CVE-2020-6490

CVE-2020-6490 affects Google Chrome/Chromium loaders prior to 83.0.4103.61, with insufficient data validation in the loader enabling a remote attacker who could write to disk to leak cross-origin data via a crafted HTML page. Upstream fixes are in Chrome/Chromium 83.0.4103.61 and newer; Debian an...

CVE-2023-5849

CVE-2023-5849 affects Chromium/Google Chrome USB handling: an integer overflow can lead to heap corruption via a crafted HTML page. Impact is high (CVE described as High); exploitation details in the wild are not provided in the documents. Remediation observed in multiple distros includes upgradi...

CVE-2019-13705

CVE-2019-13705 is a Chromium/Google Chrome extension permission bypass vulnerability. The assigned CVE refers to insufficient policy enforcement in extensions prior to 78.0.3904.70, allowing a user-lacative attacker who tricks a user into installing a malicious extension to leak cross-origin data...

CVE-2019-13759

Google Chrome vulnerable: CVE-2019-13759 stems from incorrect security UI in interstitials that enables domain spoofing via a crafted HTML page. Affected: Chrome versions prior to 79.0.3945.79. Impact: potential spoofing of the address bar/domain in interstitial UI. Mitigation: upgrade to Chrome ...

CVE-2021-30549

CVE-2021-30549 is a use-after-free in Chromium’s Spell check component affecting Chromium-based browsers up to version 91.0.4472.101. The vulnerability can be triggered when a user installs a malicious extension, potentially enabling heap corruption and remote code execution via a crafted HTML pa...

CVE-2022-0795

CVE-2022-0795 discusses a type confusion in Blink Layout in Google Chrome/Chromium up to version 99.0.4844.51 that could enable remote heap corruption via a crafted HTML page. The issue is rooted in the browser’s Blink component, exposing a vulnerability when processing HTML content. Public conne...

CVE-2019-13659

Technical details for CVE-2019-13659 are not publicly available in the provided documents. Monitor for updates from product advisories and security trackers.

CVE-2019-13737

CVE-2019-13737 in Google Chrome describes insufficient policy enforcement in the autocomplete component. The vulnerability could allow a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Affected are Chrome versions prior to 79.0.3945.79. Mit...

CVE-2019-13742

CVE-2019-13742 corresponds to an UI spoof vulnerability in Google Chrome’s Omnibox on iOS, where an incorrect security UI allowed a remote attacker to spoof the URL bar via a crafted domain name prior to version 79.0.3945.79. Connected security advisories reference Chrome/Chromium remediation pat...

CVE-2020-6403

CVE-2020-6403 affects Google Chrome/Chromium Omnibox behavior. The issue is an incorrect Omnibox implementation on iOS prior to 80.0.3987.87, which could allow a remote attacker to spoof the Omnibox (URL bar) via a crafted HTML page. Impact described in connected advisories includes UI spoofing r...

CVE-2021-30510

CVE-2021-30510 is a race condition vulnerability in the Aura component of Chromium (Chromium before 90.0.4430.212). Multiple connected advisories confirm this issue alongside other OOB/UAF problems in the Chromium stack; affected version range is before 90.0.4430.212. Impact notes in the sources ...

CVE-2022-2615

CVE-2022-2615 targets Google Chrome/Chromium prior to 104.0.5112.79, where insufficient cookie policy enforcement allows a crafted HTML page to leak cross-origin data. The issue is confirmed across multiple sources (Chromium/Chrome updates cited by Debian security tracker and related advisories)....

CVE-2022-3890

CVE-2022-3890 refers to a heap buffer overflow in Crashpad used by Google Chrome on Android before 107.0.5304.106. The vulnerability could be exploited by a remote attacker who already compromised the renderer process to potentially escape the sandbox via a crafted HTML page. Affected software is...

CVE-2019-13762

CVE-2019-13762 relates to Google Chrome/Chromium on Windows, where insufficient policy enforcement in downloads could allow a local attacker to spoof downloaded files via local code. This is a local, low-severity (CVSS 3.1: 3.3; CVSS 2.0: 2.1) issue with limited impact if exploited. The documente...

CVE-2020-6483

CVE-2020-6483 is a Chromium/Chrome vulnerability where an insufficient policy enforcement in the payments component allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Connected advisories confirm this is a Chromium/Chrome issue affecting the payments module and d...

CVE-2022-1857

CVE-2022-1857 : Affected: Google Chrome/Chromium (and derivatives) prior to version 102.0.5005.61. Root cause: Insufficient policy enforcement in the File System API, enabling a remote attacker to bypass file system restrictions via a crafted HTML page. Impact: High (remote code/restriction bypas...

CVE-2023-1231

CVE-2023-1231 describes an issue in Google Chrome on Android where the Autofill implementation allowed a crafted HTML page to spoof the omnibox contents. The vulnerability is tied to Chromium’s Autofill logic and is described as an inappropriate implementation, with a CVSS v3.1 base score of 4.3 ...

