CVE-2021-30507

CVE-2021-30507: In Chromium (Chrome/Chromium) Offline component, before 90.0.4430.212, an incorrect/ inappropriate implementation could allow a remote attacker who has compromised the renderer process to bypass site isolation via a crafted HTML page. Public advisories/state indicate the fixed ver...

CVE-2021-30571

Summary (CVE-2021-30571): An insufficient policy enforcement in DevTools of the Chromium-based Chrome before 92.0.4515.107 could allow a user- tricked into installing a malicious extension to potentially perform a sandbox escape via a crafted HTML page. The issue resides in Chromium’s DevTools co...

CVE-2023-5476

CVE-2023-5476: Use-after-free in Blink History of Google Chrome leading to potential heap corruption via a crafted HTML page. Affected: Chrome prior to 118.0.5993.70. Impact: remote attacker could exploit heap corruption (high severity in CVSS). Remediation: update to Chrome 118.0.5993.70 or newe...

CVE-2024-1284

CVE-2024-1284 concerns Chromium/Google Chrome Mojo use-after-free leading to potential heap corruption via a crafted HTML page, with the vulnerable state in Chrome/Chromium prior to version 121.0.6167.160. Multiple connected advisories confirm the affected product family (Chromium-based browsers)...

CVE-2025-5066

CVE-2025-5066 affects Google Chrome/Chromium: In Android Messages, an inappropriate implementation allowed UI spoofing via a crafted HTML page when a user engaged in specific UI gestures. Root cause is an implementation flaw in the Messages component. Impact is UI spoofing risk; no data exfiltrat...

CVE-2026-14131

CVE-2026-14131 affects Google Chrome WebAppInstalls with insufficient validation of untrusted input in the WebAppInstalls component prior to version 150.0.7871.47. The underlying issue allows a remote attacker who has compromised the renderer process to perform UI spoofing via a crafted HTML page...

CVE-2026-5911

CVE-2026-5911 corresponds to a policy bypass vulnerability in Chrome/Chromium ServiceWorkers. Multiple connected sources confirm the issue affects Chromium-based browsers and was fixed by updating to version 147.0.7727.55 in various distributions (e.g., Debian/Chromium 147.0.7727.55-1 for bookwor...

CVE-2012-4930

The CVE-2012-4930 issue affects the SPDY protocol (v3 and earlier) as used by Firefox, Chrome, and other products. It allows a man-in-the-middle to observe length-based side channels of TLS-compressed data to potentially recover plaintext HTTP headers (CRIME attack). Root cause: TLS compression w...

CVE-2020-16003

CVE-2020-16003 is a Chrome vulnerability: Use after free in the printing component. The connected data confirms Chrome/Chromium fixed this issue in the Chrome update cycle (reported as a use-after-free in printing), but the specific exploit details or affected versions beyond the prior 86.0.4240....

CVE-2021-30527

CVE-2021-30527 is a use-after-free vulnerability in Chromium’s WebUI before version 91.0.4472.77. Exploitation could be triggered by convincing a user to install a malicious extension or via a crafted HTML page, enabling heap corruption and arbitrary code execution. Affected software is Chromium/...

CVE-2022-1497

CVE-2022-1497 affects Google Chrome (Chromium base) with an Inappropriate implementation in Input that allowed a remote attacker to spoof the contents of cross-origin websites via a crafted HTML page. The connected sources consistently describe this issue in Chrome/Chromium prior to version 101.0...

CVE-2023-1531

Summary of CVE-2023-1531 : A use-after-free in ANGLE used by Google Chrome/Chromium leads to potential heap corruption when processing crafted HTML pages. Affected versions are Chrome/Chromium prior to 111.0.5563.110. Connected advisories confirm the issue in Chromium-based browsers and document ...

