Chrome Os (Google) - vulnerabilities (CVEs)

67 CVEs, 0 in the last 30 days, 713 known versions, newest CVE from 2025-07-07. Vendor: Google.

CVEs of Chrome Os

CVE-2025-6044 - CVSS 6.1 (medium), 2025-07-07: An Improper Access Control vulnerability in the Stylus Tools component of Google ChromeOS version 16238.64.0 on the garaged stylus devices allows a physical…
CVE-2025-6179 - CVSS 9.8 (critical), 2025-06-16: Permissions Bypass in Extension Management in Google ChromeOS 16181.27.0 on managed Chrome devices allows a local attacker to disable extensions and access…
CVE-2025-6177 - CVSS 7.4 (high), 2025-06-16: Privilege Escalation in MiniOS in Google ChromeOS (16063.45.2 and potentially others) on enrolled devices allows a local attacker to gain root code execution…
CVE-2025-2509 - CVSS 7.8 (high), 2025-05-06: Out-of-Bounds Read in Virglrenderer in ChromeOS 16093.57.0 allows a malicious guest VM to achieve arbitrary address access within the crosvm sandboxed…
CVE-2025-1290 - CVSS 8.1 (high), 2025-04-17: A race condition Use-After-Free vulnerability exists in the virtio_transport_space_update function within the Kernel 5.4 on ChromeOS. Concurrent allocation…
CVE-2025-2073 - CVSS 8.8 (high), 2025-04-16: Out-of-Bounds Read in netfilter/ipset in Linux Kernel ChromeOS [6.1, 5.15, 5.10, 5.4, 4.19] allows a local attacker with low privileges to trigger an…
CVE-2025-1566 - CVSS 7.5 (high), 2025-04-16: DNS Leak in Native System VPN in Google ChromeOS Dev Channel on ChromeOS 16002.23.0 allows network observers to expose plaintext DNS queries via failure to…
CVE-2025-1704 - CVSS 6.5 (medium), 2025-04-16: ComponentInstaller Modification in ComponentInstaller in Google ChromeOS 15823.23.0 on Chromebooks allows enrolled users with local access to unenroll devices…
CVE-2025-1568 - CVSS 8.8 (high), 2025-04-16: Access Control Vulnerability in Gerrit chromiumos project configuration in Google ChromeOS 16063.87.0 allows an attacker with a registered Gerrit account to…
CVE-2025-1121 - CVSS 6.8 (medium), 2025-03-07: Privilege escalation in Installer and Recovery image handling in Google ChromeOS version 15786.48.2 on device allows an attacker with physical access to gain…
CVE-2022-2743 - CVSS 8.8 (high), 2023-01-02: Integer overflow in Window Manager in Google Chrome on Chrome OS and Lacros prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in…
CVE-2014-3180 - CVSS 9.1 (critical), 2019-11-06: In kernel/compat.c in the Linux kernel before 3.17, as used in Google Chrome OS and other products, there is a possible out-of-bounds read. restart_syscall…
CVE-2019-16508 - CVSS 7.8 (high), 2019-10-01: The Imagination Technologies driver for Chrome OS before R74-11895.B, R75 before R75-12105.B, and R76 before R76-12208.0.0 allows attackers to trigger an…
CVE-2016-5179 - CVSS 9.8 (critical), 2018-03-07: Chrome OS before 53.0.2785.144 allows remote attackers to execute arbitrary commands at boot.
CVE-2017-15400 - CVSS 7.8 (high), 2018-02-07: Insufficient restriction of IPP filters in CUPS in Google Chrome OS prior to 62.0.3202.74 allowed a remote attacker to execute a command with the same…
CVE-2017-15397 - CVSS 7.4 (high), 2018-02-07: Inappropriate implementation in ChromeVox in Google Chrome OS prior to 62.0.3202.74 allowed a remote attacker in a privileged network position to observe or…
CVE-2017-5084 - CVSS 3.3 (low), 2017-10-27: Inappropriate implementation in image-burner in Google Chrome OS prior to 59.0.3071.92 allowed a local attacker to read local files via dbus-send commands to…
CVE-2016-5169 - CVSS 8.8 (high), 2016-09-25: Format string vulnerability in Google Chrome OS before 53.0.2785.103 allows remote attackers to cause a denial of service or possibly have unspecified other…
CVE-2014-3188 - CVSS 10 (critical), 2014-10-08: Google Chrome before 38.0.2125.101 and Chrome OS before 38.0.2125.101 do not properly handle the interaction of IPC and Google V8, which allows remote…
CVE-2014-1710 - CVSS 7.5 (high), 2014-03-16: The AsyncPixelTransfersCompletedQuery::End function in gpu/command_buffer/service/query_manager.cc in Google Chrome, as used in Google Chrome OS before…
CVE-2014-1708 - CVSS 10 (critical), 2014-03-16: The boot implementation in Google Chrome OS before 33.0.1750.152 does not properly consider file persistence, which allows remote attackers to execute…
CVE-2014-1707 - CVSS 7.5 (high), 2014-03-16: Directory traversal vulnerability in CrosDisks in Google Chrome OS before 33.0.1750.152 has unspecified impact and attack vectors.