CVE-2026-3927

The CVE-2026-3927 entry concerns Google Chrome’s PictureInPicture security UI. Affects Chrome/Chromium where an incorrect UI in PictureInPicture could allow a remote attacker to spoof the UI via a crafted HTML page. Public references point to Chrome/Chromium fix activity: Chrome stable releases u...

CVE-2019-13682

CVE-2019-13682 affects Google Chrome prior to 77.0.3865.75, where insufficient policy enforcement in external protocol handling allowed a remote attacker to bypass the same-origin policy via a crafted HTML page. Public report describes this in Chrome/Chromium context; Debian advisories note fixes...

CVE-2019-13711

CVE-2019-13711 is an information-disclosure vulnerability affecting Chromium/Google Chrome prior to version 78.0.3904.70. The connected sources describe a cross-context information leak in Chromium/Chrome (before 78.0.3904.70), with Debian/Mageia/Arch advisories noting fixes in 78.0.3904.70-1 or ...

CVE-2019-13747

CVE-2019-13747 affects Google Chrome/Chromium rendering on Android versions prior to 79.0.3945.79, where uninitialized data in rendering could enable a remote attacker to trigger heap corruption via a crafted HTML page. The provided connected documents confirm this CVE is tied to Chromium/Chrome ...

CVE-2019-13752

CVE-2019-13752: Affected software is Google Chrome/Chromium with SQLite in the WebKit/Blink stack. The issue is an out-of-bounds read in the SQLite library, allowing a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. It affects Chrome/Chromi...

CVE-2019-5758

CVE-2019-5758 is a use-after-free in Blink/WebKit reported for Chromium-based browsers (Zhe Jin). The connected Debian/Nessus entries enumerate it among Chromium CVEs, linked to Blink/WebKit handling of HTML, and remediation is to update Chromium/Chrome to a newer version as released in the 72.x+...

CVE-2020-6414

CVE-2020-6414 affects Chromium/Google Chrome with insufficient policy enforcement in Safe Browsing, allowing a remote attacker to bypass navigation restrictions via crafted HTML. Connected advisories (e.g., Debian DSA-4638-1 and Arch Linux ASA-202002-3) confirm the issue is tied to Safe Browsing ...

CVE-2021-30556

Chromium/WebAudio vulnerability CVE-2021-30556: Use-after-free in the WebAudio component before 91.0.4472.114 allows remote code execution via a crafted page. Affects Chromium-based products relying on this engine; upgrade to 91.0.4472.114 or newer to fix. Arch Linux advisories note that an explo...

CVE-2022-0805

CVE-2022-0805 affects Google Chrome (Chromium-based) Browser Switcher. It is a use-after-free in the Browser Switcher that could enable heap corruption after specific user interaction. The vulnerability is addressed by Chrome/Chromium updates to version 99.0.4844.51 and later (e.g., Chromium upda...

CVE-2022-1309

CVE-2022-1309 affects Chromium/Google Chrome before version 100.0.4896.88 due to insufficient policy enforcement in developer tools , potentially enabling a sandbox escape via a crafted HTML page. The issue is rated high/critical (CVSS: 9.6). Remediation observed across distributions: updates to ...

CVE-2022-1495

CVE-2022-1495 affects Google Chrome on Android (prior to 101.0.4951.41). Root cause: Incorrect security UI in the Downloads dialog could allow a remote attacker to spoof the APK downloads dialog via crafted HTML. Impact described as spoofing the downloads prompt; no exploitation details provided ...

CVE-2023-4349

CVE-2023-4349 : Use after free in Device Trust Connectors in Google Chrome prior to 116.0.5845.96. A remote attacker could potentially exploit heap corruption via a crafted HTML page. Affected product is Chrome (Chromium-based). The issue is addressed by updating to the latest Chrome/Chromium bui...

CVE-2023-4361

CVE-2023-4361 concerns Google Chrome/Chromium Autofill on Android (pre-116.0.5845.96). The vulnerability is an inappropriate Autofill implementation that allows a remote attacker to bypass Autofill restrictions via a crafted HTML page, enabling potential unauthorized autofill actions. Affected so...

CVE-2024-2883

CVE-2024-2883 is a use-after-free vulnerability in ANGLE within Google Chrome (and Chromium-based browsers) prior to version 123.0.6312.86. The flaw could enable a remote attacker to exploit heap corruption via a crafted HTML page, with high severity and potential for impact on confidentiality, i...

CVE-2019-13726

CVE-2019-13726: A buffer overflow in Google Chrome’s password manager allows remote code execution via a crafted HTML page. Affected product: Google Chrome (Chromium core). Root cause: buffer/overflow in the password management path. Impact: remote arbitrary code execution with high impact on con...

CVE-2019-13729

CVE-2019-13729 : Use-after-free in Chrome’s WebSockets before 79.0.3945.79 allowing remote heap corruption via a crafted HTML page. Affected: Google Chrome (WebSockets) on legacy builds up to 79.0.3945.79. Root cause: use-after-free in the WebSockets implementation. Impact: heap corruption; remot...

