Last updated: 21 Oct 26 08:33:26 (UTC)
2026-10-21 Chrome CVE Report
Source: http://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
Report generated: 2026-10-21
Chrome version: 156.0.8078.47
Total CVEs: 353
Release Summary
This release contains 353 CVEs across 4 severity levels with a total bounty pool of $50,000.
- Critical: 6
- High: 61
- Medium: 197
- Low: 89
- Bounty-bearing: 24
- External reporters: 54
Severity Distribution
| Severity | Count | % of Total |
|---|---|---|
| Critical | 6 | 1.7% |
| High | 61 | 17.3% |
| Medium | 197 | 55.8% |
| Low | 89 | 25.2% |
Vulnerability Type Breakdown
| Type | Count | % of Total |
|---|---|---|
| Other | 209 | 59.2% |
| Use After Free | 125 | 35.4% |
| Out of Bounds | 18 | 5.1% |
| Type Confusion | 1 | 0.3% |
Component Area Distribution
| Component | Count | % of Total |
|---|---|---|
| XR | 107 | 30.3% |
| Extensions API | 26 | 7.4% |
| ANGLE (Graphics) | 21 | 5.9% |
| Input Handling | 19 | 5.4% |
| DevTools | 16 | 4.5% |
| Media | 11 | 3.1% |
| Forms | 9 | 2.5% |
| Web App Installs | 9 | 2.5% |
| Navigation | 7 | 2.0% |
| Browser Core | 7 | 2.0% |
| File System/Input | 6 | 1.7% |
| V8 (JavaScript) | 6 | 1.7% |
| GPU | 6 | 1.7% |
| Networking | 5 | 1.4% |
| Password Manager | 5 | 1.4% |
| Views UI | 5 | 1.4% |
| Omnibox | 5 | 1.4% |
| Chromoting (Remote Desktop) | 5 | 1.4% |
| CSS | 4 | 1.1% |
| Bluetooth | 4 | 1.1% |
| 4 | 1.1% | |
| Performance APIs | 4 | 1.1% |
| Custom Tabs | 4 | 1.1% |
| Permissions | 4 | 1.1% |
| Paint/Layout | 3 | 0.8% |
| Other (33 more) | 124 | 35.1% |
High-Value Bounties
Total bounty pool: $50,000 Bounty-bearing CVEs: 24
| CVE ID | Severity | Description | Bounty |
|---|---|---|---|
| CVE-2026-113101 | High | Use after free in SiteIsolation. | $10000 |
| CVE-2026-113097 | High | Use after free in FileSystem. | $3000 |
| CVE-2026-113098 | High | Memory corruption in CacheStorage. | $2000 |
| CVE-2026-113242 | High | Memory corruption in ANGLE. | $2000 |
| CVE-2026-113058 | High | Use after free in WebUI. | $2000 |
| CVE-2026-113082 | High | Memory corruption in ANGLE. | $2000 |
| CVE-2026-113119 | High | Use after free in Network. | $2000 |
| CVE-2026-113092 | High | Use after free in Passwords. | $2000 |
| CVE-2026-113134 | High | Memory corruption in ANGLE. | $2000 |
| CVE-2026-113339 | High | Use after free in SVG. | $2000 |
| CVE-2026-113055 | Medium | Type confusion in FullScreen. | $2000 |
| CVE-2026-113068 | Medium | Use after free in Input. | $2000 |
| CVE-2026-113320 | Medium | Memory corruption in Navigation. | $2000 |
| CVE-2026-113231 | Medium | Improper input validation in Extensions. | $2000 |
| CVE-2026-113174 | Medium | Use after free in Extensions. | $2000 |
| CVE-2026-113251 | Low | Use after free in PDF. | $2000 |
| CVE-2026-113215 | Low | Use after free in Extensions. | $2000 |
| CVE-2026-113317 | High | Memory corruption in Accessibility. | $1000 |
| CVE-2026-113193 | High | Memory corruption in V8. | $1000 |
| CVE-2026-113117 | High | Improper input validation in ANGLE. | $1000 |
| CVE-2026-113022 | Medium | Memory corruption in PDFium. | $1000 |
| CVE-2026-113053 | Low | Use after free in Cookies. | $1000 |
| CVE-2026-113312 | Low | Memory corruption in Autofill. | $1000 |
| CVE-2026-113323 | Low | Use after free in Chrome for iOS. | $1000 |
External Researcher Credits
| Researcher | CVEs |
|---|---|
| @RenwaX23 | CVE-2026-113320 |
| Arni Hardarson (Neonix Security) | CVE-2026-113339, CVE-2026-113000, CVE-2026-113179, CVE-2026-112993 |
| Bhavya | CVE-2026-113172 |
| C0rk1 | CVE-2026-113161 |
| Cassio Lima | CVE-2026-113144 |
| David Erceg | CVE-2026-113079, CVE-2026-113215 |
| Findingz | CVE-2026-113317 |
| Florian Pradines | CVE-2026-113003 |
| Hafiizh | CVE-2026-113305 |
| Hafiizh ( https://www.linkedin.com/in/hafiizh-7aa6bb31/ ) | CVE-2026-113068 |
| HoneyBee | CVE-2026-113037 |
| Hoyong Jin | CVE-2026-113160, CVE-2026-113177, CVE-2026-113153 |
| James Burton | CVE-2026-113310 |
| Jamos Zhu, Sebastian Dowell | CVE-2026-113022 |
| Jinpyo Lee | CVE-2026-113134, CVE-2026-113334, CVE-2026-113340 |
| JonathanBouman | CVE-2026-113242, CVE-2026-113119 |
| Joshua Uphold | CVE-2026-113087 |
| Kirill Baev | CVE-2026-113055 |
| Luan Herrera (@lbherrera_) | CVE-2026-113231, CVE-2026-113053 |
| Manojkumar Jaganathan ( https://www.linkedin.com/in/manojkumar-j-7ba35b202/ ) Aka TheWhiteEvil ( https://hackerone.com/the-white-evil ) with HackerBro Technologies | CVE-2026-113312 |
| Matthias Pleschinger (Popax21) | CVE-2026-113012 |
| NH DEV | CVE-2026-113039 |
| Nebula Security (@nebusecurity) | CVE-2026-113193 |
| OGINOME Tomohito | CVE-2026-113058, CVE-2026-113092, CVE-2026-113221 |
| OpenAI Codex Security (amyb) | CVE-2026-113044, CVE-2026-113338, CVE-2026-113030 |
| OpenAI Codex Security (kylebot) | CVE-2026-113303 |
| Project WhatForLunch (@nebusecurity) | CVE-2026-113019 |
| Qadhafy Muhammad Tera | CVE-2026-113323 |
| Quyen Son at VinFast (@zer0qs) | CVE-2026-113101 |
| Roshan Singh | CVE-2026-113133 |
| Salvatore Gulizia (nickname: Serotav) | CVE-2026-113098 |
| Shubham Raj, Causal Security - https://causalsecurity.com | CVE-2026-113111 |
| TIENPA | CVE-2026-113123 |
| TheKng | CVE-2026-113190 |
| Werner Kasselman | CVE-2026-113078 |
| Xinyang Ge | CVE-2026-113279, CVE-2026-113072, CVE-2026-113280, CVE-2026-113135, CVE-2026-113192, CVE-2026-113309, CVE-2026-113154, CVE-2026-113336, CVE-2026-113181, CVE-2026-113095 |
| Xinyang Ge (Anthropic), assisted by Claude | CVE-2026-113271, CVE-2026-113020, CVE-2026-113318, CVE-2026-113093, CVE-2026-113212 |
| Zabith Mohammed | CVE-2026-113082, CVE-2026-113110, CVE-2026-113187, CVE-2026-113259 |