CVE-2014-1711 - CVSS 7.5 (high), 2014-03-16: The GPU driver in the kernel in Google Chrome OS before 33.0.1750.152 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly…
CVE-2014-1706 - CVSS 7.5 (high), 2014-03-16: crosh in Google Chrome OS before 33.0.1750.152 allows attackers to inject commands via unspecified vectors.
CVE-2013-2866 - CVSS 4.3 (medium), 2013-06-19: The Flash plug-in in Google Chrome before 27.0.1453.116, as used on Google Chrome OS before 27.0.1453.116 and separately, does not properly determine whether…
CVE-2013-2833 - CVSS 10 (critical), 2013-04-16: Use-after-free vulnerability in the O3D plug-in in Google Chrome OS before 26.0.1410.57 allows remote attackers to cause a denial of service or possibly have…
CVE-2013-2832 - CVSS 5 (medium), 2013-04-16: The Buffer::Set function in core/cross/buffer.cc in the O3D plug-in in Google Chrome OS before 26.0.1410.57 does not prevent uninitialized data from remaining…
CVE-2013-2835 - CVSS 5 (medium), 2013-04-16: Google Chrome OS before 26.0.1410.57 does not properly enforce origin restrictions for the O3D and Google Talk plug-ins, which allows remote attackers to…
CVE-2013-2834 - CVSS 5 (medium), 2013-04-16: Google Chrome OS before 26.0.1410.57 does not properly enforce origin restrictions for the O3D and Google Talk plug-ins, which allows remote attackers to…
CVE-2013-0927 - CVSS 7.5 (high), 2013-04-10: Google Chrome OS before 26.0.1410.57 relies on a Pango pango-utils.c read_config implementation that loads the contents of the .pangorc file in the user's…
CVE-2013-0915 - CVSS 10 (critical), 2013-03-18: The GPU process in Google Chrome OS before 25.0.1364.173 allows attackers to cause a denial of service or possibly have unspecified other impact via vectors…
CVE-2012-5129 - CVSS 7.5 (high), 2012-12-04: Heap-based buffer overflow in the WebGL subsystem in Google Chrome OS before 23.0.1271.94 allows remote attackers to cause a denial of service (GPU process…
CVE-2012-2864 - CVSS 10 (critical), 2012-08-22: Mesa, as used in Google Chrome before 21.0.1183.0 on the Acer AC700, Cr-48, and Samsung Series 5 and 5 550 Chromebook platforms, and the Samsung Chromebox…
CVE-2012-4050 - CVSS 10 (critical), 2012-07-24: Multiple unspecified vulnerabilities in Google Chrome OS before 21.0.1180.50 on the Cr-48 and Samsung Series 5 and 5 550 Chromebook platforms, and the Samsung…
CVE-2012-3290 - CVSS 10 (critical), 2012-06-07: Multiple unspecified vulnerabilities in Google Chrome before 20.0.1132.22 on the Acer AC700; Samsung Series 5, 5 550, and Chromebox 3; and Cr-48 Chromebook…
CVE-2012-1418 - CVSS 10 (critical), 2012-02-29: Multiple unspecified vulnerabilities in Google Chrome before 17.0.963.60 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown…
CVE-2012-0695 - CVSS 10 (critical), 2012-01-12: Multiple unspecified vulnerabilities in Google Chrome before 17.0.963.27 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown…
CVE-2011-4719 - CVSS 10 (critical), 2011-12-09: Multiple unspecified vulnerabilities in Google Chrome before 16.0.912.63 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown…
CVE-2011-4548 - CVSS 10 (critical), 2011-11-24: Multiple unspecified vulnerabilities in Google Chrome before 16.0.912.44 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown…
CVE-2011-3420 - CVSS 10 (critical), 2011-09-12: Multiple unspecified vulnerabilities in Google Chrome before 14.0.835.157 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown…
CVE-2011-3421 - CVSS 10 (critical), 2011-09-12: Multiple unspecified vulnerabilities in Google Chrome before 14.0.835.125 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown…
CVE-2011-2169 - CVSS 7.2 (high), 2011-05-24: Google Chrome OS before R12 0.12.433.38 Beta allows local users to gain privileges by creating a /var/lib/chromeos-aliases.conf file and placing commands in it.
