151.0.7922.72)
CVE-2026-18007
4.3 - Medium
- July 30, 2026
Inappropriate implementation in Input in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
User Interface (UI) Misrepresentation of Critical Information
Chrome Lens UI Spoof via HTML (v<=151.0.7922.72)
CVE-2026-18006
4.3 - Medium
- July 30, 2026
Inappropriate implementation in Google Lens in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
User Interface (UI) Misrepresentation of Critical Information
WebXR memory leak in Chrome before 151.0.7922.72
CVE-2026-18005
6.5 - Medium
- July 30, 2026
Inappropriate implementation in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
Information Disclosure
Chrome Speech API policy enforcement flaw before 151.0.7922.72
CVE-2026-18004
4.3 - Medium
- July 30, 2026
Insufficient policy enforcement in Speech in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
Authorization
Chrome iOS UI Spoofing <151.0.7922.72 (CVE-2026-18003)
CVE-2026-18003
4.3 - Medium
- July 30, 2026
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
User Interface (UI) Misrepresentation of Critical Information
Chrome <151.0.7922.72: Google Lens Input Validation => Sandbox Escape
CVE-2026-18002
9.6 - Critical
- July 30, 2026
Insufficient validation of untrusted input in Google Lens in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)
Improper Input Validation
Chrome WebGL Mem Leak CVE-2026-18001 (pre151.0.7922.72)
CVE-2026-18001
6.5 - Medium
- July 30, 2026
Inappropriate implementation in WebGL in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
Information Disclosure
Chrome-Android 151.0.7922.72 USB Policy Enf.
CVE-2026-18000
3.1 - Low
- July 30, 2026
Insufficient policy enforcement in USB in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
Origin Validation Error
Chrome Android PIP Race Prior 151.0.7922.72 Domain Spoofing
CVE-2026-17999
6.5 - Medium
- July 30, 2026
Race in PictureInPicture in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low)
Race Condition
Chrome <151.0.7922.72 UI Spoofing via Malicious Extension
CVE-2026-17998
4.3 - Medium
- July 30, 2026
Incorrect security UI in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low)
User Interface (UI) Misrepresentation of Critical Information
OOB read in Dawn via crafted HTML in Chrome <151.0.7922.72
CVE-2026-17995
8.1 - High
- July 30, 2026
Out of bounds read in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Low)
Out-of-bounds Read
CVE-2026-17996: Chrome Mac Browser Navigation Bypass 151.0.7922.71
CVE-2026-17996
6.2 - Medium
- July 30, 2026
Inappropriate implementation in Browser in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to bypass navigation restrictions via a malicious file. (Chromium security severity: Low)
Authorization
Chrome Passwords Cross-Origin Leakage pre-151.0.7922.72
CVE-2026-17997
3.1 - Low
- July 30, 2026
Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
Origin Validation Error
Google Chrome Android <151.0.7922.72 Media Navigation Bypass via Crafted HTML
CVE-2026-17994
4.3 - Medium
- July 30, 2026
Inappropriate implementation in Media in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)
Authorization
Google Chrome Privilege Escalation via Update Race (Windows <151.0.7922.72)
CVE-2026-17993
7 - High
- July 30, 2026
Race in Updater in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: Low)
Race Condition
Uninit Use in Skia for Google Chrome <151.0.7922.72 (Win)
CVE-2026-17992
6.5 - Medium
- July 30, 2026
Uninitialized Use in Skia in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
Use of Uninitialized Variable
Google Chrome Sandbox Escape via WebRender (v<151.0.7922.72)
CVE-2026-17991
9.6 - Critical
- July 30, 2026
Insufficient validation of untrusted input in AI in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)
Improper Input Validation
Chrome WebAuthn input validation flaw before v151.0.7922.72
CVE-2026-17990
9.6 - Critical
- July 30, 2026
Insufficient validation of untrusted input in WebAuthn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted PDF file. (Chromium security severity: Low)
Improper Input Validation
Type Confusion in V8 Engine of Google Chrome <151.0.7922.72
CVE-2026-17989
8.8 - High
- July 30, 2026
Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)
Object Type Confusion
Chrome 151.0.7922.72 Nav Bypass via Untrusted Input
CVE-2026-17988
6.5 - Medium
- July 30, 2026
Insufficient validation of untrusted input in Navigation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)
