Google Chrome Web browser
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Google Chrome.
Recent Google Chrome Security Advisories
| Advisory | Title | Published |
|---|---|---|
| 2026-07-24 | Chrome Releases: Stable Channel Update for Desktop (version 150.0.7871.186) | July 24, 2026 |
| 2026-07-22 | Chrome Releases: Chrome Stable for iOS Update (version 151) | July 22, 2026 |
| 2026-07-22 | Chrome Releases: Chrome for Android Update (version 150) | July 22, 2026 |
| 2026-07-22 | Chrome Releases: Stable Channel Update for Desktop (version 150.0.7871.181) | July 22, 2026 |
| 2026-07-17 | Chrome Releases: Stable Channel Update for Desktop (version 150.0.7871.128) | July 17, 2026 |
| 2026-07-17 | Chrome Releases: Chrome for Android Update (version 150) | July 17, 2026 |
| 2026-07-15 | Chrome Releases: Chrome Stable for iOS Update (version 151) | July 15, 2026 |
| 2026-07-15 | Chrome Releases: Stable Channel Update for Desktop (version 150.0.7871.124) | July 15, 2026 |
| 2026-07-15 | Chrome Releases: Chrome for Android Update (version 150) | July 15, 2026 |
| 2026-07-11 | Chrome Releases: Stable Channel Update for ChromeOS / ChromeOS Flex | July 11, 2026 |
Known Exploited Google Chrome Vulnerabilities
The following Google Chrome vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.
| Title | Description | Added |
|---|---|---|
| Google Chrome Skia Integer Overflow Vulnerability |
Google Chrome Skia contains an integer overflow vulnerability. Specific impacts from exploitation are not available at this time. This vulnerability resides in Skia which serves as the graphics engine for Google Chrome and ChromeOS, Android, Flutter, and other products. CVE-2023-2136 Exploit Probability: 5.8% |
April 21, 2023 |
| Google Chrome Use-After-Free Vulnerability |
Google Chrome contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption. CVE-2022-3038 Exploit Probability: 24.7% |
March 30, 2023 |
| Google Chrome Heap Buffer Overflow Vulnerability |
Google Chrome GPU contains a heap buffer overflow vulnerability that allows a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. CVE-2022-4135 Exploit Probability: 31.9% |
November 28, 2022 |
| Google Chrome Intents Insufficient Input Validation Vulnerability |
Google Chrome Intents allows for insufficient validation of untrusted input, causing unknown impacts. CISA will update this description if more information becomes available. CVE-2022-2856 Exploit Probability: 4.5% |
August 18, 2022 |
| Google Chrome Use-After-Free Vulnerability |
Use-after-free in WebAudio in Google Chrome allows a remote attacker to potentially exploit heap corruption. CVE-2019-13720 Exploit Probability: 49.1% |
May 23, 2022 |
| Google Chrome Use-After-Free Vulnerability |
Google Chrome contains a heap use-after-free vulnerability which allows an attacker to potentially perform out of bounds memory access. CVE-2019-5786 Exploit Probability: 61.5% |
May 23, 2022 |
| Google Chrome Use-After-Free Vulnerability |
The vulnerability exists due to a use-after-free error within the Animation component in Google Chrome. CVE-2022-0609 Exploit Probability: 22.0% |
February 15, 2022 |
| Google Chrome Prior to 81.0.4044.92 Use-After-Free Vulnerability |
Use-after-free vulnerability in Media in Google Chrome prior to 81.0.4044.92 allowed a Remote attacker to execute arbitrary code via a crafted HTML page. CVE-2020-6572 Exploit Probability: 10.6% |
January 10, 2022 |
| Google Chrome Browser V8 Arbitrary Code Execution |
