CVE Tools
Track your stack

Google Chrome

7,699 CVEs tracked. 77 of them are in CISA KEV.

This hub aggregates every CVE we track for Google Chrome, a product in the consumer software space. Use it to gauge the current risk picture and drill into individual advisories.

Google Chrome CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Google Chrome CVEs per month
MonthCVEs
2024-127
2025-0117
2025-029
2025-0316
2025-0413
2025-0514
2025-0610
2025-076
2025-0816
2025-0912
2025-101
2025-1167
2025-1219
2026-0112
2026-0220
2026-0374
2026-04144
2026-05370
2026-06965
2026-07487
2026-08396
2026-09467
2026-10731
2026-11215

Severity

How the 7,699 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical74310%
  • High3,60847%
  • Medium3,13941%
  • Low1602%

Latest CVEs

The 15 most recently published vulnerabilities affecting Google Chrome.

  1. CVE-2026-120930Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)5.4
  2. CVE-2026-120931Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium securit...9.6
  3. CVE-2026-121195Incorrect authorization in TrustedTypes in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)8.8
  4. CVE-2026-121141Improper input validation in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium s...5.4
  5. CVE-2026-121232Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium secu...5.1
  6. CVE-2026-121142Incorrect authorization in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chrom...—
  7. CVE-2026-121169Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromi...—
  8. CVE-2026-121064Improper input validation in Performance in Google Chrome prior to 157.0.8103.38 allowed a local attacker to potentially execute arbitrary code inside the sandbox via a local program. (Chromium sec...7.8
  9. CVE-2026-121069Use after free in Track in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)8.8
  10. CVE-2026-121230Race condition in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security sever...8.3
  11. CVE-2026-121175Improper resource exposure in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)—
  12. CVE-2026-121093Out of bounds read in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity:...—
  13. CVE-2026-121092Uncontrolled recursion in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security ...8.8
  14. CVE-2026-121041Missing authorization in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)6.5
  15. CVE-2026-121073Use after free in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security...9.6

Product grouping is registry-driven, with AI assist and human review. How it works