Google flaws being used in attacks
CISA lists 75 flaws in Google products as being used in attacks, most recently on 16 Sep 2026.
GoogleBeing used in attacks
- On CISA’s list
- 75 flaws, added between 3 Nov 2021 and 16 Sep 2026
- Most recent
- CVE-2026-58704, Google Pixel Improper Authorization Vulnerability, added 16 Sep 2026
- Used in ransomware
- None known to CISA
- Products
- Chromium V8 (41), Chromium (6), Chromium Blink (2), Chromium Intents (2), Chromium Mojo (2), and 20 more
- HARD’s advisories
- CVE-2026-87491, a memory flaw in Chrome's JavaScript engine that lets a web page run code
- CVE-2026-85046, a flaw that makes Chrome's JavaScript engine mix up types of data, letting a web page run code
- CVE-2026-11645, a flaw that lets Chrome's JavaScript engine reach memory it shouldn't, letting a web page run code
What to do
- Update every Google product you use.Install the updates Google offers, on every device, and restart when asked. Each flaw below has a fix or clear advice; that’s one of CISA’s conditions for listing it.
- If someone looks after IT for you, send them this page.Many of these are in equipment you don’t see: routers, firewalls, servers, the office network. Ask them to confirm each one is fixed, or that you don’t use the product.
- Check anything else in the lookup.Search any app, company or CVE. Not being on CISA’s list doesn’t mean safe: keep updating either way.
Every flaw, newest first
- Google Pixel
CVE-2026-58704Google Pixel Improper Authorization VulnerabilityGoogle Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - Google Chromium V8
CVE-2026-87491Google Chromium V8 Out of Bounds Write VulnerabilityGoogle Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - Google Chromium V8
CVE-2026-85046Google Chromium V8 Type Confusion VulnerabilityGoogle Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - Google Chromium V8
CVE-2026-11645Google Chromium V8 Out-of-Bounds Read and Write VulnerabilityGoogle Chromium V8 out-of-bounds read and write vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Google Dawn
CVE-2026-5281Google Dawn Use-After-Free VulnerabilityGoogle Dawn contains an use-after-free vulnerability that could allow a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. This vulnerability could affect multiple Chromium-based products including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Google Chromium V8
CVE-2026-3910Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer VulnerabilityGoogle Chromium V8 contains an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Google Skia
CVE-2026-3909Google Skia Out-of-Bounds Write VulnerabilityGoogle Skia contains an out-of-bounds write vulnerability that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Google Chromium
CVE-2026-2441Google Chromium CSS Use-After-Free VulnerabilityGoogle Chromium CSS contains a use-after-free vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Google Chromium
CVE-2025-14174Google Chromium Out of Bounds Memory Access VulnerabilityGoogle Chromium contains an out of bounds memory access vulnerability in ANGLE that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Google Chromium V8
CVE-2025-13223Google Chromium V8 Type Confusion VulnerabilityGoogle Chromium V8 contains a type confusion vulnerability that allows for heap corruption.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Google Chromium V8
CVE-2025-10585Google Chromium V8 Type Confusion VulnerabilityGoogle Chromium contains a type confusion vulnerability in the V8 JavaScript and WebAssembly engine.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Google Chromium
CVE-2025-6558Google Chromium ANGLE and GPU Improper Input Validation VulnerabilityGoogle Chromium contains an improper input validation vulnerability in ANGLE and GPU. This vulnerability could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Google Chromium V8
CVE-2025-6554Google Chromium V8 Type Confusion VulnerabilityGoogle Chromium V8 contains a type confusion vulnerability that could allow a remote attacker to perform arbitrary read/write via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Google Chromium V8
CVE-2025-5419Google Chromium V8 Out-of-Bounds Read and Write VulnerabilityGoogle Chromium V8 contains an out-of-bounds read and write vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Google Chromium Mojo
CVE-2025-2783Google Chromium Mojo Sandbox Escape VulnerabilityGoogle Chromium Mojo on Windows contains a sandbox escape vulnerability caused by a logic error, which results from an incorrect handle being provided in unspecified circumstances. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Google Chromium V8
