4145 matches found
CVE-2025-34092 Chrome Cookie Key Exposure via AppBound COM Path Validation Weakness
A cookie encryption bypass vulnerability exists in Google Chrome’s AppBound mechanism due to weak path validation logic within the elevation service. When Chrome encrypts a cookie key, it records its own executable path as validation metadata. Later, when decrypting, the elevation service compare...
CVE-2025-34091
CVE-2025-34091 describes a padding oracle vulnerability in Google Chrome’s AppBound cookie encryption, due to DPAPI decryption error reporting in Windows Event Logs. A local attacker can send malformed SYSTEM-DPAPI ciphertext to Chrome’s elevation service, distinguish padding vs MAC errors, and p...
Google Chrome Security Update (stable-channel-update-for-desktop_30-2025-06) - Mac OS X
Google Chrome is prone to a type confusion vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome";...
PT-2025-27672 · Google · Google Chrome
Name of the Vulnerable Software and Affected Versions: Google Chrome affected versions not specified Description: A padding oracle vulnerability exists in Google Chrome's AppBound cookie encryption mechanism. This issue arises due to observable decryption failure behavior in Windows Event Logs wh...
PT-2025-27671 · Google · Google Chrome
Name of the Vulnerable Software and Affected Versions: Google Chrome affected versions not specified Description: A security bypass issue exists in the AppBound cookie encryption mechanism of Google Chrome due to insufficient validation of COM server paths during inter-process communication. This...
Google Chrome < 138.0.7204.92 Vulnerability
The version of Google Chrome installed on the remote macOS host is prior to 138.0.7204.92. It is, therefore, affected by a vulnerability as referenced in the 202506stable-channel-update-for-desktop30 advisory. - Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacke...
Google Chrome < 138.0.7204.96 Vulnerability
The version of Google Chrome installed on the remote Windows host is prior to 138.0.7204.96. It is, therefore, affected by a vulnerability as referenced in the 202506stable-channel-update-for-desktop30 advisory. - Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote...
SUSE CVE-2025-6555
Use after free in Animation in Google Chrome prior to 138.0.7204.49 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...
Google Chrome Integer Overflow Vulnerability
Google Chrome is a popular web browser. Google Chrome suffers from an integer overflow vulnerability that stems from improper handling of integer values, which can be exploited by an attacker to submit a special WEB request that can be tricked into being parsed by the user, crashing the applicati...
PT-2025-26785 · Google +3 · Google Chrome +3
Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 138.0.7204.49 Description: A use after free issue in the Animation component of Google Chrome allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could lead to remote...
PT-2025-26786 · Google +2 · Google Chrome +2
Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 138.0.7204.49 Description: The issue is related to insufficient policy enforcement in the Loader component, allowing a remote attacker to bypass content security policy via a crafted HTML page. This could...
CVE-2025-6192
Use after free in Metrics in Google Chrome prior to 137.0.7151.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...
Google Chrome Type Obfuscation Vulnerability
Google Chrome is a popular web browser. Google Chrome suffers from a type obfuscation vulnerability that originates from accessing a resource using an incompatible type, which can be exploited by a remote attacker to submit a special WEB request that can be tricked into being parsed by the user,...
Astra Linux – Vulnerability in Chromium
In V8, reading out of bounds in Google Chrome before version 133.0.6943.141 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in Downloads in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...
DEBIAN-CVE-2025-5959
Type Confusion in V8 in Google Chrome prior to 137.0.7151.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...
PT-2025-25175
Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 137.0.7151.103 Description: A use-after-free vulnerability exists in the Media component of Google Chrome. This vulnerability could allow a remote attacker to exploit heap corruption through a crafted HTML page...
⚡ Weekly Recap: Chrome 0-Day, Data Wipers, Misused Tools and Zero-Click iPhone Attacks
Behind every security alert is a bigger story. Sometimes it’s a system being tested. Sometimes it’s trust being lost in quiet ways—through delays, odd behavior, or subtle gaps in control. This week, we’re looking beyond the surface to spot what really matters. Whether it’s poor design, hidden...