CO
Product
Chrome OS
67
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 12Medium 3Low 1
Watch
Add Chrome OS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-6179 | 9.8 | Jun 16 | Permissions Bypass in Extension Management in Google ChromeOS 16181.27.0 on managed Chrome devices allows a local attacker to disable extensions and access Developer Mode,… Affected: 16181.27.0 |
| CVE-2016-5179 | 9.8 | Mar 7 | Chrome OS before 53.0.2785.144 allows remote attackers to execute arbitrary commands at boot Affected: before 53.0.2785.144 |
| CVE-2014-3180 | 9.1 | Nov 6 | In kernel/compat.c in the Linux kernel before 3.17, as used in Google Chrome OS and other products, there is a possible out-of-bounds read Affected: All versions, or not specified |
| CVE-2025-2073 | 8.8 | Apr 16 | Out-of-Bounds Read in netfilter/ipset in Linux Kernel ChromeOS [6.1, 5.15, 5.10, 5.4, 4.19] allows a local attacker with low privileges to trigger an out-of-bounds read,… Affected: 16093.103.0 |
| CVE-2025-1568 | 8.8 | Apr 16 | Access Control Vulnerability in Gerrit chromiumos project configuration in Google ChromeOS 16063.87.0 allows an attacker with a registered Gerrit account to inject malicious code… Affected: 16063.87.0 |
| CVE-2022-2743 | 8.8 | Jan 2 | Integer overflow in Window Manager in Google Chrome on Chrome OS and Lacros prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific UI… Affected: All versions, or not specified |
| CVE-2016-5169 | 8.8 | Sep 25 | Format string vulnerability in Google Chrome OS before 53.0.2785.103 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown… Affected: through 52.0.2743.116 |
| CVE-2025-1290 | 8.1 | Apr 17 | A race condition Use-After-Free vulnerability exists in the virtio_transport_space_update function within the Kernel 5.4 on ChromeOS Affected: 15474.84.0 |
| CVE-2025-2509 | 7.8 | May 6 | Out-of-Bounds Read in Virglrenderer in ChromeOS 16093.57.0 allows a malicious guest VM to achieve arbitrary address access within the crosvm sandboxed process, potentially… Affected: 16093.57.0 |
| CVE-2019-16508 | 7.8 | Oct 1 | The Imagination Technologies driver for Chrome OS before R74-11895.B, R75 before R75-12105.B, and R76 before R76-12208.0.0 allows attackers to trigger an Integer Overflow and gain… Affected: before r74-11895.b; r75 before r75.12105.b; r76 before r76.12208.0.0 |
| CVE-2017-15400 | 7.8 | Feb 7 | Insufficient restriction of IPP filters in CUPS in Google Chrome OS prior to 62.0.3202.74 allowed a remote attacker to execute a command with the same privileges as the cups… Affected: before 62.0.3202.74 |
| CVE-2025-1566 | 7.5 | Apr 16 | DNS Leak in Native System VPN in Google ChromeOS Dev Channel on ChromeOS 16002.23.0 allows network observers to expose plaintext DNS queries via failure to properly tunnel DNS… Affected: 16002.23.0 |
| CVE-2010-4577 | 7.5 | Dec 22 | The CSSParser::parseFontFaceSrc function in WebCore/css/CSSParser.cpp in WebKit, as used in Google Chrome before 8.0.552.224, Chrome OS before 8.0.552.343, webkitgtk before 1.2.6,… Affected: before 8.0.552.343 |
| CVE-2025-6177 | 7.4 | Jun 16 | Privilege Escalation in MiniOS in Google ChromeOS (16063.45.2 and potentially others) on enrolled devices allows a local attacker to gain root code execution via exploiting a… Affected: 16063.45.2 |
| CVE-2017-15397 | 7.4 | Feb 7 | Inappropriate implementation in ChromeVox in Google Chrome OS prior to 62.0.3202.74 allowed a remote attacker in a privileged network position to observe or tamper with certain… Affected: before 62.0.3202.74 |
| CVE-2025-1121 | 6.8 | Mar 7 | Privilege escalation in Installer and Recovery image handling in Google ChromeOS version 15786.48.2 on device allows an attacker with physical access to gain root code execution… Affected: 15786.48.0 |
| CVE-2025-1704 | 6.5 | Apr 16 | ComponentInstaller Modification in ComponentInstaller in Google ChromeOS 15823.23.0 on Chromebooks allows enrolled users with local access to unenroll devices and intercept… Affected: 15823.23.0 |
| CVE-2025-6044 | 6.1 | Jul 7 | An Improper Access Control vulnerability in the Stylus Tools component of Google ChromeOS version 16238.64.0 on the garaged stylus devices allows a physical attacker to bypass the… Affected: 16238.64.0 |