CVE-2024-7965Google Chromium V8 Inappropriate Implementation VulnerabilityGoogle Chromium V8 contains an inappropriate implementation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Google Chromium V8
CVE-2024-7971Google Chromium V8 Type Confusion VulnerabilityGoogle Chromium V8 contains a type confusion vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Google Chromium V8
CVE-2024-5274Google Chromium V8 Type Confusion VulnerabilityGoogle Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Google Chromium V8
CVE-2024-4947Google Chromium V8 Type Confusion VulnerabilityGoogle Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Google Chromium V8
CVE-2024-4761Google Chromium V8 Out-of-Bounds Memory Write VulnerabilityGoogle Chromium V8 Engine contains an unspecified out-of-bounds memory write vulnerability via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Google Chromium
CVE-2024-4671Google Chromium Visuals Use-After-Free VulnerabilityGoogle Chromium Visuals contains a use-after-free vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Google Chromium V8
CVE-2023-4762Google Chromium V8 Type Confusion VulnerabilityGoogle Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Google Chromium V8
CVE-2024-0519Google Chromium V8 Out-of-Bounds Memory Access VulnerabilityGoogle Chromium V8 Engine contains an out-of-bounds memory access vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Google Chromium WebRTC
CVE-2023-7024Google Chromium WebRTC Heap Buffer Overflow VulnerabilityGoogle Chromium WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using WebRTC, including but not limited to Google Chrome.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Google Chromium Skia
CVE-2023-6345Google Skia Integer Overflow VulnerabilityGoogle Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a malicious file. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Google Chromium libvpx
CVE-2023-5217Google Chromium libvpx Heap Buffer Overflow VulnerabilityGoogle Chromium libvpx contains a heap buffer overflow vulnerability in vp8 encoding that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using libvpx, including but not limited to Google Chrome.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Google Chromium WebP
CVE-2023-4863Google Chromium WebP Heap-Based Buffer Overflow VulnerabilityGoogle Chromium WebP contains a heap-based buffer overflow vulnerability that allows a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. This vulnerability can affect applications that use the WebP Codec.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Google Chromium V8
CVE-2023-3079Google Chromium V8 Type Confusion VulnerabilityGoogle Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply updates per vendor instructions. - Google Chromium Skia
CVE-2023-2136Google Chrome Skia Integer Overflow VulnerabilityGoogle Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.CISA’s required actionApply updates per vendor instructions. - Google Chromium V8
CVE-2023-2033Google Chromium V8 Type Confusion VulnerabilityGoogle Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply updates per vendor instructions. - Google Chromium Network Service
CVE-2022-3038Google Chromium Network Service Use-After-Free VulnerabilityGoogle Chromium Network Service contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply updates per vendor instructions. - Google Chromium V8
CVE-2022-4262Google Chromium V8 Type Confusion VulnerabilityGoogle Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply updates per vendor instructions. - Google Chromium GPU
CVE-2022-4135Google Chromium GPU Heap Buffer Overflow VulnerabilityGoogle Chromium GPU contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply updates per vendor instructions. - Google Chromium V8
CVE-2022-3723Google Chromium V8 Type Confusion VulnerabilityGoogle Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply updates per vendor instructions. - Google Chromium Mojo
CVE-2022-3075Google Chromium Mojo Insufficient Data Validation VulnerabilityGoogle Chromium Mojo contains an insufficient data validation vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply updates per vendor instructions. - Google Chromium Intents
CVE-2022-2856Google Chromium Intents Insufficient Input Validation VulnerabilityGoogle Chromium Intents contains an insufficient validation of untrusted input vulnerability that allows a remote attacker to browse to a malicious website via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply updates per vendor instructions. - Google Chromium PopupBlocker
CVE-2021-30533Google Chromium PopupBlocker Security Bypass VulnerabilityGoogle Chromium PopupBlocker contains an insufficient policy enforcement vulnerability that allows a remote attacker to bypass navigation restrictions via a crafted iframe. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply updates per vendor instructions. - Google Chromium V8