| a45hif | CVE-2026-113054 |
| caveeroo | CVE-2026-112997 |
| chipsec | CVE-2026-113274 |
| foxribeye | CVE-2026-113174 |
| gundyman | CVE-2026-113052 |
| hamayanhamayan | CVE-2026-113117 |
| huntersnot4 | CVE-2026-113175 |
| jodyritonga | CVE-2026-113204 |
| kirtikumarar | CVE-2026-113251 |
| mikey233 of HackerOne | CVE-2026-113250 |
| mute1008 | CVE-2026-113277 |
| nh.dev2022 | CVE-2026-113097 |
| o | CVE-2026-113040 |
| phamtien.ohr.s | CVE-2026-113138 |
| weihengqiuu | CVE-2026-113270, CVE-2026-113267 |
| zenneth (randomguy6407) | CVE-2026-113222 |
Critical & High Severity Analysis
67 CVEs at Critical or High severity.
By vulnerability type:
- Other: 37
- Use After Free: 26
- Out of Bounds: 4
By component:
- ANGLE (Graphics): 14
- XR: 13
- V8 (JavaScript): 4
- Paint/Layout: 3
- GPU: 3
- Input Handling: 3
- WebRTC: 2
- File System/Input: 2
- Canvas: 2
- Forms: 2
Reporting Timeline
| Date | CVEs Reported |
|---|---|
| 2018-10-29 | 1 |
| 2021-03-25 | 1 |
| 2021-06-16 | 1 |
| 2022-10-09 | 1 |
| 2023-11-13 | 1 |
| 2024-05-15 | 1 |
| 2025-07-03 | 1 |
| 2025-08-20 | 1 |
| 2025-08-25 | 1 |
| 2026-01-21 | 1 |
| 2026-01-30 | 1 |
| 2026-03-08 | 1 |
| 2026-03-19 | 1 |
| 2026-03-23 | 1 |
| 2026-03-24 | 1 |
| 2026-03-26 | 2 |
| 2026-03-27 | 1 |
| 2026-03-28 | 3 |
| 2026-03-29 | 4 |
| 2026-03-30 | 3 |
| 2026-03-31 | 1 |
| 2026-04-01 | 2 |
| 2026-04-02 | 6 |
| 2026-04-03 | 4 |
| 2026-04-05 | 1 |
| 2026-04-06 | 1 |
| 2026-04-07 | 2 |
| 2026-04-08 | 4 |
| 2026-04-10 | 3 |
| 2026-04-11 | 3 |
| 2026-04-12 | 3 |
| 2026-04-13 | 5 |
| 2026-04-14 | 2 |
| 2026-04-15 | 1 |
| 2026-04-17 | 4 |
| 2026-04-18 | 2 |
| 2026-04-19 | 1 |
| 2026-04-21 | 1 |
| 2026-04-23 | 1 |
| 2026-04-24 | 3 |
| 2026-04-28 | 1 |
| 2026-05-08 | 1 |
| 2026-05-09 | 1 |
| 2026-05-10 | 2 |
| 2026-05-14 | 3 |
| 2026-05-15 | 10 |
| 2026-05-16 | 5 |
| 2026-05-17 | 12 |
| 2026-05-18 | 4 |
| 2026-05-19 | 1 |
| 2026-05-21 | 2 |
| 2026-05-27 | 4 |
| 2026-05-28 | 5 |
| 2026-05-29 | 2 |
| 2026-05-30 | 11 |
| 2026-06-02 | 1 |
| 2026-06-04 | 1 |
| 2026-06-05 | 1 |
| 2026-06-09 | 1 |
| 2026-06-12 | 4 |
| 2026-06-13 | 2 |
| 2026-06-15 | 2 |
| 2026-06-16 | 1 |
| 2026-06-21 | 1 |
| 2026-07-04 | 1 |
| 2026-07-09 | 6 |
| 2026-07-10 | 1 |
| 2026-07-11 | 1 |
| 2026-07-15 | 1 |
| 2026-07-16 | 1 |
| 2026-07-17 | 1 |
| 2026-07-19 | 3 |
| 2026-07-21 | 2 |
| 2026-07-28 | 1 |
| 2026-08-01 | 1 |
| 2026-08-09 | 1 |
| 2026-08-10 | 1 |
| 2026-08-17 | 1 |
| 2026-08-19 | 1 |
| 2026-08-20 | 1 |
| 2026-08-22 | 1 |
| 2026-08-23 | 1 |
| 2026-08-24 | 1 |
| 2026-08-26 | 23 |
| 2026-08-27 | 14 |
| 2026-08-28 | 4 |
| 2026-08-29 | 4 |
| 2026-08-31 | 1 |
| 2026-09-02 | 2 |
| 2026-09-03 | 3 |
| 2026-09-04 | 2 |
| 2026-09-05 | 1 |
| 2026-09-07 | 2 |
| 2026-09-08 | 1 |
| 2026-09-10 | 5 |
| 2026-09-11 | 4 |
| 2026-09-12 | 4 |
| 2026-09-13 | 2 |
| 2026-09-14 | 3 |
| 2026-09-15 | 10 |
| 2026-09-16 | 11 |
| 2026-09-17 | 20 |
| 2026-09-18 | 12 |
| 2026-09-19 | 4 |
| 2026-09-20 | 1 |
| 2026-09-21 | 2 |
| 2026-09-23 | 1 |
| 2026-09-24 | 1 |
| 2026-09-25 | 3 |
| 2026-09-27 | 1 |
| 2026-09-28 | 1 |
| 2026-09-29 | 2 |
| 2026-10-01 | 1 |
| 2026-10-02 | 6 |
| 2026-10-03 | 2 |
| 2026-10-05 | 6 |
| 2026-10-06 | 4 |
| 2026-10-08 | 1 |
| 2026-10-10 | 1 |
| 2026-10-12 | 4 |
| 2026-10-15 | 1 |
Critical CVEs
| CVE ID | Description | Reporter | Reported | Bounty | Issue |
|---|---|---|---|---|---|
| CVE-2026-113341 | Memory corruption in Skia. | 2026-10-03 | — | 569165786 | |
| CVE-2026-113279 | Memory corruption in Accessibility. | Xinyang Ge | 2026-10-05 | — | 570093145 |
| CVE-2026-113072 | Memory corruption in CSS. | Xinyang Ge | 2026-10-06 | — | 570638836 |
| CVE-2026-113280 | Memory corruption in Paint. | Xinyang Ge | 2026-10-06 | — | 570740320 |
| CVE-2026-113271 | Use after free in Accessibility. | Xinyang Ge (Anthropic), assisted by Claude | 2026-10-08 | — | 571618833 |
| CVE-2026-113303 | Memory corruption in WebRTC. | OpenAI Codex Security (kylebot) | 2026-10-15 | — | 574041825 |
Full CVE Table
| CVE ID | Severity | Description | Reporter | Reported | Bounty | Issue |
|---|---|---|---|---|---|---|
| CVE-2026-113072 | Critical | Memory corruption in CSS. | Xinyang Ge | 2026-10-06 | — | 570638836 |
| CVE-2026-113271 | Critical | Use after free in Accessibility. | Xinyang Ge (Anthropic), assisted by Claude | 2026-10-08 | — | 571618833 |
| CVE-2026-113279 | Critical | Memory corruption in Accessibility. | Xinyang Ge | 2026-10-05 | — | 570093145 |
| CVE-2026-113280 | Critical | Memory corruption in Paint. | Xinyang Ge | 2026-10-06 | — | 570740320 |
| CVE-2026-113303 | Critical | Memory corruption in WebRTC. | OpenAI Codex Security (kylebot) | 2026-10-15 | — | 574041825 |
| CVE-2026-113341 | Critical | Memory corruption in Skia. | 2026-10-03 | — | 569165786 | |
| CVE-2026-112993 | High | Use after free in Input. | Arni Hardarson (Neonix Security) | 2026-10-12 | — | 572893186 |
| CVE-2026-113000 | High | Memory corruption in Paint. | Arni Hardarson (Neonix Security) | 2026-10-12 | — | 572598342 |
| CVE-2026-113012 | High | Improper input validation in GPU. | Matthias Pleschinger (Popax21) | 2026-10-01 | — | 568215670 |
| CVE-2026-113019 | High | Use after free in Turbolev. | Project WhatForLunch (@nebusecurity) | 2026-10-05 | — | 570003644 |
| CVE-2026-113020 | High | Improper input validation in Date. | Xinyang Ge (Anthropic), assisted by Claude | 2026-09-24 | — | 565838017 |
| CVE-2026-113040 | High | Improper input validation in Proxy. | o | 2026-10-02 | — | 568906040 |
| CVE-2026-113044 | High | Use after free in V8. | OpenAI Codex Security (amyb) | 2026-09-10 | — | 559266116 |
