CVE-2020-6539

CVE-2020-6539 refers to a use-after-free in CSS handling in Google Chrome prior to 84.0.4147.105, enabling potential remote code execution via a crafted HTML page. The vulnerability affects Chrome’s CSS engine and could allow heap corruption leading to arbitrary code execution, with impact descri...

CVE-2020-6549

CVE-2020-6549 : Use-after-free in Chrome’s media subsystem (pre-84.0.4147.125) can allow a remote attacker to exploit heap corruption via a crafted HTML page. Affected: Google Chrome (media component). Root cause: use-after-free. Impact per sources: arbitrary code execution, information disclosur...

CVE-2021-21113

CVE-2021-21113 refers to a heap buffer overflow in the Skia component of the Chromium-based Chromium/Google Chrome stack, reported as affecting versions before 87.0.4280.141. The vulnerability can allow a remote attacker to potentially cause heap corruption through a crafted HTML page. The connec...

CVE-2021-30524

CVE-2021-30524 is a use-after-free vulnerability in the Chromium browser’s TabStrip component, reported before 91.0.4472.77. The issue, exploited via crafted HTML pages, could allow a remote attacker to potentially execute arbitrary code when a user is persuaded to install a malicious extension. ...

CVE-2021-30567

CVE-2021-30567 is a use-after-free in Chromium’s DevTools before 92.0.4515.107. It can allow heap corruption via a specific user gesture after convincing a user to open DevTools. Affected software is Chromium/Chrome (DevTools component). Impact: potential remote code execution or instability as d...

CVE-2023-0931

CVE-2023-0931 is a confirmed use-after-free in Video handling of Google Chrome/Chromium before 110.0.5481.177, exploitable via a crafted HTML page to potentially cause heap corruption. Affected component: Video (Chromium rendering/Media pipeline). Root cause: use-after-free in Video path, enablin...

CVE-2023-2466

CVE-2023-2466 describes an Inappropriate implementation in Prompts in Google Chrome (Chromium) prior to 113.0.5672.63 that allows a remote attacker to spoof the contents of the security UI via a crafted HTML page. Connected sources confirm Chromium/Chrome prompt-related weaknesses with this CVE a...

CVE-2023-2936

CVE-2023-2936 is a Type Confusion in Google Chrome’s V8 engine affecting Chrome prior to 114.0.5735.90, enabling remote heap corruption via a crafted HTML page. Public docs confirm Chrome/Chromium fixes and patched versions (e.g., Chromium 114.0.5735.90 and Debian/FreeBSD advisories). Remediation...

CVE-2026-15899

The CVE-2026-15899 entry relates to Google Chrome on macOS before version 150.0.7871.128, where a use-after-free in CameraCapture could allow a remote attacker to escape the Chromium sandbox via a crafted HTML page (CRITICAL impact). The connected EUVD entry confirms the same issue. No publicly d...

CVE-2026-17650

CVE-2026-17650 affects Google Chrome (Chromium-based) prior to 151.0.7922.72. Description: Use-after-free in Compositing could allow a remote attacker who has compromised the renderer process to potentially escape the sandbox via a crafted HTML page. Affected component: Compositing in Chrome. Roo...

CVE-2026-76041

An information disclosure flaw in the Skia graphics library in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to bypass the web origin policy via a crafted HTML page. Chromium rated this High severity; CVSS 3.1 base score 4.3 (MEDIUM). No public exploit code is referenced. The fi...

CVE-2020-16037

CVE-2020-16037 affects the Chromium/Chrome browser prior to version 87.0.4280.88, with a use-after-free in the clipboard component. The vulnerability, described in connected advisories, can allow a remote attacker to potentially execute arbitrary code via a crafted HTML page, due to heap corrupti...

CVE-2020-6548

CVE-2020-6548: Heap buffer overflow in Skia within Google Chrome prior to 84.0.4147.125. A remote attacker who gains control of the renderer process could exploit heap corruption via a crafted HTML page. Affected product: Chrome/Chromium with Skia integration. Impact: potential arbitrary code exe...

