Chromium vulnerabilities and fixes

CVEs that mention Chromium, ranked by priority. 513 tracked.

Chromium has 513 tracked vulnerabilities, 94 critical and 2 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 513. Most recent: 2026-10-23. Highest priority: CVE-2026-85046 (score 86/100).

• CVE-2026-85046 HIGH 8.8 EXPLOITED UPGRADE UPGRADE Google Chromium V8 Type Confusion Vulnerability
• CVE-2026-87491 HIGH 8.8 EXPLOITED UPGRADE Google Chromium V8 Out of Bounds Write Vulnerability
• CVE-2026-113263 CRITICAL 9.6 UPGRADE Use after free in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to pote
• CVE-2026-66321 HIGH 7.4 UPGRADE Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an una
• CVE-2026-112994 HIGH 8.8 UPGRADE Memory corruption in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbi
• CVE-2026-113147 HIGH 8.8 UPGRADE Improper input validation in WebShare in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to pot
• CVE-2026-57990 HIGH 7.4 MITIGATE Files or directories accessible to external parties in Microsoft Edge (Chromium-based) allows an unauthorized
• CVE-2026-65802 HIGH 7.4 UPGRADE External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclos
• CVE-2026-113022 HIGH 8.8 UPGRADE Memory corruption in PDFium in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially e
• CVE-2026-113092 HIGH 8.8 UPGRADE Use after free in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to
• CVE-2026-113099 HIGH 8.8 UPGRADE Improper input validation in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote at
• CVE-2026-17655 CRITICAL 9.6 UPGRADE Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote a
• CVE-2026-17687 CRITICAL 9.6 UPGRADE Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised
• CVE-2026-17697 CRITICAL 9.6 UPGRADE Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perfo
• CVE-2026-19149 CRITICAL 9.6 UPGRADE Use after free in Aura in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker to potentia
• CVE-2026-112995 HIGH 8.8 UPGRADE Use after free in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbit
• CVE-2026-113009 HIGH 8.8 UPGRADE Use after free in WindowControlsOverlay in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to e
• CVE-2026-113014 CRITICAL 9.6 UPGRADE Use after free in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potenti
• CVE-2026-113023 CRITICAL 9.6 UPGRADE Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to p
• CVE-2026-113072 CRITICAL 9.6 UPGRADE Memory corruption in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially exec
• CVE-2026-113089 CRITICAL 9.6 UPGRADE Improper input validation in PrintPreview in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to
• CVE-2026-113141 HIGH 8.8 UPGRADE Use after free in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to e
• CVE-2026-113146 HIGH 8.8 UPGRADE Memory corruption in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to pote
• CVE-2026-113186 CRITICAL 9.6 UPGRADE Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arb
• CVE-2026-113189 CRITICAL 9.6 UPGRADE Use after free in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary
• CVE-2026-113235 CRITICAL 9.6 UPGRADE Improper input validation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to po
• CVE-2026-113252 CRITICAL 9.6 UPGRADE Improper input validation in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote atta
• CVE-2026-113261 CRITICAL 9.6 UPGRADE Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentia
• CVE-2026-113270 CRITICAL 9.6 UPGRADE Use after free in Internals in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbit
• CVE-2026-113283 CRITICAL 9.6 UPGRADE Memory corruption in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote
• CVE-2026-113300 CRITICAL 9.6 UPGRADE Out of bounds write in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially
• CVE-2026-113328 CRITICAL 9.6 UPGRADE Improper input validation in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to pote
• CVE-2026-113336 CRITICAL 9.6 UPGRADE Memory corruption in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentia
• CVE-2026-113342 CRITICAL 9.6 UPGRADE Memory corruption in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbi
• CVE-2026-17671 CRITICAL 9.6 UPGRADE Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote a
• CVE-2026-17676 CRITICAL 9.6 UPGRADE Inappropriate implementation in ANGLE in Google Chrome on Android prior to 151.0.7922.72 allowed a remote atta
• CVE-2026-17682 CRITICAL 9.6 UPGRADE Integer overflow in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromise
• CVE-2026-17691 CRITICAL 9.6 UPGRADE Out of bounds write in ANGLE in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to p