| CVE-2026-113058 | High | Use after free in WebUI. | OGINOME Tomohito | 2026-08-22 | $2000 | 551059870 |
| CVE-2026-113082 | High | Memory corruption in ANGLE. | Zabith Mohammed | 2026-09-03 | $2000 | 556505644 |
| CVE-2026-113092 | High | Use after free in Passwords. | OGINOME Tomohito | 2026-09-07 | $2000 | 558377544 |
| CVE-2026-113093 | High | Memory corruption in DisplayLocking. | Xinyang Ge (Anthropic), assisted by Claude | 2026-09-29 | — | 567612004 |
| CVE-2026-113095 | High | Out of bounds read in Focus. | Xinyang Ge | 2026-10-05 | — | 570167919 |
| CVE-2026-113097 | High | Use after free in FileSystem. | nh.dev2022 | 2026-06-21 | $3000 | 526039697 |
| CVE-2026-113098 | High | Memory corruption in CacheStorage. | Salvatore Gulizia (nickname: Serotav) | 2026-08-19 | $2000 | 548989584 |
| CVE-2026-113101 | High | Use after free in SiteIsolation. | Quyen Son at VinFast (@zer0qs) | 2026-09-13 | $10000 | 560749221 |
| CVE-2026-113104 | High | Memory corruption in Frames. | 2026-07-17 | — | 535749304 | |
| CVE-2026-113117 | High | Improper input validation in ANGLE. | hamayanhamayan | 2026-09-19 | $1000 | 563788518 |
| CVE-2026-113119 | High | Use after free in Network. | JonathanBouman | 2026-09-04 | $2000 | 557075191 |
| CVE-2026-113134 | High | Memory corruption in ANGLE. | Jinpyo Lee | 2026-09-12 | $2000 | 560423758 |
| CVE-2026-113135 | High | Memory corruption in PictureInPicture. | Xinyang Ge | 2026-09-11 | — | 560251733 |
| CVE-2026-113141 | High | Use after free in Transactions Platform. | 2026-08-26 | — | 553128833 | |
| CVE-2026-113154 | High | Memory corruption in Canvas. | Xinyang Ge | 2026-10-05 | — | 569127861 |
| CVE-2026-113160 | High | Use after free in Turbolev. | Hoyong Jin | 2026-10-06 | — | 570203091 |
| CVE-2026-113161 | High | Use after free in WebRTC. | C0rk1 | 2026-10-03 | — | 568945639 |
| CVE-2026-113163 | High | Use after free in WebGL. | 2026-08-17 | — | 548066294 | |
| CVE-2026-113175 | High | Improper input validation in FileSystem. | huntersnot4 | 2026-10-02 | — | 568822820 |
| CVE-2026-113179 | High | Use after free in Paint. | Arni Hardarson (Neonix Security) | 2026-10-12 | — | 572695599 |
| CVE-2026-113181 | High | Use after free in Navigation. | Xinyang Ge | 2026-10-05 | — | 569408568 |
| CVE-2026-113188 | High | Memory corruption in GPU. | 2026-07-09 | — | 533122125 | |
| CVE-2026-113192 | High | Memory corruption in V8. | Xinyang Ge | 2026-10-02 | — | 568831099 |
| CVE-2026-113193 | High | Memory corruption in V8. | Nebula Security (@nebusecurity) | 2026-09-11 | $1000 | 559932543 |
| CVE-2026-113210 | High | Use after free in ANGLE. | 2026-09-18 | — | 563354824 | |
| CVE-2026-113212 | High | Memory corruption in PDF. | Xinyang Ge (Anthropic), assisted by Claude | 2026-10-10 | — | 572237007 |
| CVE-2026-113217 | High | Use after free in WebAppInstalls. | 2026-10-02 | — | 568900845 | |
| CVE-2026-113222 | High | Use after free in V8. | zenneth (randomguy6407) | 2026-09-25 | — | 566091009 |
| CVE-2026-113225 | High | Memory corruption in Browser. | 2026-09-15 | — | 562109703 | |
| CVE-2026-113234 | High | Memory corruption in ANGLE. | 2026-09-03 | — | 556750158 | |
| CVE-2026-113236 | High | Use after free in Navigation. | 2026-08-26 | — | 553119084 | |
| CVE-2026-113242 | High | Memory corruption in ANGLE. | JonathanBouman | 2026-08-23 | $2000 | 550626693 |
| CVE-2026-113252 | High | Improper input validation in ANGLE. | 2026-09-03 | — | 556750258 | |
| CVE-2026-113253 | High | Use after free in Canvas. | 2026-08-26 | — | 553117109 | |
| CVE-2026-113266 | High | Memory corruption in ANGLE. | 2026-09-14 | — | 561499641 | |
| CVE-2026-113273 | High | Memory corruption in ANGLE. | 2026-09-15 | — | 561999377 | |
| CVE-2026-113284 | High | Memory corruption in XML. | 2026-08-26 | — | 553121395 | |
| CVE-2026-113285 | High | Memory corruption in ANGLE. | 2026-09-18 | — | 563355257 | |
| CVE-2026-113293 | High | Use after free in ANGLE. | 2026-09-15 | — | 562040486 | |
| CVE-2026-113295 | High | Out of bounds read in ANGLE. | 2026-10-02 | — | 568897206 | |
| CVE-2026-113298 | High | Use after free in Transactions Platform. | 2026-08-26 | — | 553117374 | |
| CVE-2026-113305 | High | Use after free in Privacy. | Hafiizh | 2026-09-08 | — | 558464760 |
| CVE-2026-113309 | High | Out of bounds read in Media. | Xinyang Ge | 2026-10-02 | — | 568831768 |
| CVE-2026-113310 | High | Out of bounds read in Bluetooth. | James Burton | 2026-09-27 | — | 566687517 |
| CVE-2026-113315 | High | Memory corruption in ANGLE. | 2026-08-26 | — | 553117511 | |
| CVE-2026-113316 | High | Improper input validation in Views. | 2026-08-26 | — | 553140050 | |
| CVE-2026-113317 | High | Memory corruption in Accessibility. | Findingz | 2026-08-31 | $1000 | 555337558 |
| CVE-2026-113318 | High | Memory corruption in ServiceWorker. | Xinyang Ge (Anthropic), assisted by Claude | 2026-09-25 | — | 566136673 |
| CVE-2026-113322 | High | Memory corruption in Dawn. | 2026-07-19 | — | 536639352 | |
| CVE-2026-113324 | High | Use after free in GPU. | 2026-09-18 | — | 563357593 | |
| CVE-2026-113334 | High | Improper input validation in ANGLE. | Jinpyo Lee | 2026-09-20 | — | 564064199 |
| CVE-2026-113336 | High | Memory corruption in Compositing. | Xinyang Ge | 2026-10-05 | — | 569286604 |
| CVE-2026-113338 | High | Use after free in Turbolev. | OpenAI Codex Security (amyb) | 2026-09-28 | — | 567175125 |
| CVE-2026-113339 | High | Use after free in SVG. | Arni Hardarson (Neonix Security) | 2026-10-12 | $2000 | 572862424 |
