CVE-2020-6484

CVE-2020-6484 refers to insufficient data validation in the ChromeDriver component of Google Chrome prior to 83.0.4103.61. Multiple connected sources confirm the flaw affects Chrome/Chromium and that exploitation could bypass navigation restrictions via a crafted request. The Debian security noti...

CVE-2020-6527

Google Chrome before 84.0.4147.89 has an Insufficient policy enforcement in CSP that could allow a remote attacker to bypass content security policy via a crafted HTML page. This CVE affects Chrome’s CSP handling and was fixed in the 84.0.4147.89 update (stable channel) and related Chromium secur...

CVE-2022-1486

CVE-2022-1486 affects Google Chrome/Chromium’s V8 engine via a Type Confusion in V8. Prior to 101.0.4951.41, a crafted HTML page could allow a remote attacker to read potentially sensitive information from process memory. The issue is documented in Chrome/Chromium advisories and trusted feeds, wi...

CVE-2022-2477

The CVE-2022-2477 entry corresponds to a use-after-free in Chrome/Chromium’s Guest View prior to 103.0.5060.134, potentially permitting heap corruption when a user is coaxed to install a malicious extension and render a crafted HTML page. Affected component: Guest View in Chrome/Chromium. Root ca...

CVE-2023-1229

The CVE-2023-1229 entry concerns Google Chrome (Chromium-based) prior to version 111.0.5563.64. Affected component: Permission prompts implementation. Root cause: Inappropriate implementation in Permission prompts allowed a remote attacker to bypass navigation restrictions via a crafted HTML page...

CVE-2024-4558

CVE-2024-4558: Use-after-free in ANGLE within Google Chrome/Chromium's WebKit/ANGLE path allows a remote attacker to potentially trigger heap corruption via a crafted HTML page. Affects Chrome/Chromium builds prior to version 124.0.6367.155. The issue is addressed in the referenced Chrome update;...

CVE-2019-13666

CVE-2019-13666 : Google Chrome information leak in storage prior to 77.0.3865.75. Root cause: an information leak in storage that allowed cross-origin data to be exposed via a crafted HTML page. Impact: partial confidentiality loss with HIGH impact per CVSS3.1 (base score 7.4); attack vector NETW...

CVE-2019-13694

CVE-2019-13694: Use-after-free in WebRTC of Chromium/Google Chrome prior to 77.0.3865.120. Description and multiple advisories confirm a WebRTC use-after-free leading to potential remote code execution via a crafted HTML page. The fix is in Chromium 77.0.3865.120 (and related package updates in D...

CVE-2019-5814

CVE-2019-5814 affects Google Chrome/Chromium Blink: an insufficient policy enforcement in Blink allowed a remote attacker to leak cross-origin data via a crafted HTML page (CORS bypass). Impact: cross-origin data disclosure. Affected versions are before 74.0.3729.108. Remediation: upgrade to 74.0...

CVE-2020-6413

CVE-2020-6413 is a Chrome/Blink HTML validator bypass vulnerability. The issue arises from an inappropriate implementation in Blink that allowed a remote attacker to bypass HTML validators via a crafted HTML page. Affected product: Google Chrome/Chromium (Blink/WebKit). Impact per sources: bypass...

CVE-2020-6462

CVE-2020-6462 is a use-after-free in Chrome/Chromium task scheduling that could allow a renderer-compromised remote attacker to escape the sandbox via a crafted HTML page. Affected: Google Chrome/Chromium prior to 81.0.4044.129. Impact and remediation as stated in connected sources: patches exist...

CVE-2022-1125

CVE-2022-1125 affects Portals in Google Chrome prior to 100.0.4896.60, with the vulnerability described as a Use-after-Free that could allow a remote attacker to trigger heap corruption via specific user interaction. The Chrome security update (Chrome 100) fixes this and other issues; Debian secu...

