CVE-2021-30594

CVE-2021-30594 affects Chromium-derived browsers (Page Info UI) with a use-after-free in the Page Info UI component before version 92.0.4515.131. The issue is described in connected advisories as a Chromium engine vulnerability that could allow heap-type corruption via crafted interactions, with ...

CVE-2021-30603

CVE-2021-30603 concerns a data race in WebAudio for Google Chrome. The vulnerability is triggered in Chrome versions prior to 92.0.4515.159 via a crafted HTML page, potentially enabling heap corruption on a remote attacker. Affected component is WebAudio within Chrome’s rendering stack; root caus...

CVE-2022-0980

CVE-2022-0980 describes a use-after-free vulnerability in Google Chrome’s New Tab Page, exploitable when a user is convinced to install a malicious extension, potentially enabling heap corruption through specific interactions. The issue affects Chrome prior to 99.0.4844.74; Google’s Stable Channe...

CVE-2022-2478

CVE-2022-2478 is a Google Chrome vulnerability (Use-after-free in PDF handling) that allows a remote attacker to potentially cause heap corruption via a crafted HTML page. The issue affects Chrome prior to 103.0.5060.134; exploitation aligns with a network attack vector and requires user interact...

CVE-2023-5997

The CVE-2023-5997 entry corresponds to a Use-After-Free in the Garbage Collection of Google Chrome/Chromium prior to 119.0.6045.159, enabling a remote attacker to potentially corrupt the heap through a crafted HTML page. Affected software includes Chromium-based browsers (Chrome) with fixes shipp...

CVE-2020-16000

CVE-2020-16000 refers to an Inappropriate implementation in Blink in Google Chrome before 86.0.4240.111, enabling remote exploitation via a crafted HTML page that could lead to heap corruption. Affected component: Blink in Chrome; root cause: inappropriate implementation in Blink; impact: potenti...

CVE-2020-6517

CVE-2020-6517 : The connected documents confirm a heap buffer overflow in Chrome’s history handling, exploited via a crafted HTML page, affecting Chrome prior to 84.0.4147.89. The issue is listed among Chrome’s 2020 security fixes and was addressed in the Chrome 84 stable update (84.0.4147.89) fo...

CVE-2020-6562

CVE-2020-6562 affects Blink in Google Chrome; root cause is insufficient policy enforcement. A crafted HTML page could leak cross-origin data. Affected: Chrome before 85.0.4183.83. Fix: update to 85.0.4183.83 or newer (as per connected advisories).

CVE-2022-0797

The CVE-2022-0797 entry describes an out-of-bounds memory access/write in Chrome’s Mojo component before version 99.0.4844.51. A remote attacker could trigger this via a crafted HTML page, leading to arbitrary code execution or a crash. Connected sources consistently reference Chrome Mojo as the ...

CVE-2022-1131

CVE-2022-1131 is a security issue in Google Chrome's Cast UI . It is a Use-after-Free vulnerability that could enable heap corruption and potentially arbitrary code execution when a crafted HTML page is loaded. This CVE was addressed in Chrome 100.0.4896.60 (and later) as part of the March 2022 s...

CVE-2022-1856

CVE-2022-1856: Use-after-free in Google Chrome's User Education component prior to 102.0.5005.61 allows heap corruption via a crafted Chrome Extension or specific user interaction after social engineering to install a malicious extension. Affected: Google Chrome (User Education). Root cause: use-...

CVE-2026-14063

The CVE-2026-14063 entry describes an out-of-bounds read in Chromecast within Google Chrome prior to 150.0.7871.47. The issue allows a local attacker to obtain potentially sensitive information from process memory via malicious network traffic. The documented impact is information disclosure with...

CVE-2026-15130

CVE-2026-15130 affects Google Chrome navigation policy enforcement. The vulnerability arises from insufficient policy enforcement in Navigation, enabling a remote attacker to bypass site isolation via a crafted HTML page. A fix is available in the Stable channel: Windows/Mac 150.0.7871.114/115 an...

CVE-2026-19170

CVE-2026-19170 involves a use-after-free in WebGL within Google Chrome on Android, allowing potential sandbox escape via a crafted HTML page. Affected software is Google Chrome (Android) with WebGL as the vulnerable component; root cause details are described in the CVE description. The vulnerabi...