| CVE-2026-112992 | Medium | Memory corruption in Canvas. | 2026-05-18 | — | 514422784 | |
| CVE-2026-112995 | Medium | Use after free in Animation. | 2026-05-18 | — | 514447367 | |
| CVE-2026-112997 | Medium | Memory corruption in CSS. | caveeroo | 2026-09-12 | — | 560664595 |
| CVE-2026-112999 | Medium | Use after free in API. | 2026-05-15 | — | 513452101 | |
| CVE-2026-113001 | Medium | Use after free in Workers. | 2026-08-26 | — | 553144392 | |
| CVE-2026-113002 | Medium | Memory corruption in Transactions Platform. | 2026-09-16 | — | 562225226 | |
| CVE-2026-113003 | Medium | Memory corruption in HID. | Florian Pradines | 2026-04-21 | — | 505024593 |
| CVE-2026-113005 | Medium | Memory corruption in Bluetooth. | 2026-04-17 | — | 503584859 | |
| CVE-2026-113006 | Medium | Out of bounds read in Navigation. | 2026-03-26 | — | 496650333 | |
| CVE-2026-113007 | Medium | Memory corruption in Permissions. | Anonymous | 2026-08-27 | — | 553394270 |
| CVE-2026-113008 | Medium | Memory corruption in Transactions Platform. | 2026-09-18 | — | 563089510 | |
| CVE-2026-113009 | Medium | Use after free in WindowControlsOverlay. | 2026-05-17 | — | 514066540 | |
| CVE-2026-113010 | Medium | Out of bounds read in Extensions. | 2026-05-30 | — | 518240362 | |
| CVE-2026-113011 | Medium | Use after free in CredentialProvider. | 2026-04-02 | — | 498843754 | |
| CVE-2026-113014 | Medium | Use after free in PerformanceAPIs. | 2026-04-13 | — | 502251640 | |
| CVE-2026-113016 | Medium | Improper input validation in Extensions. | 2026-06-12 | — | 523237501 | |
| CVE-2026-113018 | Medium | Memory corruption in IME. | 2026-03-28 | — | 497072295 | |
| CVE-2026-113022 | Medium | Memory corruption in PDFium. | Jamos Zhu, Sebastian Dowell | 2026-03-19 | $1000 | 494352583 |
| CVE-2026-113026 | Medium | Memory corruption in PDF. | 2026-04-07 | — | 500173014 | |
| CVE-2026-113028 | Medium | Use after free in Media. | 2026-09-12 | — | 560373976 | |
| CVE-2026-113030 | Medium | Improper access control in V8. | OpenAI Codex Security (amyb) | 2026-09-15 | — | 561660149 |
| CVE-2026-113031 | Medium | Memory corruption in Media. | 2026-07-09 | — | 532939000 | |
| CVE-2026-113032 | Medium | Memory corruption in Omnibox. | Anonymous | 2026-08-01 | — | 541604102 |
| CVE-2026-113033 | Medium | Use after free in Streaming. | 2026-04-06 | — | 499869964 | |
| CVE-2026-113034 | Medium | Memory corruption in FileSystem. | 2026-03-29 | — | 497482008 | |
| CVE-2026-113035 | Medium | Out of bounds read in API. | 2026-04-02 | — | 498786597 | |
| CVE-2026-113037 | Medium | Use after free in WebSockets. | HoneyBee | 2026-09-13 | — | 560939312 |
| CVE-2026-113041 | Medium | Use after free in Actor. | 2026-06-15 | — | 524319033 | |
| CVE-2026-113042 | Medium | Use after free in Extensions. | 2026-05-28 | — | 517486906 | |
| CVE-2026-113043 | Medium | Use after free in iOSWeb. | 2026-06-09 | — | 521978171 | |
| CVE-2026-113045 | Medium | Out of bounds read in Offline. | 2026-05-17 | — | 514040146 | |
| CVE-2026-113049 | Medium | Memory corruption in Core. | 2026-07-21 | — | 537465180 | |
| CVE-2026-113050 | Medium | Out of bounds read in HID. | 2026-09-17 | — | 562655586 | |
| CVE-2026-113051 | Medium | Memory corruption in CSS. | 2026-04-18 | — | 504107363 | |
| CVE-2026-113052 | Medium | Memory corruption in V8. | gundyman | 2026-09-21 | — | 564326756 |
| CVE-2026-113054 | Medium | Out of bounds read in SiteIsolation. | a45hif | 2026-08-20 | — | 549529981 |
| CVE-2026-113055 | Medium | Type confusion in FullScreen. | Kirill Baev | 2024-05-15 | $2000 | 340578708 |
| CVE-2026-113057 | Medium | Improper access control in ComputePressure. | 2026-04-15 | — | 502710681 | |
| CVE-2026-113059 | Medium | Memory corruption in Sensor. | 2026-05-15 | — | 513620385 | |
| CVE-2026-113060 | Medium | Improper input validation in Bluetooth. | 2026-05-17 | — | 514017698 | |
| CVE-2026-113062 | Medium | Improper input validation in API. | 2026-09-16 | — | 562237871 | |
| CVE-2026-113064 | Medium | Memory corruption in OptimizationGuide. | 2026-08-26 | — | 553146807 | |
| CVE-2026-113065 | Medium | Use after free in Media. | 2026-09-16 | — | 562223549 | |
| CVE-2026-113068 | Medium | Use after free in Input. | Hafiizh ( https://www.linkedin.com/in/hafiizh-7aa6bb31/ ) | 2023-11-13 | $2000 | 40942045 |
| CVE-2026-113069 | Medium | Memory corruption in Compositing. | 2026-03-26 | — | 496644575 | |
| CVE-2026-113070 | Medium | Out of bounds read in GetUserMedia. | 2026-04-03 | — | 499112419 | |
| CVE-2026-113071 | Medium | Use after free in Notifications. | 2026-05-17 | — | 514079212 | |
| CVE-2026-113073 | Medium | Use after free in Browser. | 2026-06-02 | — | 519217664 | |
| CVE-2026-113075 | Medium | Use after free in DevTools. | 2026-08-28 | — | 553931271 | |
| CVE-2026-113076 | Medium | Use after free in Toolbar. | 2026-05-30 | — | 518068748 | |
| CVE-2026-113077 | Medium | Memory corruption in Core. | 2026-08-26 | — | 553159183 | |
| CVE-2026-113078 | Medium | Improper input validation in Compositing. | Werner Kasselman | 2026-04-05 | — | 499520020 |
| CVE-2026-113079 | Medium | Use after free in SiteIsolation. | David Erceg | 2021-03-25 | — | 40055319 |
| CVE-2026-113081 | Medium | Use after free in Compositing. | 2026-07-15 | — | 534956586 | |
| CVE-2026-113084 | Medium | Improper input validation in Permissions. | 2026-05-30 | — | 518099505 | |
| CVE-2026-113086 | Medium | Improper input validation in Input. | 2026-09-29 | — | 567673405 | |
| CVE-2026-113087 | Medium | Use after free in Actor. | Joshua Uphold | 2026-09-07 | — | 558301759 |
