CVE-2026-12469

CVE-2026-12469 affects Google Chrome on Android, where an uninitialized use in the GPU could allow a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability lies in the GPU component, with the affected version range prior to 149.0.7827.155. Remediation is to update to...

CVE-2020-15972

CVE-2020-15972 is a use-after-free in the audio path of Chromium/Google Chrome prior to 86.0.4240.75. The issue could allow a remote attacker to exploit heap corruption via a crafted HTML page, potentially leading to arbitrary code execution or other impacts as described in the Debian/Arch adviso...

CVE-2021-21209

CVE-2021-21209 concerns the Google Chrome storage API: an inappropriate implementation allowed a remote attacker to leak cross-origin data via a crafted HTML page in Chrome versions prior to 90.0.4430.72. The issue is documented across multiple advisories, noting it as an information-disclosure v...

CVE-2021-30521

CVE-2021-30521 is a documented heap buffer overflow in the Autofill component of Chromium/Google Chrome for Android (pre-91.0.4472.77). The root cause is a memory safety flaw allowing out-of-bounds access via a crafted HTML page, enabling a remote attacker to potentially execute arbitrary code. P...

CVE-2021-30531

CVE-2021-30531: A CSP policy enforcement issue in the Chromium/Google Chrome component before 91.0.4472.77 allowed remote attackers to bypass content security policy via a crafted HTML page. Affected product: Chromium/Chrome browser; vulnerable component: Content Security Policy enforcement in th...

CVE-2021-30578

CVE-2021-30578 concerns the Chromium-based Chrome/Chromium media component. The issue is an uninitialized use in the Media module prior to version 92.0.4515.107, enabling a remote attacker to trigger out-of-bounds memory access via a crafted HTML page. Exploitation would require delivering the pa...

CVE-2022-0794

The CVE-2022-0794 entry concerns Google Chrome WebShare: a use-after-free in WebShare prior to 99.0.4844.51 that could allow a remote attacker to exploit heap corruption via a crafted HTML page after convincing a user to engage in specific interaction. Affected product is Google Chrome (Chromium-...

CVE-2022-1136

CVE-2022-1136 affects Google Chrome/Chromium: Use-after-free in the Tab Strip can lead to heap corruption when a user is convinced to install a malicious extension. Affected versions are before 100.0.4896.60; the Chrome 100 stable release fixed 28 security issues including this CVE. Exploitation ...

CVE-2020-15961

CVE-2020-15961 describes insufficient policy validation in Chrome extensions, enabling a sandbox escape via a crafted extension. The issue affects Google Chrome/Chromium prior to 85.0.4183.121, where an attacker could persuade a user to install a malicious extension to bypass sandbox restrictions...

CVE-2021-21159

CVE-2021-21159 describes a heap buffer overflow in Chrome’s TabStrip prior to 89.0.4389.72. A remote attacker could potentially exploit this heap corruption via a crafted HTML page, leading to arbitrary code execution or crash. Connected advisories confirm Chrom(e/ium) components affected and not...

CVE-2021-30573

CVE-2021-30573 affects the GPU component of Chromium/Chrome before version 92.0.4515.107. It is described as a use-after-free issue that could allow a remote attacker to trigger heap corruption via a crafted HTML page, with remote code execution and content impact stated in several advisories. Ex...

CVE-2021-30582

CVE-2021-30582 corresponds to an “Inappropriate implementation in Animation” in the Chromium-based browser engine, affecting Google Chrome/Chromium prior to 92.0.4515.107. The issue enables a remote attacker to leak cross-origin data via a crafted HTML page, as described across multiple connected...

CVE-2022-2604

CVE-2022-2604 affects Google Chrome prior to 104.0.5112.79, where a use-after-free in Safe Browsing could lead to heap corruption via a crafted HTML page. The connected sources corroborate the same description across multiple trackers (Chromium/Chrome context). Impact is described as remote code ...

