CVE-2023-3217

CVE-2023-3217 is a Use-After-Free in WebXR present in Google Chrome/Chromium prior to 114.0.5735.133, capable of heap corruption via a crafted HTML page. Affected products include Google Chrome/Chromium with the WebXR component; root cause is a use-after-free in the WebXR path. Impact is rated Hi...

CVE-2020-6395

CVE-2020-6395 is an out-of-bounds read in the JavaScript component of Chromium/Google Chrome prior to version 80.0.3987.87 that could allow a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. The vulnerability is addressed in upstream Chromiu...

CVE-2021-30518

CVE-2021-30518 is a heap buffer overflow in the Reader Mode component of Chromium-based browsers (e.g., Google Chrome and chromium) before version 90.0.4430.212. The vulnerability could allow a remote attacker to trigger heap corruption via a crafted HTML page, potentially enabling arbitrary code...

CVE-2022-0608

CVE-2022-0608 is a Chrome Mojo integer overflow vulnerability (pre-98.0.4758.102) that could enable remote heap corruption via a crafted HTML page. Affected: Google Chrome (Mojo component). Impact per sources: potential arbitrary code execution or crash; CVSS values indicate high impact. Remediat...

CVE-2023-5855

CVE-2023-5855 is a Use-After-Free in Chromium/Google Chrome Reading Mode. A remote attacker could entice a user to perform specific UI gestures, potentially causing heap corruption. Affected versions are Chrome/Chromium prior to 119.0.6045.105. Mitigation: upgrade to 119.0.6045.105 or later (as r...

CVE-2024-1938

CVE-2024-1938 corresponds to a Chrome/Chromium V8 type-confusion vulnerability (prior to 122.0.6261.94). The issue enables remote attackers to potentially trigger object corruption via a crafted HTML page, with high impact across confidentiality, integrity, and availability per the source. The As...

CVE-2025-6191

CVE-2025-6191 is a Chrome/Chromium vulnerability: an integer overflow in V8 prior to 137.0.7151.119 can enable a remote attacker to trigger out-of-bounds memory access via a crafted HTML page, with a High severity. There are public advisories and a Chrome security update (Stable channel 137.0.715...

CVE-2020-16040

CVE-2020-16040 affects Google Chrome/Chromium before 87.0.4280.88 due to insufficient data validation in V8 , which could allow a remote attacker to trigger heap corruption and potentially execute arbitrary code. The vulnerability is mitigated by upgrading to 87.0.4280.88 (fixed upstream; Debian/...

CVE-2021-21132

CVE-2021-21132 stems from an inappropriate implementation in the DevTools component of Google Chrome (Chromium) prior to 88.0.4324.96, which could allow a remote attacker to escape the sandbox via a crafted Chrome Extension. Affected product/area: Chrome/Chromium DevTools. Root cause: implementat...

CVE-2023-5853

CVE-2023-5853: A security-UI obfuscation vulnerability in Chromium-based browsers (Chrome/Chromium) before 119.0.6045.105; a crafted HTML page could mislead users in the Downloads UI. Remediation: upgrade to 119.0.6045.105 or newer.

CVE-2023-5856

CVE-2023-5856 affects Google Chrome/Chromium: Use-after-free in the Side Panel prior to 119.0.6045.105 can be triggered by a crafted HTML page when a user performs specific UI gestures, potentially causing heap corruption and remote code execution. Affected software: Google Chrome (Chromium-deriv...

CVE-2025-5065

The CVE-2025-5065 entry corresponds to an insecure implementation in Chrome’s FileSystemAccess API that could enable UI spoofing via a crafted HTML page. Affected software is Google Chrome (Chromium-based); vulnerability arises from an inappropriate implementation in FileSystemAccess API prior to...

CVE-2019-13667

CVE-2019-13667 affects Google Chrome on iOS, where an inappropriate Omnibox implementation allows a remote attacker to spoof the URL bar via a crafted HTML page. The vulnerability is tied to the Omnibox component in Chrome for iOS, describing a URL spoofing issue. The description notes the issue ...

