CVE-2020-15981

CVE-2020-15981 is an information-disclosure/out-of-bounds-read issue in the audio component of Chromium/Google Chrome prior to 86.0.4240.75. The vulnerability affects Chromium-based browsers and could allow a remote attacker to read potentially sensitive memory content via a crafted HTML page. Pu...

CVE-2020-6424

CVE-2020-6424 is a use-after-free in Chrome’s media handling that could allow heap corruption via a crafted HTML page on Chrome versions prior to 80.0.3987.149. Affected: Google Chrome (desktop). Root cause: use-after-free in media code paths. Impact: remote code execution likelihood noted as hig...

CVE-2021-21178

CVE-2021-21178 refers to an inappropriate implementation in the Chromium/Google Chrome compositor on Linux and Windows, allowing a remote attacker to spoof the Omnibox via a crafted HTML page. Affected: Chromium/Chrome prior to version 89.0.4389.72. Impact: content spoofing of the URL bar. Root c...

CVE-2021-21187

CVE-2021-21187 is a Chromium/Google Chrome URL formatting vulnerability caused by insufficient data validation in the URL formatting code. It allows a remote attacker to perform domain spoofing via IDN homographs when a crafted domain name is used, with impact described as spoofing and potential ...

CVE-2021-21221

CVE-2021-21221 corresponds to an information-disclosure flaw in Chrome’s Mojo component. Description across sources states insufficient validation of untrusted input in Mojo before 90.0.4430.72, enabling a remote attacker with a compromised renderer to leak cross-origin data via a crafted HTML pa...

CVE-2023-3214

CVE-2023-3214 covers a use-after-free in Chrome/Chromium’s Autofill payments path prior to 114.0.5735.133. The vulnerability could enable heap corruption via a crafted HTML page, with high/critical impact (remote code execution possible, per the public advisories). Affected products include Googl...

CVE-2024-9964

CVE-2024-9964 : In Google Chrome/Chromium, an inappropriate implementation in Payments allows a remote attacker to trigger UI spoofing by tricking a user into certain UI gestures via a crafted Chrome Extension. Public details across connected documents confirm UI-spoofing impact for Chrome/Chromi...

CVE-2026-13874

CVE-2026-13874 describes a race in DataTransfer in Google Chrome (Chromium) prior to version 150.0.7871.47 that could allow a remote attacker to read potentially sensitive information from a process’s memory via a crafted HTML page. The issue is a data race in the DataTransfer pathway, with a net...

CVE-2020-16006

Chromium vulnerability CVE-2020-16006 concerns an inappropriate implementation in V8 prior to version 86.0.4240.183, enabling a remote attacker to potentially trigger heap corruption via a crafted HTML page. Affected software is the Chromium browser (V8 engine component). Impact is remote code ex...

CVE-2020-6558

CVE-2020-6558 affects Google Chrome on iOS (iOS WebView) prior to 85.0.4183.83. The vulnerability is due to insufficient policy enforcement in iOSWeb that allowed a remote attacker to bypass navigation restrictions with a crafted HTML page. It was fixed in the Chrome 85 stable release (85.0.4183....

CVE-2020-6561

CVE-2020-6561 affects Google Chrome (Content Security Policy implementation). The vulnerability arises from an inappropriate CSP implementation that allowed a remote attacker to leak cross-origin data via a crafted HTML page, impacting Chrome versions prior to 85.0.4183.83. According to the conne...

CVE-2020-6566

CVE-2020-6566 affects Google Chrome/Chromium prior to 85.0.4183.83, where insufficient policy enforcement in media could allow a remote attacker to leak cross-origin data via a crafted HTML page. The issue is evidenced in multiple advisories and CVE trackers, with Debian/ Fedora updates indicatin...

CVE-2021-21213

CVE-2021-21213 affects Google Chrome’s WebMIDI implementation. A use-after-free in WebMIDI prior to 90.0.4430.72 can allow a remote attacker to trigger heap corruption via a crafted HTML page, potentially leading to arbitrary code execution. Remediation: upgrade Chrome to 90.0.4430.72 or newer (a...

CVE-2022-1143

CVE-2022-1143 is a heap buffer overflow in Chrome’s WebUI, affecting Chrome before 100.0.4896.60. The issue could allow heap corruption via specific input into DevTools after user interaction, potentially enabling arbitrary code execution or other impacts described in related advisories. Public d...

CVE-2023-6112

CVE-2023-6112: Use-after-free in Navigation in Google Chrome/Chromium (

CVE-2026-12032

CVE-2026-12032 affects Google Chrome on Android (pre‑149.0.7827.115) where an inappropriate implementation in Passwords allowed a remote attacker, who had renderer access, to bypass site isolation via a crafted HTML page. The connected sources confirm the issue exists in Passwords and is tied to ...

CVE-2011-3079

CVE-2011-3079 concerns an IPC message validation weakness in Chrome’s IPC implementation (also used by Firefox prior to 38.0) that could allow sandbox escape due to insufficient authentication/validation in the listener process. Connected advisories indicate an earlier fix added authentication be...

