chromium-cve-gap

Give it the Chromium version a product is pinned to. It tells you which exploited and high-severity security fixes that pin is missing right now, and the smallest version bump that closes every one.

A Chromium fork, a CEF app, an Electron shell or a kiosk browser only moves engine when someone moves it. Staying a few majors back is not just "old" — each major that shipped since carries security fixes, and some of them are being used in real attacks today. This tool turns a version number into that list, from public data, in one command.

python chromium_cve_gap.py 151.0.7922.108

pinned            : 151.0.7922.108
current stable    : 154.0.8037.17  (3 majors ahead)
exploited (KEV)   : 2 open
high-severity     : 2 open

CVE              fixed in           KEV  severity what
CVE-2026-85046   152.0.7977.82      yes  high     Type confusion in V8, exploited in the wild
CVE-2026-87491   153.0.8010.36      yes  medium   Out-of-bounds write in V8, exploited in the wild

smallest version that closes all of the above: 153.0.8010.36
earliest CISA remediation date among the exploited ones: 2026-09-18

Where the numbers come from

• Current stable is fetched live from Google's public Chrome version-history API, per platform. No changelog, no guessing.
• The fix table (kev_fixes.json) is the maintained part. Each row is a Chromium/V8 security fix with the exact version it landed in, its NVD severity, and whether CISA lists it in the Known Exploited Vulnerabilities catalog with its remediation date. Every row in this repository was taken from NVD and CISA, not from a summary.

Use it with chromium-drift

chromium-drift reads the version a shipped product actually embeds, out of the binary. Feed that version into this tool and you have the whole picture: what they ship, and what shipping it that far back exposes them to.

What you get if you hand this to us

We build and maintain our own Chromium browser, so this is the day job, not a side script:

• the same gap, measured on your build, with the exact fixes you are missing;
• the rebase to the smallest version that closes the exploited ones, carrying your patches forward so nothing you added is lost;
• your fork put on a security clock that follows Chrome stable within days, kept separate from your feature releases;
• a repeatable build you own on every platform you ship.

Options

python chromium_cve_gap.py <version> --platform win|win64|mac|mac_arm64|linux
python chromium_cve_gap.py <version> --json      # machine-readable, for CI

Standard library only. No install, no dependencies, no network beyond Google's version-history API. Committed sample runs are in examples/.

Who built this

INNERLUXES (PRIVATE) LIMITED — browser and Chromium engineering. We build custom Chromium and CEF/Electron browsers, rebase and harden forks, and keep them current. See innerluxes.dev/browser-development/version-porting and innerluxes.dev/browser-development/custom-fork.