Google Chrome Web browser
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Google Chrome.
Recent Google Chrome Security Advisories
| Advisory | Title | Published |
|---|---|---|
| 2026-09-04 | Chrome Releases: Chrome for Android Update (version 152) | September 4, 2026 |
| 2026-09-03 | Chrome Releases: Stable Channel Update for Desktop (version 152.0.7977.82) | September 3, 2026 |
| 2026-09-02 | Chrome Releases: September 2026 | September 2, 2026 |
| 2026-09-02 | Chrome Releases: Chrome Stable for iOS Update (version 153) | September 2, 2026 |
| 2026-09-02 | Chrome Releases: Stable Channel Update for Desktop (version 152.0.7977.75) | September 2, 2026 |
| 2026-09-02 | Chrome Releases: Chrome for Android (version 152) | September 2, 2026 |
| 2026-08-26 | Chrome Releases: Chrome for Android Update (version 152) | August 26, 2026 |
| 2026-08-26 | Chrome Releases: Stable Channel Update for Desktop (version 152) | August 26, 2026 |
| 2026-08-21 | Chrome Releases: Stable Channel Update for Desktop (version 151.0.7922.173) | August 21, 2026 |
| 2026-08-21 | Chrome Releases: Chrome for Android Update (version 151) | August 21, 2026 |
Known Exploited Google Chrome Vulnerabilities
The following Google Chrome vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.
| Title | Description | Added |
|---|---|---|
| Google Chrome Skia Integer Overflow Vulnerability |
Google Chrome Skia contains an integer overflow vulnerability. Specific impacts from exploitation are not available at this time. This vulnerability resides in Skia which serves as the graphics engine for Google Chrome and ChromeOS, Android, Flutter, and other products. CVE-2023-2136 Exploit Probability: 5.7% |
April 21, 2023 |
| Google Chrome Use-After-Free Vulnerability |
Google Chrome contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption. CVE-2022-3038 Exploit Probability: 24.7% |
March 30, 2023 |
| Google Chrome Heap Buffer Overflow Vulnerability |
Google Chrome GPU contains a heap buffer overflow vulnerability that allows a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. CVE-2022-4135 Exploit Probability: 31.9% |
November 28, 2022 |
| Google Chrome Intents Insufficient Input Validation Vulnerability |
Google Chrome Intents allows for insufficient validation of untrusted input, causing unknown impacts. CISA will update this description if more information becomes available. CVE-2022-2856 Exploit Probability: 4.5% |
August 18, 2022 |
| Google Chrome Use-After-Free Vulnerability |
Use-after-free in WebAudio in Google Chrome allows a remote attacker to potentially exploit heap corruption. CVE-2019-13720 Exploit Probability: 73.0% |
May 23, 2022 |
| Google Chrome Use-After-Free Vulnerability |
Google Chrome contains a heap use-after-free vulnerability which allows an attacker to potentially perform out of bounds memory access. CVE-2019-5786 Exploit Probability: 61.5% |
May 23, 2022 |
| Google Chrome Use-After-Free Vulnerability |
The vulnerability exists due to a use-after-free error within the Animation component in Google Chrome. CVE-2022-0609 Exploit Probability: 22.3% |
February 15, 2022 |
| Google Chrome Prior to 81.0.4044.92 Use-After-Free Vulnerability |
Use-after-free vulnerability in Media in Google Chrome prior to 81.0.4044.92 allowed a Remote attacker to execute arbitrary code via a crafted HTML page. CVE-2020-6572 Exploit Probability: 10.6% |
January 10, 2022 |
| Google Chrome Browser V8 Arbitrary Code Execution |
Type Confusion in V8 in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-30563 Exploit Probability: 8.9% |
November 3, 2021 |
| Google Chrome FreeType Memory Corruption |
Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2020-15999 Exploit Probability: 44.3% |
November 3, 2021 |
| Google Chrome WebGL Use-After-Free Vulnerability |
Use after free in WebGL in Google Chrome prior to 91.0.4472.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-30554 Exploit Probability: 7.4% |
November 3, 2021 |
| Google Chrome Use-After-Free Vulnerability |
Google Chrome use-after-free error within the V8 browser engine. CVE-2021-37975 Exploit Probability: 34.9% |
November 3, 2021 |
| Google Chrome Use-After-Free Vulnerability |
Use-after-free weakness in Portals, Google's new web page navigation system for Chrome. Successful exploitation can let attackers to execute code. CVE-2021-37973 Exploit Probability: 11.6% |
November 3, 2021 |
| Google Chrome Use-After-Free Vulnerability |
Google Chrome Use-After-Free vulnerability CVE-2021-30633 Exploit Probability: 32.7% |
November 3, 2021 |
| Google Chrome Out-of-bounds write |
Google Chrome out-of-bounds write that allows to execute arbitrary code on the target system. CVE-2021-30632 Exploit Probability: 63.2% |
November 3, 2021 |
| Google Chrome Information Leakage |
Information disclosure in Google Chrome that exists due to excessive data output in core. CVE-2021-37976 Exploit Probability: 19.7% |
November 3, 2021 |
| Google Chrome Site Isolation Component Use-After-Free Remote Code Execution vulnerability |
Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. CVE-2020-16017 Exploit Probability: 2.7% |
November 3, 2021 |
| Google Chrome Heap Buffer Overflow in WebAudio Vulnerability |
Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-21166 Exploit Probability: 26.5% |
November 3, 2021 |
Of the known exploited vulnerabilities above, 3 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings. 10 known exploited Google Chrome vulnerabilities are in the top 5% (95th percentile or greater) of the EPSS exploit probability rankings.