| CVE-2026-113089 | Medium | Improper input validation in PrintPreview. | 2026-09-18 | — | 563362367 | |
| CVE-2026-113090 | Medium | Memory corruption in Interstitials. | 2026-08-26 | — | 553155133 | |
| CVE-2026-113094 | Medium | Memory corruption in API. | 2026-03-29 | — | 497494634 | |
| CVE-2026-113096 | Medium | Memory corruption in Text. | 2026-09-16 | — | 562238089 | |
| CVE-2026-113099 | Medium | Improper input validation in Omnibox. | 2026-09-02 | — | 556227230 | |
| CVE-2026-113100 | Medium | Memory corruption in Audio. | 2026-09-15 | — | 561787556 | |
| CVE-2026-113102 | Medium | Out of bounds read in FileSystem. | 2026-03-31 | — | 497965748 | |
| CVE-2026-113105 | Medium | Use after free in Extensions. | 2026-04-12 | — | 501805751 | |
| CVE-2026-113106 | Medium | Memory corruption in Skia. | 2026-08-26 | — | 553126587 | |
| CVE-2026-113108 | Medium | Use after free in Script. | 2026-04-13 | — | 502299325 | |
| CVE-2026-113109 | Medium | Memory corruption in API. | 2026-03-23 | — | 495471295 | |
| CVE-2026-113110 | Medium | Memory corruption in ShadowDOM. | Zabith Mohammed | 2026-08-27 | — | 553390794 |
| CVE-2026-113111 | Medium | Use after free in Compositing. | Shubham Raj, Causal Security - https://causalsecurity.com | 2026-09-18 | — | 563163857 |
| CVE-2026-113112 | Medium | Use after free in Extensions. | 2026-05-15 | — | 513512147 | |
| CVE-2026-113113 | Medium | Use after free in Extensions. | 2026-03-24 | — | 495899355 | |
| CVE-2026-113115 | Medium | Use after free in Transactions Platform. | 2026-05-17 | — | 514018015 | |
| CVE-2026-113118 | Medium | Memory corruption in Extensions. | 2026-05-14 | — | 513184498 | |
| CVE-2026-113120 | Medium | Improper input validation in Media. | 2026-09-12 | — | 560476932 | |
| CVE-2026-113123 | Medium | Use after free in GPU. | TIENPA | 2026-08-24 | — | 551930637 |
| CVE-2026-113124 | Medium | Memory corruption in DataTransfer. | 2026-08-26 | — | 553150456 | |
| CVE-2026-113126 | Medium | Memory corruption in PolicyContainer. | 2026-07-04 | — | 531182364 | |
| CVE-2026-113127 | Medium | Memory corruption in Browser. | 2026-04-11 | — | 501730091 | |
| CVE-2026-113128 | Medium | Missing authorization in Animation. | 2026-07-21 | — | 537109293 | |
| CVE-2026-113129 | Medium | Improper access control in Extensions. | 2026-04-11 | — | 501738293 | |
| CVE-2026-113131 | Medium | Memory corruption in Bluetooth. | 2026-04-08 | — | 500536121 | |
| CVE-2026-113133 | Medium | Memory corruption in PlatformIntegration. | Roshan Singh | 2026-09-23 | — | 565349184 |
| CVE-2026-113136 | Medium | Memory corruption in DevTools. | 2026-08-26 | — | 553114456 | |
| CVE-2026-113137 | Medium | Memory corruption in Extensions. | 2026-05-16 | — | 513758047 | |
| CVE-2026-113138 | Medium | Memory corruption in WebAppInstalls. | phamtien.ohr.s | 2026-09-14 | — | 561396577 |
| CVE-2026-113139 | Medium | Memory corruption in Autofill. | 2026-07-19 | — | 536607604 | |
| CVE-2026-113142 | Medium | Memory corruption in Extensions. | 2026-04-01 | — | 498733953 | |
| CVE-2026-113143 | Medium | Memory corruption in ANGLE. | 2026-09-18 | — | 563352451 | |
| CVE-2026-113144 | Medium | Memory corruption in Speech. | Cassio Lima | 2026-08-10 | — | 544498565 |
| CVE-2026-113146 | Medium | Memory corruption in PerformanceAPIs. | 2026-05-09 | — | 511325076 | |
| CVE-2026-113147 | Medium | Improper input validation in WebShare. | 2026-04-10 | — | 501531546 | |
| CVE-2026-113148 | Medium | Memory corruption in WebUI. | 2026-05-30 | — | 518138781 | |
| CVE-2026-113149 | Medium | Memory corruption in FullScreen. | 2026-05-27 | — | 517221283 | |
| CVE-2026-113150 | Medium | Memory corruption in Bindings. | 2026-04-03 | — | 499250086 | |
| CVE-2026-113151 | Medium | Out of bounds read in Actor. | 2026-09-11 | — | 560157609 | |
| CVE-2026-113153 | Medium | Memory corruption in SiteIsolation. | Hoyong Jin | 2026-09-14 | — | 561099700 |
| CVE-2026-113155 | Medium | Use after free in Glic. | 2026-04-24 | — | 505994167 | |
| CVE-2026-113157 | Medium | Information leak in ANGLE. | 2026-09-18 | — | 563352515 | |
| CVE-2026-113158 | Medium | Use after free in Streaming. | 2026-08-26 | — | 553157579 | |
| CVE-2026-113159 | Medium | Improper access control in DevTools. | 2026-09-15 | — | 562041808 | |
| CVE-2026-113162 | Medium | Improper input validation in Actor. | 2026-05-14 | — | 513147880 | |
| CVE-2026-113164 | Medium | Memory corruption in Voice. | 2026-04-08 | — | 500497398 | |
| CVE-2026-113165 | Medium | Use after free in Core. | 2026-08-27 | — | 553163770 | |
| CVE-2026-113166 | Medium | Memory corruption in History. | 2026-04-18 | — | 504073211 | |
| CVE-2026-113170 | Medium | Use after free in Autofill. | 2026-09-16 | — | 562236428 | |
| CVE-2026-113171 | Medium | Memory corruption in Prompts. | 2026-05-28 | — | 517477395 | |
| CVE-2026-113172 | Medium | Memory corruption in ServiceWorker. | Bhavya | 2026-05-21 | — | 515451922 |
| CVE-2026-113174 | Medium | Use after free in Extensions. | foxribeye | 2026-04-10 | $2000 | 501419037 |
| CVE-2026-113176 | Medium | Memory corruption in Omnibox. | 2026-04-03 | — | 499143720 | |
| CVE-2026-113177 | Medium | Use after free in FileSystem. | Hoyong Jin | 2026-09-11 | — | 559795243 |
| CVE-2026-113178 | Medium | Memory corruption in Views. | 2026-08-27 | — | 553163820 | |
| CVE-2026-113183 | Medium | Memory corruption in FedCM. | 2026-04-28 | — | 507227196 | |
| CVE-2026-113185 | Medium | Memory corruption in Extensions. | 2026-05-28 | — | 517461056 | |
| CVE-2026-113187 | Medium | Use after free in DOM. | Zabith Mohammed | 2026-08-28 | — | 553845833 |
