Google vulnerabilities in CISA KEV
Google has 76 vulnerabilities in CISA's catalogue of flaws known to be exploited, the 5th highest of any vendor. 11 were added in the last 12 months; none are linked to known ransomware use (0% of its entries, against 20.4% across the catalogue). CISA's median fix window for these entries is 21 days (range 3 to 181), against 21 days (range 1 to 184) across the whole catalogue. The most exploited product is Chromium V8, with 41 entries. Other frequently affected products: Chromium (6); Chromium Blink (2).
Catalog v2026.11.04, released 5 Nov 2026. Source CISA ↗. All KEV entries.
$ ./kev --vendor google --summary
Counts are computed from the catalog release on ; the 12 month window ends there.
┌─ total entries
76
in CISA KEV
┌─ first added
2021-11-03
earliest entry
┌─ latest added
2026-10-27
most recent entry
┌─ last 12 months
11
entries added
┌─ ransomware use
0 of 76
0% linked to ransomware
┌─ distinct products
26
affected products
$ awk -F, {print $1} /var/log/kev/google.log | uniq -c
Entries by the year CISA added them.
| Year | Entries added | Of which ransomware |
|---|---|---|
| 2021 | 23 | 0 |
| 2022 | 21 | 0 |
| 2023 | 7 | 0 |
| 2024 | 9 | 0 |
| 2025 | 7 | 0 |
| 2026 | 9 | 0 |
$ sort /var/log/kev/google.log | uniq -c | sort -rn | head -5
The five products with the most entries in the catalogue.
- Chromium V8 41 entries
- Chromium 6 entries
- Chromium Blink 2 entries
- Chromium Intents 2 entries
- Chromium Mojo 2 entries
$ kev-due-dates --vendor google
Days between the date CISA added an entry and the due date it set, median and range. Due dates apply to US federal agencies; for everyone else they are a patch-first ranking signal.
21 days (range 3 to 181)
median and range in days
┌─ whole catalogue
21 days (range 1 to 184)
median and range in days
$ grep -o 'CWE-[0-9]*' /var/log/kev/google.log | sort | uniq -c | sort -rn | head -3
Weakness types CISA records for these entries (73 of 76 have at least one CWE).
$ grep -ril 'Google' /var/log/news | head -5
Our reporting that names Google or one of its KEV CVE ids, newest first.
- [INFO] Hackers Use Fake Events to Steal Microsoft and Google Accounts news/fake-events-steal-microsoft-google-accounts.md
Patch Week pages with these entries
$ wc -l ./google.kev · 76 rows
Descriptions: CISA Known Exploited Vulnerabilities catalogue
- CVE-2026-111497
Brotli
Google Brotli Unchecked Return Value Vulnerability
due 2026-11-10 · CWE-252 CWE-787
$ cat CVE-2026-111497.txt
Description. Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2026-58704
Pixel
Google Pixel Improper Authorization Vulnerability
due 2026-09-19 · CWE-693
$ cat CVE-2026-58704.txt
Description. Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2026-87491
Chromium V8
Google Chromium V8 Out of Bounds Write Vulnerability
due 2026-09-23 · CWE-787
$ cat CVE-2026-87491.txt
Description. Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2026-85046
Chromium V8
Google Chromium V8 Type Confusion Vulnerability
due 2026-09-18 · CWE-843
$ cat CVE-2026-85046.txt
Description. Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2026-11645
Chromium V8
Google Chromium V8 Out-of-Bounds Read and Write Vulnerability
due 2026-06-23 · CWE-787 CWE-125
$ cat CVE-2026-11645.txt
Description. Google Chromium V8 out-of-bounds read and write vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2026-5281
Dawn
Google Dawn Use-After-Free Vulnerability
due 2026-04-15 · CWE-416
$ cat CVE-2026-5281.txt
Description. Google Dawn contains an use-after-free vulnerability that could allow a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. This vulnerability could affect multiple Chromium-based products including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2026-3909
Skia
Google Skia Out-of-Bounds Write Vulnerability
due 2026-03-27 · CWE-787
$ cat CVE-2026-3909.txt
Description. Google Skia contains an out-of-bounds write vulnerability that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2026-3910
Chromium V8
Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability
due 2026-03-27 · CWE-119
$ cat CVE-2026-3910.txt
Description. Google Chromium V8 contains an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2026-2441
Chromium
Google Chromium CSS Use-After-Free Vulnerability
due 2026-03-10 · CWE-416
$ cat CVE-2026-2441.txt
Description. Google Chromium CSS contains a use-after-free vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2025-14174
Chromium
Google Chromium Out of Bounds Memory Access Vulnerability
due 2026-01-02
$ cat CVE-2025-14174.txt
Description. Google Chromium contains an out of bounds memory access vulnerability in ANGLE that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2025-13223
Chromium V8
Google Chromium V8 Type Confusion Vulnerability
due 2025-12-10 · CWE-843
$ cat CVE-2025-13223.txt
Description. Google Chromium V8 contains a type confusion vulnerability that allows for heap corruption.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2025-10585
Chromium V8
Google Chromium V8 Type Confusion Vulnerability
due 2025-10-14 · CWE-843
$ cat CVE-2025-10585.txt
Description. Google Chromium contains a type confusion vulnerability in the V8 JavaScript and WebAssembly engine.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2025-6558
Chromium
Google Chromium ANGLE and GPU Improper Input Validation Vulnerability
due 2025-08-12 · CWE-20
$ cat CVE-2025-6558.txt
Description. Google Chromium contains an improper input validation vulnerability in ANGLE and GPU. This vulnerability could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2025-6554
Chromium V8
Google Chromium V8 Type Confusion Vulnerability
due 2025-07-23 · CWE-843
$ cat CVE-2025-6554.txt
Description. Google Chromium V8 contains a type confusion vulnerability that could allow a remote attacker to perform arbitrary read/write via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2025-5419
Chromium V8
Google Chromium V8 Out-of-Bounds Read and Write Vulnerability
due 2025-06-26 · CWE-125 CWE-787
$ cat CVE-2025-5419.txt
Description. Google Chromium V8 contains an out-of-bounds read and write vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2025-2783
Chromium Mojo
Google Chromium Mojo Sandbox Escape Vulnerability
due 2025-04-17
$ cat CVE-2025-2783.txt
Description. Google Chromium Mojo on Windows contains a sandbox escape vulnerability caused by a logic error, which results from an incorrect handle being provided in unspecified circumstances. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2024-7965
Chromium V8
Google Chromium V8 Inappropriate Implementation Vulnerability
due 2024-09-18 · CWE-358
$ cat CVE-2024-7965.txt
Description. Google Chromium V8 contains an inappropriate implementation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2024-7971
Chromium V8
Google Chromium V8 Type Confusion Vulnerability
due 2024-09-16 · CWE-843
$ cat CVE-2024-7971.txt
Description. Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2024-5274
Chromium V8
Google Chromium V8 Type Confusion Vulnerability
due 2024-06-18 · CWE-843
$ cat CVE-2024-5274.txt
Description. Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2024-4947
Chromium V8
Google Chromium V8 Type Confusion Vulnerability
due 2024-06-10 · CWE-843
$ cat CVE-2024-4947.txt
Description. Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2024-4761
Chromium V8
Google Chromium V8 Out-of-Bounds Memory Write Vulnerability
due 2024-06-06 · CWE-787
$ cat CVE-2024-4761.txt
Description. Google Chromium V8 Engine contains an unspecified out-of-bounds memory write vulnerability via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2024-4671
Chromium
Google Chromium Visuals Use-After-Free Vulnerability
due 2024-06-03 · CWE-416
$ cat CVE-2024-4671.txt
Description. Google Chromium Visuals contains a use-after-free vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-4762
Chromium V8
Google Chromium V8 Type Confusion Vulnerability
due 2024-02-27 · CWE-843
$ cat CVE-2023-4762.txt
Description. Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2024-0519
Chromium V8