EOL Dates
Ensure that you are using a supported version of Google Chrome. Here are some end of life, and end of support dates for Google Chrome.
| Release | EOL Date | Status |
|---|---|---|
| 152 | September 8, 2026 |
EOL This Year
Google Chrome 152 will become EOL this year, in September 2026. |
| 151 | August 25, 2026 |
EOL
Google Chrome 151 became EOL in 2026. |
| 150 | July 28, 2026 |
EOL
Google Chrome 150 became EOL in 2026. |
| 149 | June 30, 2026 |
EOL
Google Chrome 149 became EOL in 2026. |
| 148 | June 2, 2026 |
EOL
Google Chrome 148 became EOL in 2026. |
| 147 | May 5, 2026 |
EOL
Google Chrome 147 became EOL in 2026. |
| 146 | April 7, 2026 |
EOL
Google Chrome 146 became EOL in 2026. |
| 145 | March 10, 2026 |
EOL
Google Chrome 145 became EOL in 2026. |
| 144 | February 10, 2026 |
EOL
Google Chrome 144 became EOL in 2026. |
| 143 | January 13, 2026 |
EOL
Google Chrome 143 became EOL in 2026. |
| 142 | December 2, 2025 |
EOL
Google Chrome 142 became EOL in 2025. |
| 141 | October 28, 2025 |
EOL
Google Chrome 141 became EOL in 2025. |
| 140 | September 30, 2025 |
EOL
Google Chrome 140 became EOL in 2025. |
| 139 | September 2, 2025 |
EOL
Google Chrome 139 became EOL in 2025. |
| 138 | August 5, 2025 |
EOL
Google Chrome 138 became EOL in 2025. |
| 137 | June 24, 2025 |
EOL
Google Chrome 137 became EOL in 2025. |
| 136 | May 27, 2025 |
EOL
Google Chrome 136 became EOL in 2025. |
| 135 | April 29, 2025 |
EOL
Google Chrome 135 became EOL in 2025. |
| 134 | April 1, 2025 |
EOL
Google Chrome 134 became EOL in 2025. |
| 133 | March 4, 2025 |
EOL
Google Chrome 133 became EOL in 2025. |
By the Year
In 2026 there have been 2513 vulnerabilities in Google Chrome with an average score of 7.0 out of ten. Last year, in 2025 Chrome had 247 security vulnerabilities published. That is, 2266 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.06
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 2513 | 7.04 |
| 2025 | 247 | 7.10 |
| 2024 | 290 | 7.70 |
| 2023 | 331 | 7.39 |
| 2022 | 356 | 7.95 |
| 2021 | 373 | 7.96 |
| 2020 | 264 | 8.02 |
| 2019 | 353 | 7.34 |
| 2018 | 127 | 7.10 |
It may take a day or so for new Chrome vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Google Chrome Security Vulnerabilities
Chrome iOS <152 Improper Input Validation Enables Remote Code Exec
CVE-2026-85047
9.6 - Critical
- September 03, 2026
Improper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Improper Input Validation
Google Chrome Compositing Type Confusion Prior to 152.0.7977.82
CVE-2026-85051
8.8 - High
- September 03, 2026
Type confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Object Type Confusion
Google Chrome Mobile <152.0.7977.82: Web Origin Policy Bypass
CVE-2026-85044
6.5 - Medium
- September 03, 2026
Use of released resource in Mobile in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Operation on a Resource after Expiration or Release
Chrome <152 Skia Use-after-free enables sandbox escape via crafted HTML
CVE-2026-85049
8.8 - High
- September 03, 2026
Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Dangling pointer
OOB write in WebGL in Chrome Android <152.0.7977.82
CVE-2026-85050
9.6 - Critical
- September 03, 2026
Out of bounds write in WebGL in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Memory Corruption
Improper Resource Exposure CacheStorage in Chrome <152.0.7977.82
CVE-2026-85053
8.8 - High
- September 03, 2026
Improper resource exposure in CacheStorage in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Exposure of Resource to Wrong Sphere
Chrome DevTools UA in <152.0.7977.82: Remote Code Exec
CVE-2026-85042
9.6 - Critical
- September 03, 2026
Use after free in DevTools in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Dangling pointer
Chrome CrashReporting OOB Read <152.0.7977.82
CVE-2026-85052
3.1 - Low
- September 03, 2026
Out of bounds read in CrashReporting in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Out-of-bounds Read
Chrome: UAF in Compositing pre-152.0.7977.82
CVE-2026-85048
8.3 - High
- September 03, 2026
Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Dangling pointer
Google Chrome <152.0.7977.82: Network Cleanup Bypass Remote Access
CVE-2026-85043
9.1 - Critical
- September 03, 2026
Incomplete cleanup in Network in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: High)
Insufficient Cleanup
Type confusion in V8 (Chrome <152.0.7977.82) sandbox escape
CVE-2026-85046
8.8 - High
- September 03, 2026
Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Object Type Confusion