CVE-2019-5825Google Chromium V8 Out-of-Bounds Write VulnerabilityGoogle Chromium V8 Engine contains an out-of-bounds write vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply updates per vendor instructions. - Google Chromium V8
CVE-2018-17480Google Chromium V8 Out-of-Bounds Write VulnerabilityGoogle Chromium V8 Engine contains out-of-bounds write vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply updates per vendor instructions. - Google Chromium V8
CVE-2018-17463Google Chromium V8 Remote Code Execution VulnerabilityGoogle Chromium V8 Engine contains an unspecified vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply updates per vendor instructions. - Google Chromium V8
CVE-2018-6065Google Chromium V8 Integer Overflow VulnerabilityGoogle Chromium V8 Engine contains an integer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply updates per vendor instructions. - Google Chromium V8
CVE-2017-5070Google Chromium V8 Type Confusion VulnerabilityGoogle Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply updates per vendor instructions. - Google Chromium V8
CVE-2017-5030Google Chromium V8 Memory Corruption VulnerabilityGoogle Chromium V8 Engine contains a memory corruption vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply updates per vendor instructions. - Google Chromium V8
CVE-2016-5198Google Chromium V8 Out-of-Bounds Memory VulnerabilityGoogle Chromium V8 Engine contains an out-of-bounds memory access vulnerability that allows a remote attacker to perform read/write operations, leading to code execution, via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply updates per vendor instructions. - Google Chromium V8
CVE-2016-1646Google Chromium V8 Out-of-Bounds Read VulnerabilityGoogle Chromium V8 Engine contains an out-of-bounds read vulnerability that allows a remote attacker to cause a denial of service or possibly have another unspecified impact via crafted JavaScript code. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply updates per vendor instructions. - Google Chrome WebAudio
CVE-2019-13720Google Chrome WebAudio Use-After-Free VulnerabilityGoogle Chrome WebAudio contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.CISA’s required actionApply updates per vendor instructions. - Google Chrome Blink
CVE-2019-5786Google Chrome Blink Use-After-Free VulnerabilityGoogle Chrome Blink contains a heap use-after-free vulnerability that allows an attacker to potentially perform out of bounds memory access via a crafted HTML page.CISA’s required actionApply updates per vendor instructions. - Google Chromium V8
CVE-2022-1364Google Chromium V8 Type Confusion VulnerabilityGoogle Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply updates per vendor instructions. - Google Pixel
CVE-2021-39793Google Pixel Out-of-Bounds Write VulnerabilityGoogle Pixel contains a possible out-of-bounds write due to a logic error in the code that could lead to local escalation of privilege.CISA’s required actionApply updates per vendor instructions. - Google Chromium V8
CVE-2022-1096Google Chromium V8 Type Confusion VulnerabilityGoogle Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply updates per vendor instructions. - Google Chromium Animation
CVE-2022-0609Google Chromium Animation Use-After-Free VulnerabilityGoogle Chromium Animation contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply updates per vendor instructions. - Google Chrome Media
CVE-2020-6572Google Chrome Media Use-After-Free VulnerabilityGoogle Chrome Media contains a use-after-free vulnerability that allows a remote attacker to execute code via a crafted HTML page.CISA’s required actionApply updates per vendor instructions. - Google Chromium V8
CVE-2021-4102Google Chromium V8 Use-After-Free VulnerabilityGoogle Chromium V8 Engine contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply updates per vendor instructions. - Google Chromium V8
CVE-2021-38003Google Chromium V8 Memory Corruption VulnerabilityGoogle Chromium V8 Engine has a bug in JSON.stringify, where the internal TheHole value can leak to script code, causing memory corruption. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply updates per vendor instructions. - Google Chromium Intents
CVE-2021-38000Google Chromium Intents Improper Input Validation VulnerabilityGoogle Chromium Intents contains an improper input validation vulnerability that allows a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply updates per vendor instructions. - Google Chromium
CVE-2021-37976Google Chromium Information Disclosure VulnerabilityGoogle Chromium contains an information disclosure vulnerability within the core memory component that allows a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply updates per vendor instructions. - Google Chromium V8