CVE-2023-2721

CVE-2023-2721 involves a use-after-free in Navigation in Google Chrome (Chromium) prior to version 113.0.5672.126, enabling potential heap corruption via a crafted HTML page. Affected software is Google Chrome/Chromium; root cause is a memory misreference in Navigation leading to use-after-free. ...

CVE-2024-2626

CVE-2024-2626 affects Google Chrome/Chromium where an out-of-bounds read in SwiftShader could allow a remote attacker to cause memory access issues via a crafted HTML page. Affected component: SwiftShader within Chrome/Chromium before version 123.0.6312.58. Impact: information disclosure through ...

CVE-2016-5157

CVE-2016-5157: A heap-based buffer overflow in opj_dwt_interleave_v (OpenJPEG) affects PDFium in Google Chrome; exploitation possible via crafted JPEG 2000 data. Affected Chrome builds were prior to 53.0.2785.89 on Windows/OS X and prior to 53.0.2785.92 on Linux. Debian/FreeBSD advisories referen...

CVE-2019-5823

CVE-2019-5823 corresponds to a forced navigation from a service worker vulnerability in Chromium/Google Chrome, allowing navigation restriction bypass via a crafted HTML page. Affected products include Chromium/Chrome before version 74.0.3729.108. The issue is described as an access restriction b...

CVE-2019-5858

CVE-2019-5858 affects Chromium/Google Chrome on macOS (OS X) prior to 76.0.3809.87; the CVE entry describes an incorrect security UI in the MacOS services integration that could let a local attacker execute arbitrary code via a crafted HTML page. Public-connected advisories for this family (CVE-2...

CVE-2020-15959

CVE-2020-15959 affects Google Chrome/Chromium browsers up to versions prior to 85.0.4183.102, where insufficient policy enforcement in networking could allow an attacker, via social engineering to persuade a user to enable logging, to obtain potentially sensitive information from a process’s memo...

CVE-2020-15976

CVE-2020-15976 is a use-after-free in the WebXR component of Chromium/Google Chrome (Android) prior to 86.0.4240.75, potentially enabling heap corruption and arbitrary code execution via a crafted HTML page. Remediation from connected sources includes upgrading to Chromium 86.0.4240.75 or newer (...

CVE-2021-21171

CVE-2021-21171 is a Chrome/Chromium UI security issue where the TabStrip and Navigation UI could spoof the Omnibox via a crafted HTML page. Affected product: Chromium before version 89.0.4389.72. Root cause: incorrect security UI handling in TabStrip/Navigation leading to content spoofing. Impact...

CVE-2021-21197

CVE-2021-21197 describes a heap buffer overflow in the TabStrip component of Google Chrome before 89.0.4389.114, enabling a remote attacker to potentially corrupt the heap via a crafted HTML page. Connected sources (Debian security advisories and Astra Linux bulletin) corroborate the same tab-imp...

CVE-2021-30525

CVE-2021-30525 describes a use-after-free in the Chromium browser's TabGroups component prior to 91.0.4472.77. A remote attacker could trigger heap corruption by convincing a user to install a crafted HTML page via a malicious extension. The issue is part of a broader set of Chromium vulnerabilit...

CVE-2021-30569

CVE-2021-30569 is a use-after-free in the sqlite component of the Chromium browser engine (Chrome) before version 92.0.4515.107. The vulnerability could allow a remote attacker to cause heap corruption via a crafted HTML page, potentially enabling arbitrary code execution. The connected data from...

CVE-2022-1128

CVE-2022-1128 affects Google Chrome on Windows and is caused by an inappropriate implementation of the Web Share API. The issue allows a crafted HTML page on a local network segment to leak cross-origin data. The vulnerability is tied to Chrome versions prior to 100.0.4896.60. The CVSS v3.1 vecto...

CVE-2022-1919

CVE-2022-1919 concerns a Use-after-Free in Google Chrome Codecs, before 101.0.4951.41, enabling a remote attacker to potentially trigger heap corruption via a crafted HTML page. The vulnerability is documented with a high CVSS score (8.8) and network attack vector with user interaction required. ...