Google Chromium V8 Out-of-Bounds Memory Access Vulnerability
due 2024-02-07 · CWE-787
$ cat CVE-2024-0519.txt
Description. Google Chromium V8 Engine contains an out-of-bounds memory access vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-7024
Chromium WebRTC
Google Chromium WebRTC Heap Buffer Overflow Vulnerability
due 2024-01-23 · CWE-787
$ cat CVE-2023-7024.txt
Description. Google Chromium WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using WebRTC, including but not limited to Google Chrome.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-6345
Chromium Skia
Google Skia Integer Overflow Vulnerability
due 2023-12-21 · CWE-190
$ cat CVE-2023-6345.txt
Description. Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a malicious file. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-5217
Chromium libvpx
Google Chromium libvpx Heap Buffer Overflow Vulnerability
due 2023-10-23 · CWE-787
$ cat CVE-2023-5217.txt
Description. Google Chromium libvpx contains a heap buffer overflow vulnerability in vp8 encoding that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using libvpx, including but not limited to Google Chrome.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-4863
Chromium WebP
Google Chromium WebP Heap-Based Buffer Overflow Vulnerability
due 2023-10-04 · CWE-787
$ cat CVE-2023-4863.txt
Description. Google Chromium WebP contains a heap-based buffer overflow vulnerability that allows a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. This vulnerability can affect applications that use the WebP Codec.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-3079
Chromium V8
Google Chromium V8 Type Confusion Vulnerability
due 2023-06-28 · CWE-843
$ cat CVE-2023-3079.txt
Description. Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply updates per vendor instructions.
- CVE-2023-2136
Chromium Skia
Google Chrome Skia Integer Overflow Vulnerability
due 2023-05-12 · CWE-190
$ cat CVE-2023-2136.txt
Description. Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.
Required action. Apply updates per vendor instructions.
- CVE-2023-2033
Chromium V8
Google Chromium V8 Type Confusion Vulnerability
due 2023-05-08 · CWE-843
$ cat CVE-2023-2033.txt
Description. Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply updates per vendor instructions.
- CVE-2022-3038
Chromium Network Service
Google Chromium Network Service Use-After-Free Vulnerability
due 2023-04-20 · CWE-416
$ cat CVE-2022-3038.txt
Description. Google Chromium Network Service contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply updates per vendor instructions.
- CVE-2022-4262
Chromium V8
Google Chromium V8 Type Confusion Vulnerability
due 2022-12-26 · CWE-122 CWE-843
$ cat CVE-2022-4262.txt
Description. Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply updates per vendor instructions.
- CVE-2022-4135
Chromium GPU
Google Chromium GPU Heap Buffer Overflow Vulnerability
due 2022-12-19 · CWE-787
$ cat CVE-2022-4135.txt
Description. Google Chromium GPU contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply updates per vendor instructions.
- CVE-2022-3723
Chromium V8
Google Chromium V8 Type Confusion Vulnerability
due 2022-11-18 · CWE-122 CWE-843
$ cat CVE-2022-3723.txt
Description. Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply updates per vendor instructions.
- CVE-2022-3075
Chromium Mojo
Google Chromium Mojo Insufficient Data Validation Vulnerability
due 2022-09-29 · CWE-20
$ cat CVE-2022-3075.txt
Description. Google Chromium Mojo contains an insufficient data validation vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply updates per vendor instructions.
- CVE-2022-2856
Chromium Intents
Google Chromium Intents Insufficient Input Validation Vulnerability
due 2022-09-08 · CWE-20
$ cat CVE-2022-2856.txt
Description. Google Chromium Intents contains an insufficient validation of untrusted input vulnerability that allows a remote attacker to browse to a malicious website via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply updates per vendor instructions.
