CH
Browser
Chrome
On CISA KEVExploited in the wildRansomware-linked
7,406
CVEs
77
On KEV
10.0
Max CVSS
851
New 30D
Severity mix
Critical 438High 56Medium 6Low 0
Watch
Add Chrome to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-1666 | 9.8 | May 14 | Multiple unspecified vulnerabilities in Google Chrome before 50.0.2661.94 allow attackers to cause a denial of service or possibly have other impact via unknown vectors Affected: through 50.0.2661.87 |
| CVE-2016-1662 | 9.8 | May 14 | extensions/renderer/gc_callback.cc in Google Chrome before 50.0.2661.94 does not prevent fallback execution once the Garbage Collection callback has started, which allows remote… Affected: through 50.0.2661.87 |
| CVE-2016-1659 | 9.8 | Apr 18 | Multiple unspecified vulnerabilities in Google Chrome before 50.0.2661.75 allow attackers to cause a denial of service or possibly have other impact via unknown vectors Affected: through 49.0.2623.112 |
| CVE-2016-2843 | 9.8 | Mar 6 | Multiple unspecified vulnerabilities in Google V8 before 4.9.385.26, as used in Google Chrome before 49.0.2623.75, allow attackers to cause a denial of service or possibly have… Affected: through 48.0.2564.116 |
| CVE-2016-1642 | 9.8 | Mar 6 | Multiple unspecified vulnerabilities in Google Chrome before 49.0.2623.75 allow attackers to cause a denial of service or possibly have other impact via unknown vectors Affected: through 48.0.2564.116 |
| CVE-2016-1639 | 9.8 | Mar 6 | Use-after-free vulnerability in browser/extensions/api/webrtc_audio_private/webrtc_audio_private_api.cc in the WebRTC Audio Private API implementation in Google Chrome before… Affected: through 48.0.2564.116 |
| CVE-2016-1636 | 9.8 | Mar 6 | The PendingScript::notifyFinished function in WebKit/Source/core/dom/PendingScript.cpp in Google Chrome before 49.0.2623.75 relies on memory-cache information about… Affected: through 48.0.2564.116 |
| CVE-2016-1635 | 9.8 | Mar 6 | extensions/renderer/render_frame_observer_natives.cc in Google Chrome before 49.0.2623.75 does not properly consider object lifetimes and re-entrancy issues during… Affected: through 48.0.2564.116 |
| CVE-2016-1633 | 9.8 | Mar 6 | Use-after-free vulnerability in Blink, as used in Google Chrome before 49.0.2623.75, allows remote attackers to cause a denial of service or possibly have unspecified other impact… Affected: through 48.0.2564.116 |
| CVE-2016-1629 | 9.8 | Feb 21 | Google Chrome before 48.0.2564.116 allows remote attackers to bypass the Blink Same Origin Policy and a sandbox protection mechanism via unspecified vectors Affected: through 48.0.2564.109 |
| CVE-2016-2051 | 9.8 | Jan 25 | Multiple unspecified vulnerabilities in Google V8 before 4.8.271.17, as used in Google Chrome before 48.0.2564.82, allow attackers to cause a denial of service or possibly have… Affected: through 47.0.2526.111 |
| CVE-2015-6792 | 9.8 | Dec 24 | The MIDI subsystem in Google Chrome before 47.0.2526.106 does not properly handle the sending of data, which allows remote attackers to execute arbitrary code or cause a denial of… Affected: through 47.0.2526.80 |
| CVE-2015-6764 | 9.8 | Dec 6 | The BasicJsonStringifier::SerializeJSArray function in json-stringifier.h in the JSON stringifier in Google V8, as used in Google Chrome before 47.0.2526.73, improperly loads… Affected: through 46.0.2490.86 |
| CVE-2015-1276 | 9.8 | Jul 23 | Use-after-free vulnerability in content/browser/indexed_db/indexed_db_backing_store.cc in the IndexedDB implementation in Google Chrome before 44.0.2403.89 allows remote attackers… Affected: through 43.0.2357.134 |
| CVE-2010-4202 | 9.8 | Nov 6 | Multiple integer overflows in Google Chrome before 7.0.517.44 on Linux allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted… Affected: before 7.0.517.44 |
| CVE-2010-4201 | 9.8 | Nov 6 | Use-after-free vulnerability in Google Chrome before 7.0.517.44 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors… Affected: before 7.0.517.44 |
| CVE-2010-4197 | 9.8 | Nov 6 | Use-after-free vulnerability in WebKit, as used in Google Chrome before 7.0.517.44, webkitgtk before 1.2.6, and other products, allows remote attackers to cause a denial of… Affected: before 7.0.517.44 |
| CVE-2010-4203 | 9.8 | Nov 5 | WebM libvpx (aka the VP8 Codec SDK) before 0.9.5, as used in Google Chrome before 7.0.517.44, allows remote attackers to cause a denial of service (memory corruption) or possibly… Affected: before 7.0.517.44 |
| CVE-2010-4205 | 9.8 | Nov 5 | Google Chrome before 7.0.517.44 does not properly handle the data types of event objects, which allows remote attackers to cause a denial of service or possibly have unspecified… Affected: before 7.0.517.44 |
| CVE-2010-4204 | 9.8 | Nov 5 | WebKit, as used in Google Chrome before 7.0.517.44, webkitgtk before 1.2.6, and other products, accesses a frame object after this object has been destroyed, which allows remote… Affected: before 7.0.517.44 |
| CVE-2010-4042 | 9.8 | Oct 21 | Google Chrome before 7.0.517.41 does not properly handle element maps, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via… Affected: before 7.0.517.41 |