CVE-2024-9963

CVE-2024-9963 concerns Google Chrome/Chromium where insufficient data validation in Downloads allows a remote attacker to spoof UI when a user, lured by a crafted HTML page and specific UI gestures, interacts with the page. Affected product/version: Chrome/Chromium prior to 130.0.6723.58. Root ca...

CVE-2019-5855

CVE-2019-5855 affecting Chromium is due to an integer overflow in the PDFium text rendering path, allowing a remote attacker to potentially execute arbitrary code via a crafted PDF. The advisory in Arch Linux (ASA-201908-1) states this as part of a set of issues in Chromium before 76.0.3809.87-1,...

CVE-2021-21119

CVE-2021-21119 : A use-after-free in the Media component of Google Chrome/Chromium prior to 88.0.4324.96 could allow a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. The issue affects Chromium-based browsers and was noted a...

CVE-2021-21128

CVE-2021-21128 is a heap buffer overflow in Blink/WebKit of the Chromium browser prior to 88.0.4324.96. Per the Arch/DEBIAN security entries, this is a Chromium/browser component issue that could enable arbitrary code execution and is fixed in newer Chromium builds (upstream or downstream) after ...

CVE-2021-21135

CVE-2021-21135 corresponds to an incorrect implementation in the Performance API of Chromium/Chrome prior to 88.0.4324.96. The flaw allows a remote attacker to leak cross-origin data via a crafted HTML page. The issue is tied to the Chromium browser, with advisories and package updates in distrib...

CVE-2021-21189

CVE-2021-21189 is a policy-enforcement vulnerability in the Chromium/Chromium-based browser payments component, allowing navigation/policy bypass via a crafted HTML page in versions prior to 89.0.4389.72. Public documents confirm the issue affects Chromium’s payments logic and that upstream fixes...

CVE-2021-30566

CVE-2021-30566 affects Chromium-based web engines (Chrome/Chromium) with a stack buffer overflow in the Printing component prior to 92.0.4515.107. The flaw could be triggered by a crafted HTML page and, if a renderer process is compromised, may allow remote code execution or other impact as descr...

CVE-2021-30585

CVE-2021-30585 is a use-after-free in the sensor handling of the Chromium browser engine used by Google Chrome on Windows, before version 92.0.4515.107. A crafted HTML page could trigger a heap corruption that a remote attacker could exploit. Public documents consistently describe the vulnerabili...

CVE-2023-5850

The CVE-2023-5850 issue affects Google Chrome/Chromium prior to version 119.0.6045.105, caused by an Incorrect security UI in the Downloads feature that can allow domain spoofing through a crafted domain name. The vulnerability is described as a medium-severity Chromium security issue and is addr...

CVE-2024-2400

CVE-2024-2400 describes a use-after-free in Chrome/Chromium’s Performance Manager, allowing a remote attacker to potentially corrupt heap via a crafted HTML page. Affected software includes Google Chrome and Chromium, with vulnerable iterations prior to version 122.0.6261.128. The underlying issu...

CVE-2024-2627

CVE-2024-2627 : Use-after-free in Canvas of Google Chrome/Chromium (pre-123.0.6312.58) can allow a remote attacker to trigger heap corruption via a crafted HTML page. Impact: high. Remediation: upgrade Chromium/Chrome to a fixed build (e.g., Chromium 123.0.6312.86+ as per Debian/Chromium advisori...

CVE-2024-9966

CVE-2024-9966 affects Google Chrome/Chromium (Navigations) and is caused by an inappropriate implementation that allows bypassing the Content Security Policy via a crafted HTML page. The issue has a documented low severity and is associated with Chrome/Chromium builds prior to 130.0.6723.58. Publ...