CVE-2019-13761

CVE-2019-13761 affects Google Chrome/Chromium Omnibox UI, where a security UI flaw allowed domain spoofing via IDN homographs in crafted domain names. Root cause: incorrect security UI in Omnibox. Impact: remote attacker could spoof domains; no exploit details provided in the sources. Remediation...

CVE-2020-6550

CVE-2020-6550 is a Use-After-Free in IndexedDB in Google Chrome before 84.0.4147.125 that could allow a remote attacker to cause heap corruption via a crafted HTML page. The issue affects Chrome/Chromium’s IndexedDB component; root cause is a use-after-free memory error leading to potential arbit...

CVE-2021-21202

CVE-2021-21202: Use-after-free in Chrome extensions (extensions subsystem) prior to 90.0.4430.72 enables a crafted Chrome Extension to potentially escape the sandbox. Affected product: Google Chrome; root cause: use-after-free in extensions. Impact: sandbox escape risk. Remediation: update to Chr...

CVE-2021-30516

The CVE-2021-30516 entry refers to a heap buffer overflow in the History component of Chromium prior to 90.0.4430.212. The accompanying connected advisories confirm exploitation potential via crafted HTML pages and note this affects Chromium-based browsers (Chrome/Chromium family). Root cause: a ...

CVE-2022-1498

CVE-2022-1498 affects Google Chrome/Chromium: Inappropriate implementation in the HTML Parser allowed a remote attacker to leak cross-origin data via a crafted HTML page. The issue is tied to Chrome/Chromium versions prior to 101.0.4951.41. Public references reiter the same description across mul...

CVE-2019-13716

CVE-2019-13716 affects Google Chrome (and Chromium) prior to 78.0.3904.70, where insufficient policy enforcement in service workers could allow a remote attacker to bypass navigation restrictions via a crafted HTML page. Exploitation is via a page crafted to abuse the service worker state, leadin...

CVE-2019-5871

CVE-2019-5871 is a heap-buffer overflow in Skia used by Google Chrome/Chromium. The issue arises from a vulnerability in the Skia library that could allow a remote attacker to exploit heap corruption via a crafted HTML page. Public advisories confirm this CVE is reported in Chrome/Chromium and no...

CVE-2021-21225

CVE-2021-21225 is an out-of-bounds memory access in V8 within Google Chrome prior to 90.0.4430.85. The connected advisories confirm this vulnerability affects Chrome/V8 and describe the impact as potentially enabling heap corruption via a crafted HTML page, allowing remote code execution in the s...

CVE-2021-30515

CVE-2021-30515 affects the File API in Chromium-based browsers (Chromium/Chrome) prior to 90.0.4430.212. The vulnerability is a use-after-free in the File API component, enabling a remote attacker to craft a page that could trigger heap corruption. Exploitation status is not described in the prov...

CVE-2022-1312

CVE-2022-1312 affects Google Chrome/Chromium prior to 100.0.4896.88, where a use-after-free in storage could allow a user-assisted sandbox escape via a crafted Chrome Extension. Multiple connected sources confirm the issue and the affected version range, and debian/fedora advisories show remediat...

CVE-2019-5812

CVE-2019-5812: In Google Chrome for iOS, the security UI is inadequate, enabling domain spoofing via a crafted HTML page. The vulnerability affects the iOS UI path in Chrome prior to version 74.0.3729.108. Public sources in the connected documents confirm this CVE is tied to Chrome/Chromium updat...

CVE-2021-21208

CVE-2021-21208 affects Google Chrome/Chromium’s QR scanner. Root cause: insufficient data validation in the QR code scanner on iOS prior to 90.0.4430.72, enabling a crafted QR code to induce domain spoofing. Affected versions are Chrome/Chromium before that build. Remediation: upgrade to Chromium...