Improper Input Validation
Google Chrome <151.0.7922.72 Notification sandbox escape (PDF)
CVE-2026-17987
9.6 - Critical
- July 30, 2026
Insufficient validation of untrusted input in Notifications in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted PDF file. (Chromium security severity: Low)
Improper Input Validation
Google Chrome 151.0.7922.72 Bluetooth SO Policy Bypass
CVE-2026-17986
6.5 - Medium
- July 30, 2026
Insufficient policy enforcement in Bluetooth in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)
Authorization
Google Chrome 151.0.7922.72 or earlier Speech API: Site Isolation Bypass
CVE-2026-17985
6.5 - Medium
- July 30, 2026
Insufficient policy enforcement in Speech in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)
Client-Side Enforcement of Server-Side Security
Google Chrome Android Crossorigin Data Leak 151.0.7922.72
CVE-2026-17984
3.3 - Low
- July 30, 2026
Inappropriate implementation in Browser in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
Origin Validation Error
Google Chrome <151.0.7922.72 UI Spoof via Global Media Controls
CVE-2026-17983
4.3 - Medium
- July 30, 2026
Inappropriate implementation in Global Media Controls in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
User Interface (UI) Misrepresentation of Critical Information
Chrome <=151.0.7922.71 Cast Input Validation Exploit Same-Origin Bypass
CVE-2026-17982
4.3 - Medium
- July 30, 2026
Insufficient validation of untrusted input in Cast in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)
Improper Input Validation
Chrome <151.0.7922.72: Blink XSS-CO Data Leak (CVE-2026-17981)
CVE-2026-17981
4.3 - Medium
- July 30, 2026
Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
Origin Validation Error
Chrome Android <151.0.7922.72 Cross-Origin Leak via UI Gestures
CVE-2026-17980
3.1 - Low
- July 30, 2026
Inappropriate implementation in UI in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
User Interface (UI) Misrepresentation of Critical Information
Race in V8 Engine Pre-151.0.7922.72 Chrome Remote Code Exec
CVE-2026-17979
7.5 - High
- July 30, 2026
Race in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)
Race Condition
Side-Channel Leakage in WebCodecs of Google Chrome v<151.0.7922.72
CVE-2026-17978
5.3 - Medium
- July 30, 2026
Side-channel information leakage in WebCodecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
Improper Protection Against Physical Side Channels
Google Chrome 151.0.7922.72 CSS policy bypass leak
CVE-2026-17977
4.3 - Medium
- July 30, 2026
Policy bypass in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
Origin Validation Error
Google Chrome151.0.7922.72 Ext DACL Bypass via Crafted Domain
CVE-2026-17976
4.3 - Medium
- July 30, 2026
Insufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to bypass discretionary access control via a crafted domain name. (Chromium security severity: Low)
Authorization
CVE-2026-17975: Chrome IME Memory Disclosure on macOS <151.0.7922.72
CVE-2026-17975
6.5 - Medium
- July 30, 2026
Inappropriate implementation in IME in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
Information Disclosure
Chrome DevTools Policy Bypass before 151.0.7922.72 via crafted HTML
CVE-2026-17974
6.5 - Medium
- July 30, 2026
Insufficient policy enforcement in DevTools in Google Chrome prior to 151.0.7922.72 allowed a local attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)
Client-Side Enforcement of Server-Side Security
Google Chrome Mac <151.0.7922.72 Views Memory Leak
CVE-2026-17973
5.5 - Medium
- July 30, 2026
Inappropriate implementation in Views in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
Information Disclosure
Chrome iOS <151.0.7922.72 UI Spoofing Vulnerability
CVE-2026-17972
4.3 - Medium
- July 30, 2026
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
User Interface (UI) Misrepresentation of Critical Information
Google Chrome < 151.0.7922.72 Passwords RCE via Crafted HTML
CVE-2026-17969
8.8 - High
- July 30, 2026
Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)
Improper Privilege Management
UI Spoofing via Untrusted Inputs in Google Chrome <151.0.7922.72
CVE-2026-17970
4.3 - Medium
- July 30, 2026
Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed an attacker in a privileged network position to perform UI spoofing via malicious network traffic. (Chromium security severity: Low)
Improper Input Validation
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Google Chrome or by Google? Click the Watch button to subscribe.
