CVE Tools
Track your stack

Google Chrome

7,011 CVEs tracked. 77 of them are in CISA KEV.

This hub aggregates every CVE we track for Google Chrome, a product in the consumer software space. Use it to gauge the current risk picture and drill into individual advisories.

Google Chrome CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Google Chrome CVEs per month
MonthCVEs
2024-1113
2024-127
2025-0117
2025-029
2025-0316
2025-0413
2025-0514
2025-0610
2025-076
2025-0816
2025-0912
2025-101
2025-1167
2025-1219
2026-0112
2026-0220
2026-0374
2026-04144
2026-05370
2026-06965
2026-07487
2026-08396
2026-09467
2026-10258

Severity

How the 7,011 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical6589%
  • High3,16745%
  • Medium3,02643%
  • Low1582%

Latest CVEs

The 15 most recently published vulnerabilities affecting Google Chrome.

  1. CVE-2026-106355Missing authorization in Media in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted...5.3
  2. CVE-2026-106272UI misrepresentation in Chromoting in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially spoof UI elements via crafted network...5.4
  3. CVE-2026-106234Use after free in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chr...9.6
  4. CVE-2026-106269Use after free in CSS in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)8.8
  5. CVE-2026-106310Use of released resource in FontAccess in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page...6.5
  6. CVE-2026-106345Use of released resource in Session in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromiu...4.2
  7. CVE-2026-106251UI misrepresentation in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. (Chrom...5.4
  8. CVE-2026-106325Incorrect reference resolution in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak cross-origin data via a crafted HTML page. (Chromium s...4.3
  9. CVE-2026-106334Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium secur...8.8
  10. CVE-2026-106294Incomplete cleanup in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security sev...9.1
  11. CVE-2026-106236UI misrepresentation in Chromoting in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. (C...5.4
  12. CVE-2026-106390Incorrect provision of specified functionality in SanitizerAPI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium sec...4.3
  13. CVE-2026-106385Race condition in Chromoting in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially bypass system access restrictions via crafted network tra...5.3
  14. CVE-2026-106413Race condition in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security...4.2
  15. CVE-2026-106339Use of released resource in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTM...3.1

Product grouping is registry-driven, with AI assist and human review. How it works