Chrome vulnerabilitiesAnd the versions its exploited flaws hit.
Chrome is made by Google. We track 3,680 published vulnerabilities listed under that exact name, across 9,619 versions. 69 of them are on the list of flaws known to be exploited, the newest added on 23 September 2025. Google lists newer releases under their own names, such as Chrome OS, so check those pages too.
The most recent Chrome flaw added to the known-exploited list is CVE-2025-10585, on 23 September 2025. We keep watching the known-exploited list.
Is Chrome listed under other names? Yes.
Google also lists Chrome under more specific names, such as Chrome OS and Chrome Frame. Flaws listed only under those names are counted on their own pages, not here. If you run one of these, open its page for its own exploited flaws.
Which versions of Chrome do the exploited flaws hit?
Each exploited flaw lists the versions it affects, usually as ranges. "before 140.0.7339.185" means every version up to, but not including, 140.0.7339.185. Find your version, then patch.
- CVE-2025-10585Exploited list, 23 Sep 2025
Google Chromium V8 Type Confusion Vulnerability
before 140.0.7339.185 - CVE-2025-6558Exploited list, 22 Jul 2025
Google Chromium ANGLE and GPU Improper Input Validation Vulnerability
before 138.0.7204.157 - CVE-2025-6554Exploited list, 2 Jul 2025
Google Chromium V8 Type Confusion Vulnerability
before 138.0.7204.96before 138.0.7204.92 - CVE-2025-5419Exploited list, 5 Jun 2025
Google Chromium V8 Out-of-Bounds Read and Write Vulnerability
before 137.0.7151.68 - CVE-2025-4664Exploited list, 15 May 2025
Google Chromium Loader Insufficient Policy Enforcement Vulnerability
before 136.0.7103.113 - CVE-2025-2783Exploited list, 27 Mar 2025
Google Chromium Mojo Sandbox Escape Vulnerability
before 134.0.6998.177 - CVE-2014-0497Exploited list, 17 Sep 2024
Adobe Flash Player Integer Underflow Vulnerablity
before 32.0.1700.107 - CVE-2024-7965Exploited list, 28 Aug 2024
Google Chromium V8 Inappropriate Implementation Vulnerability
before 128.0.6613.84 - CVE-2024-7971Exploited list, 26 Aug 2024
Google Chromium V8 Type Confusion Vulnerability
before 128.0.6613.84 - CVE-2024-5274Exploited list, 28 May 2024
Google Chromium V8 Type Confusion Vulnerability
before 125.0.6422.112 - CVE-2024-4947Exploited list, 20 May 2024
Google Chromium V8 Type Confusion Vulnerability
before 125.0.6422.60 - CVE-2024-4761Exploited list, 16 May 2024
Google Chromium V8 Out-of-Bounds Memory Write Vulnerability
before 124.0.6367.207 - CVE-2024-4671Exploited list, 13 May 2024
Google Chromium Visuals Use-After-Free Vulnerability
before 124.0.6367.201 - CVE-2023-4762Exploited list, 6 Feb 2024
Google Chromium V8 Type Confusion Vulnerability
before 116.0.5845.179 - CVE-2024-0519Exploited list, 17 Jan 2024
Google Chromium V8 Out-of-Bounds Memory Access Vulnerability
before 120.0.6099.224 - CVE-2023-7024Exploited list, 2 Jan 2024
Google Chromium WebRTC Heap Buffer Overflow Vulnerability
before 120.0.6099.129 - CVE-2023-6345Exploited list, 30 Nov 2023
Google Skia Integer Overflow Vulnerability
before 119.0.6045.199 - CVE-2023-5217Exploited list, 2 Oct 2023
Google Chromium libvpx Heap Buffer Overflow Vulnerability
before 117.0.5938.132 - CVE-2023-4863Exploited list, 13 Sep 2023
Google Chromium WebP Heap-Based Buffer Overflow Vulnerability
before 116.0.5845.187 - CVE-2023-3079Exploited list, 7 Jun 2023
Google Chromium V8 Type Confusion Vulnerability
before 114.0.5735.110 - CVE-2023-2136Exploited list, 21 Apr 2023
Google Chrome Skia Integer Overflow Vulnerability
before 112.0.5615.137 - CVE-2023-2033Exploited list, 17 Apr 2023
Google Chromium V8 Type Confusion Vulnerability
before 112.0.5615.121 - CVE-2022-3038Exploited list, 30 Mar 2023
Google Chromium Network Service Use-After-Free Vulnerability
before 105.0.5195.52 - CVE-2022-4262Exploited list, 5 Dec 2022
Google Chromium V8 Type Confusion Vulnerability
before 108.0.5359.94 - CVE-2022-4135Exploited list, 28 Nov 2022
Google Chromium GPU Heap Buffer Overflow Vulnerability
before 107.0.5304.121 - CVE-2022-3723Exploited list, 28 Oct 2022
Google Chromium V8 Type Confusion Vulnerability
before 107.0.5304.87 - CVE-2022-3075Exploited list, 8 Sep 2022
Google Chromium Mojo Insufficient Data Validation Vulnerability
before 105.0.5195.102 - CVE-2022-2294Exploited list, 25 Aug 2022
WebRTC Heap Buffer Overflow Vulnerability
before 103.0.5060.114 - CVE-2022-2856Exploited list, 18 Aug 2022
Google Chromium Intents Insufficient Input Validation Vulnerability
before 104.0.5112.101before 104.0.5112.102 - CVE-2021-30533Exploited list, 27 Jun 2022
Google Chromium PopupBlocker Security Bypass Vulnerability
before 91.0.4472.77
Showing the 30 most recently added of 69 exploited flaws. The full list is below.