| CVE-2026-113189 | Medium | Use after free in Core. | 2026-05-17 | — | 514016335 | |
| CVE-2026-113190 | Medium | Use after free in ServiceWorker. | TheKng | 2026-05-18 | — | 514372708 |
| CVE-2026-113191 | Medium | Use after free in Internals. | 2025-08-25 | — | 441089142 | |
| CVE-2026-113194 | Medium | Memory corruption in Core. | 2026-05-17 | — | 513989760 | |
| CVE-2026-113195 | Medium | Improper input validation in Downloads. | 2026-05-30 | — | 518055043 | |
| CVE-2026-113196 | Medium | Improper access control in Mobile. | 2026-04-19 | — | 504231046 | |
| CVE-2026-113197 | Medium | Use after free in Forms. | 2026-09-16 | — | 562230410 | |
| CVE-2026-113198 | Medium | Use after free in Extensions. | 2026-04-02 | — | 498861195 | |
| CVE-2026-113199 | Medium | Out of bounds read in Payments. | 2026-09-16 | — | 562226316 | |
| CVE-2026-113200 | Medium | Use after free in ANGLE. | 2026-09-18 | — | 563350676 | |
| CVE-2026-113202 | Medium | Use after free in BrowserTag. | 2026-06-12 | — | 523201686 | |
| CVE-2026-113203 | Medium | Use after free in CSS. | 2026-09-16 | — | 562230438 | |
| CVE-2026-113204 | Medium | Use after free in TrustedWebActivities. | jodyritonga | 2026-08-09 | — | 544328873 |
| CVE-2026-113205 | Medium | Use after free in Variations. | 2026-05-10 | — | 511820971 | |
| CVE-2026-113206 | Medium | Memory corruption in Omnibox. | 2026-05-28 | — | 517407917 | |
| CVE-2026-113207 | Medium | Use after free in SiteIsolation. | 2026-05-10 | — | 511806651 | |
| CVE-2026-113208 | Medium | Use after free in ContextualSearch. | 2026-05-16 | — | 513774784 | |
| CVE-2026-113209 | Medium | Memory corruption in Navigation. | 2026-04-17 | — | 503774403 | |
| CVE-2026-113211 | Medium | Memory corruption in ServiceWorker. | 2026-04-02 | — | 498828493 | |
| CVE-2026-113216 | Medium | Use after free in Navigation. | 2026-09-04 | — | 556899544 | |
| CVE-2026-113218 | Medium | Use after free in DataTransfer. | 2026-05-29 | — | 518003952 | |
| CVE-2026-113219 | Medium | Memory corruption in Contacts. | 2026-04-17 | — | 503583985 | |
| CVE-2026-113220 | Medium | Memory corruption in Extensions. | 2026-04-12 | — | 501875966 | |
| CVE-2026-113221 | Medium | Use after free in Google Lens. | OGINOME Tomohito | 2026-09-15 | — | 561921279 |
| CVE-2026-113224 | Medium | Memory corruption in WebAppInstalls. | 2026-05-30 | — | 518108422 | |
| CVE-2026-113228 | Medium | Use after free in Network. | 2026-08-29 | — | 554556700 | |
| CVE-2026-113230 | Medium | Improper input validation in Browser. | 2026-08-26 | — | 553153823 | |
| CVE-2026-113231 | Medium | Improper input validation in Extensions. | Luan Herrera (@lbherrera_) | 2026-01-21 | $2000 | 477664550 |
| CVE-2026-113232 | Medium | Memory corruption in Search. | 2026-05-14 | — | 513226023 | |
| CVE-2026-113233 | Medium | Out of bounds read in Core. | 2026-09-15 | — | 562111801 | |
| CVE-2026-113235 | Medium | Improper input validation in Passwords. | 2026-09-18 | — | 563352925 | |
| CVE-2026-113238 | Medium | Memory corruption in CustomTabs. | 2026-05-16 | — | 513789297 | |
| CVE-2026-113239 | Medium | Range error in SiteIsolation. | 2026-04-08 | — | 500522368 | |
| CVE-2026-113240 | Medium | Use after free in Chromecast. | 2026-03-30 | — | 497577345 | |
| CVE-2026-113243 | Medium | Memory corruption in DOM. | 2026-08-26 | — | 553147798 | |
| CVE-2026-113246 | Medium | Memory corruption in iOSWebView. | 2026-06-13 | — | 523705767 | |
| CVE-2026-113249 | Medium | Improper input validation in Mobile. | 2026-05-15 | — | 513480110 | |
| CVE-2026-113250 | Medium | Use after free in ANGLE. | mikey233 of HackerOne | 2026-03-08 | — | 490808751 |
| CVE-2026-113255 | Medium | Use after free in CustomTabs. | 2026-05-30 | — | 518065595 | |
| CVE-2026-113257 | Medium | Memory corruption in Media. | 2026-04-02 | — | 498994634 | |
| CVE-2026-113258 | Medium | Memory corruption in Chromoting. | 2026-09-16 | — | 562236876 | |
| CVE-2026-113259 | Medium | Use after free in Frames. | Zabith Mohammed | 2026-08-28 | — | 554008013 |
| CVE-2026-113261 | Medium | Use after free in WebAppInstalls. | 2026-05-21 | — | 515440087 | |
| CVE-2026-113262 | Medium | Use after free in Extensions. | 2026-05-27 | — | 517094892 | |
| CVE-2026-113263 | Medium | Use after free in Core. | 2026-03-27 | — | 497026542 | |
| CVE-2026-113264 | Medium | Improper input validation in Extensions. | 2026-04-12 | — | 501786099 | |
| CVE-2026-113265 | Medium | Memory corruption in BFCache. | 2026-06-04 | — | 520017400 | |
| CVE-2026-113267 | Medium | Memory corruption in Video. | weihengqiuu | 2026-09-10 | — | 559707641 |
| CVE-2026-113270 | Medium | Use after free in Internals. | weihengqiuu | 2026-09-05 | — | 557501968 |
| CVE-2026-113272 | Medium | Memory corruption in Extensions. | 2026-05-15 | — | 513486355 | |
| CVE-2026-113275 | Medium | Use after free in API. | 2026-04-13 | — | 502040109 | |
| CVE-2026-113276 | Medium | Memory corruption in Passwords. | 2026-05-29 | — | 517809727 | |
| CVE-2026-113277 | Medium | Out of bounds read in CustomTabs. | mute1008 | 2026-08-26 | — | 552951369 |
| CVE-2026-113278 | Medium | Use after free in Extensions. | 2026-05-17 | — | 514080341 | |
| CVE-2026-113281 | Medium | Memory corruption in SiteIsolation. | 2026-04-01 | — | 498742883 | |
| CVE-2026-113282 | Medium | Use after free in Views. | 2026-08-26 | — | 553160293 | |
| CVE-2026-113283 | Medium | Memory corruption in CredentialProvider. | 2026-04-13 | — | 502085234 | |
