CVE-2020-6510

CVE-2020-6510 describes a heap buffer overflow in Chrome/Chromium’s background fetch path (prior to 84.0.4147.89). A remote attacker could exploit this via a crafted HTML page to achieve heap corruption. The issue is publicly acknowledged across multiple advisories; remediation is to upgrade to C...

CVE-2022-0796

CVE-2022-0796 affects Google Chrome/Chromium via a Use-after-free in Media vulnerability present before version 99.0.4844.51 . The issue could allow a remote attacker to exploit a heap corruption condition through a crafted HTML page. Affected platforms include Chromium-based packages across dist...

CVE-2022-0807

CVE-2022-0807 refers to an inappropriate Autofill implementation in Google Chrome before 99.0.4844.51. A remote attacker could bypass navigation restrictions via a crafted HTML page. Public sources corroborate a Chrome/Chromium family impact and cite the fix in 99.0.4844.51 (Chromium-based browse...

CVE-2022-2623

CVE-2022-2623 refers to a Use-After-Free in Offline in Google Chrome on Android before 104.0.5112.79, which could allow heap corruption when a user engages in specific UI interactions after a convincing prompt. The CVE is associated with Chrome/Chromium code paths affecting offline UI, with the N...

CVE-2022-2852

CVE-2022-2852: Use-after-free in FedCM in Google Chrome before 104.0.5112.101 allows remote attackers to potentially exploit heap corruption via a crafted HTML page. Connected sources confirm the issue in Chrome’s FedCM code path and cite affected versions, with Debian noting fixes in 104.0.5112....

CVE-2024-7973

CVE-2024-7973 is a reported heap buffer overflow in PDFium used by Google Chrome/Chromium, enabling a remote attacker to trigger an out-of-bounds memory read via a crafted PDF file. Affected software includes Chrome/Chromium prior to the 128.0.6613.84 fix (Linux, Windows, macOS). The underlying i...

CVE-2019-5818

CVE-2019-5818 affects Chromium/Google Chrome’s media reader component before version 74.0.3729.108. The root cause is an uninitialized value in media processing, which can allow a remote attacker to obtain potentially sensitive information from process memory via a crafted video file. Public advi...

CVE-2020-6392

CVE-2020-6392 describes an insufficient policy enforcement in the Extensions component of Chromium/Google Chrome, allowing an attacker who lures a user to install a crafted malicious extension to bypass navigation restrictions. Public advisories in connected documents indicate the issue affects C...

CVE-2024-2625

CVE-2024-2625 affects Google Chrome/V8 with an object lifecycle issue in V8 prior to 123.0.6312.58 that could allow remote exploitation via a crafted HTML page (high severity). The issue is fixed in Chrome 123.0.6312.58+; Debian reports a fix to 123.0.6312.86-1~deb12u1 for stable, and Fedora pack...

CVE-2024-7534

Summary: CVE-2024-7534 describes a heap buffer overflow in the Layout component of Google Chrome/Chromium, exploitable through a crafted HTML page. The vulnerability affects Chromium-based Chrome before version 127.0.6533.99 and is listed with High severity (CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/...

CVE-2019-13686

CVE-2019-13686 affects Chromium/Google Chrome in offline page handling. The issue is a Use-after-Free in offline mode that can lead to heap corruption, exploitable via a crafted HTML page. Affected product family: Chromium/Chrome browsers; root cause: use-after-free in offline pages flow. Impact:...

CVE-2019-5770

CVE-2019-5770 affects Google Chrome WebGL: insufficient input validation leads to an out-of-bounds memory read via a crafted HTML page. Vulnerable in Chrome up to version 72.0.3626.81; fixes shipped in later Chrome updates (e.g., 72.0.3626.81+). Debian/Fedora advisories and vendor advisories refe...

CVE-2020-6479

CVE-2020-6479 affects Chromium/Google Chrome before 83.0.4103.61. Root cause: an inappropriate implementation in the sharing component could allow a remote attacker to spoof the security UI via a crafted HTML page. Impact: spoofed security UI and potential circumvention of security checks, as des...

CVE-2023-4572

CVE-2023-4572 is a use-after-free vulnerability in Chrome/Chromium's MediaStream that could allow remote code execution via a crafted HTML page, caused by heap corruption. The CVE affects Chrome/Chromium browsers before the referenced fix version 116.0.5845.140. Public updates released by Debian ...

CVE-2023-5480

CVE-2023-5480 affects Chromium-based browsers (Google Chrome/Chromium) with versions prior to 119.0.6045.105. It describes an inappropriate implementation in Payments that could allow a remote attacker to bypass XSS protections via a malicious file. Public advisories in this set confirm remediati...

CVE-2026-76041

An information leak in the Skia graphics library within Google Chrome (prior to version 151.0.7922.169 ) allows a remote attacker to potentially bypass the web origin policy via a crafted HTML page. This vulnerability also affects Microsoft Edge (Chromium-based) and was identified in Opera . Publ...

