CH
Browser
Chrome
On CISA KEVExploited in the wildRansomware-linked
7,406
CVEs
77
On KEV
10.0
Max CVSS
851
New 30D
Severity mix
Critical 438High 56Medium 6Low 0
Watch
Add Chrome to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-5866 | 9.8 | Nov 25 | Out of bounds memory access in JavaScript in Google Chrome prior to 75.0.3770.142 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page Affected: before 75.0.3770.142 |
| CVE-2016-9652 | 9.8 | Nov 20 | Multiple unspecified vulnerabilities in Google Chrome before 55.0.2883.75 Affected: before 55.0.2883.75 |
| CVE-2016-5194 | 9.8 | Nov 20 | Unspecified vulnerabilities in Google Chrome before 54.0.2840.59 Affected: before 54.0.2840.59 |
| CVE-2017-15398 | 9.8 | Aug 28 | A stack buffer overflow in the QUIC networking stack in Google Chrome prior to 62.0.3202.89 allowed a remote attacker to gain code execution via a malicious server Affected: before 62.0.3202.89 |
| CVE-2016-5178 | 9.8 | May 23 | Multiple unspecified vulnerabilities in Google Chrome before 53.0.2785.143 allow remote attackers to cause a denial of service or possibly have other impact via unknown vectors Affected: through 53.0.2785.129 |
| CVE-2014-9654 | 9.8 | Apr 24 | The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before 2014-12-03, as used in Google Chrome before 40.0.2214.91, calculates certain values… Affected: through 40.0.2214.85 |
| CVE-2013-6647 | 9.8 | Apr 11 | A use-after-free in AnimationController::endAnimationUpdate in Google Chrome Affected: All versions, or not specified |
| CVE-2016-5146 | 9.8 | Aug 7 | Multiple unspecified vulnerabilities in Google Chrome before 52.0.2743.116 allow attackers to cause a denial of service or possibly have other impact via unknown vectors Affected: through 52.0.2743.82 |
| CVE-2016-5144 | 9.8 | Aug 7 | The Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before 52.0.2743.116, mishandles the script-path hostname, remoteBase parameter, and… Affected: through 52.0.2743.82 |
| CVE-2016-5143 | 9.8 | Aug 7 | The Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before 52.0.2743.116, mishandles the script-path hostname, remoteBase parameter, and… Affected: through 52.0.2743.82 |
| CVE-2016-5142 | 9.8 | Aug 7 | The Web Cryptography API (aka WebCrypto) implementation in Blink, as used in Google Chrome before 52.0.2743.116, does not properly copy data buffers, which allows remote attackers… Affected: through 52.0.2743.82 |
| CVE-2016-5140 | 9.8 | Aug 7 | Heap-based buffer overflow in the opj_j2k_read_SQcd_SQcc function in j2k.c in OpenJPEG, as used in PDFium in Google Chrome before 52.0.2743.116, allows remote attackers to cause a… Affected: through 52.0.2743.82 |
| CVE-2016-1666 | 9.8 | May 14 | Multiple unspecified vulnerabilities in Google Chrome before 50.0.2661.94 allow attackers to cause a denial of service or possibly have other impact via unknown vectors Affected: through 50.0.2661.87 |
| CVE-2016-1662 | 9.8 | May 14 | extensions/renderer/gc_callback.cc in Google Chrome before 50.0.2661.94 does not prevent fallback execution once the Garbage Collection callback has started, which allows remote… Affected: through 50.0.2661.87 |
| CVE-2016-1659 | 9.8 | Apr 18 | Multiple unspecified vulnerabilities in Google Chrome before 50.0.2661.75 allow attackers to cause a denial of service or possibly have other impact via unknown vectors Affected: through 49.0.2623.112 |
| CVE-2016-2843 | 9.8 | Mar 6 | Multiple unspecified vulnerabilities in Google V8 before 4.9.385.26, as used in Google Chrome before 49.0.2623.75, allow attackers to cause a denial of service or possibly have… Affected: through 48.0.2564.116 |
| CVE-2016-1642 | 9.8 | Mar 6 | Multiple unspecified vulnerabilities in Google Chrome before 49.0.2623.75 allow attackers to cause a denial of service or possibly have other impact via unknown vectors Affected: through 48.0.2564.116 |
| CVE-2016-1639 | 9.8 | Mar 6 | Use-after-free vulnerability in browser/extensions/api/webrtc_audio_private/webrtc_audio_private_api.cc in the WebRTC Audio Private API implementation in Google Chrome before… Affected: through 48.0.2564.116 |
| CVE-2016-1636 | 9.8 | Mar 6 | The PendingScript::notifyFinished function in WebKit/Source/core/dom/PendingScript.cpp in Google Chrome before 49.0.2623.75 relies on memory-cache information about… Affected: through 48.0.2564.116 |
| CVE-2016-1635 | 9.8 | Mar 6 | extensions/renderer/render_frame_observer_natives.cc in Google Chrome before 49.0.2623.75 does not properly consider object lifetimes and re-entrancy issues during… Affected: through 48.0.2564.116 |
| CVE-2016-1633 | 9.8 | Mar 6 | Use-after-free vulnerability in Blink, as used in Google Chrome before 49.0.2623.75, allows remote attackers to cause a denial of service or possibly have unspecified other impact… Affected: through 48.0.2564.116 |
| CVE-2016-1629 | 9.8 | Feb 21 | Google Chrome before 48.0.2564.116 allows remote attackers to bypass the Blink Same Origin Policy and a sandbox protection mechanism via unspecified vectors Affected: through 48.0.2564.109 |
| CVE-2016-2051 | 9.8 | Jan 25 | Multiple unspecified vulnerabilities in Google V8 before 4.8.271.17, as used in Google Chrome before 48.0.2564.82, allow attackers to cause a denial of service or possibly have… Affected: through 47.0.2526.111 |
