Vulnerabilities in Google
7,001 resultsCVE-2026-106368MEDIUMUI misrepresentation in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafteEPSS 0.2%CVE-2026-106338MEDIUMUI misrepresentation in PictureInPicture in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof address baEPSS 0.2%CVE-2026-11143MEDIUMOut of bounds read in Extensions in Google Chrome on Linux prior to 149.0.7827.53 allowed an attacker who convinced a user to install a maliEPSS 0.2%CVE-2026-106284MEDIUMOut of bounds read in Printing in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker who had compromised the rendeEPSS 0.2%CVE-2026-106343MEDIUMImproper state validation in Autofill AI in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof UI elementEPSS 0.2%CVE-2026-28587CRITICALIn MmsSmsProvider of MmsSmsProvider.java, there is a possible way to retrieve sensitive information due to a missing permission check. This EPSS 0.2%CVE-2023-21246—In ShortcutInfo of ShortcutInfo.java, there is a possible way for an app to retain notification listening access due to an uncaught exceptioEPSS 0.2%CVE-2026-106286—Confused deputy in Omnibox in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via crafted networkEPSS 0.2%CVE-2026-5899MEDIUMInsufficient policy enforcement in History Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a userEPSS 0.2%CVE-2026-49883CRITICALIn checkReadPermission of PermissionsManager.java, there is a possible way to monitor sensitive device state data due to a missing permissioEPSS 0.2%CVE-2026-106418—Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass wEPSS 0.2%CVE-2025-22412HIGHIn multiple functions of sdp_server.cc, there is a possible use after free due to a logic error in the code. This could lead to remote (proxEPSS 0.2%CVE-2026-17724MEDIUMRace in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) vEPSS 0.2%CVE-2026-9123HIGHHeap buffer overflow in Chromecast in Google Chrome on Android, Linux, ChromeOS prior to 148.0.7778.179 allowed a local attacker to execute EPSS 0.2%CVE-2026-10942HIGHInappropriate implementation in UI in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to perform privilege escalatiEPSS 0.2%CVE-2026-12014HIGHUse after free in Cast in Google Chrome prior to 149.0.7827.115 allowed an attacker on the local network segment to potentially perform a saEPSS 0.2%CVE-2025-13640LOWInappropriate implementation in Passwords in Google Chrome prior to 143.0.7499.41 allowed a local attacker to bypass authentication via physEPSS 0.2%CVE-2026-10001HIGHUse after free in PerformanceManager in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer proEPSS 0.2%CVE-2026-17666CRITICALCryptographic Flaw in Enterprise in Google Chrome prior to 151.0.7922.72 allowed an attacker in a privileged network position to bypass discEPSS 0.2%CVE-2026-10011LOWInappropriate implementation in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer proEPSS 0.2%