CVE-2021-30537

The CVE-2021-30537 entry concerns the Chromium browser’s cookies component. The connected documents confirm: affected software is Chromium prior to version 91.0.4472.77; vulnerability type is insufficient policy enforcement in cookies; attacker could bypass cookie policy via a crafted HTML page. ...

CVE-2022-0803

CVE-2022-0803 concerns Google Chrome prior to 99.0.4844.51. It describes an inappropriate implementation in Permissions that allows a remote attacker to tamper with the Omnibox (URL bar) contents via a crafted HTML page. The issue affects Chrome’s handling within the Permissions component and has...

CVE-2022-1145

CVE-2022-1145 is a Chrome use-after-free in Extensions affecting Chrome

CVE-2023-1534

CVE-2023-1534 is an out-of-bounds read in ANGLE used by Google Chrome/Chromium prior to version 111.0.5563.110, enabling heap corruption via a crafted HTML page after an attacker compromises the renderer process. The connected sources confirm affected products (Chrome/Chromium) and the vulnerable...

CVE-2021-21160

CVE-2021-21160 is a heap buffer overflow in WebAudio within Chromium/Google Chrome prior to version 89.0.4389.72. A remote attacker could exploit this via a crafted HTML page to cause heap corruption. The connected sources confirm this issue across multiple advisories (Chromium/Chromebook updates...

CVE-2021-21196

CVE-2021-21196 involves a heap buffer overflow in the TabStrip component of Chromium/Google Chrome on Windows, prior to version 89.0.4389.114. The underlying issue is a heap overflow that could be triggered by a crafted HTML page, potentially enabling heap corruption. Affected software, evidence ...

CVE-2022-1636

CVE-2022-1636 affects Google Chrome up to version 101.0.4951.64, where a use-after-free in Performance APIs could allow a remote attacker to trigger heap corruption via a crafted HTML page. Impact is high (C/H/I/H; network attack vector, no privileges required, user interaction required). Remedia...

CVE-2023-0141

Conforms to CVE-2023-0141: Google Chrome/Chromium suffered from insufficient CORS policy enforcement, enabling a remote attacker to leak cross-origin data via a crafted HTML page. Affected versions were prior to 109.0.5414.74. The Chrome stable update 109.0.5414.74+ includes fixes; the release no...

CVE-2023-4909

CVE-2023-4909 describes an Inappropriate implementation in Interstitials in Google Chrome/Chromium prior to 117.0.5938.62 that allows a remote attacker to obfuscate the security UI via a crafted HTML page. The issue is documented across multiple sources (Chromium/Chrome advisories, Debian securit...

CVE-2019-5761

CVE-2019-5761 affects Google Chrome’s SwiftShader component. The issue is described as incorrect object lifecycle management in SwiftShader, enabling a remote attacker to potentially exploit heap corruption via a crafted HTML page. Affected software is Chrome prior to version 72.0.3626.81. Fedora...

CVE-2020-15963

CVE-2020-15963 concerns Google Chrome where insufficient policy enforcement in extensions could allow a user-tempted installation of a malicious extension to sandbox-escape. Affected software: Google Chrome prior to 85.0.4183.121 (extensions component policy enforcement). Root cause: insufficient...

CVE-2021-21212

CVE-2021-21212 affects Google Chrome on ChromeOS (and Chromium-based builds) with an incorrect security UI in the Network Config UI, before version 90.0.4430.72. The underlying issue is a security UI flaw that could allow a remote attacker to potentially compromise WiFi connection security via a ...

CVE-2021-30520

CVE-2021-30520 affects Chromium before 90.0.4430.212. A use-after-free in the Tab Strip component enables arbitrary code execution via crafted pages or extension interactions. Affected: Chromium-based browsers as shipped in Chromium upstream; vulnerable component is Tab Strip. Impact: remote atta...

CVE-2022-1313

CVE-2022-1313 describes a use-after-free in Chromium-based browsers (Chrome/Chromium) related to tab groups, leading to potential heap corruption via a crafted HTML page. The issue affects Chromium-derived browsers and was publicly disclosed with the impact of remote code execution/compromise via...

CVE-2023-5187

CVE-2023-5187 is a use-after-free vulnerability in Chrome/Chromium extensions prior to 117.0.5938.132. A user who installs a crafted malicious extension could trigger heap corruption via a crafted HTML page, potentially leading to arbitrary code execution. Affected: Google Chrome/Chromium extensi...

CVE-2011-3045

CVE-2011-3045 describes an integer signedness error in libpng’s png_inflate (pngrutil.c) affecting libpng before 1.4.10beta01. The vulnerability, cited as used in Google Chrome before 17.0.963.83 and other products, can cause a denial of service (application crash) or potentially allow arbitrary ...

CVE-2019-5875

CVE-2019-5875 is a URL-spoofing vulnerability in Chromium-based browsers (Google Chrome/Chromium) where insufficient data validation in downloads allowed a crafted HTML page to spoof the Omnibox (URL bar). Connected advisories confirm the vulnerability and document remediation: Debian’s security ...