Race Condition in V8 in Chrome <152.0.7977.82 Arbitrary Code Execution
CVE-2026-85045
7.5 - High
- September 03, 2026
Race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
TOCTTOU
Chrome UI Misrep Spoof FullScreen before 152.0.7977.75
CVE-2026-84356
4.3 - Medium
- September 01, 2026
UI misrepresentation in FullScreen in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low)
User Interface (UI) Misrepresentation of Critical Information
Chrome TabStrip UAF before 152.0.7977.75
CVE-2026-84350
8.8 - High
- September 01, 2026
Use after free in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via UI Interaction. (Chromium security severity: Low)
Dangling pointer
Chrome <152: Actor Incorrect Auth Enables Web Origin Policy Bypass
CVE-2026-84331
3.1 - Low
- September 01, 2026
Incorrect authorization in Actor in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
AuthZ
Incorrect Authorization in Autofill (Google Chrome Android <152.0.7977.75)
CVE-2026-84327
6.5 - Medium
- September 01, 2026
Incorrect authorization in Autofill in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
AuthZ
CredentialProvider Confused Deputy Leak Google Chrome <152.0.7977.75 on Windows
CVE-2026-84329
5.3 - Medium
- September 01, 2026
Confused deputy in CredentialProvider in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)
Confused Deputy
Chrome Android FullScreen UI Spoofing <152.0.7977.75
CVE-2026-84330
5.4 - Medium
- September 01, 2026
UI misrepresentation in FullScreen in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)
User Interface (UI) Misrepresentation of Critical Information
Google Chrome <=152.0.7977.75: SiteSettings auth bypass via crafted HTML
CVE-2026-84332
6.5 - Medium
- September 01, 2026
Incorrect authorization in SiteSettings in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
AuthZ
Chromoting Auth Bypass: Local Exec in Chrome <152.0.7977.75 Windows
CVE-2026-84334
8.1 - High
- September 01, 2026
Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 152.0.7977.75 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Medium)
AuthZ
Chrome TabStrip Auth Bypass <152.0.7977.75
CVE-2026-84335
8.3 - High
- September 01, 2026
Incorrect authorization in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
AuthZ
Chrome <=152.0.7977.75: Improper Priv Mgmt in Downloads Spoofs URL Bar
CVE-2026-84358
4.2 - Medium
- September 01, 2026
Improper privilege management in Downloads in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)
Improper Privilege Management
Chrome MediaCapture Info Leak <152.0.7977.75
CVE-2026-84348
6.5 - Medium
- September 01, 2026
Information leak in MediaCapture in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to potentially leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Information Disclosure
Google Chrome <152 Improper Input Validation in DataTransfer (CVE-2026-84325)
CVE-2026-84325
9.8 - Critical
- September 01, 2026
Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a co-installed app. (Chromium security severity: High)
Improper Input Validation
Missing auth in Chrome FileSystem pre-152.0.7977.75 allows remote info leak
CVE-2026-84323
5.3 - Medium
- September 01, 2026
Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
AuthZ
Use-after-free Chrome WebRTC <152.0.7977.75
CVE-2026-84347
8.8 - High
- September 01, 2026
Use after free in WebRTC in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Dangling pointer
Chrome FileSystem Auth Bypass via Crafted HTML (pre-152.0.7977.75)
CVE-2026-84328
3.1 - Low
- September 01, 2026
Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
AuthZ
Chrome <=152 Navigation Auth Bypass via Renderer
CVE-2026-84355
3.1 - Low
- September 01, 2026
Incorrect authorization in Navigation in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
AuthZ
Chrome UA in Proxy before 152.0.7977.75 allows remote code exec
CVE-2026-84324
9 - Critical
- September 01, 2026
Use after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)
Dangling pointer
Uninitialized V8 Resource Enables Remote Code Exec in Chrome <152.0.7977.75
CVE-2026-84326
8.8 - High
- September 01, 2026
Uninitialized resource in V8 in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Use of Uninitialized Resource
Use After Free in Chrome's Dawn (Android pre-152.0.7977.75)
CVE-2026-84333
9.6 - Critical
- September 01, 2026
Use after free in Dawn in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Dangling pointer
Use-after-free in Chrome <152.0.7977.75 Renderer: Remote Code Exec