Which Chrome vulnerabilities are being exploited?
50 flaws are on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 8.8Google Chromium V8 Type Confusion Vulnerability
Google Chromium contains a type confusion vulnerability in the V8 JavaScript and WebAssembly engine.
- 8.8Google Chromium ANGLE and GPU Improper Input Validation Vulnerability
Google Chromium contains an improper input validation vulnerability in ANGLE and GPU.
- 8.1Google Chromium V8 Type Confusion Vulnerability
Google Chromium V8 contains a type confusion vulnerability that could allow a remote attacker to perform arbitrary read/write via a crafted HTML page.
- 8.8Google Chromium V8 Out-of-Bounds Read and Write Vulnerability
Google Chromium V8 contains an out-of-bounds read and write vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- 4.3Google Chromium Loader Insufficient Policy Enforcement Vulnerability
Google Chromium contains an insufficient policy enforcement vulnerability that allows a remote attacker to leak cross-origin data via a crafted HTML page.
- 8.3Google Chromium Mojo Sandbox Escape Vulnerability
Google Chromium Mojo on Windows contains a sandbox escape vulnerability caused by a logic error, which results from an incorrect handle being provided in unspecified circumstances.
- 9.8Adobe Flash Player Integer Underflow Vulnerablity
Adobe Flash Player contains an integer underflow vulnerability that allows a remote attacker to execute arbitrary code.
- 8.8Google Chromium V8 Inappropriate Implementation Vulnerability
Google Chromium V8 contains an inappropriate implementation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Which Chrome flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 73%CVE-2011-3389Medium
The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained...
- 73%CVE-2011-3026Medium
Integer overflow in libpng, as used in Google Chrome before 17.0.963.56, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger an integer...
- 54%CVE-2010-1663Critical
The Google URL Parsing Library (aka google-url or GURL) in Google Chrome before 4.1.249.1064 allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
- 43%CVE-2010-1205Critical
Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in progressive applications, might allow remote attackers to execute arbitrary code via a PNG image that triggers an additional...
- 16%CVE-2014-1568High
Mozilla Network Security Services (NSS) before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozilla Firefox before 32.0.3, Mozilla Firefox ESR 24.x before 24.8.1 and 31.x before 31.1.1,...
- 12%CVE-2013-2842High
Use-after-free vulnerability in Google Chrome before 27.0.1453.93 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of widgets.
Running Chrome? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
Google Chromium contains a type confusion vulnerability in the V8 JavaScript and WebAssembly engine.
- Matched to
- Chrome on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 3,680 published vulnerabilities listed under the name Chrome, across 9,619 versions. The most recent Chrome flaw added to the known-exploited list is CVE-2025-10585, on 23 September 2025.
69 are on the list of flaws known to be exploited. The most recently added are CVE-2025-10585, CVE-2025-6558 and CVE-2025-6554.
Google also lists Chrome under more specific names, such as Chrome OS and Chrome Frame. Flaws listed only under those names are counted on their own pages, not here. Open the release you run to see its own list.
Each flaw names its own versions, usually as ranges. The newest, CVE-2025-10585, affects before 140.0.7339.185. The versions for every exploited flaw are listed on this page.
Create a EdgeProtect account and track Chrome. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.