| CVE-2017-5084 | 3.3 | Oct 27 | Inappropriate implementation in image-burner in Google Chrome OS prior to 59.0.3071.92 allowed a local attacker to read local files via dbus-send commands to a BurnImage D-Bus… Affected: before 59.0.3071.92 |
| CVE-2014-3188 | – | Oct 8 | Google Chrome before 38.0.2125.101 and Chrome OS before 38.0.2125.101 do not properly handle the interaction of IPC and Google V8, which allows remote attackers to execute… Affected: through 38.0.2125.77 |
| CVE-2014-1711 | – | Mar 16 | The GPU driver in the kernel in Google Chrome OS before 33.0.1750.152 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other… Affected: through 33.0.1750.149; 33.0.1750.2; 33.0.1750.5; 33.0.1750.16; 33.0.1750.29; 33.0.1750.51; +5 more |
| CVE-2014-1710 | – | Mar 16 | The AsyncPixelTransfersCompletedQuery::End function in gpu/command_buffer/service/query_manager.cc in Google Chrome, as used in Google Chrome OS before 33.0.1750.152, does not… Affected: through 33.0.1750.149; 33.0.1750.2; 33.0.1750.5; 33.0.1750.16; 33.0.1750.29; 33.0.1750.51; +5 more |
| CVE-2014-1708 | – | Mar 16 | The boot implementation in Google Chrome OS before 33.0.1750.152 does not properly consider file persistence, which allows remote attackers to execute arbitrary code via… Affected: through 33.0.1750.149; 33.0.1750.2; 33.0.1750.5; 33.0.1750.16; 33.0.1750.29; 33.0.1750.51; +5 more |
| CVE-2014-1707 | – | Mar 16 | Directory traversal vulnerability in CrosDisks in Google Chrome OS before 33.0.1750.152 has unspecified impact and attack vectors Affected: through 33.0.1750.149; 33.0.1750.2; 33.0.1750.5; 33.0.1750.16; 33.0.1750.29; 33.0.1750.51; +5 more |
| CVE-2014-1706 | – | Mar 16 | crosh in Google Chrome OS before 33.0.1750.152 allows attackers to inject commands via unspecified vectors Affected: through 33.0.1750.149; 33.0.1750.2; 33.0.1750.5; 33.0.1750.16; 33.0.1750.29; 33.0.1750.51; +5 more |
| CVE-2013-2866 | – | Jun 19 | The Flash plug-in in Google Chrome before 27.0.1453.116, as used on Google Chrome OS before 27.0.1453.116 and separately, does not properly determine whether a user wishes to… Affected: 27.0.1453.115 |
| CVE-2013-2835 | – | Apr 16 | Google Chrome OS before 26.0.1410.57 does not properly enforce origin restrictions for the O3D and Google Talk plug-ins, which allows remote attackers to bypass the… Affected: through 26.0.1410.56; 26.0.1410.0; 26.0.1410.1; 26.0.1410.3; 26.0.1410.4; 26.0.1410.5; +34 more |
| CVE-2013-2834 | – | Apr 16 | Google Chrome OS before 26.0.1410.57 does not properly enforce origin restrictions for the O3D and Google Talk plug-ins, which allows remote attackers to bypass the… Affected: through 26.0.1410.56; 26.0.1410.0; 26.0.1410.1; 26.0.1410.3; 26.0.1410.4; 26.0.1410.5; +34 more |
| CVE-2013-2833 | – | Apr 16 | Use-after-free vulnerability in the O3D plug-in in Google Chrome OS before 26.0.1410.57 allows remote attackers to cause a denial of service or possibly have unspecified other… Affected: through 26.0.1410.56; 26.0.1410.0; 26.0.1410.1; 26.0.1410.3; 26.0.1410.4; 26.0.1410.5; +34 more |
| CVE-2013-2832 | – | Apr 16 | The Buffer::Set function in core/cross/buffer.cc in the O3D plug-in in Google Chrome OS before 26.0.1410.57 does not prevent uninitialized data from remaining in a buffer, which… Affected: through 26.0.1410.56; 26.0.1410.0; 26.0.1410.1; 26.0.1410.3; 26.0.1410.4; 26.0.1410.5; +34 more |
| CVE-2013-0927 | – | Apr 10 | Google Chrome OS before 26.0.1410.57 relies on a Pango pango-utils.c read_config implementation that loads the contents of the .pangorc file in the user's home directory, and the… Affected: through 26.0.1410.56; 26.0.1410.0; 26.0.1410.1; 26.0.1410.3; 26.0.1410.4; 26.0.1410.5; +34 more |
| CVE-2013-0915 | – | Mar 18 | The GPU process in Google Chrome OS before 25.0.1364.173 allows attackers to cause a denial of service or possibly have unspecified other impact via vectors related to an… Affected: through 25.0.1364.172; 25.0.1364.0; 25.0.1364.1; 25.0.1364.2; 25.0.1364.3; 25.0.1364.5; +34 more |
| CVE-2012-5129 | – | Dec 4 | Heap-based buffer overflow in the WebGL subsystem in Google Chrome OS before 23.0.1271.94 allows remote attackers to cause a denial of service (GPU process crash) or possibly have… Affected: through 21.0.1180.57 |