CVE-2022-3889

CVE-2022-3889 : Type Confusion in V8 affecting Google Chrome/Chromium prior to 107.0.5304.106, leading to potential heap corruption via a crafted HTML page. Root cause: type confusion in V8. Impact: remote attacker could exploit to compromise memory; Chromium security rating: High. Affected produ...

CVE-2023-4900

CVE-2023-4900 affects Google Chrome/Chromium family (Android Chrome prior to 117.0.5938.62) where an inappropriate implementation in Custom Tabs allows a remote attacker to obfuscate a permission prompt via a crafted HTML page. Connected advisories indicate this is one of multiple Chromium issues...

CVE-2023-4903

CVE-2023-4903 concerns Google Chrome on Android before 117.0.5938.62, where Inappropriate implementation in Custom Mobile Tabs allowed a remote attacker to spoof security UI via a crafted HTML page. The linked sources confirm this is a Chromium-derived issue affecting Chrome/Chromium and related ...

CVE-2025-8879

CVE-2025-8879 is a heap buffer overflow in libaom used by Google Chrome/Chromium prior to 139.0.7258.127. The vulnerability allows remote exploitation via a curated set of gestures, leading to heap corruption with high impact (execution of code, crash). Affected component: libaom integration in C...

CVE-2019-5771

CVE-2019-5771 : An incorrect JIT of GLSL shaders in SwiftShader used by Google Chrome prior to 72.0.3626.81 allows a remote attacker to execute arbitrary code via a crafted HTML page. This is fixed in Chrome 72.0.3626.81 and later. The vulnerability affects SwiftShader’s GLSL JIT within Chrome; n...

CVE-2019-5854

CVE-2019-5854 is an integer overflow in the PDFium component of Chromium/Google Chrome prior to 76.0.3809.87, leading to potential heap corruption when processing crafted PDFs. Multiple connected sources (Debian security advisories, Arch Linux ASA, CVE listings) confirm PDFium’s role and the affe...

CVE-2021-21185

CVE-2021-21185 affects the Chromium browser (Extensions component) with a policy enforcement issue that could allow a user-targeted attacker who lures a user into installing a malicious extension to exfiltrate sensitive information. The Debian advisories list this CVE among multiple Chromium fixe...

CVE-2021-21204

CVE-2021-21204 is a use-after-free in Blink/WebKit reported for Google Chrome on macOS before 90.0.4430.72, allowing remote heap corruption via a crafted HTML page. The issue is confirmed across multiple vendor advisories (Debian, Fedora, Alpine, Astra Linux) and is addressed by updating to Chrom...

CVE-2021-30534

CVE-2021-30534 concerns Chromium’s iFrameSandbox, where insufficient policy enforcement prior to version 91.0.4472.77 could allow a remote attacker to bypass navigation restrictions via a crafted HTML page. The issue is part of a broader set of Chromium vulnerabilities fixed in the 91.0.4472.77 r...

CVE-2022-1137

CVE-2022-1137 affects Google Chrome extensions prior to 100.0.4896.60. The connected sources describe an "Inappropriate implementation in Extensions" in Chrome, enabling an attacker who persuades a user to install a malicious extension to leak potentially sensitive information via a crafted HTML ...

CVE-2022-2165

CVE-2022-2165 — Summary : The connected sources confirm a vulnerability in Google Chrome (desktop) stemming from insufficient data validation in URL formatting, enabling domain spoofing via IDN homographs with a crafted domain name. The issue affects Chrome up to version 103.0.5060.53 and is addr...

CVE-2024-9122

Type Confusion in V8 of Google Chrome (Chromium) prior to 129.0.6668.70 allows remote attackers to cause out-of-bounds memory access via a crafted HTML page. Affected products include Chromium/Chrome; vulnerable component is V8. Public references in connected documents confirm the issue and indic...