CVE-2021-30552

CVE-2021-30552 is a use-after-free in the Extensions component of the Chromium browser before version 91.0.4472.101. A remote attacker could exploit this via a crafted HTML page or a malicious extension to achieve arbitrary code execution through heap corruption. Several connected advisories conf...

CVE-2022-1314

CVE-2022-1314 is a type confusion in V8 within Google Chrome/Chromium, exposing heap corruption via a crafted HTML page. Connected sources confirm impact on Chromium/Chrome prior to version 100.0.4896.88, with patches released in the Chrome/Chromium update stream (e.g., Debian’s 100.0.4896.88 fix...

CVE-2019-13670

CVE-2019-13670 is a memory corruption issue in the v8 JavaScript engine of Chromium/Google Chrome. Affects Chrome/Chromium builds prior to 77.0.3865.75 with insufficient data validation that could enable heap corruption via a crafted HTML page. The Debian security advisory lists CVE-2019-13670 am...

CVE-2021-21152

CVE-2021-21152 describes a heap buffer overflow in the Media component of Chromium-based browsers (Google Chrome/Chromium) on Linux prior to 88.0.4324.182. Root cause is a heap buffer overflow in media handling that could allow remote attackers to trigger heap corruption via a crafted HTML page. ...

CVE-2023-0138

CVE-2023-0138 is a heap buffer overflow in libphonenumber affecting Google Chrome/Chromium prior to 109.0.5414.74, enabling potential heap corruption via a crafted HTML page. The issue is tied to Chrome/Chromium’s libphonenumber component; remediation is to upgrade to Chrome 109.0.5414.74 or late...

CVE-2023-5186

CVE-2023-5186 is a use-after-free vulnerability in Chromium-based browsers (Google Chrome and Chromium) prior to 117.0.5938.132. The issue lies in Passwords handling, where a crafted UI interaction can lead to a heap corruption through a use-after-free condition, potentially enabling arbitrary co...

CVE-2019-13727

CVE-2019-13727 is a policy-enforcement error in Chrome’s WebSockets implementation that could allow a remote attacker to bypass the same-origin policy via a crafted HTML page. The vulnerability affects Google Chrome versions prior to 79.0.3945.79, with the issue explicitly tied to insufficient po...

CVE-2019-13744

CVE-2019-13744 affects Google Chrome before 79.0.3945.79, where insufficient policy enforcement in cookies could enable a remote attacker to leak cross-origin data via a crafted HTML page. The issue is rooted in cookie policy handling within Chrome; several advisories reference this CVE as part o...

CVE-2022-0604

CVE-2022-0604 is a heap buffer overflow in Chrome’s Tab Groups, affecting Chrome before 98.0.4758.102. Affected component is the Tab Groups feature; root cause is a heap overflow that could be triggered by a crafted HTML page after user interaction with a malicious extension. Practical impact per...

CVE-2023-5851

CVE-2023-5851 describes an insecure/incorrect implementation in Downloads of Google Chrome (Chromium) prior to 119.0.6045.105, which allowed a remote attacker to obfuscate the security UI via a crafted HTML page. Public references in the connected documents confirm the issue affects Chromium-base...

CVE-2020-6380

CVE-2020-6380: In Google Chrome/Chromium, insufficient policy enforcement in extensions allowed a remote attacker with a compromised renderer to bypass site isolation via a crafted extension, affecting versions prior to 79.0.3945.130. The vulnerability is described as a policy enforcement error i...

CVE-2021-21153

CVE-2021-21153 : A stack buffer overflow in the GPU Process of Google Chrome on Linux (pre-88.0.4324.182) could allow a remote attacker to cause out-of-bounds memory access via a crafted HTML page. The available connected documents confirm the affected component and root cause, and indicate the v...