• CVE-2026-17695 CRITICAL 9.6 UPGRADE Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker
• CVE-2026-17704 CRITICAL 9.6 UPGRADE Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised
• CVE-2026-17717 CRITICAL 9.6 UPGRADE Integer overflow in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially per
• CVE-2026-66312 MEDIUM 6.5 UPGRADE Buffer over-read in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a netwo
• CVE-2026-76036 CRITICAL 9.6 UPGRADE Buffer overflow in Dawn in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker to ex
• CVE-2026-112992 CRITICAL 9.6 UPGRADE Memory corruption in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially e
• CVE-2026-113007 CRITICAL 9.6 UPGRADE Memory corruption in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentia
• CVE-2026-113056 CRITICAL 9.6 UPGRADE Memory corruption in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to pote
• CVE-2026-113116 CRITICAL 9.6 UPGRADE Use after free in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially ex
• CVE-2026-113118 HIGH 8.8 UPGRADE Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute a
• CVE-2026-113126 CRITICAL 9.6 UPGRADE Memory corruption in PolicyContainer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to pote
• CVE-2026-113138 CRITICAL 9.6 UPGRADE Memory corruption in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to poten
• CVE-2026-113169 CRITICAL 9.6 UPGRADE Memory corruption in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote att
• CVE-2026-113171 CRITICAL 9.6 UPGRADE Memory corruption in Prompts in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker t
• CVE-2026-113211 CRITICAL 9.6 UPGRADE Memory corruption in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potent
• CVE-2026-113222 CRITICAL 9.6 UPGRADE Use after free in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute
• CVE-2026-113331 HIGH 8.8 UPGRADE Memory corruption in Controls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially
• CVE-2026-17675 CRITICAL 9.6 UPGRADE Out of bounds write in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had comprom
• CVE-2026-17701 CRITICAL 9.6 UPGRADE Insufficient validation of untrusted input in ANGLE in Google Chrome on Mac prior to 151.0.7922.72 allowed a r
• CVE-2026-17718 CRITICAL 9.6 UPGRADE Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perfo
• CVE-2026-17721 CRITICAL 9.6 UPGRADE Out of bounds write in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially
• CVE-2026-17801 CRITICAL 9.6 UPGRADE Out of bounds read and write in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to pot
• CVE-2026-17894 HIGH 8.8 UPGRADE Use after free in Views in Google Chrome on Linux prior to 151.0.7922.72 allowed a remote attacker to potentia
• CVE-2026-66315 HIGH 7.5 UPGRADE Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a netwo
• CVE-2026-76035 CRITICAL 9.6 UPGRADE Inappropriate implementation in Media in Google Chrome on on Mac prior to 151.0.7922.169 allowed a remote atta
• CVE-2026-113078 CRITICAL 9.6 Improper input validation in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to
• CVE-2026-113084 CRITICAL 9.6 UPGRADE Improper input validation in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to
• CVE-2026-113163 HIGH 8.8 UPGRADE Use after free in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to exe
• CVE-2026-16806 HIGH 8.8 UPGRADE Use after free in WebMCP in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execute arbitra
• CVE-2026-17681 CRITICAL 9.6 UPGRADE Insufficient validation of untrusted input in Web Authentication in Google Chrome on Android prior to 151.0.79
• CVE-2026-17881 HIGH 8.8 UPGRADE Integer overflow in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitra
• CVE-2026-19166 CRITICAL 9.6 UPGRADE Use after free in Web Authentication in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to pot
• CVE-2026-66326 MEDIUM 6.5 UPGRADE Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over
• CVE-2026-76034 HIGH 8.8 UPGRADE Buffer overflow in WebGL in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitra
• CVE-2026-76040 HIGH 8.8 UPGRADE Use after free in Browser in Google Chrome on on Mac prior to 151.0.7922.169 allowed a remote attacker leverag
• CVE-2026-76045 HIGH 8.8 UPGRADE Use after free in WebGL in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrar
• CVE-2026-113217 HIGH 8.8 UPGRADE Use after free in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attack
• CVE-2026-115570 HIGH 7.4 Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS
• CVE-2026-17666 CRITICAL 9.1 UPGRADE Cryptographic Flaw in Enterprise in Google Chrome prior to 151.0.7922.72 allowed an attacker in a privileged n