CVE-2019-13765

CVE-2019-13765 describes a use-after-free in Chrome’s Content Delivery Manager leading to potential heap corruption via a crafted HTML page. Affected software: Google Chrome (Content Delivery Manager component); vulnerable when running versions prior to 78.0.3904.70. The underlying impact is remo...

CVE-2020-6452

CVE-2020-6452 affects Chromium/Google Chrome prior to 80.0.3987.162 (and related Chromium builds). Root cause: heap/buffer overflow in the Media component (and related use-after-free issues in WebAudio per connected records). Impact: remote attacker could potentially execute arbitrary code by ent...

CVE-2020-6554

CVE-2020-6554 is a use-after-free in Chrome extensions that could enable a sandbox escape via a crafted extension in Chrome versions before 84.0.4147.125. Public connected documents confirm Chromium/Chrome advisories and Debian advisory references to this vulnerability and related fixes; one Debi...

CVE-2021-21121

CVE-2021-21121 is a concrete use-after-free vulnerability in Chromium’s Omnibox on Linux, described as a use-after-free in the Omnibox component of the Chromium browser before version 88.0.4324.96. The advisory states a remote attacker could potentially perform a sandbox escape via a crafted HTML...

CVE-2021-21192

CVE-2021-21192 refers to a heap buffer overflow in the Chrome tab groups implementation, allowing a remote attacker to potentially trigger heap corruption via a crafted HTML page. Affected product: Google Chrome (tab groups feature). Vulnerable component: tab groups code path handling HTML-driven...

CVE-2021-30511

CVE-2021-30511 concerns an information-disclosure flaw: an out-of-bounds read in the Tab Groups component of the Chromium browser before version 90.0.4430.212. Multiple connected advisories (Fedora/Arch/Linux security bulletins and Debian tracker) corroborate the same description for Chromium/Chr...

CVE-2021-30528

CVE-2021-30528 is a use-after-free vulnerability in the Chromium WebAuthentication component (Chromium/Google Chrome) on Android, before version 91.0.4472.77. The issue can allow a remote attacker who has compromised the renderer process of a user who saved a credit card in their Google account t...

CVE-2022-2007

CVE-2022-2007 affects Chromium/Google Chrome’s WebGPU component. Use-after-free in WebGPU on versions prior to 102.0.5005.115 enables potential heap corruption via a crafted HTML page. The issue is cited across multiple sources (Chrome/Chromium release notes, Debian security tracker advisories, G...

CVE-2022-2011

CVE-2022-2011 describes a use-after-free in ANGLE used by Google Chrome/Chromium. The vulnerability affects Chrome/Chromium prior to 102.0.5005.115 and can allow remote heap corruption via a crafted HTML page. Connected sources consistently reference ANGLE use-after-free and list Chromium/Chrome ...

CVE-2022-2605

CVE-2022-2605 : Out-of-bounds read in Dawn of Google Chrome prior to 104.0.5112.79 could allow a remote attacker to potentially trigger heap corruption with a crafted HTML page. Public sources in connected documents indicate this affects Chrome/Chromium components and that fixes exist in 104.0.51...

CVE-2023-6351

CVE-2023-6351 describes a use-after-free in libavif used by Google Chrome before 119.0.6045.199, allowing a remote attacker to cause heap corruption via a crafted AVIF file. Affected product/component: Google Chrome/Chromium with libavif. Root cause: use-after-free in libavif leading to possible ...

CVE-2026-12469

CVE-2026-12469 affects Google Chrome on Android, where an uninitialized use in the GPU could allow a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability lies in the GPU component, with the affected version range prior to 149.0.7827.155. Remediation is to update to...

CVE-2020-15972

CVE-2020-15972 is a use-after-free in the audio path of Chromium/Google Chrome prior to 86.0.4240.75. The issue could allow a remote attacker to exploit heap corruption via a crafted HTML page, potentially leading to arbitrary code execution or other impacts as described in the Debian/Arch adviso...