Type Confusion in V8 in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-30563 Exploit Probability: 8.9% |
November 3, 2021 |
| Google Chrome FreeType Memory Corruption |
Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2020-15999 Exploit Probability: 50.6% |
November 3, 2021 |
| Google Chrome WebGL Use-After-Free Vulnerability |
Use after free in WebGL in Google Chrome prior to 91.0.4472.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-30554 Exploit Probability: 7.4% |
November 3, 2021 |
| Google Chrome Use-After-Free Vulnerability |
Google Chrome use-after-free error within the V8 browser engine. CVE-2021-37975 Exploit Probability: 34.9% |
November 3, 2021 |
| Google Chrome Use-After-Free Vulnerability |
Use-after-free weakness in Portals, Google's new web page navigation system for Chrome. Successful exploitation can let attackers to execute code. CVE-2021-37973 Exploit Probability: 11.7% |
November 3, 2021 |
| Google Chrome Use-After-Free Vulnerability |
Google Chrome Use-After-Free vulnerability CVE-2021-30633 Exploit Probability: 32.7% |
November 3, 2021 |
| Google Chrome Out-of-bounds write |
Google Chrome out-of-bounds write that allows to execute arbitrary code on the target system. CVE-2021-30632 Exploit Probability: 64.5% |
November 3, 2021 |
| Google Chrome Information Leakage |
Information disclosure in Google Chrome that exists due to excessive data output in core. CVE-2021-37976 Exploit Probability: 19.9% |
November 3, 2021 |
| Google Chrome Site Isolation Component Use-After-Free Remote Code Execution vulnerability |
Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. CVE-2020-16017 Exploit Probability: 2.7% |
November 3, 2021 |
| Google Chrome Heap Buffer Overflow in WebAudio Vulnerability |
Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-21166 Exploit Probability: 23.8% |
November 3, 2021 |
Of the known exploited vulnerabilities above, 2 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings. 11 known exploited Google Chrome vulnerabilities are in the top 5% (95th percentile or greater) of the EPSS exploit probability rankings.
EOL Dates
Ensure that you are using a supported version of Google Chrome. Here are some end of life, and end of support dates for Google Chrome.
| Release | EOL Date | Status |
|---|---|---|
| 150 | July 28, 2026 |
EOL This Year
Google Chrome 150 will become EOL this year, in July 2026. |
| 149 | June 30, 2026 |
EOL
Google Chrome 149 became EOL in 2026. |
| 148 | June 2, 2026 |
EOL
Google Chrome 148 became EOL in 2026. |
| 147 | May 5, 2026 |
EOL
Google Chrome 147 became EOL in 2026. |
| 146 | April 7, 2026 |
EOL
Google Chrome 146 became EOL in 2026. |
| 145 | March 10, 2026 |
EOL
Google Chrome 145 became EOL in 2026. |
| 144 | February 10, 2026 |
EOL
Google Chrome 144 became EOL in 2026. |
| 143 | January 13, 2026 |
EOL
Google Chrome 143 became EOL in 2026. |
| 142 | December 2, 2025 |
EOL
Google Chrome 142 became EOL in 2025. |
| 141 | October 28, 2025 |
EOL
Google Chrome 141 became EOL in 2025. |
| 140 | September 30, 2025 |
EOL
Google Chrome 140 became EOL in 2025. |
| 139 | September 2, 2025 |
EOL
Google Chrome 139 became EOL in 2025. |
| 138 | August 5, 2025 |
EOL
Google Chrome 138 became EOL in 2025. |
| 137 | June 24, 2025 |
EOL
Google Chrome 137 became EOL in 2025. |
| 136 | May 27, 2025 |
EOL
Google Chrome 136 became EOL in 2025. |
| 135 | April 29, 2025 |
EOL
Google Chrome 135 became EOL in 2025. |
| 134 | April 1, 2025 |
EOL
Google Chrome 134 became EOL in 2025. |
| 133 | March 4, 2025 |
EOL