• CVE-2026-17677 HIGH 8.8 UPGRADE Inappropriate implementation in ANGLE in Google Chrome on Android prior to 151.0.7922.72 allowed a remote atta
• CVE-2026-17678 HIGH 8.8 UPGRADE Out of bounds read in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromi
• CVE-2026-17680 CRITICAL 9.6 UPGRADE Heap buffer overflow in Color in Google Chrome on ChromeOS prior to 151.0.7922.72 allowed a remote attacker wh
• CVE-2026-17758 CRITICAL 9.6 UPGRADE Heap buffer overflow in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially
• CVE-2026-17847 CRITICAL 9.6 UPGRADE Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote a
• CVE-2026-19157 CRITICAL 9.6 UPGRADE Out of bounds write in ANGLE in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker to
• CVE-2026-66318 HIGH 8.1 UPGRADE Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose informa
• CVE-2026-113018 HIGH 8.8 UPGRADE Memory corruption in IME in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially exec
• CVE-2026-113019 HIGH 8.8 UPGRADE Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitr
• CVE-2026-113088 HIGH 8.8 UPGRADE Memory corruption in Mobile in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to
• CVE-2026-113091 HIGH 8.8 UPGRADE Use after free in PerformanceAPIs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attac
• CVE-2026-113096 HIGH 8.8 UPGRADE Memory corruption in Text in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to e
• CVE-2026-113107 HIGH 8.8 UPGRADE Use after free in Media in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to exe
• CVE-2026-113145 HIGH 8.8 UPGRADE Memory corruption in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker
• CVE-2026-113156 HIGH 8.8 UPGRADE Use after free in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to
• CVE-2026-113210 HIGH 8.8 UPGRADE Use after free in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to exe
• CVE-2026-17651 CRITICAL 9.6 UPGRADE Insufficient validation of untrusted input in Dawn in Google Chrome on Android prior to 151.0.7922.72 allowed
• CVE-2026-17652 CRITICAL 9.6 UPGRADE Use after free in Views in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised
• CVE-2026-17656 CRITICAL 9.6 UPGRADE Use after free in Ozone in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perfo
• CVE-2026-17669 CRITICAL 9.6 UPGRADE Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote
• CVE-2026-17670 CRITICAL 9.6 UPGRADE Use after free in Views in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised
• CVE-2026-17672 CRITICAL 9.6 UPGRADE Insufficient validation of untrusted input in Chromecast in Google Chrome prior to 151.0.7922.72 allowed a rem
• CVE-2026-17673 CRITICAL 9.6 UPGRADE Integer overflow in QUIC in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised
• CVE-2026-17684 CRITICAL 9.6 UPGRADE Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 al
• CVE-2026-17688 CRITICAL 9.6 UPGRADE Use after free in Input in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised
• CVE-2026-17692 CRITICAL 9.6 UPGRADE Use after free in DataTransfer in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker wh
• CVE-2026-17708 CRITICAL 9.6 UPGRADE Use after free in Audio in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised
• CVE-2026-17710 CRITICAL 9.6 UPGRADE Inappropriate implementation in MHTML in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker
• CVE-2026-17712 HIGH 8.8 UPGRADE Race in Skia in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary cod
• CVE-2026-17713 CRITICAL 9.6 UPGRADE Insufficient validation of untrusted input in Accessibility in Google Chrome on Android prior to 151.0.7922.72
• CVE-2026-17725 HIGH 8.8 UPGRADE Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary co
• CVE-2026-17726 CRITICAL 9.6 UPGRADE Integer overflow in WebGL in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to pote
• CVE-2026-17727 CRITICAL 9.6 UPGRADE Out of bounds write in WebGL in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to p
• CVE-2026-17738 CRITICAL 9.6 UPGRADE Insufficient validation of untrusted input in Payments in Google Chrome prior to 151.0.7922.72 allowed a remot
• CVE-2026-17768 CRITICAL 9.6 UPGRADE Insufficient validation of untrusted input in WebSockets in Google Chrome prior to 151.0.7922.72 allowed a rem
• CVE-2026-17803 CRITICAL 9.6 UPGRADE Insufficient validation of untrusted input in Save to Drive in Google Chrome prior to 151.0.7922.72 allowed a
• CVE-2026-17804 CRITICAL 9.6 UPGRADE Use after free in Media in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised
• CVE-2026-17832 CRITICAL 9.6 UPGRADE Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised
• CVE-2026-17834 CRITICAL 9.6 UPGRADE Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remo
• CVE-2026-17837 CRITICAL 9.6 UPGRADE Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remot
• CVE-2026-17848 CRITICAL 9.6 UPGRADE Integer overflow in Codecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially pe
• CVE-2026-17856 CRITICAL 9.6 UPGRADE Inappropriate implementation in Network in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attack
• CVE-2026-17865 CRITICAL 9.6 UPGRADE Inappropriate implementation in Crypto in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacke
• CVE-2026-17922 HIGH 8.8 UPGRADE Inappropriate implementation in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker t
• CVE-2026-17924 CRITICAL 9.6 UPGRADE Use after free in DNS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised th
• CVE-2026-17935 HIGH 8.8 UPGRADE Heap buffer overflow in Codecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute ar
• CVE-2026-17940 CRITICAL 9.6 UPGRADE Insufficient validation of untrusted input in Picture-in-Picture in Google Chrome on Android prior to 151.0.79
• CVE-2026-17947 CRITICAL 9.6 UPGRADE Use after free in WebSockets in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially
• CVE-2026-17987 CRITICAL 9.6 UPGRADE Insufficient validation of untrusted input in Notifications in Google Chrome prior to 151.0.7922.72 allowed a
• CVE-2026-17989 HIGH 8.8 UPGRADE Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary co
• CVE-2026-17990 CRITICAL 9.6 UPGRADE Insufficient validation of untrusted input in WebAuthn in Google Chrome prior to 151.0.7922.72 allowed a remot
• CVE-2026-17991 CRITICAL 9.6 UPGRADE Insufficient validation of untrusted input in AI in Google Chrome prior to 151.0.7922.72 allowed a remote atta
• CVE-2026-18002 CRITICAL 9.6 UPGRADE Insufficient validation of untrusted input in Google Lens in Google Chrome prior to 151.0.7922.72 allowed a re
• CVE-2026-18015 CRITICAL 9.6 UPGRADE Inappropriate implementation in Tint in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker
• CVE-2026-19147 HIGH 8.3 UPGRADE Use after free in Aura in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker who had com
• CVE-2026-19148 HIGH 8.3 UPGRADE Out of bounds write in GPU in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker who had
• CVE-2026-19164 CRITICAL 9.6 UPGRADE Insufficient validation of untrusted input in Codecs in Google Chrome prior to 151.0.7922.109 allowed a remote
• CVE-2026-19170 CRITICAL 9.6 UPGRADE Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker to poten
• CVE-2026-19171 CRITICAL 9.6 UPGRADE Use after free in Media in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker to poten
• CVE-2026-19175 CRITICAL 9.6 UPGRADE Use after free in Payments in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially p
• CVE-2026-57989 HIGH 7.4 UPGRADE Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose informa
• CVE-2026-76038 HIGH 8.8 UPGRADE Type confusion in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary c
• CVE-2026-76047 HIGH 8.8 UPGRADE Type confusion in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary c
• CVE-2026-113117 HIGH 8.8 UPGRADE Improper input validation in ANGLE in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker
• CVE-2026-113119 HIGH 8.8 UPGRADE Use after free in Network in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to e
• CVE-2026-113121 HIGH 8.8 UPGRADE Memory corruption in ContextMenu in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attack
• CVE-2026-113134 HIGH 8.8 UPGRADE Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to
• CVE-2026-113164 HIGH 8.8 UPGRADE Memory corruption in Voice in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to
• CVE-2026-113207 HIGH 8.8 UPGRADE Use after free in SiteIsolation in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacke
• CVE-2026-16805 HIGH 8.8 UPGRADE Use after free in Blink in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execute arbitrar
• CVE-2026-17653 HIGH 8.3 UPGRADE Use after free in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised t
• CVE-2026-17658 HIGH 8.8 UPGRADE Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary co
• CVE-2026-17661 HIGH 8.8 UPGRADE Use after free in Loader in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrar

FAQ

How do I fix Chromium vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Chromium being exploited right now?

Yes: 2 Chromium CVEs are on the CISA Known Exploited Vulnerabilities list, so patch those first.

Which Chromium CVE should I patch first?

CVE-2026-85046 currently ranks highest (86/100): Google Chromium V8 Type Confusion Vulnerability.

← Back to latest CVEs