CVE-2019-5802

CVE-2019-5802 is a UI spoofing vulnerability in Chromium/Google Chrome prior to 73.0.3683.75. The issue enables a remote attacker to spoof a domain via crafted HTML content, as documented by multiple sources (Chrome security notes and distribution advisories). The flaw is categorized under conten...

CVE-2021-30548

CVE-2021-30548: A use-after-free in the Loader component of Chromium/Chrome prior to 91.0.4472.101 allows remote code execution via a crafted HTML page. Affected software: Chromium/Chrome (Loader); root cause: use-after-free. Impact: remote attacker could run arbitrary code. Remediation: upgrade ...

CVE-2023-1224

CVE-2023-1224 affects Google Chrome/Chromium Web Payments API prior to 111.0.5563.64, where insufficient policy enforcement allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. The issue originates from Chromium Web Payments policy enforcement and results in an abi...

CVE-2025-5959

CVE-2025-5959 is a Type Confusion in V8 used by Google Chrome prior to 137.0.7151.103 that allowed a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page. Affected software is Google Chrome (Chromium/V8 engine); the issue is rated High severity with network...

CVE-2026-14142

Summary : CVE-2026-14142 describes an inappropriate implementation in Google Chrome’s Extensions prior to 150.0.7871.47, enabling a remote attacker (with renderer access) to spoof the UI via a crafted HTML page. The vulnerability affects Chrome extensions rendering logic and is rated Low severity...

CVE-2019-13739

The CVE-2019-13739 entry describes an insufficent policy enforcement flaw in Google Chrome’s Omnibox, enabling domain spoofing via IDN homographs. A remote attacker could exploit a crafted domain name to spoof a site, with impact limited to the UI/identity surface. Affected software is Chrome (Om...

CVE-2021-21149

CVE-2021-21149 is a stack buffer overflow in the Data Transfer component of Google Chrome on Linux prior to 88.0.4324.182, enabling remote out-of-bounds memory access via a crafted HTML page. Upstream and downstream advisories (Chromium/Chrome updates) fix this by upgrading to 88.0.4324.182 or ne...

CVE-2021-21232

CVE-2021-21232 affects Google Chrome DevTools. Use-after-free in Dev Tools prior to version 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Debian and other advisories note the fix in Chrome 90.0.4430.93 (and Chrome/Chromium update channels),...

CVE-2021-30506

CVE-2021-30506 affects Chromium/ Chrome Web App Installs component on Android before 90.0.4430.212. The issue is an Incorrect security UI that lets an attacker convince a user to install a web application and inject scripts or HTML into a privileged page via a crafted HTML page. Impact is that re...

CVE-2021-30539

CVE-2021-30539 affects Chromium browser (and Chromium-based Google Chrome) before 91.0.4472.77. The root cause is insufficient validation/enforcement of the Content Security Policy, allowing a remote attacker to bypass CSP via a crafted HTML page. Public advisories in connected documents confirm ...

CVE-2023-1230

CVE-2023-1230 concerns an Inappropriate implementation in WebApp Installs in Google Chrome on Android before version 111.0.5563.64. The issue allows an attacker who persuades a user to install a malicious WebApp to spoof the contents of the PWA installer via a crafted HTML page. Affected product ...

CVE-2019-13669

CVE-2019-13669 affects Google Chrome versions before 77.0.3865.75. The issue is an incorrect data validation in navigation that allows a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. The provided sources identify the vulnerability and its impact as URL ba...

CVE-2019-5868

CVE-2019-5868 is a use-after-free in PDFium within the Chromium/Google Chrome stack, before version 76.0.3809.100 . The underlying issue in PDFium could allow a remote attacker to cause heap corruption via a crafted PDF file. Multiple connected sources confirm the PCV as part of a broader set of ...

CVE-2020-6420

CVE-2020-6420 affects Google Chrome (media component). The issue is insufficient policy enforcement that allows a remote attacker to bypass the same-origin policy via a crafted HTML page, enabling information disclosure and potential further actions. Affected versions are Chrome before 80.0.3987....

CVE-2021-21156

CVE-2021-21156 refers to a heap buffer overflow in V8 (Chromium/Google Chrome) prior to 88.0.4324.182. The vulnerability in the V8 component could allow a remote attacker to potentially corrupt heap memory via a crafted script, leading to arbitrary code execution on the affected host. Public docu...

CVE-2020-6401

CVE-2020-6401 affects Google Chrome/Chromium Omnibox. The root cause is insufficient validation of untrusted input, enabling domain spoofing via IDN homographs with crafted domain names. Public sources in connected documents describe a domain-spoofing vulnerability tied to Omnibox input validatio...

CVE-2020-6477

CVE-2020-6477 affects Google Chrome on macOS (OS X) before 83.0.4103.61. The issue is an inappropriate implementation in the installer that allows a local attacker to escalate privileges via a crafted file. Public references in the connected documents confirm the affected product and root cause, ...