CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 07:30 UTC)

What this means for you

This week: 5,443 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,443; Show in the list
Critical, last 7 days: 355; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product google:chrome. Show all products

3,398 CVEs, showing 1 to 50Page 1 of 68Next

CVE	Severity	Title	Published
CVE-2011-0609 Known exploited	High 7.8	Unspecified vulnerability in Adobe Flash Player 10.2.154.13 and earlier on Windows, Mac OS X, Linux, and Solaris; 10.1.106.16 and earlier on Android; Adobe AIR 2.5.1 and earlier; and Authplay.dll (ak… Assigned by adobe	Mar 15, 2011
CVE-2011-0611 Known exploited	High 8.8	Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.19140; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe R… Assigned by adobe	Apr 13, 2011
CVE-2011-3389	Medium 4.3	The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode wi… Assigned by mitre	Sep 6, 2011
CVE-2014-0497 Known exploited	High 8.8	Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute ar… Assigned by adobe	Feb 5, 2014
CVE-2016-1646 Known exploited	High 8.8	The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to c… Assigned by Chrome	Mar 29, 2016
CVE-2016-5131	High 8.8	Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via… Assigned by Chrome	Jul 23, 2016
CVE-2016-5198 Known exploited	High 8.8	V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac included incorrect optimisation assumptions, which allowed a remote attacker to… Assigned by Chrome	Jan 19, 2017
CVE-2017-5030 Known exploited	High 8.8	Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.2987.108 for Android allowed a remote attacker to execute arbitrary code via a… Assigned by Chrome	Apr 24, 2017
CVE-2015-1239	Medium 6.5	Double free vulnerability in the j2k_read_ppm_v3 function in OpenJPEG before r2997, as used in PDFium in Google Chrome, allows remote attackers to cause a denial of service (process crash) via a craf…	Oct 18, 2017
CVE-2017-5070 Known exploited	High 8.8	Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a craft… Assigned by Chrome	Oct 27, 2017
CVE-2017-15422	Medium 6.5	Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before 60.1, as used in V8 in Google Chrome prior to 63.0.3239.84 and other products, allowed a… Assigned by Chrome	Aug 28, 2018
CVE-2018-6065 Known exploited	High 8.8	Integer overflow in computing the required allocation size when instantiating a new javascript object in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit he… Assigned by Chrome	Nov 14, 2018
CVE-2018-17463 Known exploited	High 8.8	Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Assigned by Chrome	Nov 14, 2018
CVE-2018-17480 Known exploited	High 8.8	Execution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to execute arbitrary code i… Assigned by Chrome	Dec 11, 2018
CVE-2019-5786 Known exploited	Medium 6.5	Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. Assigned by Chrome	Jun 27, 2019
CVE-2019-13720 Known exploited	High 8.8	Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Nov 25, 2019
CVE-2019-5825 Known exploited	Medium 6.5	Out of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Nov 25, 2019
CVE-2020-6418 Known exploited	High 8.8	Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Feb 27, 2020
CVE-2020-10531	High 8.8	An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. Assigned by mitre	Mar 12, 2020
CVE-2020-15999 Known exploited	Critical 9.6	Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Nov 3, 2020
CVE-2020-16009 Known exploited	High 8.8	Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Nov 3, 2020
CVE-2020-16010 Known exploited	Critical 9.6	Heap buffer overflow in UI in Google Chrome on Android prior to 86.0.4240.185 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted… Assigned by Chrome	Nov 3, 2020
CVE-2020-16013 Known exploited	High 8.8	Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Jan 8, 2021
CVE-2020-16017 Known exploited	Critical 9.6	Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML… Assigned by Chrome	Jan 8, 2021
CVE-2020-6572 Known exploited	High 8.8	Use after free in Media in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to execute arbitrary code via a crafted HTML page. Assigned by Chrome	Jan 14, 2021
CVE-2021-21148 Known exploited	High 8.8	Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Feb 9, 2021
CVE-2021-21166 Known exploited	High 8.8	Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Mar 9, 2021
CVE-2021-21193 Known exploited	High 8.8	Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Mar 16, 2021
CVE-2021-21220 Known exploited	High 8.8	Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Apr 26, 2021
CVE-2021-21206 Known exploited	High 8.8	Use after free in Blink in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Apr 26, 2021
CVE-2021-21224 Known exploited	High 8.8	Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Assigned by Chrome	Apr 26, 2021
CVE-2021-30533 Known exploited	Medium 6.5	Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions via a crafted iframe. Assigned by Chrome	Jun 7, 2021
CVE-2021-30551 Known exploited	High 8.8	Type confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Jun 15, 2021
CVE-2021-30554 Known exploited	High 8.8	Use after free in WebGL in Google Chrome prior to 91.0.4472.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Jul 2, 2021
CVE-2021-30563 Known exploited	High 8.8	Type Confusion in V8 in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Aug 3, 2021
CVE-2021-37975 Known exploited	High 8.8	Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Oct 8, 2021
CVE-2021-30632 Known exploited	High 8.8	Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Oct 8, 2021
CVE-2021-30633 Known exploited	Critical 9.6	Use after free in Indexed DB API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML p… Assigned by Chrome	Oct 8, 2021
CVE-2021-37973 Known exploited	Critical 9.6	Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Assigned by Chrome	Oct 8, 2021
CVE-2021-37976 Known exploited	Medium 6.5	Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Assigned by Chrome	Oct 8, 2021
CVE-2021-38000 Known exploited	Medium 6.1	Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page. Assigned by Chrome	Nov 23, 2021
CVE-2021-38003 Known exploited	High 8.8	Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Nov 23, 2021
CVE-2021-4102 Known exploited	High 8.8	Use after free in V8 in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Feb 11, 2022
CVE-2022-0609 Known exploited	High 8.8	Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Apr 4, 2022
CVE-2022-1096 Known exploited	High 8.8	Type confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Jul 22, 2022
CVE-2022-1364 Known exploited	High 8.8	Type confusion in V8 Turbofan in Google Chrome prior to 100.0.4896.127 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Jul 26, 2022
CVE-2022-2294 Known exploited	High 8.8	Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Jul 28, 2022
CVE-2022-2856 Known exploited	Medium 6.5	Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 104.0.5112.101 allowed a remote attacker to arbitrarily browse to a malicious website via a crafted HTML pag… Assigned by Chrome	Sep 26, 2022
CVE-2022-3038 Known exploited	High 8.8	Use after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Sep 26, 2022
CVE-2022-3075 Known exploited	Critical 9.6	Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted… Assigned by Chrome	Sep 26, 2022

Page 1 of 68Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.