Class familyGoogle · Chromium
Google Chrome race condition flaws, 2021–2026
57 Chromium CVEs with CWE-362 weaknesses, 9 Mar 2021 to 6 Oct 2026. 1 is in CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it..
CVEs by year
Published each year. Select a CVE to open it.Grouped by product and weakness type (CWE); not proven to share a root cause.
1 2021’21
5 2022’22
2023’23
1 2024’24
3 2025’25
47 2026’26
In CISA KEVNot in KEV
20211 CVE, 1 in KEV
20225 CVEs
20241 CVE
20253 CVEs
202647 CVEs
- CVE-2026-5890
- CVE-2026-5893
- CVE-2026-6921
- CVE-2026-7954
- CVE-2026-7960
- CVE-2026-8520
- CVE-2026-10006
- CVE-2026-9959
- CVE-2026-10940
- CVE-2026-11145
- CVE-2026-11677
- CVE-2026-1220
- CVE-2026-12454
- CVE-2026-12468
- CVE-2026-13874
- CVE-2026-13882
- CVE-2026-13905
- CVE-2026-14015
- CVE-2026-14082
- CVE-2026-14133
- CVE-2026-15119
- CVE-2026-17709
- CVE-2026-17711
- CVE-2026-17712
- CVE-2026-17724
- CVE-2026-17822
- CVE-2026-17841
- CVE-2026-17855
- CVE-2026-17979
- CVE-2026-17999
- CVE-2026-78901
- CVE-2026-78906
- CVE-2026-78915
- CVE-2026-78979
- CVE-2026-79094
- CVE-2026-87467
- CVE-2026-87601
- CVE-2026-87641
- CVE-2026-91723
- CVE-2026-95280
- CVE-2026-95384
- CVE-2026-106201
- CVE-2026-106213
- CVE-2026-106238
- CVE-2026-106255
- CVE-2026-106377
- CVE-2026-106426
CVEs in this family
Table view of the years above| CVE | Published | Title | Linked from | Priority |
|---|---|---|---|---|
| CVE-2021-21166KEV | 9 Mar 2021 | Google Chromium Race Condition Vulnerability | Grouped by weakness | 63.7 |
| CVE-2022-2854 | 26 Sep 2022 | Use after free in SwiftShader in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially… | Grouped by weakness | 17.4 |
| CVE-2022-2857 | 26 Sep 2022 | Use after free in Blink in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap… | Grouped by weakness | 22.3 |
| CVE-2022-3042 | 26 Sep 2022 | Use after free in PhoneHub in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker to… | Grouped by weakness | 16.1 |
| CVE-2022-3049 | 26 Sep 2022 | Use after free in SplitScreen in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker… | Grouped by weakness | 16.5 |
| CVE-2022-3307 | 1 Nov 2022 | Use after free in media in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to potentially exploit heap… | Grouped by weakness | 17.1 |
| CVE-2024-6778 | 16 Jul 2024 | Race in DevTools in Google Chrome prior to 126.0.6478.182 allowed an attacker who convinced a user to install a… | Grouped by weakness | 22.4 |
| CVE-2025-8880 | 13 Aug 2025 | Race in V8 in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to execute arbitrary code inside a… | Grouped by weakness | 9.9 |
| CVE-2025-12432 | 10 Nov 2025 | Race in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption… | Grouped by weakness | 9.3 |
| CVE-2025-13721 | 2 Dec 2025 | Race in v8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption… | Grouped by weakness | 8.5 |
| CVE-2026-5890 | 8 Apr 2026 | Race in WebCodecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive… | Grouped by weakness | 6.8 |
| CVE-2026-5893 | 8 Apr 2026 | Race in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption… | Grouped by weakness | 5.6 |
| CVE-2026-6921 | 23 Apr 2026 | Race in GPU in Google Chrome on Windows prior to 147.0.7727.117 allowed a remote attacker to potentially perform a… | Grouped by weakness | 7.5 |
| CVE-2026-7954 | 6 May 2026 | Race in Shared Storage in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the… | Grouped by weakness | 3.1 |
| CVE-2026-7960 | 6 May 2026 | Race in Speech in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer… | Grouped by weakness | 5.1 |
| CVE-2026-8520 | 14 May 2026 | Race in Payments in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox… | Grouped by weakness | 7.0 |
| CVE-2026-10006 | 28 May 2026 | Race in WebAudio in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a… | Grouped by weakness | 8.0 |
| CVE-2026-9959 | 28 May 2026 | Race in WebRTC in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data… | Grouped by weakness | 2.8 |
| CVE-2026-10940 | 4 Jun 2026 | Race in Codecs in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the… | Grouped by weakness | 8.5 |
| CVE-2026-11145 | 4 Jun 2026 | Race in Geolocation in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin… | Grouped by weakness | 4.8 |
| CVE-2026-11677 | 8 Jun 2026 | Race in Network in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker who had compromised the… | Grouped by weakness | 6.6 |
| CVE-2026-1220 | 10 Jun 2026 | Race in V8 in Google Chrome prior to 144.0.7559.99 allowed a remote attacker to potentially exploit type confusion via… | Grouped by weakness | 9.7 |
| CVE-2026-12454 | 17 Jun 2026 | Race in Safe Browsing in Google Chrome on Mac prior to 149.0.7827.155 allowed a remote attacker who had compromised… | Grouped by weakness | 6.6 |