| CVE-2026-113289 | Medium | Improper input validation in PerformanceAPIs. | 2026-05-08 | — | 511311494 | |
| CVE-2026-113290 | Medium | Use after free in Input. | 2026-04-24 | — | 506152584 | |
| CVE-2026-113297 | Medium | Improper access control in Ozone. | 2026-09-16 | — | 562237117 | |
| CVE-2026-113301 | Medium | Memory corruption in WebAppInstalls. | 2026-03-28 | — | 497299147 | |
| CVE-2026-113302 | Medium | Use after free in Extensions. | 2026-04-08 | — | 500491981 | |
| CVE-2026-113304 | Medium | Memory corruption in GPU. | 2026-09-10 | — | 559720179 | |
| CVE-2026-113307 | Medium | Memory corruption in Extensions. | 2026-05-17 | — | 514066180 | |
| CVE-2026-113308 | Medium | Use after free in Core. | 2026-05-30 | — | 518102808 | |
| CVE-2026-113311 | Medium | Use after free in ServiceWorker. | 2026-04-03 | — | 499365667 | |
| CVE-2026-113319 | Medium | Use after free in Accessibility. | 2026-04-14 | — | 502689637 | |
| CVE-2026-113320 | Medium | Memory corruption in Navigation. | @RenwaX23 | 2025-07-03 | $2000 | 429432679 |
| CVE-2026-113321 | Medium | Use after free in Extensions. | 2026-05-15 | — | 513521516 | |
| CVE-2026-113325 | Medium | Memory corruption in SignIn. | 2026-05-30 | — | 518088604 | |
| CVE-2026-113326 | Medium | Memory corruption in Core. | 2026-08-26 | — | 553150372 | |
| CVE-2026-113327 | Medium | Use after free in Chromecast. | 2026-05-15 | — | 513417142 | |
| CVE-2026-113328 | Medium | Improper input validation in Privacy. | 2026-05-30 | — | 518055862 | |
| CVE-2026-113329 | Medium | Out of bounds read in Installer. | 2026-06-05 | — | 520429499 | |
| CVE-2026-113332 | Medium | Memory corruption in GPU. | 2026-05-27 | — | 517031871 | |
| CVE-2026-113333 | Medium | Memory corruption in Extensions. | 2026-04-10 | — | 501370810 | |
| CVE-2026-113335 | Medium | Memory corruption in Extensions. | 2026-05-30 | — | 518055882 | |
| CVE-2026-113337 | Medium | Memory corruption in Scroll. | 2026-04-11 | — | 501680084 | |
| CVE-2026-113340 | Medium | Memory corruption in ANGLE. | Jinpyo Lee | 2026-09-21 | — | 564213722 |
| CVE-2026-113342 | Medium | Memory corruption in Network. | 2026-09-15 | — | 562024413 | |
| CVE-2026-113343 | Medium | Memory corruption in Sandbox. | 2026-04-14 | — | 502376419 | |
| CVE-2026-113344 | Medium | Use after free in Performance. | 2026-09-15 | — | 561926123 | |
| CVE-2026-112994 | Low | Memory corruption in Browser. | 2026-09-17 | — | 562962437 | |
| CVE-2026-112996 | Low | Memory corruption in Loader. | 2026-09-17 | — | 563015686 | |
| CVE-2026-112998 | Low | Memory corruption in Views. | 2026-08-26 | — | 553134101 | |
| CVE-2026-113004 | Low | Memory corruption in Sync. | 2026-05-15 | — | 513394775 | |
| CVE-2026-113013 | Low | Memory corruption in DevTools. | 2026-09-19 | — | 563814519 | |
| CVE-2026-113015 | Low | Use after free in Workers. | 2026-03-29 | — | 497408124 | |
| CVE-2026-113017 | Low | Use after free in Views. | 2026-08-26 | — | 553132165 | |
| CVE-2026-113021 | Low | Use after free in WebAppInstalls. | 2026-08-26 | — | 553146562 | |
| CVE-2026-113023 | Low | Improper input validation in Extensions. | 2026-05-27 | — | 517148875 | |
| CVE-2026-113024 | Low | Use after free in WebAppInstalls. | 2026-07-09 | — | 533043403 | |
| CVE-2026-113025 | Low | Use after free in Input. | 2026-07-09 | — | 533113044 | |
| CVE-2026-113027 | Low | Memory corruption in WebFonts. | 2026-04-23 | — | 505807063 | |
| CVE-2026-113029 | Low | Improper access control in ANGLE. | 2026-06-13 | — | 523708661 | |
| CVE-2026-113036 | Low | Memory corruption in HTML. | 2026-08-27 | — | 553335083 | |
| CVE-2026-113038 | Low | Memory corruption in DevTools. | 2026-08-28 | — | 553931056 | |
| CVE-2026-113039 | Low | Use after free in Bookmarks. | NH DEV | 2026-09-25 | — | 566069559 |
| CVE-2026-113046 | Low | Improper input validation in Passwords. | 2026-09-17 | — | 562999635 | |
| CVE-2026-113047 | Low | Memory corruption in BrowserTag. | 2026-08-27 | — | 553267541 | |
| CVE-2026-113048 | Low | Memory corruption in DevTools. | 2026-05-18 | — | 514445657 | |
| CVE-2026-113053 | Low | Use after free in Cookies. | Luan Herrera (@lbherrera_) | 2022-10-09 | $1000 | 40061291 |
| CVE-2026-113056 | Low | Memory corruption in PerformanceAPIs. | 2026-04-13 | — | 502288792 | |
| CVE-2026-113061 | Low | Memory corruption in Chromoting. | 2026-08-29 | — | 554557866 | |
| CVE-2026-113063 | Low | Improper input validation in Chromoting. | 2026-09-17 | — | 562960821 | |
| CVE-2026-113066 | Low | Memory corruption in Fonts. | 2026-09-16 | — | 562223550 | |
| CVE-2026-113067 | Low | Use after free in Chromoting. | 2026-09-17 | — | 562999766 | |
| CVE-2026-113074 | Low | Use after free in Media. | 2026-09-17 | — | 563003907 | |
| CVE-2026-113080 | Low | Use after free in WebAppInstalls. | 2026-07-10 | — | 533135911 | |
| CVE-2026-113083 | Low | Memory corruption in Actor. | 2026-09-18 | — | 563337773 | |
| CVE-2026-113085 | Low | Use after free in Media. | 2026-09-10 | — | 559776316 | |
| CVE-2026-113088 | Low | Memory corruption in Mobile. | 2026-09-19 | — | 563812927 | |
| CVE-2026-113091 | Low | Use after free in PerformanceAPIs. | 2026-03-29 | — | 497433155 | |
| CVE-2026-113103 | Low | Use after free in WebProtect. | 2026-04-07 | — | 500474551 | |
| CVE-2026-113107 | Low | Use after free in Media. | 2026-09-10 | — | 559776445 | |
| CVE-2026-113114 | Low | Use after free in SignIn. | 2026-03-28 | — | 497087197 | |
| CVE-2026-113116 | Low | Use after free in DevTools. | 2026-08-27 | — | 553259748 | |
| CVE-2026-113121 | Low | Memory corruption in ContextMenu. | 2026-09-17 | — | 562909956 | |
