Google Chromium known exploited vulnerabilities, ranked
CISA lists 6 Google Chromium CVEs as exploited in the wild. 2 were added in the last 12 months and 0 are known to be used in ransomware. The table ranks all of them by EPSS, FIRST's estimate of the chance a CVE is exploited in the next 30 days, so the first rows are the ones to patch first.
Patch these first
- CVE-2026-2441: EPSS 55.1%, added 2026-02-17
- CVE-2021-21166: EPSS 24.0%, added 2021-11-03
- CVE-2025-14174: EPSS 22.3%, added 2025-12-12
- CVE-2021-37976: EPSS 19.9%, added 2021-11-03
- CVE-2025-6558: EPSS 9.6%, added 2025-07-22
All 6 Google Chromium CVEs in CISA KEV, by EPSS
| # | CVE | Flaw | EPSS | Ransomware | Added | Federal due |
|---|---|---|---|---|---|---|
| 1 | CVE-2026-2441 | Chromium CSS Use-After-Free | 55.1% | – | 2026-02-17 | 2026-03-10 |
| 2 | CVE-2021-21166 | Chromium Race Condition | 24.0% | – | 2021-11-03 | 2021-11-17 |
| 3 | CVE-2025-14174 | Chromium Out of Bounds Memory Access | 22.3% | – | 2025-12-12 | 2026-01-02 |
| 4 | CVE-2021-37976 | Chromium Information Disclosure | 19.9% | – | 2021-11-03 | 2021-11-17 |
| 5 | CVE-2025-6558 | Chromium ANGLE and GPU Improper Input Validation | 9.6% | – | 2025-07-22 | 2025-08-12 |
| 6 | CVE-2024-4671 | Chromium Visuals Use-After-Free | 8.3% | – | 2024-05-13 | 2024-06-03 |
EPSS changes daily; a CVE with a low EPSS that is in KEV is still exploited somewhere. Federal due dates bind US federal civilian agencies; everyone else can use them as a priority hint.
Sources: CISA KEV, FIRST EPSS.
More: all Google KEV CVEs · other Google products: Chromium V8 · free KEV badge for Google · all vendors