CVE-2026-19137

Google Chrome WebGL use-after-free on Android prior to 151.0.7922.109 can allow a renderer-compromised attacker to escape the sandbox via a crafted HTML page. The CVE-2026-19137 entry is corroborated by ENISA EUVD-2026-54263 and NVD/CVE records. The vulnerability affects WebGL in Chrome; root cau...

CVE-2026-5918

CVE-2026-5918 affects Google Chrome (Chromium-based); it stems from an inappropriate navigation implementation that could allow a renderer-compromised remote attacker to leak cross-origin data via a crafted HTML page. The public bulletins confirm the vulnerability in Chrome prior to 147.0.7727.55...

CVE-2020-16005

CVE-2020-16005 concerns the ANGLE component of Chromium (Chromium/Chrome) prior to the patch level 86.0.4240.183. The documented root cause is insufficient policy enforcement in ANGLE, which could allow a remote attacker to potentially trigger heap corruption via a crafted HTML page, leading to a...

CVE-2020-6552

CVE-2020-6552 is a use-after-free in Blink affecting Google Chrome prior to 84.0.4147.125. The vulnerability could allow remote heap corruption via a crafted HTML page, enabling arbitrary code execution or a crash. Debian/GLSA notes advise upgrading Chromium/Chrome to the fixed version (84.0.4147...

CVE-2021-21161

CVE-2021-21161 is a reported heap buffer overflow in the Chromium browser’s TabStrip component, fixed in versions before 89.0.4389.72 (vulnerable prior to that update). The issue allows a remote attacker to potentially cause heap corruption via a crafted HTML page. In practice, updates to Chromiu...

CVE-2021-30519

CVE-2021-30519 affects the Chromium-based Chrome/Chromium Payments component, where a use-after-free leads to heap corruption via a crafted HTML page. Versions prior to 90.0.4430.212 are vulnerable. A fix is shipped in 90.0.4430.212 (upstream) with distributors (e.g., Fedora/Arch Linux) updating ...

CVE-2021-30540

CVE-2021-30540 affects Chromium/Google Chrome components prior to version 91.0.4472.77, with an incorrect security UI in the payments flow that could allow a remote attacker to spoof the domain via a crafted HTML page. The vulnerability is documented across multiple sources (Chromium/Chrome relea...

CVE-2023-1528

The connected Astra Linux bulletin confirms CVE-2023-1528 affects Chromium-based browsers, notably Google Chrome/Chromium Passwords, with the issue being a use-after-free that could lead to heap corruption when an attacker who has compromised the renderer page crafts HTML. This allows a remote at...

CVE-2023-2929

CVE-2023-2929 describes an out-of-bounds write in Google Chrome’s SwiftShader component, enabling potential remote heap corruption via a crafted HTML page. Affected products are Google Chrome/Chromium with SwiftShader; vulnerable if using versions prior to 114.0.5735.90. The Debian advisory (DSA-...

CVE-2024-2886

The CVE-2024-2886 entry concerns a use-after-free in WebCodecs within Google Chrome, exploitable via a crafted HTML page to achieve arbitrary read/write. Affected software is Google Chrome (WebCodecs) with the vulnerable intake prior to version 123.0.6312.86. The impact is high (network attack ve...

CVE-2020-16016

CVE-2020-16016 affects Google Chrome (Chromium base) prior to 86.0.4240.193. An inappropriate implementation in base allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Documented consequences include arbitrary code e...

CVE-2020-6555

CVE-2020-6555 affects Google Chrome/Chromium WebGL. The vulnerability is an out-of-bounds read in WebGL that could allow a remote attacker to read potentially sensitive data from a process memory via a crafted page, prior to Chrome version 84.0.4147.125. Affected products include Chrome/Chromium ...