CVE-2021-21129

CVE-2021-21129 describes a policy-enforcement vulnerability in Chromium’s File System API, prior to version 88.0.4324.96, enabling a remote attacker to bypass filesystem restrictions via a crafted HTML page. Root cause: insufficient policy enforcement in the File System API. Impact stated by sour...

CVE-2021-30568

CVE-2021-30568 corresponds to a heap buffer overflow in WebGL within the Chromium-based Chromium/Chrome engine, affecting versions prior to 92.0.4515.107. The vulnerability is triggered by processing a crafted HTML page and could enable remote code execution through heap corruption. The Astra Lin...

CVE-2021-30598

CVE-2021-30598 — normal mode Affected software: Google Chrome (V8 engine). The connected documents confirm a type confusion vulnerability in V8 prior to Chrome version 92.0.4515.159. What is vulnerable: the V8 JavaScript engine implementation in Chrome contains a type confusion flaw that can be t...

CVE-2021-30601

CVE-2021-30601: A use-after-free in Chrome’s Extensions API affects Google Chrome versions prior to 92.0.4515.159. An attacker convincing a user to install a malicious extension could potentially exploited heap corruption via a crafted HTML page. Affected component: Chrome Extensions API; root ca...

CVE-2023-1214

CVE-2023-1214 affects Chromium/Google Chrome prior to 111.0.5563.64, due to a V8 type confusion that could enable remote heap corruption via a crafted HTML page. The connected Astra Linux bulletin confirms the same description and identifies the vulnerable line of Chromium prior to the 111.0.5563...

CVE-2023-1533

CVE-2023-1533 corresponds to a use-after-free in WebProtect within Google Chrome before version 111.0.5563.110, leading to potential heap corruption via a crafted HTML page. Multiple sources (Chromium-derived advisories and Astra Linux bulletin) confirm the issue affects Chrome/Chromium component...

CVE-2024-1939

CVE-2024-1939 affects Google Chrome's V8 engine (prior to Chrome 122.0.6261.94). It describes a Type Confusion in V8 that can lead to heap corruption via a crafted HTML page, potentially enabling remote code execution. The connected exploit content attributes the root cause to wasmS128 handling a...

CVE-2020-15966

CVE-2020-15966 refers to Google Chrome where insufficient policy enforcement in extensions prior to 85.0.4183.121 could allow a user-driven attacker to obtain potentially sensitive information by convincing a user to install a malicious extension. Public disclosures in Debian/Arch/Fedora security...

CVE-2020-15967

CVE-2020-15967 affects Chromium/Google Chrome prior to 86.0.4240.75, with a use-after-free in the payments component that could potentially lead to remote code execution and sandbox escape. Debian/FreeBSD/Arch Fedora advisories confirm the issue and provide a fixed version: 86.0.4240.75 (or newer...

CVE-2020-15971

CVE-2020-15971 is a use-after-free in the printing component of Chromium/Google Chrome before 86.0.4240.75. A remote attacker who has compromised the renderer could potentially escape the sandbox via a crafted HTML page, as described in multiple sources (Debian/Arch/FreeBSD summaries). Public dis...

CVE-2020-15974

CVE-2020-15974 is an integer overflow in Blink affecting Chromium/Google Chrome prior to 86.0.4240.75, potentially enabling arbitrary code execution or site‑isolation bypass as described in the linked Debian advisory. Debian notes a broader patch set and fixes in 87.0.4280.88-0.4~deb10u1 for Chro...

CVE-2020-15991

CVE-2020-15991: Use-after-free in the password manager of Chromium/Google Chrome before 86.0.4240.75 allows a remote attacker who can render HTML in the renderer to potentially escape the sandbox. The Debian/Fedora/Arch security advisories and FreeBSD/vuxml entries confirm this vulnerability and ...