CVE-2021-21172

CVE-2021-21172 corresponds to a policy enforcement error in Chrome's File System API on Windows, allowing a remote attacker to bypass filesystem restrictions via a crafted HTML page. Affected: Google Chrome/Chromium prior to 89.0.4389.72 (File System API component). Root cause: insufficient polic...

CVE-2021-30574

CVE-2021-30574 is a use-after-free in the protocol handling component of the Chromium-based Google Chrome browser prior to 92.0.4515.107. The description indicates an attacker could craft an HTML page to trigger a remote heap corruption, potentially enabling arbitrary code execution or similar im...

CVE-2026-12460

CVE-2026-12460 affects Google Chrome/Chromium: insufficient policy enforcement in File System Access allows a remote attacker who has compromised the renderer to bypass site isolation via a crafted PDF file, prior to Chrome 149.0.7827.155. The vulnerability is triggered through the JavaScript/PDF...

CVE-2020-6537

CVE-2020-6537 involves a type confusion in V8 used by Google Chrome/Chromium, allowing a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Affected: Chromium/Google Chrome browsers prior to version 84.0.4147.105. Root cause: V8 type confusion leading to code ex...

CVE-2022-1862

CVE-2022-1862 corresponds to an issue in Google Chrome extensions: an inappropriate implementation in Extensions allowed a user-assisted attacker to bypass profile restrictions via a crafted HTML page. The vulnerability affects Chrome prior to 102.0.5005.61 (and related Chromium builds). Impact d...

CVE-2023-2133

CVE-2023-2133 affects Chromium/Google Chrome’s Service Worker API. It describes an out-of-bounds memory access that could enable heap corruption via a crafted HTML page. Impact is high (C/H/I/A) with network attacker vector and user interaction required. The description states a fix for Chromium/...

CVE-2026-12463

The CVE-2026-12463 entry corresponds to an UXSS vulnerability in Google Chrome on Linux, caused by an inappropriate implementation in Views that allowed a compromised renderer to inject arbitrary scripts/HTML via a crafted HTML page. Affected product is Chrome on Linux, with the issue present pri...

CVE-2021-21198

CVE-2021-21198 is an out-of-bounds read in the Inter-Process Communication (IPC) path of Chrome/Chromium before 89.0.4389.114, reported as a renderer-initiated sandbox-escape risk via a crafted HTML page. Connected advisories confirm the issue in Chromium's IPC and note remediation via upgrade to...

CVE-2021-21201

CVE-2021-21201: Use-after-free in permissions of Google Chrome prior to 90.0.4430.72 can allow a remote attacker with renderer access to escape the sandbox via a crafted HTML page. Connected advisories (e.g., ASA-202104-2/ASA-202104-5) reiterate sandbox-escape and related issues across Chromium c...

CVE-2021-30509

CVE-2021-30509 affects Chromium/Google Chrome before 90.0.4430.212. It describes an out-of-bounds write in the Tab Strip component that an attacker could trigger by convincing a user to install a malicious extension, enabling memory corruption via a crafted HTML page and crafted Chrome extension....

CVE-2021-30536

CVE-2021-30536 is an information-disclosure/out-of-bounds-read issue in the V8 engine of the Chromium browser before 91.0.4472.77. Multiple sources (Arch Linux ASA-202106-2/ASA-202106-33, Debian, Alpine, Fedora) describe it as affecting Chromium/Chrome prior to that version, with remediation by u...

CVE-2021-30576

CVE-2021-30576 is a use-after-free vulnerability in DevTools of the Chromium browser engine before version 92.0.4515.107. The issue can be triggered when a user is convinced to install a malicious extension and visit a crafted HTML page, potentially allowing remote code execution or content spoof...

CVE-2023-1530

CVE-2023-1530 affects Chromium-derived browsers (Google Chrome/Chromium) prior to version 111.0.5563.110. The flaw is a Use-After-Free in PDF handling that can enable heap corruption via a crafted HTML page, leading to remote code execution risk as described in multiple advisories. Remediation is...

CVE-2019-5816

CVE-2019-5816 : A process lifetime issue in Google Chrome on Android (pre-74.0.3729.108) could allow a remote attacker to persist an exploited process via a crafted HTML page. The vulnerability is addressed in Chromium/Chrome updates (e.g., Chrome for Android and related Chromium patches such as ...

CVE-2019-8075

CVE-2019-8075 affects Google Chrome/Chromium (Flash component). Root cause: insufficient data validation in Flash leading to Same Origin Policy bypass and potential information disclosure. In Chrome/Chromium, fixes appeared in the 87.x series: Chrome 87.0.4280.66+ (and later) to address the vulne...

CVE-2020-16011

CVE-2020-16011 is a heap buffer overflow in Google Chrome’s Windows UI, prior to version 86.0.4240.183, that could allow a remote attacker who has compromised the renderer to potentially escape the Chrome sandbox via a crafted HTML page. Public advisories (Debian, FreeBSD, Debian DSA, and Chrome ...