CVE-2021-21145

CVE-2021-21145: A use-after-free in the Fonts component of Chromium prior to version 88.0.4324.146. Several advisories (Debian DSA-4846-1, Arch ASA-202102-4, Alpine, Fedora, etc.) document this as a Chromium/Fonts issue that could allow a remote attacker to exploit heap corruption via a crafted H...

CVE-2021-30572

The CVE-2021-30572 entry corresponds to a use-after-free in the Chromium Autofill component before version 92.0.4515.107, allowing a remote attacker to potentially exploit heap corruption via a crafted HTML page. Connected sources corroborate the same description across multiple advisories (Astra...

CVE-2021-30602

CVE-2021-30602 describes a use-after-free in WebRTC in Google Chrome prior to 92.0.4515.159, where a crafted HTML page on a malicious site could trigger heap corruption. Affected product: Google Chrome (WebRTC component). Root cause: use-after-free leading to heap corruption. Impact: potential he...

CVE-2022-1874

This CVE affects Google Chrome on macOS. It describes Insufficient policy enforcement in Safe Browsing, allowing a remote attacker to bypass downloads protection via a crafted HTML page in versions prior to 102.0.5005.61. The issue is documented across multiple sources (Chromium/Chrome release no...

CVE-2022-2606

CVE-2022-2606 describes a use-after-free in Chrome/Chromium’s Managed devices API, allowing a remote attacker to potentially trigger heap corruption when a user enables a specific Enterprise policy and loads a crafted HTML page. Affected products are Google Chrome/Chromium prior to version 104.0....

CVE-2023-4906

Chromium/Google Chrome Autofill vulnerability CVE-2023-4906: Insufficient policy enforcement in Autofill allows bypass via a crafted HTML page. Descriptions in connected docs confirm affected components (Chromium/Chrome/ChromeOS), root cause, and low severity. Public fixes exist: Debian/Debian se...

CVE-2023-5473

CVE-2023-5473 affects Google Chrome/Chromium Cast: Use-after-free in Cast prior to 118.0.5993.70 allows a renderer-compromised remote attacker to potentially cause heap corruption via a crafted HTML page (Chromium severity: Low). Public disclosures and advisories in connected documents confirm th...

CVE-2023-5474

CVE-2023-5474 corresponds to a heap buffer overflow in PDF handling in Google Chrome/Chromium before 118.0.5993.70. A remote attacker could exploit this by convincing a user to perform specific interactions with a crafted PDF, potentially causing heap corruption. Public advisories reference Chrom...

CVE-2026-6298

CVE-2026-6298 is a heap buffer overflow in Skia used by Google Chrome prior to 147.0.7727.101. The vulnerability could allow a remote attacker to read potentially sensitive information from process memory via a crafted HTML page. The connected sources confirm the issue and its CVSS context (Chrom...

CVE-2013-2877

CVE-2013-2877 is a libxml2 out-of-bounds read vulnerability triggered by XML documents that end abruptly due to missing checks for the XML_PARSER_EOF state. It affected libxml2 up to version 2.9.0 (used in Chrome and other products) and could lead to denial of service. Remediation in the public a...

CVE-2020-15962

Chromium/Google Chrome before 85.0.4183.121 is affected by a serial policy validation insufficiency that could allow a remote attacker to cause out-of-bounds memory access via a crafted HTML page. The issue is documented as CVE-2020-15962 and is addressed by upgrading to Chromium 85.0.4183.121+ (...

CVE-2020-16004

CVE-2020-16004 affects Google Chrome/Chromium before 86.0.4240.183. The issue is a use-after-free in the user interface, leading to potential heap corruption exploitable by a remote attacker via a crafted HTML page. Multiple connected advisories confirm the same CVE and the vulnerability’s impact...

CVE-2021-21126

Chromium/Google Chrome is affected by CVE-2021-21126 due to an insufficient policy enforcement in extensions, enabling a remote attacker to bypass site isolation via a crafted extension. Affected components include the extensions subsystem of Chromium (prior to version 88.0.4324.96). The issue is...