| CVE-2015-6792 | 9.8 | Dec 24 | The MIDI subsystem in Google Chrome before 47.0.2526.106 does not properly handle the sending of data, which allows remote attackers to execute arbitrary code or cause a denial of… Affected: through 47.0.2526.80 |
| CVE-2015-6764 | 9.8 | Dec 6 | The BasicJsonStringifier::SerializeJSArray function in json-stringifier.h in the JSON stringifier in Google V8, as used in Google Chrome before 47.0.2526.73, improperly loads… Affected: through 46.0.2490.86 |
| CVE-2015-1276 | 9.8 | Jul 23 | Use-after-free vulnerability in content/browser/indexed_db/indexed_db_backing_store.cc in the IndexedDB implementation in Google Chrome before 44.0.2403.89 allows remote attackers… Affected: through 43.0.2357.134 |
| CVE-2010-4202 | 9.8 | Nov 6 | Multiple integer overflows in Google Chrome before 7.0.517.44 on Linux allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted… Affected: before 7.0.517.44 |
| CVE-2010-4201 | 9.8 | Nov 6 | Use-after-free vulnerability in Google Chrome before 7.0.517.44 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors… Affected: before 7.0.517.44 |
| CVE-2010-4197 | 9.8 | Nov 6 | Use-after-free vulnerability in WebKit, as used in Google Chrome before 7.0.517.44, webkitgtk before 1.2.6, and other products, allows remote attackers to cause a denial of… Affected: before 7.0.517.44 |
| CVE-2010-4203 | 9.8 | Nov 5 | WebM libvpx (aka the VP8 Codec SDK) before 0.9.5, as used in Google Chrome before 7.0.517.44, allows remote attackers to cause a denial of service (memory corruption) or possibly… Affected: before 7.0.517.44 |
| CVE-2010-4205 | 9.8 | Nov 5 | Google Chrome before 7.0.517.44 does not properly handle the data types of event objects, which allows remote attackers to cause a denial of service or possibly have unspecified… Affected: before 7.0.517.44 |
| CVE-2010-4204 | 9.8 | Nov 5 | WebKit, as used in Google Chrome before 7.0.517.44, webkitgtk before 1.2.6, and other products, accesses a frame object after this object has been destroyed, which allows remote… Affected: before 7.0.517.44 |
| CVE-2010-4042 | 9.8 | Oct 21 | Google Chrome before 7.0.517.41 does not properly handle element maps, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via… Affected: before 7.0.517.41 |
| CVE-2010-4041 | 9.8 | Oct 21 | The sandbox implementation in Google Chrome before 7.0.517.41 on Linux does not properly constrain worker processes, which might allow remote attackers to bypass intended access… Affected: before 7.0.517.41 |
| CVE-2010-4039 | 9.8 | Oct 21 | Google Chrome before 7.0.517.41 on Linux does not properly set the PATH environment variable, which has unspecified impact and attack vectors Affected: before 7.0.517.41 |
| CVE-2010-3729 | 9.8 | Oct 5 | The SPDY protocol implementation in Google Chrome before 6.0.472.62 does not properly manage buffers, which might allow remote attackers to execute arbitrary code via unspecified… Affected: before 6.0.472.62 |
| CVE-2010-3416 | 9.8 | Sep 16 | Google Chrome before 6.0.472.59 on Linux does not properly implement the Khmer locale, which allows remote attackers to cause a denial of service (memory corruption) or possibly… Affected: before 6.0.472.59 |
| CVE-2010-1205 | 9.8 | Jun 30 | Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in progressive applications, might allow remote attackers to execute arbitrary code via a PNG… Affected: before 5.0.375.99 |
| CVE-2026-113169 | 9.6 | Oct 20 | Memory corruption in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted… Affected: 156.0.8078.47 before 156.0.8078.47 |
| CVE-2026-113116 | 9.6 | Oct 20 | Use after free in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page Affected: 156.0.8078.47 before 156.0.8078.47 |
| CVE-2026-113186 | 9.6 | Oct 20 | Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page Affected: 156.0.8078.47 before 156.0.8078.47 |
| CVE-2026-113023 | 9.6 | Oct 20 | Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted… Affected: 156.0.8078.47 before 156.0.8078.47 |
| CVE-2026-113300 | 9.6 | Oct 20 | Out of bounds write in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page Affected: 156.0.8078.47 before 156.0.8078.47 |
| CVE-2026-113056 | 9.6 | Oct 20 | Memory corruption in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML… Affected: 156.0.8078.47 before 156.0.8078.47 |
| CVE-2026-113089 | 9.6 | Oct 20 | Improper input validation in PrintPreview in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted… Affected: 156.0.8078.47 before 156.0.8078.47 |
| CVE-2026-113235 | 9.6 | Oct 20 | Improper input validation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted… Affected: 156.0.8078.47 before 156.0.8078.47 |
| CVE-2026-113342 | 9.6 | Oct 20 | Memory corruption in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page Affected: 156.0.8078.47 before 156.0.8078.47 |
| CVE-2026-113138 | 9.6 | Oct 20 | Memory corruption in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML… Affected: 156.0.8078.47 before 156.0.8078.47 |
| CVE-2026-113270 | 9.6 | Oct 20 | Use after free in Internals in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page Affected: 156.0.8078.47 before 156.0.8078.47 |
| CVE-2026-113007 | 9.6 | Oct 20 | Memory corruption in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML… Affected: 156.0.8078.47 before 156.0.8078.47 |
The 500 most important CVEs for this product (exploited first, then by severity)