CVE-2020-6507

CVE-2020-6507 describes an out-of-bounds write in the V8 JavaScript engine used by Google Chrome, allowing remote exploitation to potentially cause heap corruption via a crafted HTML page. The vulnerability affects Chrome versions prior to 83.0.4103.106. Connected documents confirm an exploit exi...

CVE-2021-21120

CVE-2021-21120 is a use-after-free in Chromium’s WebSQL implementation reported as affecting Chromium before version 88.0.4324.96 . The connected sources confirm a remote attacker could potentially exploit this to cause heap corruption via a crafted HTML page. The details consistently reference t...

CVE-2021-21183

CVE-2021-21183: In Google Chrome/Chromium before 89.0.4389.72, an inappropriate implementation in the Performance APIs allowed a remote attacker to leak cross-origin data via a crafted HTML page. The issue is part of a broader set of Chromium-related vulnerabilities fixed in late 2021; Debian adv...

CVE-2021-30530

CVE-2021-30530 : The connected documents confirm a vulnerability in Chromium’s WebAudio component prior to 91.0.4472.77, described as an out-of-bounds memory access. Exploitation is possible through a crafted HTML page that could be remote, with impact including potential memory access violations...

CVE-2022-0978

The CVE-2022-0978 entry affects ANGLE in Google Chrome prior to version 99.0.4844.74, where a use-after-free could enable a remote attacker to trigger heap corruption via a crafted HTML page. Public sources detail the issue as part of multiple Chromium/Chrome security fixes, with advisories and c...

CVE-2022-1868

The CVE-2022-1868 case concerns Google Chrome’s Extensions API where an improper implementation allowed bypassing navigation restrictions when a user is convinced to install a crafted malicious extension. Affected software is Google Chrome prior to 102.0.5005.61; a fix is reflected in Chrome/chro...

CVE-2022-1870

CVE-2022-1870 describes a use-after-free in Chrome’s App Service, exploitable via a crafted Chrome Extension, potentially yielding heap corruption. Affected product: Google Chrome (App Service) prior to version 102.0.5005.61. Reported impact in the sources is high severity with potential for arbi...

CVE-2023-0133

CVE-2023-0133 affects Google Chrome/Chromium: an Inappropriate implementation in Permission prompts allowed bypass of main origin permission delegation via a crafted HTML page on Android prior to 109.0.5414.74. The issue is fixed in Chrome 109 release line (109.0.5414.74 and newer). Affected prod...

CVE-2023-0134

CVE-2023-0134 describes a use-after-free in the Chrome/Chromium shopping cart (Cart) component prior to 109.0.5414.74. The vulnerability could enable heap corruption via database corruption and a crafted HTML page when a user is convinced to install a malicious extension. Affected product/version...

CVE-2023-4907

CVE-2023-4907 affects Google Chrome on Android (pre-117.0.5938.62). The issue stems from an inappropriate implementation in the Intents module, enabling a remote attacker to obfuscate security UI via a crafted HTML page. The vulnerability is categorized with a low severity and was disclosed as pa...

CVE-2024-1283

The connected records corroborate CVE-2024-1283: a heap buffer overflow in Skia used by Google Chrome/Chromium prior to 121.0.6167.160. The vulnerability allows remote attackers to trigger heap corruption via a crafted HTML page, potentially enabling code execution. Affected software includes Chr...

CVE-2026-12453

CVE-2026-12453 affects Google Chrome (Chromium-based) prior to 149.0.7827.155. The issue is insufficient validation of untrusted input in Input, allowing a renderer process account-compromised page to bypass the same-origin policy via a crafted HTML page. Practical impact stated is the bypass of ...

CVE-2019-5767

CVE-2019-5767 affects Google Chrome on Android (WebAPKs). The issue is caused by insufficient protection of the permission UI in WebAPKs, allowing an attacker who persuades a user to install a malicious APK to access privacy/security sensitive web APIs. Affected: Chrome on Android with WebAPK per...

CVE-2020-6417

CVE-2020-6417: In Google Chrome, an inappropriate implementation in the installer before version 80.0.3987.87 allows a local attacker to execute arbitrary code via a crafted registry entry. Connected advisories confirm this as a Chrome installer path issue (local impact) and indicate that remedia...

CVE-2021-21122

CVE-2021-21122 is a use-after-free in the Blink/WebKit component of the Chromium/Chrome stack, reported to affect Chromium builds before version 88.0.4324.96. The vulnerability resides in Blink and, per security advisories, could result in arbitrary code execution or heap corruption when a crafte...

CVE-2021-21188

CVE-2021-21188 is a Chrome/Blink use-after-free vulnerability in Blink/WebKit leading to potential heap corruption. Connected documents confirm the issue exists in Google Chrome prior to version 89.0.4389.72 and is exploitable via a crafted HTML page, with remote code execution as a possible impa...

CVE-2021-30507

CVE-2021-30507: In Chromium (Chrome/Chromium) Offline component, before 90.0.4430.212, an incorrect/ inappropriate implementation could allow a remote attacker who has compromised the renderer process to bypass site isolation via a crafted HTML page. Public advisories/state indicate the fixed ver...