| CVE-2010-4041 | 9.8 | Oct 21 | The sandbox implementation in Google Chrome before 7.0.517.41 on Linux does not properly constrain worker processes, which might allow remote attackers to bypass intended access… Affected: before 7.0.517.41 |
| CVE-2010-4039 | 9.8 | Oct 21 | Google Chrome before 7.0.517.41 on Linux does not properly set the PATH environment variable, which has unspecified impact and attack vectors Affected: before 7.0.517.41 |
| CVE-2010-3729 | 9.8 | Oct 5 | The SPDY protocol implementation in Google Chrome before 6.0.472.62 does not properly manage buffers, which might allow remote attackers to execute arbitrary code via unspecified… Affected: before 6.0.472.62 |
| CVE-2010-3416 | 9.8 | Sep 16 | Google Chrome before 6.0.472.59 on Linux does not properly implement the Khmer locale, which allows remote attackers to cause a denial of service (memory corruption) or possibly… Affected: before 6.0.472.59 |
| CVE-2010-1205 | 9.8 | Jun 30 | Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in progressive applications, might allow remote attackers to execute arbitrary code via a PNG… Affected: before 5.0.375.99 |
| CVE-2026-113169 | 9.6 | Oct 20 | Memory corruption in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted… Affected: 156.0.8078.47 before 156.0.8078.47 |
| CVE-2026-113116 | 9.6 | Oct 20 | Use after free in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page Affected: 156.0.8078.47 before 156.0.8078.47 |
| CVE-2026-113186 | 9.6 | Oct 20 | Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page Affected: 156.0.8078.47 before 156.0.8078.47 |
| CVE-2026-113023 | 9.6 | Oct 20 | Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted… Affected: 156.0.8078.47 before 156.0.8078.47 |
| CVE-2026-113300 | 9.6 | Oct 20 | Out of bounds write in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page Affected: 156.0.8078.47 before 156.0.8078.47 |
| CVE-2026-113056 | 9.6 | Oct 20 | Memory corruption in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML… Affected: 156.0.8078.47 before 156.0.8078.47 |
| CVE-2026-113089 | 9.6 | Oct 20 | Improper input validation in PrintPreview in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted… Affected: 156.0.8078.47 before 156.0.8078.47 |
| CVE-2026-113235 | 9.6 | Oct 20 | Improper input validation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted… Affected: 156.0.8078.47 before 156.0.8078.47 |
| CVE-2026-113342 | 9.6 | Oct 20 | Memory corruption in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page Affected: 156.0.8078.47 before 156.0.8078.47 |
| CVE-2026-113138 | 9.6 | Oct 20 | Memory corruption in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML… Affected: 156.0.8078.47 before 156.0.8078.47 |
| CVE-2026-113270 | 9.6 | Oct 20 | Use after free in Internals in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page Affected: 156.0.8078.47 before 156.0.8078.47 |
| CVE-2026-113007 | 9.6 | Oct 20 | Memory corruption in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML… Affected: 156.0.8078.47 before 156.0.8078.47 |
| CVE-2026-113126 | 9.6 | Oct 20 | Memory corruption in PolicyContainer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML… Affected: 156.0.8078.47 before 156.0.8078.47 |
| CVE-2026-113084 | 9.6 | Oct 20 | Improper input validation in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted… Affected: 156.0.8078.47 before 156.0.8078.47 |
| CVE-2026-113328 | 9.6 | Oct 20 | Improper input validation in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML… Affected: 156.0.8078.47 before 156.0.8078.47 |
| CVE-2026-113171 | 9.6 | Oct 20 | Memory corruption in Prompts in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a… Affected: 156.0.8078.47 before 156.0.8078.47 |
| CVE-2026-113261 | 9.6 | Oct 20 | Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML… Affected: 156.0.8078.47 before 156.0.8078.47 |
| CVE-2026-112992 | 9.6 | Oct 20 | Memory corruption in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page Affected: 156.0.8078.47 before 156.0.8078.47 |
| CVE-2026-113189 | 9.6 | Oct 20 | Use after free in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page Affected: 156.0.8078.47 before 156.0.8078.47 |
| CVE-2026-113014 | 9.6 | Oct 20 | Use after free in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML… Affected: 156.0.8078.47 before 156.0.8078.47 |
| CVE-2026-113283 | 9.6 | Oct 20 | Memory corruption in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox… Affected: 156.0.8078.47 before 156.0.8078.47 |
| CVE-2026-113078 | 9.6 | Oct 20 | Improper input validation in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted… Affected: 156.0.8078.47 before 156.0.8078.47 |
| CVE-2026-113211 | 9.6 | Oct 20 | Memory corruption in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML… Affected: 156.0.8078.47 before 156.0.8078.47 |
| CVE-2026-113263 | 9.6 | Oct 20 | Use after free in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML… Affected: 156.0.8078.47 before 156.0.8078.47 |
The 500 most important CVEs for this product (exploited first, then by severity)