CVE-2021-30589

CVE-2021-30589 affects Chromium’s Sharing component in Google Chrome/Chromium prior to 92.0.4515.107, due to insufficient validation of untrusted input. This could allow a remote attacker to bypass navigation restrictions via a crafted click-to-call link. Affected: Chromium before 92.0.4515.107. ...

CVE-2021-30602

CVE-2021-30602 describes a use-after-free in WebRTC in Google Chrome prior to 92.0.4515.159, where a crafted HTML page on a malicious site could trigger heap corruption. Affected product: Google Chrome (WebRTC component). Root cause: use-after-free leading to heap corruption. Impact: potential he...

CVE-2023-4350

CVE-2023-4350 is an issue in Chromium-based Chrome on Android involving an inappropriate implementation in Fullscreen that could allow a remote attacker to spoof the Omnibox (URL bar) via a crafted HTML page. The vulnerability originates from the Fullscreen implementation and affects Android buil...

CVE-2023-4352

CVE-2023-4352 is a Type Confusion in V8 affecting Google Chrome and other Chromium-based browsers prior to 116.0.5845.96, enabling potential heap corruption via a crafted HTML page. The CVE is rated High (8.8) with network attack vector, low complexity, requiring user interaction, and impacts to ...

CVE-2023-4906

Chromium/Google Chrome Autofill vulnerability CVE-2023-4906: Insufficient policy enforcement in Autofill allows bypass via a crafted HTML page. Descriptions in connected docs confirm affected components (Chromium/Chrome/ChromeOS), root cause, and low severity. Public fixes exist: Debian/Debian se...

CVE-2026-14127

CVE-2026-14127 involves an inappropriate implementation in Chrome’s printing flow prior to 150.0.7871.47. A remote attacker who already had code execution in the renderer could trigger UI spoofing via a crafted HTML page. Affected product is Google Chrome (Chromium-based); impact described as low...

CVE-2020-6506

CVE-2020-6506 affects Android WebView used by Google Chrome on Android, due to insufficient policy enforcement in WebView that allows bypassing site isolation via a crafted HTML page. The issue is categorized as a policy enforcement error in WebView, impacting the ability to enforce cross-origin/...

CVE-2023-0130

CVE-2023-0130 refers to an Inappropriate implementation in the Fullscreen API in Google Chrome/Chromium. The vulnerability could allow a remote attacker to spoof the Omnibox (URL bar) via a crafted HTML page. The issue is documented as affecting Chrome/Chromium and was addressed in Chrome 109.0.5...

CVE-2023-5473

CVE-2023-5473 affects Google Chrome/Chromium Cast: Use-after-free in Cast prior to 118.0.5993.70 allows a renderer-compromised remote attacker to potentially cause heap corruption via a crafted HTML page (Chromium severity: Low). Public disclosures and advisories in connected documents confirm th...

CVE-2023-5474

CVE-2023-5474 corresponds to a heap buffer overflow in PDF handling in Google Chrome/Chromium before 118.0.5993.70. A remote attacker could exploit this by convincing a user to perform specific interactions with a crafted PDF, potentially causing heap corruption. Public advisories reference Chrom...

CVE-2019-5849

CVE-2019-5849 is described in the connected sources as an out-of-bounds read in the Skia graphics library in Google Chrome prior to 75.0.3770.80, enabling a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Affected product: Google Chrome (Sk...

CVE-2020-15990

CVE-2020-15990 affects Chromium/Google Chrome: a use-after-free in the autofill component prior to 86.0.4240.75 can allow a remote attacker, via a crafted HTML page loaded in a compromised renderer, to potentially escape the sandbox and execute arbitrary code. Public reports in Debian/Arch/Linux ...

CVE-2020-6545

CVE-2020-6545 describes a use-after-free in Chrome’s audio pipeline that could allow remote code execution via a crafted HTML page, due to heap corruption in affected builds up to 84.0.4147.125. Debian and Debian-tracker entries confirm the issue and fix version (84.0.4147.125) was released; mult...

CVE-2021-21137

CVE-2021-21137 concerns an incorrect calculation issue in the DevTools component of Chromium prior to 88.0.4324.96. The core vulnerability is an inappropriate implementation in DevTools that could allow a remote attacker to obtain potentially sensitive information from disk via a crafted HTML pag...

CVE-2021-21141

CVE-2021-21141 affects Chromium-based browsers (Chrome/Chromium) up to version 88.0.4324.96, due to insufficient policy enforcement in the File System API. This allows a remote attacker to bypass the file-extension policy via a crafted HTML page. The issue is mitigated by upgrading to 88.0.4324.9...

CVE-2021-30581

CVE-2021-30581 is a use-after-free in DevTools of the Chromium browser engine prior to version 92.0.4515.107 . The issue, observed in the Chromium DevTools component, can be triggered by a crafted HTML page and a user-provided malicious extension, with the potential for remote code execution or c...

CVE-2022-0979

CVE-2022-0979 affects Google Chrome on Android (before 99.0.4844.74). The issue is a use-after-free in Safe Browsing that can lead to heap corruption when a user is prompted to interact with a crafted HTML page. Affected product: Chrome for Android; root cause: use-after-free in Safe Browsing; po...