Google Chrome 133 became EOL in 2025. |
| 132 | February 4, 2025 |
EOL
Google Chrome 132 became EOL in 2025. |
| 131 | January 14, 2025 |
EOL
Google Chrome 131 became EOL in 2025. |
By the Year
In 2026 there have been 1709 vulnerabilities in Google Chrome with an average score of 7.2 out of ten. Last year, in 2025 Chrome had 247 security vulnerabilities published. That is, 1462 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.26.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 1709 | 7.25 |
| 2025 | 247 | 6.99 |
| 2024 | 290 | 7.70 |
| 2023 | 331 | 7.40 |
| 2022 | 356 | 7.95 |
| 2021 | 373 | 7.96 |
| 2020 | 264 | 8.02 |
| 2019 | 353 | 7.34 |
| 2018 | 127 | 7.10 |
It may take a day or so for new Chrome vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Google Chrome Security Vulnerabilities
Use after free in Input in Google Chrome <150.0.7871.186
CVE-2026-16804
8.3 - High
- July 23, 2026
Use after free in Input in Google Chrome prior to 150.0.7871.186 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Dangling pointer
Use-after-Free in Chrome WebMCP before 150.0.7871.186 (Remote code execution)
CVE-2026-16806
8.8 - High
- July 23, 2026
Use after free in WebMCP in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Dangling pointer
Use after free in Blink (Chrome <150.0.7871.186) Enables Remote Code Execution
CVE-2026-16805
8.8 - High
- July 23, 2026
Use after free in Blink in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Dangling pointer
Out-of-bounds write in Codecs in Chrome 150.0.7871.186 Caused Sandbox Escape
CVE-2026-16807
8.8 - High
- July 23, 2026
Out of bounds write in Codecs in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Memory Corruption
Use-after-free in Chrome Android GPU (pre-150.0.7871.182) sandbox escape
CVE-2026-16424
9.6 - Critical
- July 21, 2026
Use after free in GPU in Google Chrome on Android prior to 150.0.7871.182 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Dangling pointer
Chrome UI UAF before 150.0.7871.182
CVE-2026-16423
8.8 - High
- July 21, 2026
Use after free in UI in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Dangling pointer
Chrome <150.0.7871.182 Cert Validation CVE-2026-16422
CVE-2026-16422
7.5 - High
- July 21, 2026
Insufficient validation of untrusted input in Certificate in Google Chrome on Linux prior to 150.0.7871.182 allowed an attacker in a privileged network position to perform domain spoofing via malicious network traffic. (Chromium security severity: High)
Improper Input Validation
Chrome ANGLE OOB Read/Write Sandbox Escape v<150.0.7871.182 (Android)
CVE-2026-16419
9.6 - Critical
- July 21, 2026
Out of bounds read and write in ANGLE in Google Chrome on Android prior to 150.0.7871.182 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Out-of-bounds Read
V8 Stack Buffer Overflow in Chrome <150.0.7871.182 (Remote Code Exec)
CVE-2026-16418
8.8 - High
- July 21, 2026
Stack buffer overflow in V8 in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Stack Overflow
Google Chrome <=150.0.7871.182 Omnibox Spoof via Untrusted Input
CVE-2026-16415
5.4 - Medium
- July 21, 2026
Insufficient validation of untrusted input in Extensions in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: High)
Improper Input Validation
Uninitialized Use in Skia (Chrome <150.0.7871.182)
CVE-2026-16417
3.1 - Low
- July 21, 2026
Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Use of Uninitialized Variable
Google Chrome <150.0.7871.182 Integer OverFlow in Chromecast Allows SandboxEsc.