CVE-2026-84349
8.3 - High
- September 01, 2026
Use after free in Browser in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Dangling pointer
Buffer overflow in GPU in Google Chrome <152.0.7977.75 on Windows
CVE-2026-84351
8.3 - High
- September 01, 2026
Buffer overflow in GPU in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Stack Overflow
Chrome Omnibox Improper Input Validation (<=152.0.7977.75)
CVE-2026-84357
6.5 - Medium
- September 01, 2026
Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: High)
Improper Input Validation
Chrome FS Auth Bypass Pre-152.0.7977.75 Remote Exec
CVE-2026-84354
9.6 - Critical
- September 01, 2026
Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
AuthZ
Google Chrome Android WebGL UAF RCE before 152.0.7977.75
CVE-2026-84352
9.6 - Critical
- September 01, 2026
Use after free in WebGL in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Dangling pointer
Google Chrome Skia Info Leak <152.0.7977.75
CVE-2026-84359
3.1 - Low
- September 01, 2026
Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Information Disclosure
UEF in Shared Tab Groups: Chrome Android <152.0.7977.75 Remote Code Exec
CVE-2026-84353
9.6 - Critical
- September 01, 2026
Use after free in Shared Tab Groups in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Dangling pointer
Out of bounds read in V8 (Chrome <151.0.7922.72) allows RCE
CVE-2026-82072
8.8 - High
- August 27, 2026
Out of bounds read in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Out-of-bounds Read
Chrome CustomTabs Ref Res Bypass <152.0.7977.65
CVE-2026-79254
4.3 - Medium
- August 25, 2026
Incorrect reference resolution in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
Use of Incorrectly-Resolved Name or Reference
Google Chrome <152.0.7977.65 Cookie Input Validation Bypass
CVE-2026-79260
6.5 - Medium
- August 25, 2026
Improper input validation in Cookies in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
Improper Input Validation
Use-after-free in Chrome Sync on iOS <152.0.7977.65
CVE-2026-78964
9.6 - Critical
- August 25, 2026
Use after free in Sync in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Dangling pointer
Uninitialized Skia Res Chrome <152.0.7977.65: Sandbox Read
CVE-2026-78914
6.5 - Medium
- August 25, 2026
Uninitialized resource in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Use of Uninitialized Resource
Chrome Proxy Info Leak Windows <152.0.7977.65
CVE-2026-79126
5.9 - Medium
- August 25, 2026
Incorrect provision of specified functionality in Proxy in Google Chrome on on Windows prior to 152.0.7977.65 allowed an adjacent attacker to potentially obtain sensitive information via crafted network traffic. (Chromium security severity: Low)
Incorrect Provision of Specified Functionality
Mobile Chrome iOS <152.0.7977.65 Info Leak via Crafted File
CVE-2026-78957
5.5 - Medium
- August 25, 2026
Information leak in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a local attacker to obtain sensitive information via a crafted file. (Chromium security severity: Low)
Information Disclosure
Race Condition in Chrome Enterprise on Windows <152.0.7977.65
CVE-2026-78915
7.5 - High
- August 25, 2026
Race condition in Enterprise in Google Chrome on on Windows prior to 152.0.7977.65 allowed an adjacent attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Low)
Race Condition
Info Leak in Chrome Mobile iOS <152.0.7977.65 via Local Program
CVE-2026-78981
6.5 - Medium
- August 25, 2026
Information leak in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a local attacker to potentially obtain sensitive information via a local program. (Chromium security severity: Low)
Information Disclosure
Google Chrome Network: Improper Input Validation (v <152.0.7977.65)
CVE-2026-79253
6.5 - Medium
- August 25, 2026
Improper input validation in Network in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)
Improper Input Validation
Chrome Forms IAM flaw <152.0.7977.65 sensitive data exfil via crafted page
CVE-2026-79133
6.5 - Medium
- August 25, 2026
Incorrect authorization in Forms in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
AuthZ
Browser Auth Bypass in Chrome Android 152.0.7977.65 (UI Interaction)
CVE-2026-79225
4.3 - Medium
- August 25, 2026
Incorrect authorization in Browser in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via UI Interaction. (Chromium security severity: Low)
AuthZ
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Google Chrome or by Google? Click the Watch button to subscribe.