CVE-2019-13661

CVE-2019-13661 describes a UI spoofing vulnerability in Chromium-based Google Chrome prior to 77.0.3865.75, enabling a remote attacker to spoof notifications via a crafted HTML page. The initial description confirms the affected software (Chromium/Chrome) and the impact (notification spoofing in ...

CVE-2020-6408

CVE-2020-6408 : The connected sources confirm an insufficient policy enforcement in CORS within Google Chrome/Chromium before version 80.0.3987.87. A local attacker could obtain potentially sensitive information by presenting a crafted HTML page, as described in multiple advisories (Debian, Arch ...

CVE-2025-4096

A heap buffer overflow in the HTML component of Google Chrome (prior to version 136.0.7103.59 ) allows a remote attacker to potentially exploit heap corruption by visiting a crafted HTML page. This vulnerability is classified with High security severity. While specific exploitation details are no...

CVE-2019-5784

CVE-2019-5784 affects Chromium/Chrome’s V8 engine. Root cause: incorrect handling of deferred code in V8 leads to potential heap corruption via a crafted HTML page. Impact: remote attacker could exploit heap corruption. Affected versions: Chrome/Chromium before 72.0.3626.96. Remediation: upgrade ...

CVE-2019-5800

CVE-2019-5800 affects Chromium/Google Chrome prior to 73.0.3683.75. The issue is an access restriction bypass: a CSP bypass via blob URLs in the Content Security Policy, enabling crafted pages to bypass CSP protections. Affected component areas are CSP enforcement mechanisms related to blob URLs ...

CVE-2020-6433

CVE-2020-6433 describes an insufficient policy enforcement vulnerability in the extensions component of Chromium/Google Chrome, allowing a remote attacker to bypass navigation restrictions via crafted HTML. This is part of a broader set of policy enforcement issues in Chromium 81.x. Debian/Arch/F...

CVE-2020-6456

CVE-2020-6456 affects the chromium/chrome browser family. The vulnerability is caused by insufficient validation of untrusted input in the clipboard, enabling a local attacker to bypass site isolation via crafted clipboard contents in affected builds prior to 81.0.4044.92. Public records in multi...

CVE-2023-1233

Summary: CVE-2023-1233 refers to an insufficient policy enforcement issue in Resource Timing in Google Chrome (Chromium-based) before version 111.0.5563.64. The vulnerability could allow a user-wanted attacker who persuades a user to install a malicious extension to potentially access sensitive i...

CVE-2024-7025

CVE-2024-7025 describes an integer overflow in the Layout component of Google Chrome, exploitable via a crafted HTML page to cause heap corruption. Multiple connected advisories confirm the issue affects Chrome builds prior to version 129.0.6668.89 and have been addressed in later releases. Publi...

CVE-2019-5820

CVE-2019-5820 is a PDFium-based integer overflow in Chromium/Google Chrome prior to 74.0.3729.108 that could allow a remote attacker to potentially trigger heap corruption via a crafted PDF. The issue is documented across multiple advisories (Debian DSA-4500, Arch Linux ASA-201904-12, Gentoo GLSA...

CVE-2020-6470

CVE-2020-6470 affects Chromium/Google Chrome clipboard handling. The root cause is insufficient validation of untrusted input in the clipboard, enabling a local attacker to inject arbitrary scripts or HTML (UXSS) via crafted clipboard content. Connected advisories confirm upstream fixes in the 83...

CVE-2022-1634

CVE-2022-1634 affects Google Chrome (Browser UI component). The underlying issue is a Use-after-free in the Browser UI, exploitable via specific UI interactions after convincing a user to engage in those interactions. The vulnerability was addressed in Chrome stable channel update to version 101....

CVE-2023-1236

CVE-2023-1236 affects Google Chrome (Chromium-based) prior to 111.0.5563.64 via an inappropriate implementation in Internals that allowed remote spoofing of an iframe origin through a crafted HTML page. The issue is logged as a Low severity in Chromium terms (CVSS 3.1 base 4.3, MEDIUM overall). R...

CVE-2026-12458

An inappropriate implementation in the Passwords component of Google Chrome (and Microsoft Edge ) prior to version 149.0.7827.155 allows a remote attacker to leak cross-origin data . This is achieved by convincing a user to perform specific UI gestures while visiting a crafted HTML page. The vuln...

CVE-2022-2160

The CVE-2022-2160 entry concerns Insufficient policy enforcement in DevTools for Google Chrome on Windows before 103.0.5060.53. A malicious extension installed by a user could allow access to potentially sensitive data from local files via a crafted HTML page. Connected documents corroborate the ...

CVE-2023-1232

CVE-2023-1232 affects Google Chrome (Chromium-based) Resource Timing: insufficient policy enforcement can allow a remote attacker to obtain potentially sensitive information from the API via a crafted HTML page. The issue is documented as Low severity and is mitigated by upgrading to Chrome 111.0...

CVE-2019-13679

CVE-2019-13679 is a PDFium-related issue in Google Chrome/Chromium where insufficient policy enforcement allowed a crafted PDF to trigger print dialogs without user activation. Connected advisories (Fedora/Debian/Nessus) confirm the vulnerability and show remediation through upgrading Chromium/Ch...