- CVE-2021-30533
Chromium PopupBlocker
Google Chromium PopupBlocker Security Bypass Vulnerability
due 2022-07-18 · CWE-863
$ cat CVE-2021-30533.txt
Description. Google Chromium PopupBlocker contains an insufficient policy enforcement vulnerability that allows a remote attacker to bypass navigation restrictions via a crafted iframe. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply updates per vendor instructions.
- CVE-2016-1646
Chromium V8
Google Chromium V8 Out-of-Bounds Read Vulnerability
due 2022-06-22 · CWE-119
$ cat CVE-2016-1646.txt
Description. Google Chromium V8 Engine contains an out-of-bounds read vulnerability that allows a remote attacker to cause a denial of service or possibly have another unspecified impact via crafted JavaScript code. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply updates per vendor instructions.
- CVE-2016-5198
Chromium V8
Google Chromium V8 Out-of-Bounds Memory Vulnerability
due 2022-06-22 · CWE-125 CWE-787
$ cat CVE-2016-5198.txt
Description. Google Chromium V8 Engine contains an out-of-bounds memory access vulnerability that allows a remote attacker to perform read/write operations, leading to code execution, via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply updates per vendor instructions.
- CVE-2017-5030
Chromium V8
Google Chromium V8 Memory Corruption Vulnerability
due 2022-06-22 · CWE-125
$ cat CVE-2017-5030.txt
Description. Google Chromium V8 Engine contains a memory corruption vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply updates per vendor instructions.
- CVE-2017-5070
Chromium V8
Google Chromium V8 Type Confusion Vulnerability
due 2022-06-22 · CWE-843
$ cat CVE-2017-5070.txt
Description. Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply updates per vendor instructions.
- CVE-2018-17463
Chromium V8
Google Chromium V8 Remote Code Execution Vulnerability
due 2022-06-22
$ cat CVE-2018-17463.txt
Description. Google Chromium V8 Engine contains an unspecified vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply updates per vendor instructions.
- CVE-2018-17480
Chromium V8
Google Chromium V8 Out-of-Bounds Write Vulnerability
due 2022-06-22 · CWE-787
$ cat CVE-2018-17480.txt
Description. Google Chromium V8 Engine contains out-of-bounds write vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply updates per vendor instructions.
- CVE-2018-6065
Chromium V8
Google Chromium V8 Integer Overflow Vulnerability
due 2022-06-22 · CWE-190 CWE-787
$ cat CVE-2018-6065.txt
Description. Google Chromium V8 Engine contains an integer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply updates per vendor instructions.
- CVE-2019-5825
Chromium V8
Google Chromium V8 Out-of-Bounds Write Vulnerability
due 2022-06-22 · CWE-787
$ cat CVE-2019-5825.txt
Description. Google Chromium V8 Engine contains an out-of-bounds write vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply updates per vendor instructions.
- CVE-2019-13720
Chrome WebAudio
Google Chrome WebAudio Use-After-Free Vulnerability
due 2022-06-13 · CWE-416
$ cat CVE-2019-13720.txt
Description. Google Chrome WebAudio contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Required action. Apply updates per vendor instructions.
- CVE-2019-5786
Chrome Blink
Google Chrome Blink Use-After-Free Vulnerability
due 2022-06-13 · CWE-416
$ cat CVE-2019-5786.txt
Description. Google Chrome Blink contains a heap use-after-free vulnerability that allows an attacker to potentially perform out of bounds memory access via a crafted HTML page.
Required action. Apply updates per vendor instructions.
- CVE-2022-1364
Chromium V8
Google Chromium V8 Type Confusion Vulnerability
due 2022-05-06 · CWE-843
$ cat CVE-2022-1364.txt
Description. Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply updates per vendor instructions.