CVE-2011-2171 - CVSS 10 (critical), 2011-05-24: Unspecified vulnerability in the dbugs package in Google Chrome OS before R12 0.12.433.38 Beta has unknown impact and attack vectors.
CVE-2011-2170 - CVSS 4.4 (medium), 2011-05-24: Google Chrome OS before R12 0.12.433.38 Beta, when Guest mode is enabled, does not prevent changes on the about:flags page, which has unspecified impact and…
CVE-2011-1306 - CVSS 10 (critical), 2011-03-08: Unspecified vulnerability in the Scratchpad application in Google Chrome OS before R10 0.10.156.46 Beta has unknown impact and attack vectors.
CVE-2011-1042 - CVSS 4.3 (medium), 2011-02-18: Use-after-free vulnerability in flimflamd in flimflam in Google Chrome OS before 0.9.130.14 Beta allows user-assisted remote attackers to cause a denial of…
CVE-2011-0479 - CVSS 7.5 (high), 2011-01-14: Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 do not properly interact with extensions, which allows remote attackers to cause a denial of…
CVE-2011-0482 - CVSS 4.3 (medium), 2011-01-14: Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 do not properly perform a cast of an unspecified variable during handling of anchors, which…
CVE-2011-0485 - CVSS 10 (critical), 2011-01-14: Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 do not properly handle speech data, which allows remote attackers to execute arbitrary code…
CVE-2011-0481 - CVSS 9.3 (critical), 2011-01-14: Buffer overflow in Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 allows remote attackers to cause a denial of service or possibly have…
CVE-2011-0484 - CVSS 7.5 (high), 2011-01-14: Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 do not properly perform DOM node removal, which allows remote attackers to cause a denial of…
CVE-2011-0480 - CVSS 9.3 (critical), 2011-01-14: Multiple buffer overflows in vorbis_dec.c in the Vorbis decoder in FFmpeg, as used in Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344, allow…
CVE-2011-0483 - CVSS 5 (medium), 2011-01-14: Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 do not properly perform a cast of an unspecified variable during handling of video, which…
CVE-2011-0472 - CVSS 9.3 (critical), 2011-01-14: Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 do not properly handle the printing of PDF documents, which allows user-assisted remote…
CVE-2011-0475 - CVSS 9.3 (critical), 2011-01-14: Use-after-free vulnerability in Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 allows remote attackers to cause a denial of service or…
CVE-2011-0478 - CVSS 10 (critical), 2011-01-14: Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 do not properly handle SVG use elements, which allows remote attackers to cause a denial of…
CVE-2011-0471 - CVSS 10 (critical), 2011-01-14: The node-iteration implementation in Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 does not properly handle pointers, which allows remote…
CVE-2011-0474 - CVSS 10 (critical), 2011-01-14: Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 do not properly handle Cascading Style Sheets (CSS) token sequences in conjunction with…
CVE-2011-0477 - CVSS 10 (critical), 2011-01-14: Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 do not properly handle a mismatch in video frame sizes, which allows remote attackers to…
CVE-2011-0470 - CVSS 5 (medium), 2011-01-14: Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 do not properly handle extensions notification, which allows remote attackers to cause a…
CVE-2011-0473 - CVSS 10 (critical), 2011-01-14: Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 do not properly handle Cascading Style Sheets (CSS) token sequences in conjunction with…
CVE-2011-0476 - CVSS 10 (critical), 2011-01-14: Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 allow remote attackers to cause a denial of service (stack memory corruption) or possibly…
CVE-2010-4575 - CVSS 4.3 (medium), 2010-12-22: The ThemeInstalledInfoBarDelegate::Observe function in browser/extensions/theme_installed_infobar_delegate.cc in Google Chrome before 8.0.552.224 and Chrome…
CVE-2010-4578 - CVSS 7.5 (high), 2010-12-22: Google Chrome before 8.0.552.224 and Chrome OS before 8.0.552.343 do not properly perform cursor handling, which allows remote attackers to cause a denial of…
CVE-2010-4574 - CVSS 7.5 (high), 2010-12-22: The Pickle::Pickle function in base/pickle.cc in Google Chrome before 8.0.552.224 and Chrome OS before 8.0.552.343 on 64-bit Linux platforms does not properly…
CVE-2010-4577 - CVSS 7.5 (high), 2010-12-22: The CSSParser::parseFontFaceSrc function in WebCore/css/CSSParser.cpp in WebKit, as used in Google Chrome before 8.0.552.224, Chrome OS before 8.0.552.343,…
CVE-2010-4576 - CVSS 5 (medium), 2010-12-22: browser/worker_host/message_port_dispatcher.cc in Google Chrome before 8.0.552.224 and Chrome OS before 8.0.552.343 does not properly handle certain…