CVE-2014-1745

CVE-2014-1745 is a use-after-free in Blink’s SVG handling (SVGFontFaceElement) that affects Google Chrome prior to 35.0.1916.114. The vulnerability arises when an SVGFontFaceElement is removed, potentially allowing a denial of service and possibly additional unspecified impacts. The core issue is...

CVE-2020-15995

CVE-2020-15995 is a vulnerability in Chromium/Google Chrome’s V8 engine, where an out-of-bounds write in V8 prior to 87.0.4280.141 could enable a remote attacker to potentially achieve heap corruption via a crafted HTML page. The issue was fixed by upgrading to Chromium version 87.0.4280.141 (or ...

CVE-2020-16002

CVE-2020-16002 is a use-after-free in PDFium leveraged via crafted PDFs in Google Chrome (before 86.0.4240.111). The vulnerability affects Chrome’s PDF rendering path (PDFium) and could allow a remote attacker to trigger heap corruption, with the potential for arbitrary impact as described in the...

CVE-2020-6538

CVE-2020-6538 affects Google Chrome WebView on Android (inappropriate WebView implementation) allowing cross-origin data leakage via a crafted HTML page. Connected sources indicate the issue was fixed in Chrome/Chromium releases around 84.0.4147.105; Debian’s advisory lists CVE-2020-6538 among up...

CVE-2021-21112

CVE-2021-21112 is a use-after-free in the Blink component of the Chromium-based Chrome stack (before 87.0.4280.141). The vulnerability allows a remote attacker to potentially trigger heap corruption via a crafted HTML page. Impact: partial confidentiality/integrity/availability degradation as des...

CVE-2021-21175

In Google Chrome, CVE-2021-21175 corresponds to an inappropriate implementation in the Site Isolation feature prior to 89.0.4389.72. The issue allows a remote attacker to leak cross-origin data through a crafted HTML page. Affected product: Google Chrome (Site Isolation). Root cause: improper imp...

CVE-2021-21186

CVE-2021-21186 refers to a policy-enforcement error in the QR scanning component of the Chromium/Chrome stack on iOS, allowing a user who is coaxed into scanning a crafted QR code to bypass navigation restrictions. Affected product: Google Chrome (iOS) with Chromium QR scan integration prior to 8...

CVE-2021-21211

CVE-2021-21211 refers to an insecure navigation implementation in Google Chrome on iOS before 90.0.4430.72, enabling a remote attacker to leak cross-origin data via a crafted HTML page. The connected sources confirm the same vulnerability description across multiple trackers (e.g., Debian securit...

CVE-2021-37962

CVE-2021-37962 is a use-after-free in Chrome’s Performance Manager before version 94.0.4606.54, enabling a remote attacker who has compromised the renderer to potentially trigger heap corruption via a crafted HTML page. The vulnerability affects Google Chrome (renderer/Performance Manager compone...

CVE-2022-3656

CVE-2022-3656 affects Google Chrome/Chromium’s File System API, with Insufficient data validation that allowed bypassing file-system restrictions via a crafted HTML page. Affected: Chrome/Chromium prior to 107.0.5304.62; impact per NVD: high (CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; base 8....

CVE-2022-4186

CVE-2022-4186 affects Google Chrome/Chromium, describing insufficient validation of untrusted input in Downloads. Prior to 108.0.5359.71, an attacker who convinces a user to install a malicious extension could bypass Download restrictions via a crafted HTML page. The CVE is labeled Medium severit...

CVE-2023-0705

Google Chrome/Chromium Core has an integer overflow vulnerability tracked as CVE-2023-0705, fixed in Chrome 110.0.5481.77 and later. A remote attacker could trigger the overflow to cause heap corruption via a crafted HTML page, requiring user interaction. Affected line items include Chrome/Chromi...

CVE-2026-12444

Chromoting in Google Chrome on Windows is affected by an out-of-bounds read vulnerability tracked as CVE-2026-12444. The issue allows a local attacker to obtain potentially sensitive information from process memory via a malicious file. The root cause is an out-of-bounds memory read in Chromoting...

CVE-2014-3152

CVE-2014-3152 affects Google V8’s ARM codegen path. An integer underflow in LCodeGen::PrepareKeyedOperand (arm/lithium-codegen-arm.cc) in V8 builds used by Chrome before 35.0.1916.114 allows remote denial of service via vectors triggering a negative key value. Public reports indicate patches were...

CVE-2020-6520

CVE-2020-6520: A heap buffer overflow in Skia used by Google Chrome prior to version 84.0.4147.89 allowed remote exploitation via a crafted HTML page (heap corruption). Multiple connected sources confirm the issue resides in Skia used by Chrome/Chromium and the fix was delivered via Chrome/Chromi...

CVE-2020-6540

CVE-2020-6540 is a buffer overflow in Skia used by Google Chrome, prior to 84.0.4147.105, allowing remote heap corruption via a crafted HTML page. The Debian security advisory DSA-4824-1 lists CVE-2020-6540 among fixed issues and recommends upgrading Chromium to at least 87.0.4280.88-0.4~deb10u1 ...