- CVE-2021-39793
Pixel
Google Pixel Out-of-Bounds Write Vulnerability
due 2022-05-02 · CWE-787
$ cat CVE-2021-39793.txt
Description. Google Pixel contains a possible out-of-bounds write due to a logic error in the code that could lead to local escalation of privilege.
Required action. Apply updates per vendor instructions.
- CVE-2022-1096
Chromium V8
Google Chromium V8 Type Confusion Vulnerability
due 2022-04-18 · CWE-843
$ cat CVE-2022-1096.txt
Description. Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply updates per vendor instructions.
- CVE-2022-0609
Chromium Animation
Google Chromium Animation Use-After-Free Vulnerability
due 2022-03-01 · CWE-416
$ cat CVE-2022-0609.txt
Description. Google Chromium Animation contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply updates per vendor instructions.
- CVE-2020-6572
Chrome Media
Google Chrome Media Use-After-Free Vulnerability
due 2022-07-10 · CWE-416
$ cat CVE-2020-6572.txt
Description. Google Chrome Media contains a use-after-free vulnerability that allows a remote attacker to execute code via a crafted HTML page.
Required action. Apply updates per vendor instructions.
- CVE-2021-4102
Chromium V8
Google Chromium V8 Use-After-Free Vulnerability
due 2021-12-29 · CWE-416
$ cat CVE-2021-4102.txt
Description. Google Chromium V8 Engine contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply updates per vendor instructions.
- CVE-2020-15999
Chrome FreeType
Google Chrome FreeType Heap Buffer Overflow Vulnerability
due 2021-11-17 · CWE-787
$ cat CVE-2020-15999.txt
Description. Google Chrome uses FreeType, an open-source software library to render fonts, which contains a heap buffer overflow vulnerability in the function Load_SBit_Png when processing PNG images embedded into fonts. This vulnerability is part of an exploit chain with CVE-2020-17087 on Windows and CVE-2020-16010 on Android.
Required action. Apply updates per vendor instructions.
- CVE-2020-16009
Chromium V8
Google Chromium V8 Type Confusion Vulnerability
due 2022-05-03 · CWE-787 CWE-843
$ cat CVE-2020-16009.txt
Description. Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply updates per vendor instructions.
- CVE-2020-16010
Chrome for Android UI
Google Chrome for Android UI Heap Buffer Overflow Vulnerability
due 2022-05-03 · CWE-787
$ cat CVE-2020-16010.txt
Description. Google Chrome for Android UI contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page.
Required action. Apply updates per vendor instructions.
- CVE-2020-16013
Chromium V8
Google Chromium V8 Incorrect Implementation Vulnerabililty
due 2022-05-03 · CWE-787
$ cat CVE-2020-16013.txt
Description. Google Chromium V8 Engine contains an inappropriate implementation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply updates per vendor instructions.
- CVE-2020-16017
Chrome
Google Chrome Use-After-Free Vulnerability
due 2022-05-03 · CWE-416
$ cat CVE-2020-16017.txt
Description. Google Chrome contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page.
Required action. Apply updates per vendor instructions.
- CVE-2020-6418
Chromium V8
Google Chromium V8 Type Confusion Vulnerability
due 2022-05-03 · CWE-843
$ cat CVE-2020-6418.txt
Description. Google Chromium V8 Engine contains a type confusion vulnerability allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply updates per vendor instructions.
- CVE-2021-21148
Chromium V8
Google Chromium V8 Heap Buffer Overflow Vulnerability
due 2021-11-17 · CWE-122
$ cat CVE-2021-21148.txt
Description. Google Chromium V8 Engine contains a heap buffer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply updates per vendor instructions.
- CVE-2021-21166
Chromium
Google Chromium Race Condition Vulnerability
due 2021-11-17 · CWE-122 CWE-362
$ cat CVE-2021-21166.txt
Description. Google Chromium contains a race condition vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply updates per vendor instructions.