CVE-2021-30546

CVE-2021-30546 is a use-after-free in the Chromium Autofill component prior to version 91.0.4472.101 , allowing a remote attacker to potentially trigger heap corruption via a crafted HTML page. The vulnerability affects Google/Chromium browsers with Autofill enabled, and is part of a broader set ...

CVE-2022-0974

CVE-2022-0974 pertains to Google Chrome on Chrome OS prior to 99.0.4844.74, where a use-after-free in Splitscreen can be triggered by a crafted HTML page after user interaction, potentially enabling heap corruption and remote code execution. The issue is documented across multiple sources (NVD de...

CVE-2022-1305

CVE-2022-1305 is a Use-after-free in storage in Chromium/Google Chrome prior to 100.0.4896.88 that could allow a remote attacker to trigger heap corruption via a crafted HTML page. Advisories indicate fixes in version 100.0.4896.88+ across distributions (e.g., Debian DSA-5120-1, Fedora/chromium u...

CVE-2022-1499

CVE-2022-1499 – Chrome/Chromium WebAuthentication bypass Affected software: Google Chrome (Chromium derivatives) on desktop platforms; affected component: WebAuthentication implementation.Root cause: Inappropriate implementation in WebAuthentication allowed a remote attacker to bypass the same-or...

CVE-2022-2743

Mode C: The CVE-2022-2743 entry describes a concrete vulnerability in Google Chrome’s Window Manager on Chrome OS and Lacros, where an integer overflow can enable a remote attacker to cause an out-of-bounds memory write through crafted UI interactions. Affected software is Google Chrome on Chrome...

CVE-2023-0471

CVE-2023-0471: Use-after-free in WebTransport in Google Chrome before 109.0.5414.119. A crafted HTML page could trigger heap corruption via WebTransport, enabling remote code execution or instability per Chromium advisory. The Chrome release notes confirm a security fix in the 109.0.5414.119 Stab...

CVE-2019-5765

CVE-2019-5765 is described in the connected documents as an access restriction bypass (policy enforcement error) in the Chromium browser prior to version 72.0.3626.81. Fedora Arch/Linux advisories and Debian security trackers list this CVE among Chromium issues resolved by upgrading to 72.0.3626....

CVE-2019-5861

CVE-2019-5861 affects Chromium/Blink prior to 76.0.3809.87, where an error in determining the click location could allow bypassing anti-clickjacking (content spoofing). Affected component: Blink/WebKit click-location logic in Chromium before the fixed version. Impact per advisories: potential con...

CVE-2019-5879

CVE-2019-5879 : In Google Chrome, before 77.0.3865.75, insufficient policy enforcement in extensions allowed a user-tricked installation of a malicious extension to read local files. The issue arises from vulnerable extension permissions; impact is local data exposure. Affected product: Google Ch...

CVE-2023-4905

CVE-2023-4905 affects Google Chrome/Chromium where an inappropriate implementation in Prompts allowed a remote attacker to spoof the security UI via a crafted HTML page. The vulnerability is associated with Chrome/Chromium versions prior to 117.0.5938.62. Publicly documented fixes include Chrome/...

CVE-2022-1135

CVE-2022-1135 affects Google Chrome (Chromium-based) Shopping Cart handling prior to version 100.0.4896.60, where a use-after-free could lead to heap corruption. Root cause is a vulnerability in Shopping Cart code paths that can be triggered by standard user interaction, enabling potential remote...

CVE-2022-1146

CVE-2022-1146 affects Google Chrome prior to 100.0.4896.60, due to an inappropriate implementation in Resource Timing. This flaw could allow a remote attacker to leak cross-origin data via a crafted HTML page. Multiple connected sources (Chrome release notes, Debian security advisory, Gentoo GLSA...

CVE-2022-2480

The CVE-2022-2480 entry concerns a Use after free in the Service Worker API in Google Chrome, affecting versions prior to 103.0.5060.134. The connected sources confirm heap corruption as the potential impact when a crafted HTML page triggers the vulnerability. Remediation documented in Debian/rel...