CVE-2020-6482

CVE-2020-6482 describes an insufficient policy enforcement vulnerability in Chrome’s developer tools. The root cause is improper access control in the developer tools component, allowing a user who installs a crafted malicious extension to bypass navigation restrictions. This could enable a remot...

CVE-2024-4558

CVE-2024-4558: Use-after-free in ANGLE within Google Chrome/Chromium's WebKit/ANGLE path allows a remote attacker to potentially trigger heap corruption via a crafted HTML page. Affects Chrome/Chromium builds prior to version 124.0.6367.155. The issue is addressed in the referenced Chrome update;...

CVE-2020-6397

CVE-2020-6397 is described as an insecure sharing implementation in Google Chrome/Chromium that allows a remote attacker to spoof the security UI via a crafted HTML page. Public records among connected sources confirm this as a content spoofing issue in the sharing component of Chromium/Chrome up...

CVE-2020-6429

CVE-2020-6429 refers to a use-after-free in Google Chrome’s audio path that could allow remote heap corruption via a crafted HTML page. Public references in Debian and Alpine security advisories confirm the flaw affects Chromium/Chrome up to version 80.0.3987.149, with fixed versions pushed in th...

CVE-2020-6459

Affected software: Google Chrome (payments implementation). Issue: a use-after-free in payments leads to potential heap corruption. Root cause: use-after-free in the payments code path as described in CVE-2020-6459. Impact: remote attacker could trigger arbitrary behavior via a crafted HTML page;...

CVE-2020-6478

CVE-2020-6478 is an implementation error in Chrome/Chromium’s full screen mode that could allow a remote attacker to spoof the security UI via a crafted HTML page. Public advisories (e.g., Debian DSA-4714-1, Arch security, Gentoo GLSA) confirm the issue affects Chromium/Chrome before version 83.0...

CVE-2019-13694

CVE-2019-13694: Use-after-free in WebRTC of Chromium/Google Chrome prior to 77.0.3865.120. Description and multiple advisories confirm a WebRTC use-after-free leading to potential remote code execution via a crafted HTML page. The fix is in Chromium 77.0.3865.120 (and related package updates in D...

CVE-2019-5834

CVE-2019-5834 involves insufficient data validation in Blink used by Google Chrome, enabling domain spoofing via a crafted HTML page in Chrome versions older than 75.0.3770.80. The vulnerability is attributed to the Blink component and affects Chrome before the fixed release. Debian advisories li...

CVE-2020-6458

CVE-2020-6458 is an out-of-bounds read/write in PDFium used by Google Chrome, allowing heap corruption via a crafted PDF file in Chrome before 81.0.4044.122. Remediation: upgrade Chrome to 81.0.4044.122 or newer (as reflected in Debian/Fedora advisories). Ensure affected systems are updated to ve...

CVE-2020-6487

CVE-2020-6487 corresponds to an access-restriction bypass in the downloads component of the Chromium/Google Chrome browser prior to version 83.0.4103.61. The issue is described as insufficient policy enforcement in downloads that allowed a remote attacker to bypass navigation restrictions via a c...

CVE-2022-2481

CVE-2022-2481 affects Google Chrome/Chromium, describing a use-after-free in Views that could allow heap corruption via UI interactions. The issue is tied to Chrome/Chromium builds prior to 103.0.5060.134. Exploitation requires user interaction, with remote threat actors potentially triggering th...

CVE-2026-17650

Google Chrome and Chromium -based browsers (including Microsoft Edge ) are vulnerable to a use after free flaw in the Compositing component. This vulnerability allows a remote attacker who has already compromised the renderer process to potentially perform a sandbox escape by interacting with a c...

CVE-2026-87605

Missing authorization in Contacts in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

CVE-2019-13723

CVE-2019-13723 is a use-after-free vulnerability in Chromium/Google Chrome’s Web Bluetooth implementation. The issue affects Web Bluetooth handling in Chromium browser builds prior to version 78.0.3904.108, where a compromised renderer could trigger heap corruption via a crafted HTML page to pote...

CVE-2019-5817

CVE-2019-5817 is a heap buffer overflow in ANGLE used by Google Chrome on Windows, prior to Chrome 74.0.3729.108. The issue could allow a remote attacker to cause heap corruption via a crafted HTML page. Affected component: ANGLE in Chrome (Windows). Root cause per the linked records is a heap bu...

CVE-2020-6446

CVE-2020-6446 : In Chromium, an insufficient policy enforcement issue in the Trusted Types component allowed bypass of CSP via a crafted HTML page, affecting builds prior to 81.0.4044.92. This is described in multiple sources (Arch Linux ASA-202004-9, Debian DSA-4714-1, Gentoo GLSA-202004-09). Re...

CVE-2020-6505

CVE-2020-6505 affects Google Chrome/Chromium prior to 83.0.4103.106, with a use-after-free vulnerability in the speech component that could permit a remote sandbox escape via a crafted HTML page. Public fixes are reflected in Chrome/Chromium updates (e.g., 83.0.4103.116+), with Debian/Fedora advi...