CVE-2022-4189

CVE-2022-4189 relates to Google Chrome/Chromium: Insufficient policy enforcement in DevTools that could let a user who installs a malicious extension bypass navigation restrictions via a crafted Chrome Extension. The issue is documented with a Medium severity (CVSS v3.1 base score 4.3) and is add...

CVE-2023-0941

CVE-2023-0941 is referenced in connected Astra Linux security notes as a Use-after-free in Prompts vulnerability affecting Google Chrome/Chromium before version 110.0.5481.177 . The issue could enable a remote attacker to potentially cause heap corruption via a crafted HTML page (Chromium securit...

CVE-2023-1220

The CVE-2023-1220 entry is confirmed to be a heap buffer overflow in UMA within Google Chrome (Chromium) prior to 111.0.5563.64. The vulnerability could be triggered by a remote attacker who has compromised the renderer process through a crafted HTML page, potentially causing heap corruption. Con...

CVE-2023-1810

CVE-2023-1810 corresponds to a heap buffer overflow in Visuals of Google Chrome/Chromium before 112.0.5615.49. The issue allows a remote attacker who has compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. Severity is High (CVSS v3.1 base score 8.8). A...

CVE-2024-9958

CVE-2024-9958 affects Google Chrome/Chromium Picture-in-Picture: an inappropriate implementation allows UI spoofing via a crafted HTML page. The issue is addressed in Chromium/Chrome with version 130.0.6723.58 (and related ChromeOS updates); Debian advisories confirm a fix in chromium 130.0.6723....

CVE-2025-2135

CVE-2025-2135 corresponds to a Type Confusion in V8 used by Google Chrome, prior to 134.0.6998.88, that could lead to heap corruption via a crafted HTML page. Public materials in connected documents corroborate Chrome’s vulnerability class and Chrome version discussed in Chrome’s security updates...

CVE-2026-12027

The CVE-2026-12027 entry corresponds to an insecure/incorrect implementation in Google Chrome’s Headless mode prior to 149.0.7827.115, where a renderer-compromised page could trigger a sandbox escape through a crafted HTML page. Affected software is Chrome/Chromium Headless; root cause is an inap...

CVE-2026-14129

The CVE-2026-14129 entry concerns Google Chrome on Android. An inappropriate implementation in the PreviewTab component allows a remote attacker to perform UI spoofing through a crafted HTML page after convincing the user to perform specific UI gestures. The issue is fixed in Chrome/Chromium upda...

CVE-2026-9115

CVE-2026-9115 : In Google Chrome, the Service Worker policy enforcement is insufficient prior to 148.0.7778.179, permitting a remote attacker to bypass the same-origin policy via a crafted HTML page. Affected: Chrome/Chromium's Service Worker. Impact is a potential cross-origin bypass as describe...

CVE-2020-6427

CVE-2020-6427 is a use-after-free in Google Chrome’s audio subsystem that could allow a remote attacker to exploit heap corruption via a crafted HTML page. Affected: Google Chrome (audio path); vulnerability type: use-after-free. Impact: potential remote code execution is described in affected ad...

CVE-2020-6543

CVE-2020-6543 affects Google Chrome/Chromium and is a use-after-free in the task scheduling path that could allow a remote attacker to abuse heap corruption via a crafted HTML page. The vulnerability is described as potentially enabling remote code execution with network attack surface and requir...

CVE-2020-6556

CVE-2020-6556 describes a heap buffer overflow in the SwiftShader component of Google Chrome/Chromium prior to version 84.0.4147.135, enabling remote exploitation of heap corruption via a crafted HTML page. The issue affects the SwiftShader path in Chrome/Chromium and could lead to arbitrary code...

CVE-2020-6560

CVE-2020-6560 concerns Google Chrome’s autofill: insufficient policy enforcement before version 85.0.4183.83 can allow a remote attacker to leak cross-origin data via a crafted HTML page. The affected component is autofill policy enforcement in Chrome; root cause is improper policy checks that ex...

CVE-2021-30526

CVE-2021-30526 describes an out-of-bounds write in the Chromium project’s TabStrip component, affecting Google Chrome and Chromium builds prior to version 91.0.4472.77. An attacker could persuade a user to install a crafted malicious extension via a specially crafted HTML page, triggering an out-...

CVE-2022-3201

CVE-2022-3201 affects Google Chrome/DevTools on ChromeOS with insufficient input validation in DevTools prior to 105.0.5195.125, enabling a crafted HTML page via a user-instigated malicious extension to bypass navigation restrictions. The issue is tied to Chrome/Chromium DevTools input handling a...

CVE-2017-5029

CVE-2017-5029 affects libxslt 1.1.29 and is used by Blink/Chrome. The issue is an integer overflow in xsltAddTextString during a size calculation, enabling a remote attacker to cause an out-of-bounds memory write via a crafted HTML page. Connected records corroborate the libxslt involvement and i...

CVE-2019-13766

CVE-2019-13766_affects_Google_Chrome: Use-after-free in accessibility leads to potential heap corruption via a crafted HTML page. Affected software: Google Chrome prior to 77.0.3865.75. Root cause: use-after-free in accessibility code path. Impact: remote attacker could exploit heap corruption on...