CVE-2022-1479

CVE-2022-1479 is a Chrome/Chromium issue affecting the ANGLE component and was described as a use-after-free vulnerability that could allow a remote attacker to cause heap corruption via a crafted HTML page. The vulnerability is tied to Google Chrome prior to version 101.0.4951.41. Public bulleti...

CVE-2023-1221

The CVE-2023-1221 entry describes a Chromium-based issue in Google Chrome’s Extensions API: insufficient policy enforcement allowed a user-assisted attacker to bypass navigation restrictions via a crafted extension in Chrome prior to 111.0.5563.64. Affected software is Google Chrome/Chromium with...

CVE-2023-5484

The CVE-2023-5484 entry concerns Chrome/Chromium where an inappropriate implementation in the Navigation UI allows a remote attacker to spoof security UI via a crafted HTML page. Affected product: Google Chrome/Chromium browser. Root cause: navigation handling in Chromium before 118.0.5993.70 per...

CVE-2018-6156

CVE-2018-6156 affects Google Chrome/WebRTC: an incorrect derivation of a packet length in WebRTC can cause a heap-based buffer overflow, enabling potential remote arbitrary code execution via a crafted video file. The security notes in connected docs indicate the fix was applied in chrome-related...

CVE-2019-5773

CVE-2019-5773 : Insufficient origin validation in IndexedDB in Google Chrome before 72.0.3626.81 allows a remote attacker who compromised the renderer process to bypass the same-origin policy via a crafted HTML page. Affected product/version: Google Chrome (IndexedDB). Root cause: origin validati...

CVE-2020-6393

CVE-2020-6393 affects Google Chrome/Chromium Blink up to version 80.0.3987.87, where insufficient policy enforcement in Blink allowed a remote attacker to leak cross-origin data via a crafted HTML page. The root cause is a policy enforcement flaw in Blink, leading to cross-origin data exposure. A...

CVE-2020-6468

CVE-2020-6468 is a type confusion vulnerability in the V8 JavaScript engine used by Google Chrome/Chromium, affecting versions prior to 83.0.4103.61. The issue, identified in the V8 component, can lead to heap corruption and potential remote code execution when a user visits a specially crafted H...

CVE-2020-6491

CVE-2020-6491 affects Chromium/Google Chrome prior to 83.0.4103.61. The issue is an insufficient data validation in the site information component, enabling a remote attacker to spoof the security UI via a crafted domain. Impact involves content spoofing; remediation is to upgrade Chromium/Chrome...

CVE-2022-1487

CVE-2022-1487 describes a use-after-free in Ozone within Google Chrome/Chromium, allowing potential remote heap corruption when running a Wayland test. Affected product/portion: Ozone in Chrome/Chromium prior to version 101.0.4951.41. Root cause: use-after-free vulnerability in Ozone components. ...

CVE-2022-2623

CVE-2022-2623 refers to a Use-After-Free in Offline in Google Chrome on Android before 104.0.5112.79, which could allow heap corruption when a user engages in specific UI interactions after a convincing prompt. The CVE is associated with Chrome/Chromium code paths affecting offline UI, with the N...

CVE-2019-13696

Chromium/Google Chrome prior to version 77.0.3865.120 is affected by CVE-2019-13696 due to a use-after-free in the V8 component. This vulnerability could allow a remote attacker to execute arbitrary code via a crafted HTML page, with the issue fixed in 77.0.3865.120 according to multiple advisori...

CVE-2019-5864

CVE-2019-5864 concerns Google Chrome/Chromium where insufficient port filtering in CORS for extensions allowed bypassing Content Security Policy. Affected: Chrome/Chromium versions prior to 76.0.3809.87. Impact noted across multiple advisories (Arch Linux ASA-201908-1, Debian DSA-4500-1, Debian D...

CVE-2020-6399

CVE-2020-6399 is a policy-enforcement error in the AppCache component of the Chromium browser that allows a remote attacker to leak cross-origin data via a crafted HTML page. Affected product: Chromium prior to version 80.0.3987.87 (Chrome-based). Root cause per the public records is insufficient...

