Class familyGoogle · Chromium V8
Google Chrome code injection flaws, 2024–2026
19 Chromium V8 CVEs with CWE-94 weaknesses, 11 Jun 2024 to 6 Oct 2026. 1 is in CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it..
CVEs by year
Published each year. Select a CVE to open it.Grouped by product and weakness type (CWE); not proven to share a root cause.
1 2024’24
2025’25
18 2026’26
In CISA KEVNot in KEV
CVEs in this family
Table view of the years above| CVE | Published | Title | Linked from | Priority |
|---|---|---|---|---|
| CVE-2024-5834 | 11 Jun 2024 | Inappropriate implementation in Dawn in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to execute… | Grouped by weakness | 13.4 |
| CVE-2026-3910KEV | 13 Mar 2026 | Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability | Grouped by weakness | 66.3 |
| CVE-2026-8021 | 6 May 2026 | Script injection in UI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who convinced a user to… | Grouped by weakness | 3.9 |
| CVE-2026-8539 | 14 May 2026 | Script injection in SanitizerAPI in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker to… | Grouped by weakness | 4.8 |
| CVE-2026-9938 | 28 May 2026 | Inappropriate implementation in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute… | Grouped by weakness | 11.1 |
| CVE-2026-9976 | 28 May 2026 | Inappropriate implementation in USB in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute… | Grouped by weakness | 10.6 |
| CVE-2026-10904 | 4 Jun 2026 | Inappropriate implementation in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute… | Grouped by weakness | 14.1 |
| CVE-2026-10928 | 4 Jun 2026 | Script injection in Headless in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary… | Grouped by weakness | 13.2 |
| CVE-2026-11157 | 4 Jun 2026 | Script injection in Accessibility in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to… | Grouped by weakness | 4.2 |
| CVE-2026-11218 | 4 Jun 2026 | Inappropriate implementation in PlatformIntegration in Google Chrome on Windows prior to 149.0.7827.53 allowed a… | Grouped by weakness | 6.8 |
| CVE-2026-11231 | 4 Jun 2026 | Inappropriate implementation in Safe Browsing in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker… | Grouped by weakness | 8.1 |
| CVE-2026-11688 | 8 Jun 2026 | Inappropriate implementation in SVG in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute… | Grouped by weakness | 9.6 |
| CVE-2026-14383 | 1 Jul 2026 | Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute… | Grouped by weakness | 14.5 |
| CVE-2026-14407 | 1 Jul 2026 | Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute… | Grouped by weakness | 13.7 |
| CVE-2026-17922 | 30 Jul 2026 | Inappropriate implementation in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to… | Grouped by weakness | 13.7 |
| CVE-2026-79249 | 25 Aug 2026 | Code injection in Bisection in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive… | Grouped by weakness | 7.3 |
| CVE-2026-91719 | 15 Sep 2026 | Code injection in XML in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to bypass web origin policy… | Grouped by weakness | 5.9 |
| CVE-2026-106189 | 6 Oct 2026 | Code injection in ReaderMode in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging… | Grouped by weakness | 9.4 |
| CVE-2026-106416 | 6 Oct 2026 | Code injection in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social… | Grouped by weakness | 5.4 |