NuGetPackage

CefSharp.Common

6 known vulnerabilities (2 critical, 3 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release: 156.0.150 (Nov 4, 2026): no advisory affects it
Newest unaffected release: 156.0.150 (Nov 4, 2026), the latest release
Advisories: 6 · 2 critical, 3 high, 1 medium

Releases: 230 since 33.0.0
Registry: NuGet
Releases read: Nov 8, 2026

Version timeline

CVE-2026-48796
Affects 31.0.0-pre1 to 147.0.100 (148.0.90 is outside it)
CVE-2022-0609
Affects 31.0.0-pre1 to 98.1.190 (98.1.210 is outside it)
CVE-2020-16017
Affects 31.0.0-pre1 to 86.0.240-pre (86.0.241 is outside it)
CVE-2020-16013
Affects 31.0.0-pre1 to 86.0.240-pre (86.0.241 is outside it)
CVE-2020-16009
Affects 31.0.0-pre1 to 86.0.240-pre (86.0.241 is outside it)
CVE-2020-15999
Affects 31.0.0-pre1 to 85.3.121 (85.3.130 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 6

CVE-2026-48796Medium 5.3
CefSharp: `FolderSchemeHandlerFactory` path boundary check can expose files outside the configured root folder
Affected: fixed in 148.0.90.
Fixed in 148.0.90 (released May 29, 2026, 81 days before disclosure).
The latest release, 156.0.150, is not affected.
CVE-2022-0609High 8.8 · KEV
Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a c
Affected: fixed in 98.1.210.
Fixed in 98.1.210 (released Feb 18, 2022, 45 days before disclosure).
The latest release, 156.0.150, is not affected.
CVE-2020-16017Critical 9.6 · KEV
Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process
Affected: fixed in 86.0.241.
Fixed in 86.0.241 (released Nov 27, 2020, 42 days before disclosure).
The latest release, 156.0.150, is not affected.
CVE-2020-16013High 8.8 · KEV
Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.198 allowed a remote attacker to potentially exploit heap corruption
Affected: fixed in 86.0.241.
Fixed in 86.0.241 (released Nov 27, 2020, 42 days before disclosure).
The latest release, 156.0.150, is not affected.
CVE-2020-16009High 8.8 · KEV
Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption
Affected: fixed in 86.0.241.
Fixed in 86.0.241 (released Nov 27, 2020, 24 days after disclosure).
The latest release, 156.0.150, is not affected.
CVE-2020-15999Critical 9.6 · KEV
Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption vi
Affected: fixed in 85.3.130.
Fixed in 85.3.130 (released Oct 25, 2020, 9 days before disclosure).
The latest release, 156.0.150, is not affected.