- CVE-2021-21193
Chromium Blink
Google Chromium Blink Use-After-Free Vulnerability
due 2021-11-17 · CWE-416
$ cat CVE-2021-21193.txt
Description. Google Chromium Blink contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply updates per vendor instructions.
- CVE-2021-21206
Chromium Blink
Google Chromium Blink Use-After-Free Vulnerability
due 2021-11-17 · CWE-416
$ cat CVE-2021-21206.txt
Description. Google Chromium Blink contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply updates per vendor instructions.
- CVE-2021-21220
Chromium V8
Google Chromium V8 Improper Input Validation Vulnerability
due 2021-11-17 · CWE-20 CWE-122
$ cat CVE-2021-21220.txt
Description. Google Chromium V8 Engine contains an improper input validation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply updates per vendor instructions.
- CVE-2021-21224
Chromium V8
Google Chromium V8 Type Confusion Vulnerability
due 2021-11-17 · CWE-843
$ cat CVE-2021-21224.txt
Description. Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply updates per vendor instructions.
- CVE-2021-30551
Chromium V8
Google Chromium V8 Type Confusion Vulnerability
due 2021-11-17 · CWE-122 CWE-843
$ cat CVE-2021-30551.txt
Description. Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply updates per vendor instructions.
- CVE-2021-30554
Chromium WebGL
Google Chromium WebGL Use-After-Free Vulnerability
due 2021-11-17 · CWE-416
$ cat CVE-2021-30554.txt
Description. Google Chromium WebGL contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply updates per vendor instructions.
- CVE-2021-30563
Chromium V8
Google Chromium V8 Type Confusion Vulnerability
due 2021-11-17 · CWE-122 CWE-843
$ cat CVE-2021-30563.txt
Description. Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply updates per vendor instructions.
- CVE-2021-30632
Chromium V8
Google Chromium V8 Out-of-Bounds Write Vulnerability
due 2021-11-17 · CWE-122
$ cat CVE-2021-30632.txt
Description. Google Chromium V8 Engine contains an out-of-bounds write vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply updates per vendor instructions.
- CVE-2021-30633
Chromium Indexed DB API
Google Chromium Indexed DB API Use-After-Free Vulnerability
due 2021-11-17 · CWE-416
$ cat CVE-2021-30633.txt
Description. Google Chromium Indexed DB API contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply updates per vendor instructions.
- CVE-2021-37973
Chromium Portals
Google Chromium Portals Use-After-Free Vulnerability
due 2021-11-17 · CWE-416
$ cat CVE-2021-37973.txt
Description. Google Chromium Portals contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability affects web browsers that utilize Chromium, including Google Chrome and Microsoft Edge.
Required action. Apply updates per vendor instructions.
- CVE-2021-37975
Chromium V8
Google Chromium V8 Use-After-Free Vulnerability
due 2021-11-17 · CWE-416
$ cat CVE-2021-37975.txt
Description. Google Chromium V8 Engine contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply updates per vendor instructions.
- CVE-2021-37976
Chromium
Google Chromium Information Disclosure Vulnerability
due 2021-11-17 · CWE-862
$ cat CVE-2021-37976.txt
Description. Google Chromium contains an information disclosure vulnerability within the core memory component that allows a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply updates per vendor instructions.
- CVE-2021-38000
Chromium Intents
Google Chromium Intents Improper Input Validation Vulnerability
due 2021-11-17 · CWE-20
$ cat CVE-2021-38000.txt
Description. Google Chromium Intents contains an improper input validation vulnerability that allows a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply updates per vendor instructions.
- CVE-2021-38003
Chromium V8
Google Chromium V8 Memory Corruption Vulnerability
due 2021-11-17 · CWE-122 CWE-755
$ cat CVE-2021-38003.txt
Description. Google Chromium V8 Engine has a bug in JSON.stringify, where the internal TheHole value can leak to script code, causing memory corruption. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action. Apply updates per vendor instructions.