CVE-2020-15964

CVE-2020-15964 is a Chrome/Chromium vulnerability affecting the media component (V8) with a pre-85.0.4183.121 build. The issue is described as an out-of-bounds write in V8 that could enable remote arbitrary code execution, tied to heap corruption in crafted HTML pages. Multiple connected advisori...

CVE-2020-6559

CVE-2020-6559 is a Use-After-Free in Chrome/Chromium’s Presentation API (heap corruption) that could be exploited remotely via a crafted HTML page. Affected products are Google Chrome/Chromium prior to version 85.0.4183.83. Mitigation from the connected documents shows upgrading to 85.0.4183.83 o...

CVE-2021-21181

CVE-2021-21181 is a side-channel information leakage vulnerability in Chrome Autofill. The connected Debian security advisories confirm this CVE among a chromium set and state that fixes are available in Chrome 89.x (mitigated in Debian packages as 89.0.4389.114 and later). The Astra Linux bullet...

CVE-2021-30514

The CVE-2021-30514 entry maps to a concrete Chromium flaw: a use-after-free in Autofill prior to version 90.0.4430.212, enabling a remote attacker who can render pages to potentially trigger heap corruption. Affected software is the Chromium browser (Chromium project; Chrome builds align with Chr...

CVE-2021-30579

CVE-2021-30579 is a use-after-free vulnerability in the Chromium-based UI framework of Google Chrome prior to 92.0.4515.107. The issue could allow a remote attacker to trigger heap corruption via a crafted HTML page, with the impact described as remote code execution and potential content spoofin...

CVE-2023-2932

CVE-2023-2932 is a use-after-free in the Chrome/Chromium PDF component, allowing heap corruption via a crafted PDF. Affected: Google Chrome (pre-114.0.5735.90) and Chromium-based builds. Root cause: use-after-free in PDF handling. Impact: high (as per CVE severity and CVSS). Remediation: upgrade ...

CVE-2019-5780

The CVE-2019-5780 entry refers to Google Chrome on macOS with insufficient restrictions on Apple Events before Chrome 72.0.3626.81, allowing a local attacker to execute JavaScript via Apple Events. Affects Chrome versions prior to the 72.0.3626.81 update. Root cause: insufficient restriction of A...

CVE-2020-15970

CVE-2020-15970 is a Use-after-free in the NFC component of the Chromium/Google Chrome browser before 86.0.4240.75. Public sources in Debian/Arch/Fedora/FreeBSD describe it as a remote issue where an attacker who can cause renderer compromise could potentially escape the sandbox via a crafted HTML...

CVE-2020-6383

CVE-2020-6383 is a type confusion in Google Chrome's V8 engine that could allow a remote attacker to cause heap corruption via a crafted HTML page. The initial entry notes Chrome versions prior to 80.0.3987.116 were affected. The connected Chrome update (Stable Channel Update for Desktop) confirm...

CVE-2020-6432

CVE-2020-6432 : Affected software is Chromium/Google Chrome prior to 81.0.4044.92. Description: an insufficient policy enforcement in navigations vulnerability could allow a remote attacker to bypass navigation restrictions via a crafted HTML page. Impact per documents: potential bypass of naviga...

CVE-2020-6509

CVE-2020-6509 affects Chromium/Google Chrome before 83.0.4103.116, with a use-after-free in the extensions component. The issue enables a remote attacker to potentially execute arbitrary code (sandbox escape) when a user is convinced to install a crafted malicious extension. Multiple connected ad...

CVE-2020-6518

CVE-2020-6518: Use-after-free in Google Chrome’s developer tools prior to 84.0.4147.89, enabling a remote attacker who entices a user to use devtools to potentially trigger heap corruption via a crafted HTML page. Affected product: Google Chrome (Developer Tools). Root cause: use-after-free in de...

CVE-2020-6539

CVE-2020-6539 refers to a use-after-free in CSS handling in Google Chrome prior to 84.0.4147.105, enabling potential remote code execution via a crafted HTML page. The vulnerability affects Chrome’s CSS engine and could allow heap corruption leading to arbitrary code execution, with impact descri...

CVE-2021-21113

CVE-2021-21113 refers to a heap buffer overflow in the Skia component of the Chromium-based Chromium/Google Chrome stack, reported as affecting versions before 87.0.4280.141. The vulnerability can allow a remote attacker to potentially cause heap corruption through a crafted HTML page. The connec...

CVE-2021-30524

CVE-2021-30524 is a use-after-free vulnerability in the Chromium browser’s TabStrip component, reported before 91.0.4472.77. The issue, exploited via crafted HTML pages, could allow a remote attacker to potentially execute arbitrary code when a user is persuaded to install a malicious extension. ...

CVE-2021-30567

CVE-2021-30567 is a use-after-free in Chromium’s DevTools before 92.0.4515.107. It can allow heap corruption via a specific user gesture after convincing a user to open DevTools. Affected software is Chromium/Chrome (DevTools component). Impact: potential remote code execution or instability as d...