| CVE-2026-12468 | 17 Jun 2026 | Race in Updater in Google Chrome on Mac prior to 149.0.7827.155 allowed a remote attacker who had compromised the… | Grouped by weakness | 6.5 |
| CVE-2026-13874 | 30 Jun 2026 | Race in DataTransfer in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive… | Grouped by weakness | 6.0 |
| CVE-2026-13882 | 30 Jun 2026 | Race in USB in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process… | Grouped by weakness | 9.9 |
| CVE-2026-13905 | 30 Jun 2026 | Race in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a local attacker to obtain potentially… | Grouped by weakness | 3.1 |
| CVE-2026-14015 | 30 Jun 2026 | Race in WebRTC in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data… | Grouped by weakness | 7.9 |
| CVE-2026-14082 | 30 Jun 2026 | Race in Storage in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a… | Grouped by weakness | 7.9 |
| CVE-2026-14133 | 30 Jun 2026 | Race in History Embeddings in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing… | Grouped by weakness | 4.5 |
| CVE-2026-15119 | 8 Jul 2026 | Race in GetUserMedia in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who had compromised the… | Grouped by weakness | 8.9 |
| CVE-2026-17709 | 30 Jul 2026 | Race in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the… | Grouped by weakness | 10.7 |
| CVE-2026-17711 | 30 Jul 2026 | Race in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the… | Grouped by weakness | 10.7 |
| CVE-2026-17712 | 30 Jul 2026 | Race in Skia in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside… | Grouped by weakness | 13.9 |
| CVE-2026-17724 | 30 Jul 2026 | Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary… | Grouped by weakness | 4.3 |
| CVE-2026-17822 | 30 Jul 2026 | Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing… | Grouped by weakness | 7.3 |
| CVE-2026-17841 | 30 Jul 2026 | Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing… | Grouped by weakness | 7.3 |
| CVE-2026-17855 | 30 Jul 2026 | Race in DevTools in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the… | Grouped by weakness | 10.7 |
| CVE-2026-17979 | 30 Jul 2026 | Race in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a… | Grouped by weakness | 9.5 |
| CVE-2026-17999 | 30 Jul 2026 | Race in PictureInPicture in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform… | Grouped by weakness | 7.3 |
| CVE-2026-78901 | 25 Aug 2026 | Race condition in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code… | Grouped by weakness | 9.5 |
| CVE-2026-78906 | 25 Aug 2026 | Race condition in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute… | Grouped by weakness | 12.4 |
| CVE-2026-78915 | 25 Aug 2026 | Race condition in Enterprise in Google Chrome on on Windows prior to 152.0.7977.65 allowed an adjacent attacker to… | Grouped by weakness | 6.0 |
| CVE-2026-78979 | 25 Aug 2026 | Race condition in Core in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker leveraging… | Grouped by weakness | 5.3 |
| CVE-2026-79094 | 25 Aug 2026 | Race condition in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access… | Grouped by weakness | 7.5 |
| CVE-2026-87467 | 9 Sep 2026 | Race condition in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to… | Grouped by weakness | 5.8 |
| CVE-2026-87601 | 9 Sep 2026 | Race condition in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code… | Grouped by weakness | 9.5 |
| CVE-2026-87641 | 9 Sep 2026 | Race condition in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access… | Grouped by weakness | 5.3 |
| CVE-2026-91723 | 15 Sep 2026 | Race condition in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to spoof UI… | Grouped by weakness | 4.1 |
| CVE-2026-95280 | 29 Sep 2026 | Race condition in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code… | Grouped by weakness | 7.6 |
| CVE-2026-95384 | 29 Sep 2026 | Race condition in Transactions Platform in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to… | Grouped by weakness | 5.0 |
| CVE-2026-106201 | 6 Oct 2026 | Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code… | Grouped by weakness | 10.9 |
| CVE-2026-106213 | 6 Oct 2026 | Race condition in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially leak… | Grouped by weakness | 5.2 |
| CVE-2026-106238 | 6 Oct 2026 | Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the… | Grouped by weakness | 10.5 |
| CVE-2026-106255 | 6 Oct 2026 | Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute… | Grouped by weakness | 9.2 |
| CVE-2026-106377 | 6 Oct 2026 | Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the… | Grouped by weakness | 9.5 |
| CVE-2026-106426 | 6 Oct 2026 | Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute… | Grouped by weakness | 8.6 |