CVE-2026-16416
8.3 - High
- July 21, 2026
Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.182 allowed a local attacker to potentially perform a sandbox escape via malicious network traffic. (Chromium security severity: High)
Integer Overflow or Wraparound
Chrome Chromecast sandbox escape via untrusted input (before 150.0.7871.182)
CVE-2026-16414
8.3 - High
- July 21, 2026
Insufficient validation of untrusted input in Chromecast in Google Chrome prior to 150.0.7871.182 allowed a local attacker to potentially perform a sandbox escape via malicious network traffic. (Chromium security severity: High)
Improper Input Validation
ANGLE OOB write in Chrome <=150.0.7871.182, sandbox escape via crafted HTML page
CVE-2026-16413
8.3 - High
- July 21, 2026
Out of bounds write in ANGLE in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Memory Corruption
Chrome <150.0.7871.182 Remote Code Exec in WebAudio via Crafted HTML
CVE-2026-16421
8.8 - High
- July 21, 2026
Inappropriate implementation in WebAudio in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Improper Input Validation
WebAudio Type Confusion Chrome <150.0.7871.182 Remote Code Execution
CVE-2026-16420
8.8 - High
- July 21, 2026
Type Confusion in WebAudio in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Object Type Confusion
Use After Free in Aura (Chrome <150.0.7871.128)
CVE-2026-15905
7.8 - High
- July 20, 2026
Use after free in Aura in Google Chrome prior to 150.0.7871.128 allowed a local attacker to potentially exploit heap corruption via a malicious file. (Chromium security severity: High)
Dangling pointer
Chrome Ozone UAF via UI Gestures pre-150.0.7871.128
CVE-2026-15904
8.8 - High
- July 20, 2026
Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.128 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Dangling pointer
Out of bounds read/write in V8 (Chrome <150.0.7871.128) enabling sandbox escape
CVE-2026-15903
8.8 - High
- July 20, 2026
Out of bounds read and write in V8 in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Out-of-bounds Read
Use-after-free in Chrome Cast (pre-150.0.7871.128) via crafted HTML
CVE-2026-15902
8.8 - High
- July 20, 2026
Use after free in Cast in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Dangling pointer
Chrome Use-After-Free (UF) in Network prior 150.0.7871.128, critical
CVE-2026-15901
9.6 - Critical
- July 20, 2026
Use after free in Network in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
Dangling pointer
Google Chrome <150.0.7871.128 Use After Free in GPU (Android)
CVE-2026-15900
9.6 - Critical
- July 20, 2026
Use after free in GPU in Google Chrome on Android prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
Dangling pointer
Google Chrome Mac <150.0.7871.128 Use-After-Free CameraCapture Sandbox Escape
CVE-2026-15899
9.6 - Critical
- July 20, 2026
Use after free in CameraCapture in Google Chrome on Mac prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
Dangling pointer
Insufficient Validation of Untrusted Input in Navigation (Chrome <150.0.7871.125)
CVE-2026-15778
6.5 - Medium
- July 14, 2026
Insufficient validation of untrusted input in Navigation in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
Improper Input Validation
UAF in Chrome UI before 150.0.7871.125 (Linux) Remote Heap Corruption
CVE-2026-15777
7.5 - High
- July 14, 2026
Use after free in UI in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Dangling pointer
Arbitrary Code Exec in Chrome V8 <150.0.7871.125 via Crafted HTML
CVE-2026-15776
8.8 - High
- July 14, 2026
Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Object Type Confusion
Same-Origin Policy Bypass via V8 in Chrome <150.0.7871.125
CVE-2026-15775
6.5 - Medium
- July 14, 2026
Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)
Origin Validation Error
Use-after-free in Chrome GPU (Android <150.0.7871.125) Sandbox Escape
CVE-2026-15772
8.3 - High
- July 14, 2026
Use after free in GPU in Google Chrome on Android prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Dangling pointer
Use-After-Free in Skia (Chrome <150.0.7871.125) Sandbox escape via HTML
CVE-2026-15774
8.3 - High
- July 14, 2026
Use after free in Skia in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Dangling pointer
Use-after-Free in Chrome Core (v<150.0.7871.125)
CVE-2026-15773
9.6 - Critical
- July 14, 2026
Use after free in Core in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Dangling pointer
