// tag
Chrome
Security incidents tagged Chrome. Newest first.
- incidents
- 7
- live
- 1
- patched
- 6
## 7 Chrome incidents in the last year
through Oct 22, 2026show 7 older incidents7 older incidents
September 2026 2
highChrome zero-day CVE-2026-87491 (V8 OOB write)patched
› Google Chrome / Chromium V8 patched
September 9 2026 Chrome 153 patched CVE-2026-87491, a V8 out-of-bounds write Google said was exploited in the wild — the seventh Chrome zero-day of 2026. Fixed in 153.0.8010.36/.37. CISA KEV listed.
open incident →CVE-2026-87491highChrome zero-day CVE-2026-85046 (V8 type confusion)patched
› Google Chrome / Chromium V8 patched
September 4 2026 Chrome update patched CVE-2026-85046, a V8 type confusion zero-day Google said was exploited in the wild. Fixed in Chrome 152.0.7977.82/.83. Later added to CISA KEV.
open incident →CVE-2026-85046
June 2026 1
highChrome zero-day CVE-2026-11645 (V8 OOB)patched
› Google Chrome / Chromium V8 patched
June 2026 Chrome emergency update patched CVE-2026-11645, an out-of-bounds read/write in V8 exploited in the wild (fifth Chrome zero-day of 2026 at the time). Stable builds 149.0.7827.102/.103.
open incident →CVE-2026-11645
April 2026 1
highChrome zero-day CVE-2026-5281 (Dawn / WebGPU UAF)patched
› Google Chrome / Chromium Dawn patched
April 2026 Chrome patch for CVE-2026-5281, a use-after-free in Dawn (WebGPU), actively exploited in the wild.
open incident →CVE-2026-5281
March 2026 1
highChrome zero-days CVE-2026-3909 (Skia) and CVE-2026-3910 (V8)patched
› Google Chrome / Chromium patched
March 2026 Chrome updates fixed two actively exploited zero-days: CVE-2026-3909 (out-of-bounds write in Skia) and CVE-2026-3910 (inappropriate implementation in V8).
open incident →CVE-2026-3909 · CVE-2026-3910
February 2026 1
highChrome zero-day CVE-2026-2441 (CSS use-after-free)patched
› Google Chrome / Chromium patched
First actively exploited Chrome zero-day of 2026. Google patched CVE-2026-2441, a high-severity use-after-free in CSS (CSSFontFeatureValuesMap), in mid-February Chrome 145 updates. Google stated an exploit existed in the wild.
open incident →CVE-2026-2441
February 2025 1
- criticalliveunpatchedsince Feb 19, 2025
Fearless Wallet browser extension leaked private keys for ~20 months
› Fearless Wallet browser extension (Chrome; Firefox build delisted)
The Polkadot Community Foundation warned that Fearless Wallet browser-extension versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 contained code, added Feb 19 2025 inside a large 'TON ecosystem' change, that sent private keys/recovery data to an attacker server when the wallet was unlocked. The code was active at different times until Oct 10 2026. Eight users have reported losses totalling 17,286 DOT. Anyone who used the extension since Feb 2025 must create a new keypair in another wallet and move funds.