CVE-2020-6557

CVE-2020-6557 affects Chromium prior to 86.0.4240.75. The vulnerability arises from an inappropriate implementation in the networking component, enabling domain spoofing via a crafted HTML page. Public documents in connected sources confirm the issue and recommend upgrading Chromium to 86.0.4240....

CVE-2020-6569

CVE-2020-6569 is an integer overflow in WebUSB in Google Chrome/Chromium prior to 85.0.4183.83. The vulnerability could allow a remote attacker who has compromised the renderer process to potentially cause heap corruption via a crafted HTML page. Public advisories in the connected set (e.g., Debi...

CVE-2021-21155

CVE-2021-21155 is a heap buffer overflow in the Tab Strip component of the Chromium-based Chrome/Chromium browser for Windows, before build 88.0.4324.182. The issue arises when a crafted HTML page is loaded, with a compromised renderer process potentially enabling a sandbox escape. The connected ...

CVE-2022-2479

CVE-2022-2479 affects Google Chrome/Chromium, with insufficient validation of untrusted input in a file-context on Android before version 103.0.5060.134. An attacker could entice a user to install a malicious app and, via a crafted HTML page, read potentially sensitive information from internal f...

CVE-2022-3885

CVE-2022-3885 is a Use-after-free in V8 affecting Google Chrome prior to 107.0.5304.106 that could allow remote heap corruption via a crafted HTML page. The issue is confirmed in multiple trusted sources (Chromium/Chrome advisories and Astra Linux bulletin) and is tracked in Debian as fixed in Ch...

CVE-2023-2312

CVE-2023-2312 is a Use-after-free in Chrome/Chromium’s Offline component affecting Google Chrome (and Chromium-based browsers) on Android, prior to version 116.0.5845.96. The issue could allow a remote attacker who has already compromised the renderer process to trigger heap corruption via a craf...

CVE-2020-15960

CVE-2020-15960 refers to an information-disclosure vulnerability in Chromium/Google Chrome prior to 85.0.4183.121. The 15960 issue is an out-of-bounds read in the storage component, exploitable via a crafted HTML page. The Debian/Arch/Gentoo entries corroborate the fix was to upgrade to 85.0.4183...

CVE-2020-15968

CVE-2020-15968 is a use-after-free in Blink (Chromium) prior to 86.0.4240.75, contributing to arbitrary code execution via a crafted page. The connected Arch Linux advisory (ASA-202010-1) specifies this as a remote issue in chromium before 86.0.4240.75-1 and notes the fix as upstream in 86.0.4240...

CVE-2020-15977

The CVE entry CVE-2020-15977 describes an insufficient data validation issue in the dialogs component of the Chromium browser prior to 86.0.4240.75, enabling a remote attacker to potentially disclose data from disk via a crafted HTML page. Connected advisories (e.g., Arch Linux ASA-202010-1) enum...

CVE-2020-15989

CVE-2020-15989 affects the PDFium component in Chromium/Google Chrome, where uninitialized data could allow a crafted PDF file to disclose potentially sensitive information from process memory. This vulnerability is tied to the Chromium baseline before 86.0.4240.75 (reported in multiple advisorie...

CVE-2020-6541

The CVE-2020-6541 entry concerns a Use-after-free in WebUSB in Google Chrome prior to version 84.0.4147.105 . The underlying issue could allow a remote attacker to potentially exploit a heap corruption via a crafted HTML page. Affected software is Chrome’s WebUSB component; exploitability is desc...

CVE-2021-21174

CVE-2021-21174 is an implementation error in the Referrer policy handling in Chromium/Google Chrome before 89.0.4389.72, allowing a remote attacker to bypass navigation restrictions via a crafted HTML page. Affected product: Chromium/Chrome (referrer policy component). Root cause: inappropriate/r...

CVE-2021-30599

Affected software: Google Chrome (V8 engine). The CVE-2021-30599 entry describes a type confusion in V8 that allowed remote code execution inside the sandbox via a crafted HTML page, for Chrome versions prior to 92.0.4515.159. The issue originates from the V8 type confusion and impacts the sandbo...