CVE-2020-6512

CVE-2020-6512: A type confusion in Google Chrome’s V8 engine prior to 84.0.4147.89 could allow a remote attacker to exploit heap corruption via a crafted HTML page, potentially enabling arbitrary code execution. Affected product: Chrome (V8). Root cause: type confusion in V8. Impact: remote code ...

CVE-2021-21191

CVE-2021-21191 is a use-after-free vulnerability in the WebRTC component of Chromium-based browsers (Google Chrome) prior to 89.0.4389.90. The issue allows a remote attacker to potentially exploit heap corruption via a crafted HTML page, as described in the CVE entry. Connected documents confirm ...

CVE-2021-30555

CVE-2021-30555 is a use-after-free in the Chromium Sharing component up to version 91.0.4472.114. An attacker could exploit heap corruption by convincing a user to install a malicious extension and rendering a crafted HTML page with user gesture. Impact described as arbitrary code execution/remot...

CVE-2022-2295

The CVE-2022-2295 issue is a type confusion in V8 affecting Google Chrome/Chromium, prior to version 103.0.5060.114, enabling a remote attacker to potentially trigger heap corruption via a crafted HTML page. Public details across connected sources confirm the affected component as Chromium’s V8 e...

CVE-2019-13668

CVE-2019-13668 affects Google Chrome prior to 77.0.3865.75, where insufficient policy enforcement in developer tools could allow a crafted HTML page to leak cross-origin data (information disclosure). The issue is documented across multiple sources (CVE entry and Debian/ Gentoo advisories) and ha...

CVE-2019-5835

CVE-2019-5835 describes an object lifecycle issue in the SwiftShader component of Google Chrome/Chromium prior to 75.0.3770.80 that could allow a remote attacker to perform out-of-bounds memory access via a crafted HTML page. Public advisories and trackers consistently tie this CVE to Chrome/Chro...

CVE-2019-5872

CVE-2019-5872 describes a use-after-free in Chrome’s Mojo component that could be triggered by a crafted HTML page, potentially allowing heap corruption. Affected: Google Chrome (Mojo path), version before 77.0.3865.75. Exploitation details, specific impact, and exact remediation are not provided...

CVE-2019-5881

CVE-2019-5881 : Out-of-bounds read in SwiftShader used by Google Chrome allowed remote attackers to obtain potentially sensitive information from process memory via a crafted HTML page. Affected product: Google Chrome (SwiftShader component). Root cause: memory read beyond bounds. Impact: informa...

CVE-2020-6412

CVE-2020-6412 affects Chromium/Google Chrome Omnibox: insufficient validation of untrusted input allows domain spoofing via IDN homographs in crafted domain names. Root cause is input validation flaw in Omnibox prior to 80.0.3987.87. Documents confirm affected component and version range and prov...

CVE-2020-6486

CVE-2020-6486 is an access restriction bypass in the navigations component of the Chromium/Google Chrome browser, prior to version 83.0.4103.61. The vulnerability stems from insufficient policy enforcement in navigations, enabling a remote attacker to bypass navigation restrictions via a crafted ...

CVE-2021-30557

CVE-2021-30557 is a use-after-free vulnerability in the Chromium-based TabGroups component prior to version 91.0.4472.114. The issue can allow a remote attacker to trigger heap corruption via a crafted HTML page after guiding a user to install a malicious extension, potentially leading to arbitra...

CVE-2019-13677

CVE-2019-13677 concerns Google Chrome/Chromium: insufficient policy enforcement in site isolation allowed remote bypass via a crafted HTML page. Connected advisories confirm the vulnerability and provide remediation guidance: Chromium/Chrome fixed in the 78.0.3904.97 series (Debian DSA-4562-1 lis...