| CVE-2026-113122 | Low | Memory corruption in Loader. | 2026-09-17 | — | 563016452 | |
| CVE-2026-113125 | Low | Memory corruption in DevTools. | 2026-09-19 | — | 563819290 | |
| CVE-2026-113130 | Low | Use after free in Actor. | 2026-09-17 | — | 563004214 | |
| CVE-2026-113132 | Low | Memory corruption in DevTools. | 2026-09-17 | — | 562953023 | |
| CVE-2026-113140 | Low | Use after free in ANGLE. | 2026-07-19 | — | 536445815 | |
| CVE-2026-113145 | Low | Memory corruption in Messages. | 2026-08-27 | — | 553169805 | |
| CVE-2026-113152 | Low | Memory corruption in SignIn. | 2026-06-12 | — | 523264945 | |
| CVE-2026-113156 | Low | Use after free in Messages. | 2026-08-27 | — | 553253820 | |
| CVE-2026-113167 | Low | Memory corruption in Network. | 2026-05-16 | — | 513692667 | |
| CVE-2026-113168 | Low | Use after free in Permissions. | 2026-03-30 | — | 497593347 | |
| CVE-2026-113169 | Low | Memory corruption in WebAppInstalls. | 2026-09-17 | — | 562955271 | |
| CVE-2026-113173 | Low | Improper input validation in UI. | 2026-08-27 | — | 553274389 | |
| CVE-2026-113180 | Low | Memory corruption in ContentCapture. | 2026-07-16 | — | 535725111 | |
| CVE-2026-113182 | Low | Memory corruption in Passwords. | 2026-09-17 | — | 562994234 | |
| CVE-2026-113184 | Low | Memory corruption in Scheduling. | 2026-07-28 | — | 540068924 | |
| CVE-2026-113186 | Low | Memory corruption in DevTools. | 2026-07-11 | — | 533644359 | |
| CVE-2026-113201 | Low | Memory corruption in Google Lens. | 2026-04-17 | — | 503665813 | |
| CVE-2026-113213 | Low | Memory corruption in DevTools. | 2026-05-15 | — | 513686739 | |
| CVE-2026-113214 | Low | Improper input validation in FullScreen. | 2026-04-24 | — | 506148052 | |
| CVE-2026-113215 | Low | Use after free in Extensions. | David Erceg | 2018-10-29 | $2000 | 40092886 |
| CVE-2026-113223 | Low | Memory corruption in DevTools. | 2026-05-16 | — | 513735940 | |
| CVE-2026-113226 | Low | Memory corruption in Model. | 2026-06-12 | — | 523248913 | |
| CVE-2026-113227 | Low | Use after free in Editing. | 2026-09-17 | — | 563021080 | |
| CVE-2026-113229 | Low | Use after free in Loader. | 2026-03-30 | — | 497827101 | |
| CVE-2026-113237 | Low | Memory corruption in Chromoting. | 2026-09-17 | — | 562978160 | |
| CVE-2026-113241 | Low | Memory corruption in Toolbar. | 2026-05-17 | — | 514078082 | |
| CVE-2026-113244 | Low | Improper input validation in UI. | 2026-05-17 | — | 514078112 | |
| CVE-2026-113245 | Low | Memory corruption in DevTools. | 2026-07-09 | — | 532985249 | |
| CVE-2026-113247 | Low | Memory corruption in DevTools. | 2026-05-19 | — | 514508203 | |
| CVE-2026-113248 | Low | Memory corruption in FileSystem. | 2026-08-29 | — | 554560940 | |
| CVE-2026-113251 | Low | Use after free in PDF. | kirtikumarar | 2021-06-16 | $2000 | 40056239 |
| CVE-2026-113254 | Low | Memory corruption in DevTools. | 2026-09-17 | — | 562955705 | |
| CVE-2026-113256 | Low | Use after free in Permissions. | 2026-04-02 | — | 498748871 | |
| CVE-2026-113260 | Low | Memory corruption in Core. | 2026-08-27 | — | 553326035 | |
| CVE-2026-113268 | Low | Memory corruption in Navigation. | 2026-08-27 | — | 553661952 | |
| CVE-2026-113269 | Low | Memory corruption in BrowserTag. | 2026-08-27 | — | 553334273 | |
| CVE-2026-113274 | Low | Use after free in ReadingMode. | chipsec | 2026-10-06 | — | 570715681 |
| CVE-2026-113286 | Low | Memory corruption in Google Lens. | 2026-09-18 | — | 563183231 | |
| CVE-2026-113287 | Low | Use after free in Prompts. | 2026-09-17 | — | 562945664 | |
| CVE-2026-113288 | Low | Memory corruption in Core. | 2026-09-02 | — | 556213889 | |
| CVE-2026-113291 | Low | Memory corruption in FullScreen. | 2026-05-17 | — | 514008724 | |
| CVE-2026-113292 | Low | Improper input validation in Omnibox. | 2026-08-27 | — | 553248404 | |
| CVE-2026-113294 | Low | Improper input validation in Loader. | 2026-09-17 | — | 563015337 | |
| CVE-2026-113296 | Low | Memory corruption in Actor. | 2026-06-15 | — | 524316342 | |
| CVE-2026-113299 | Low | Memory corruption in WebProtect. | 2026-07-09 | — | 532987588 | |
| CVE-2026-113300 | Low | Out of bounds write in Forms. | 2026-05-15 | — | 513468106 | |
| CVE-2026-113306 | Low | Improper input validation in Network. | 2026-06-16 | — | 524695296 | |
| CVE-2026-113312 | Low | Memory corruption in Autofill. | Manojkumar Jaganathan ( https://www.linkedin.com/in/manojkumar-j-7ba35b202/ ) Aka TheWhiteEvil ( https://hackerone.com/the-white-evil ) with HackerBro Technologies | 2025-08-20 | $1000 | 439873332 |
| CVE-2026-113313 | Low | Memory corruption in DevTools. | 2026-08-29 | — | 554475322 | |
| CVE-2026-113314 | Low | Use after free in Media. | 2026-09-17 | — | 562970433 | |
| CVE-2026-113323 | Low | Use after free in Chrome for iOS. | Qadhafy Muhammad Tera | 2026-01-30 | $1000 | 480153486 |
| CVE-2026-113330 | Low | Memory corruption in CustomTabs. | 2026-05-28 | — | 517320634 | |
| CVE-2026-113331 | Low | Memory corruption in Controls. | 2026-09-17 | — | 562993085 |
Additional CVEs (from blog text only)
None. Every CVE ID mentioned in the release post text is present in the unjam JSON output.
Methodology Notes
- Structured CVE data extracted via
unjam --cve. - Vulnerability types and component areas classified from CVE description text.
- Bounty amounts from the
bountyfield in unjam output. - External researchers identified from the
reporterfield (non-Google, non-anonymous). - Blog-text cross-check compared 353 distinct CVE IDs found in the release post HTML against the 353 IDs in the unjam JSON.