CVE-2021-21179

CVE-2021-21179 affects Google Chrome/Chromium, specifically a use-after-free in the Network Internals component on Linux prior to version 89.0.4389.72, enabling potential heap corruption via a crafted HTML page. A patch is available by upgrading to Chrome/Chromium 89.0.4389.72 or newer (see refer...

CVE-2021-21182

CVE-2021-21182 affects Google Chrome/Chromium navigations: insufficient policy enforcement in navigations allows a renderer-compromised remote attacker to bypass navigation restrictions via a crafted HTML page, for Chrome/Chromium fixes before/at 89.0.4389.72. Connected advisories (Debian Arch/DS...

CVE-2022-1138

CVE-2022-1138 affects Google Chrome (Chromium-based) before 100.0.4896.60. The vulnerability is caused by an inappropriate implementation in the Web Cursor component, which could allow a remote attacker with renderer access to obscure the Omnibox (URL bar) via a crafted HTML page. Remediation per...

CVE-2022-4908

CVE-2022-4908 refers to an inappropriate implementation in Chrome/Chromium’s iFrame Sandbox that could leak cross-origin data via a crafted HTML page. Affected product is Google Chrome (and Chromium-based components); vulnerable component/behavior is the iFrame Sandbox. The root cause is an incor...

CVE-2023-1213

CVE-2023-1213 describes a use-after-free in SwiftShader within Google Chrome/Chromium before 111.0.5563.64, allowing a remote attacker to potentially cause heap corruption via a crafted HTML page. The issue has high severity (CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Affected component is C...

CVE-2023-3420

CVE-2023-3420 describes a Type Confusion in V8 affecting Google Chrome/Chromium before 114.0.5735.198, allowing a remote attacker to trigger heap corruption via a crafted HTML page. Affected downstream advisories/coordination reference Chromium fixes prior to 114.0.5735.198 (e.g., Debian DSA-5440...

CVE-2026-14013

CVE-2026-14013 affects Google Chrome before version 150.0.7871.47, due to an inappropriate SVG implementation that enables UI spoofing via a crafted HTML page. The issue is documented across multiple feeds (NVD, Debian OSV, EUVD) with a Medium severity. The connected references indicate a patch/r...

CVE-2019-13675

CVE-2019-13675 affects Google Chrome/Chromium: insufficient data validation in the extensions subsystem allows a remote attacker to disable extensions via a crafted HTML page. Publicly cited in Debian/Fedora advisories, with fixes implemented in Chromium/Chrome 78.x (as seen in Fedora/security ad...

CVE-2019-13678

CVE-2019-13678 affects Chromium/Google Chrome download-dialog spoofing. Root cause relates to incorrect data validation in the download dialog, enabling domain spoofing via crafted HTML. Debian advisories indicate remediation by upgrading Chromium to 78.0.3904.97-1~deb10u1 (and newer), with other...

CVE-2019-5760

CVE-2019-5760 affects Google Chrome’s WebRTC implementation. Insufficient pointer validation could lead to heap corruption via a crafted HTML page, enabling remote exploitation. The fix is available in Chrome updates from 72.0.3626.81 onward.

CVE-2020-15985

Technical details about CVE-2020-15985 are not publicly provided in the supplied documents. Monitor for updates in connected advisories and CVE trackers as additional details may emerge.

CVE-2020-15987

CVE-2020-15987 is a use-after-free in the WebRTC component of Chromium/Google Chrome prior to 86.0.4240.75. This vulnerability could allow a remote attacker to potentially cause heap corruption via a crafted WebRTC stream, leading to arbitrary code execution as described in connected advisories. ...

CVE-2020-16039

CVE-2020-16039 is a use-after-free vulnerability in Chromium’s extensions component, fixed in Chromium versions before 87.0.4280.88 and addressed by upgrading to 87.0.4280.88 or newer per Debian/Arch Linux advisories. Affected product: Chromium browser (extensions module). Root cause: use-after-f...

CVE-2021-21165

CVE-2021-21165: Data indicates a heap/object lifecycle issue in Chrome/Chromium audio paths before 89.0.4389.72, enabling potential remote arbitrary code execution. The Astra/Audit/Debian entries confirm an audio component flaw in Chromium with the same version bound. Affected product: Chromium b...

CVE-2021-21167

CVE-2021-21167 affects Google Chrome prior to 89.0.4389.72, with a use-after-free in the bookmarks component that can lead to heap corruption via a crafted HTML page. Affected software is the Chromium-based browser (Chrome); root cause is a use-after-free condition in bookmarks. Impact stated: re...

CVE-2021-30590

CVE-2021-30590 is a heap buffer overflow in the Bookmarks component of the Chromium-based browser engine before version 92.0.4515.131. The disclosed impact across connected records states potential remote code execution or heap corruption via crafted HTML pages, affecting Chrome/Chromium-derived ...

CVE-2021-30594

CVE-2021-30594 affects Chromium-derived browsers (Page Info UI) with a use-after-free in the Page Info UI component before version 92.0.4515.131. The issue is described in connected advisories as a Chromium engine vulnerability that could allow heap-type corruption via crafted interactions, with ...