Uninitialized Use V8 in Chrome <150.0.7871.125 (CVE-2026-15770)
CVE-2026-15770
6.5 - Medium
- July 14, 2026
Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
Use of Uninitialized Variable
Chrome Media Component Leak: CVE-2026-15771 (<=150.0.7871.124 Windows)
CVE-2026-15771
5.3 - Medium
- July 14, 2026
Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
Improper Input Validation
Chrome <150.0.7871.125: HTML-in-CANVAS SOP Bypass
CVE-2026-15768
6.5 - Medium
- July 14, 2026
Insufficient policy enforcement in HTML-in-Canvas in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)
Origin Validation Error
Chrome Linux Toolkit Theming sandbox escape <=150.0.7871.125 (High)
CVE-2026-15769
8.3 - High
- July 14, 2026
Insufficient validation of untrusted input in Linux Toolkit Theming in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Improper Input Validation
libyuv Heap Buffer Overflow in Chrome Windows <150.0.7871.125
CVE-2026-15767
8.8 - High
- July 14, 2026
Heap buffer overflow in libyuv in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted video file. (Chromium security severity: High)
Heap-based Buffer Overflow
Use-after-free in Chrome Ozone before 150.0.7871.125 (Critical)
CVE-2026-15765
7.5 - High
- July 14, 2026
Use after free in Ozone in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
Dangling pointer
Uninitialized Use in Skia (Chrome <150.0.7871.125) - Remote Info Leakage
CVE-2026-15766
6.5 - Medium
- July 14, 2026
Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
Use of Uninitialized Variable
UAF in Chrome Ozone 150.0.7871.125 via UI Gestures
CVE-2026-15764
7.5 - High
- July 14, 2026
Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
Dangling pointer
Chrome Navigation Site Isolation Bypass <150.0.7871.115
CVE-2026-15131
4.3 - Medium
- July 08, 2026
Inappropriate implementation in Navigation in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
Improper Input Validation
Use-after-Free in Chrome IndexedDB (before 150.0.7871.115)
CVE-2026-15107
8.8 - High
- July 08, 2026
Use after free in IndexedDB in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
Dangling pointer
Insufficient policy enforcement in Chrome Navigation prior to 150.0.7871.115
CVE-2026-15130
4.3 - Medium
- July 08, 2026
Insufficient policy enforcement in Navigation in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: High)
Client-Side Enforcement of Server-Side Security
Google Chrome 150.0.7871.115 - Forms UXSS via arbitrary script injection
CVE-2026-15128
6.1 - Medium
- July 08, 2026
Inappropriate implementation in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High)
XSS
Chrome <150.0.7871.115 UXSS via WebGL
CVE-2026-15127
6.1 - Medium
- July 08, 2026
Inappropriate implementation in WebGL in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High)
XSS
Google Chrome <150.0.7871.115 UAF in Forms sandboxed exec
CVE-2026-15126
8.8 - High
- July 08, 2026
Use after free in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Dangling pointer
Insecure Forms Remote Code Exec in Chrome <150.0.7871.115
CVE-2026-15125
8.8 - High
- July 08, 2026
Inappropriate implementation in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
AuthZ
GoogleChrome 150.0.7871.115 Password Policy Bypass (Same-Origin)
CVE-2026-15124
4.3 - Medium
- July 08, 2026
Insufficient policy enforcement in Passwords in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)
Improper Input Validation
Chrome DOM heap corruption CVE-2026-15123 prior to 150.0.7871.115
CVE-2026-15123
8.8 - High
- July 08, 2026
Inappropriate implementation in DOM in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Heap-based Buffer Overflow
Chrome 150.0.7871.115 Codecs NL sandbox escape via crafted HTML
CVE-2026-15122
8.3 - High
- July 08, 2026
Insufficient validation of untrusted input in Codecs in Google Chrome on Windows prior to 150.0.7871.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Improper Input Validation
UaF in WebRTC of Chrome <150.0.7871.115
CVE-2026-15121
8.8 - High
- July 08, 2026
Use after free in WebRTC in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Dangling pointer
Use-After-Free in Chrome Core (pre-150.0.7871.115) Enables sandbox escape
CVE-2026-15120
8.3 - High
- July 08, 2026
Use after free in Core in Google Chrome on Windows prior to 150.0.7871.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Dangling pointer
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Google Chrome or by Google? Click the Watch button to subscribe.