| CVE-2012-2864 | – | Aug 22 | Mesa, as used in Google Chrome before 21.0.1183.0 on the Acer AC700, Cr-48, and Samsung Series 5 and 5 550 Chromebook platforms, and the Samsung Chromebox Series 3, allows remote… Affected: 21.0.1180.0; 21.0.1180.1; 21.0.1180.2; 21.0.1180.3; 21.0.1180.4; 21.0.1180.5; +27 more |
| CVE-2012-4050 | – | Jul 24 | Multiple unspecified vulnerabilities in Google Chrome OS before 21.0.1180.50 on the Cr-48 and Samsung Series 5 and 5 550 Chromebook platforms, and the Samsung Chromebox Series 3,… Affected: through 21.0.1180.49; 21.0.1180.0; 21.0.1180.1; 21.0.1180.2; 21.0.1180.3; 21.0.1180.4; +25 more |
| CVE-2012-3290 | – | Jun 7 | Multiple unspecified vulnerabilities in Google Chrome before 20.0.1132.22 on the Acer AC700; Samsung Series 5, 5 550, and Chromebox 3; and Cr-48 Chromebook platforms have unknown… Affected: through 20.0.1132.21; 20.0.1132.0; 20.0.1132.1; 20.0.1132.2; 20.0.1132.3; 20.0.1132.4; +16 more |
| CVE-2012-1418 | – | Feb 29 | Multiple unspecified vulnerabilities in Google Chrome before 17.0.963.60 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown impact and attack vectors Affected: through 17.0.963.59 |
| CVE-2012-0695 | – | Jan 12 | Multiple unspecified vulnerabilities in Google Chrome before 17.0.963.27 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown impact and attack vectors Affected: through 17.0.963.26 |
| CVE-2011-4719 | – | Dec 9 | Multiple unspecified vulnerabilities in Google Chrome before 16.0.912.63 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown impact and attack vectors Affected: through 16.0.912.62 |
| CVE-2011-4548 | – | Nov 24 | Multiple unspecified vulnerabilities in Google Chrome before 16.0.912.44 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown impact and attack vectors Affected: through 16.0.912.43 |
| CVE-2011-3421 | – | Sep 12 | Multiple unspecified vulnerabilities in Google Chrome before 14.0.835.125 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown impact and attack… Affected: through 14.0.835.124 |
| CVE-2011-3420 | – | Sep 12 | Multiple unspecified vulnerabilities in Google Chrome before 14.0.835.157 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown impact and attack… Affected: through 14.0.835.156 |
| CVE-2011-2171 | – | May 24 | Unspecified vulnerability in the dbugs package in Google Chrome OS before R12 0.12.433.38 Beta has unknown impact and attack vectors Affected: through 0.12.433.35; 0.9.126.0; 0.10.142.3; 0.10.146.1; 0.10.156.1; 0.10.156.4; +25 more |
| CVE-2011-2170 | – | May 24 | Google Chrome OS before R12 0.12.433.38 Beta, when Guest mode is enabled, does not prevent changes on the about:flags page, which has unspecified impact and local attack vectors Affected: through 0.12.433.35; 0.9.126.0; 0.10.142.3; 0.10.146.1; 0.10.156.1; 0.10.156.4; +25 more |
| CVE-2011-2169 | – | May 24 | Google Chrome OS before R12 0.12.433.38 Beta allows local users to gain privileges by creating a /var/lib/chromeos-aliases.conf file and placing commands in it Affected: through 0.12.433.35; 0.9.126.0; 0.10.142.3; 0.10.146.1; 0.10.156.1; 0.10.156.4; +25 more |
| CVE-2011-1306 | – | Mar 8 | Unspecified vulnerability in the Scratchpad application in Google Chrome OS before R10 0.10.156.46 Beta has unknown impact and attack vectors Affected: through 0.10.156.36; 0.10.142.3; 0.10.146.1; 0.10.156.1; 0.10.156.4; 0.10.156.18; +3 more |
| CVE-2011-1042 | – | Feb 18 | Use-after-free vulnerability in flimflamd in flimflam in Google Chrome OS before 0.9.130.14 Beta allows user-assisted remote attackers to cause a denial of service (daemon crash)… Affected: through 0.9.126.0; 8.0.552.342; 8.0.552.343; 8.0.552.344 |
| CVE-2011-0474 | – | Jan 14 | Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 do not properly handle Cascading Style Sheets (CSS) token sequences in conjunction with cursors, which allows… Affected: before 8.0.552.344 |
| CVE-2011-0473 | – | Jan 14 | Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 do not properly handle Cascading Style Sheets (CSS) token sequences in conjunction with CANVAS elements, which… Affected: before 8.0.552.344 |
| CVE-2011-0472 | – | Jan 14 | Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 do not properly handle the printing of PDF documents, which allows user-assisted remote attackers to cause a… Affected: before 8.0.552.344 |