CVE-2021-37975Google Chromium V8 Use-After-Free VulnerabilityGoogle Chromium V8 Engine contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply updates per vendor instructions. - Google Chromium Portals
CVE-2021-37973Google Chromium Portals Use-After-Free VulnerabilityGoogle Chromium Portals contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability affects web browsers that utilize Chromium, including Google Chrome and Microsoft Edge.CISA’s required actionApply updates per vendor instructions. - Google Chromium Indexed DB API
CVE-2021-30633Google Chromium Indexed DB API Use-After-Free VulnerabilityGoogle Chromium Indexed DB API contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply updates per vendor instructions. - Google Chromium V8
CVE-2021-30632Google Chromium V8 Out-of-Bounds Write VulnerabilityGoogle Chromium V8 Engine contains an out-of-bounds write vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply updates per vendor instructions. - Google Chromium V8
CVE-2021-30563Google Chromium V8 Type Confusion VulnerabilityGoogle Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply updates per vendor instructions. - Google Chromium WebGL
CVE-2021-30554Google Chromium WebGL Use-After-Free VulnerabilityGoogle Chromium WebGL contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply updates per vendor instructions. - Google Chromium V8
CVE-2021-30551Google Chromium V8 Type Confusion VulnerabilityGoogle Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply updates per vendor instructions. - Google Chromium V8
CVE-2021-21224Google Chromium V8 Type Confusion VulnerabilityGoogle Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply updates per vendor instructions. - Google Chromium V8
CVE-2021-21220Google Chromium V8 Improper Input Validation VulnerabilityGoogle Chromium V8 Engine contains an improper input validation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply updates per vendor instructions. - Google Chromium Blink
CVE-2021-21206Google Chromium Blink Use-After-Free VulnerabilityGoogle Chromium Blink contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply updates per vendor instructions. - Google Chromium Blink
CVE-2021-21193Google Chromium Blink Use-After-Free VulnerabilityGoogle Chromium Blink contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply updates per vendor instructions. - Google Chromium
CVE-2021-21166Google Chromium Race Condition VulnerabilityGoogle Chromium contains a race condition vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply updates per vendor instructions. - Google Chromium V8
CVE-2021-21148Google Chromium V8 Heap Buffer Overflow VulnerabilityGoogle Chromium V8 Engine contains a heap buffer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply updates per vendor instructions. - Google Chrome
CVE-2020-16017Google Chrome Use-After-Free VulnerabilityGoogle Chrome contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page.CISA’s required actionApply updates per vendor instructions. - Google Chromium V8
CVE-2020-16013Google Chromium V8 Incorrect Implementation VulnerabililtyGoogle Chromium V8 Engine contains an inappropriate implementation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply updates per vendor instructions. - Google Chrome for Android UI
CVE-2020-16010Google Chrome for Android UI Heap Buffer Overflow VulnerabilityGoogle Chrome for Android UI contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page.CISA’s required actionApply updates per vendor instructions. - Google Chromium V8
CVE-2020-16009Google Chromium V8 Type Confusion VulnerabilityGoogle Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply updates per vendor instructions. - Google Chrome FreeType
CVE-2020-15999Google Chrome FreeType Heap Buffer Overflow VulnerabilityGoogle Chrome uses FreeType, an open-source software library to render fonts, which contains a heap buffer overflow vulnerability in the function Load_SBit_Png when processing PNG images embedded into fonts. This vulnerability is part of an exploit chain with CVE-2020-17087 on Windows and CVE-2020-16010 on Android.CISA’s required actionApply updates per vendor instructions. - Google Chromium V8
CVE-2020-6418Google Chromium V8 Type Confusion VulnerabilityGoogle Chromium V8 Engine contains a type confusion vulnerability allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.CISA’s required actionApply updates per vendor instructions.
From CISA’s Known Exploited Vulnerabilities catalog, updated 21 Oct 2026 (version 2026.10.21). CISA’s required actions are written for US government agencies. Google on CISA’s site.