Chrome vulnerabilities

2,945 known vulnerabilities in Chrome from Google. 2,939 are rated high or critical, and 78 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Google Chromium V8 Improper Input Validation Exploited

  CVE-2021-21220Apr 26, 2021GoogleEPSS 70.4%

  Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

• 8.8 High severity

  Google Chromium Blink Use-After-Free Exploited

  CVE-2021-21206Apr 26, 2021GoogleEPSS 9.31%

  Use after free in Blink in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

• 8.8 High severity

  Google Chromium Blink Use-After-Free Exploited

  CVE-2021-21193Mar 16, 2021GoogleEPSS 9.95%

  Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

• 8.8 High severity

  Google Chromium Race Condition Exploited

  CVE-2021-21166Mar 9, 2021GoogleEPSS 24%

  Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

• 8.8 High severity

  Google Chromium V8 Heap Buffer Overflow Exploited

  CVE-2021-21148Feb 9, 2021GoogleEPSS 20%

  Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

• 8.8 High severity

  Google Chrome Media Use-After-Free Exploited

  CVE-2020-6572Jan 14, 2021GoogleEPSS 10.6%

  Use after free in Media in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to execute arbitrary code via a crafted HTML page.

• 9.6 Critical severity

  Google Chrome Use-After-Free Exploited

  CVE-2020-16017Jan 8, 2021GoogleEPSS 2.73%

  Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

• 8.8 High severity

  Google Chromium V8 Incorrect Implementation Vulnerabililty Exploited

  CVE-2020-16013Jan 8, 2021GoogleEPSS 2.76%

  Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

• 9.6 Critical severity

  Google Chrome for Android UI Heap Buffer Overflow Exploited

  CVE-2020-16010Nov 3, 2020GoogleEPSS 6.36%

  Heap buffer overflow in UI in Google Chrome on Android prior to 86.0.4240.185 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

• 8.8 High severity

  Google Chromium V8 Type Confusion Exploited

  CVE-2020-16009Nov 3, 2020GoogleEPSS 48.3%

  Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

• 9.6 Critical severity

  Google Chrome FreeType Heap Buffer Overflow Exploited

  CVE-2020-15999Nov 3, 2020GoogleEPSS 63.9%

  Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

• 8.8 High severity

  Google Chromium V8 Type Confusion Exploited

  CVE-2020-6418Feb 27, 2020GoogleEPSS 78.8%

  Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

• 6.5 Medium severity

  Google Chromium V8 Out-of-Bounds Write Exploited

  CVE-2019-5825Nov 25, 2019GoogleEPSS 55.9%

  Out of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

• 8.8 High severity

  Google Chrome WebAudio Use-After-Free Exploited

  CVE-2019-13720Nov 25, 2019GoogleEPSS 49.4%

  Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

• 6.5 Medium severity

  Google Chrome Blink Use-After-Free Exploited

  CVE-2019-5786Jun 27, 2019GoogleEPSS 61.1%

  Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.

• 8.8 High severity

  Google Chromium V8 Out-of-Bounds Write Exploited

  CVE-2018-17480Dec 11, 2018GoogleEPSS 35.6%

  Execution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

• 8.8 High severity

  Google Chromium V8 Integer Overflow Exploited

  CVE-2018-6065Nov 14, 2018GoogleEPSS 60.3%

  Integer overflow in computing the required allocation size when instantiating a new javascript object in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

• 8.8 High severity

  Google Chromium V8 Remote Code Execution Exploited

  CVE-2018-17463Nov 14, 2018GoogleEPSS 84.6%

  Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

• 8.8 High severity

  Google Chromium V8 Type Confusion Exploited

  CVE-2017-5070Oct 27, 2017Google Chrome prior to 59.0.3071.86 for Linux, Windows and Mac, and 59.0.3071.92 for AndroidEPSS 32.1%

  Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

• 8.8 High severity

  Google Chromium V8 Memory Corruption Exploited

  CVE-2017-5030Apr 24, 2017Google Chrome prior to 57.0.2987.98 for Linux, Windows and Mac, and 57.0.2987.108 for AndroidEPSS 40.6%

  Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.2987.108 for Android allowed a remote attacker to execute arbitrary code via a crafted HTML page.

• 8.8 High severity

  Google Chromium V8 Out-of-Bounds Memory Exploited

  CVE-2016-5198Jan 19, 2017Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and MacEPSS 34.2%

  V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac included incorrect optimisation assumptions, which allowed a remote attacker to perform arbitrary read/write operations, leading to code exe

• 8.8 High severity

  Google Chromium V8 Out-of-Bounds Read Exploited

  CVE-2016-1646Mar 29, 2016DebianEPSS 48.1%

  The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly hav

• 9.8 Critical severity

  Adobe Flash Player Integer Underflow Vulnerablity Exploited

  CVE-2014-0497Feb 5, 2014AdobeEPSS 99.9%

  Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors.

• 8.8 High severity

  Adobe Flash Player Remote Code Execution Exploited

  CVE-2011-0611Apr 13, 2011AdobeEPSS 99.4%

  Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.19140; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader 9.x before 9.4.4 and 10.x through 10.0.1 on Windows, Ad

• 7.8 High severity

  Adobe Flash Player Unspecified Exploited

  CVE-2011-0609Mar 15, 2011AdobeEPSS 63.5%

  Unspecified vulnerability in Adobe Flash Player 10.2.154.13 and earlier on Windows, Mac OS X, Linux, and Solaris; 10.1.106.16 and earlier on Android; Adobe AIR 2.5.1 and earlier; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader and Acrobat 9.x through