CVE-2022-1307

CVE-2022-1307 affects Google Chrome/Chromium components implementing full screen in Chrome/Chromium (Android and desktop variants). The publicly available description states an inappropriate full-screen implementation allowed a remote attacker to spoof the Omnibox (URL bar) via a crafted HTML pag...

CVE-2023-0132

CVE-2023-0132 affects Google Chrome/Chromium. The issue is an inappropriate implementation in permission prompts that allowed a remote attacker to force acceptance of a permission prompt via a crafted HTML page. Affected versions include Chrome/Chromium on Windows prior to 109.0.5414.74. The requ...

CVE-2023-0135

Summary of CVE-2023-0135 (Google Chrome/Chromium) : A use-after-free in the Cart component of Google Chrome prior to 109.0.5414.74 allowed an attacker—if a user was convinced to install a malicious extension—to potentially trigger heap corruption via database corruption and a crafted HTML page. T...

CVE-2023-0140

CVE-2023-0140 describes an incorrect File System API implementation in Google Chrome on Windows prior to 109.0.5414.74, which allowed a remote attacker to bypass file system restrictions via a crafted HTML page. The issue affects Chrome’s Chromium-based File System API behavior and is listed as L...

CVE-2026-13950

CVE-2026-13950 affects Google Chrome (GPU component) with an uninitialized use in GPU that could allow a remote attacker who already compromised the renderer process to read potentially sensitive data from process memory via a crafted HTML page. Affected version range is Chrome before 150.0.7871....

CVE-2026-9116

CVE-2026-9116: In Google Chrome, insufficient policy enforcement in ServiceWorker before version 148.0.7778.179 allows a remote attacker to leak cross-origin data via a crafted HTML page. Affects Chrome’s ServiceWorker component; impact stated as Confidentiality impact (partial) with a CVSS v3.1 ...

CVE-2021-21154

CVE-2021-21154 describes a heap buffer overflow in the Chromium/Chrome Tab Strip component before 88.0.4324.182. A remote attacker who already has renderer access could potentially trigger a sandbox escape via a crafted HTML page. Affected product/variant: Google Chrome/Chromium (Tab Strip codepa...

CVE-2021-21162

CVE-2021-21162: Use-after-free in Chromium’s WebRTC before 89.0.4389.72. Affects the WebRTC component; root cause is a use-after-free leading to potential heap corruption exploitable by a crafted HTML page. Exploitation status not detailed in the provided docs beyond the CVE entry. Remediation: u...

CVE-2021-21168

CVE-2021-21168 describes a policy-enforcement vulnerability in Chrome’s appcache: a remote attacker could exfiltrate potentially sensitive memory from a crafted HTML page. Affected: Chrome before 89.0.4389.72. Remediation: update to a version containing the fix (Debian notes 89.0.4389.114-1 for t...

CVE-2021-21176

CVE-2021-21176 is an issue in Chromium/Google Chrome’s full screen mode where an inadequate implementation allowed a remote attacker to spoof the Omnibox (URL bar) via a crafted HTML page. Affected products include Chrome/Chromium prior to version 89.0.4389.72 across multiple advisories; the root...

CVE-2021-30577

CVE-2021-30577 affects Google Chrome’s Installer component; prior to 92.0.4515.107 there is insufficient policy enforcement, enabling a remote attacker to escalate to local privileges via a crafted file. Remediation: upgrade to 92.0.4515.107 or newer. Exploitation status is not provided in the do...

CVE-2021-37984

CVE-2021-37984: A heap buffer overflow in PDFium within Chromium/Chrome (before 95.0.4638.54). Affected: Google Chrome and Chromium-based browsers; vulnerability arises from PDFium aging, enabling potential remote heap corruption via crafted HTML. Remediation: update to Chrome/Chromium 95.0.4638....