CVE-2019-13699

CVE-2019-13699 pertains to the Chromium/Google Chrome media component prior to version 78.0.3904.70, where a use-after-free in media could be triggered by a crafted page and lead to heap corruption or arbitrary code execution. The vulnerability can be exploited by remote attackers who have compro...

CVE-2019-13701

CVE-2019-13701 : A URL spoofing issue in Google Chrome/Chromium was caused by an incorrect implementation in navigation that allowed a remote attacker to spoof the Omnibox (URL bar) via a crafted page, prior to version 78.0.3904.70. Public records indicate the vulnerability affects Chromium/Chrom...

CVE-2019-5768

CVE-2019-5768 affects Google Chrome prior to 72.0.3626.81. The vulnerability arises from DevTools API not correctly gating on extension capability in DevTools, enabling an attacker who persuades a user to install a malicious Chrome Extension to read local files. The issue is fixed by updating to ...

CVE-2020-6534

CVE-2020-6534: Heap buffer overflow in WebRTC of Google Chrome (Chromium) prior to 84.0.4147.89. A crafted HTML page could trigger heap corruption, potentially enabling arbitrary code execution. The connected FreeBSD/Vuxml entry confirms CVE-2020-6534 as part of Chrome/Chromium security fixes and...

CVE-2020-6536

CVE-2020-6536 affects Google Chrome/Chromium PWAs. Root cause: Incorrect security UI in PWAs allowed a crafted PWA to spoof the Omnibox (URL bar). Impact: potential for spoofing the address bar content via a remote PWA installation. Remediation: update to Chrome/Chromium 84.0.4147.89 (stable chan...

CVE-2019-13665

CVE-2019-13665 affects Chromium/Google Chrome’s Blink component. Description: insufficient filtering in Blink allowed a crafted HTML page to bypass multiple file download protections. Impact: remote attacker could bypass download protections via a malicious page on affected Chrome/Chromium builds...

CVE-2019-13749

CVE-2019-13749 is a UI spoof vulnerability in the Omnibox (URL bar) of Google Chrome/Chromium. The issue allowed spoofing via a crafted page. Mitigation observed in connected advisories: update to a patched Chrome/Chromium version (e.g., Debian/Ubuntu debs list fixes to 79.0.3945.130+; Fedora upd...

CVE-2019-5807

CVE-2019-5807 is a memory corruption issue in the V8 JavaScript engine in Google Chrome/Chromium prior to 74.0.3729.108. The vulnerability exists in V8’s handling of crafted HTML pages, potentially enabling heap corruption and remote code execution through a page load. Remediation across affected...

CVE-2019-5865

CVE-2019-5865 describes a site isolation bypass in Chromium/ Google Chrome prior to 76.0.3809.87 due to insufficient policy enforcement in navigations when a renderer is compromised. The vulnerability allowed a remote attacker to bypass site isolation via a crafted HTML page, enabling potential a...

CVE-2023-4357

CVE-2023-4357 affects Google Chrome (Chromium-based) and its Chromium derivatives. The vulnerability is caused by insufficient validation of untrusted input in XML, enabling a remote attacker to bypass file access restrictions via a crafted HTML page. Public records confirm impact on Chrome befor...

CVE-2018-20073

CVE-2018-20073 concerns Google Chrome prior to 72.0.3626.81, where use of extended attributes in downloads could allow a local attacker to read download URLs via the filesystem (information leakage). The CVE is evidenced in multiple sources, including the NVD entry and Debian/openSUSE/OSS advisor...

CVE-2019-13754

CVE-2019-13754 affects Google Chrome/Chromium where insufficient policy enforcement in extensions could let a remote attacker bypass navigation restrictions via a crafted HTML page. The vulnerability is scoped to Chrome versions before 79.0.3945.79. Public advisories and updates indicate remediat...

CVE-2019-5766

CVE-2019-5766 describes an incorrect origin taint handling in Canvas within Chromium/Google Chrome, which could allow a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability is tied to the Canvas origin taint check and is listed against Chrome versions prior to 72.0...