CVE-2020-16043

CVE-2020-16043 affects Chromium-based browsers (e.g., Chrome) before version 87.0.4280.141 . The issue is an insufficient data validation in networking that could allow a remote attacker to bypass discretionary access control via malicious network traffic. Impact per sources: remote code/impact r...

CVE-2020-6435

CVE-2020-6435 describes a policy enforcement error in extensions that affects Google Chrome/Chromium prior to 81.0.4044.92. The issue, rooted in insufficient policy enforcement within the extensions component, could allow a remote attacker who has achieved renderer access to bypass navigation res...

CVE-2020-6445

CVE-2020-6445 discusses an insufficient policy enforcement vulnerability in the trusted types component of the Chromium/Chrome browser before version 81.0.4044.92, enabling a remote attacker to bypass Content Security Policy via a crafted HTML page. Public references in Debian/Arch/Fedora advisor...

CVE-2020-6575

The CVE-2020-6575 vulnerability affects Google Chrome’s Mojo component in the renderer path, described as a race condition that could allow a sandbox escape when a crafted HTML page is loaded. The issue requires the renderer process to be compromised to exploit the sandbox escape vector. Exploita...

CVE-2020-6576

CVE-2020-6576 is a vulnerability in the Chromium browser involving a use-after-free in the offscreen canvas component. The issue could allow a remote attacker to corrupt the heap via a crafted HTML page, potentially enabling arbitrary code execution. The most concrete remediation in the provided ...

CVE-2021-21106

The CVE-2021-21106 issue affects Chromium-based browsers (e.g., Google Chrome up to 87.0.4280.141 and related Chromium builds) and is caused by a use-after-free in the autofill component. This vulnerability could allow a remote attacker who has compromised the renderer process to escape the sandb...

CVE-2021-21116

CVE-2021-21116: Heap buffer overflow in the audio component of Chromium-based browsers (Chrome/Chromium) before 87.0.4280.141. A remote attacker could exploit heap corruption via a crafted HTML page. Remediation: update to 87.0.4280.141 or later.

CVE-2021-30559

CVE-2021-30559 is an out-of-bounds write in ANGLE within Chromium/Google Chrome prior to 91.0.4472.164. The issue could allow a remote attacker to trigger heap corruption via a crafted HTML page, enabling arbitrary code execution or crash. Affected component: ANGLE in the Chromium browser engine;...

CVE-2022-4188

CVE-2022-4188 affects Google Chrome on Android before 108.0.5359.71, due to insufficient validation of untrusted input in CORS. This allowed a remote attacker to bypass the same-origin policy via a crafted HTML page. The issue is categorized as Medium severity (CVSS 3.1: 4.3). A fix was released ...

CVE-2023-4902

CVE-2023-4902 affects Google Chrome and Chromium. The issue is an inappropriate implementation in Input that lets a remote attacker spoof security UI via a crafted HTML page. Root cause: flawed handling in the Input module prior to version 117.0.5938.62. Impact: spoofed UI could mislead users; ex...

CVE-2026-14117

The CVE-2026-14117 entry concerns Google Chrome’s DevTools on Windows prior to version 150.0.7871.47. The vulnerability is described as insufficient validation of untrusted input in DevTools, which could enable a remote attacker to obtain potentially sensitive information from process memory when...

CVE-2020-15975

CVE-2020-15975 affects Chromium/Google Chrome before 86.0.4240.75, caused by an integer overflow in the SwiftShader component that could enable remote code execution via crafted HTML. Debian/Arch advisories confirm the vulnerability in SwiftShader with the fix to version 86.0.4240.75 (or later) a...

CVE-2020-15986

CVE-2020-15986 affects Chromium's media component. An integer overflow in media before 86.0.4240.75 could enable a remote attacker to potentially cause heap corruption and arbitrary code execution. Public records in connected documents reference Chrome/Chromium updates fixing this in version 86.0...

CVE-2020-6496

CVE-2020-6496 : Use-after-free in the payments component of Google Chrome on macOS before 83.0.4103.97 allows a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Affected: Chrome/macOS; Root cause: use-after-free in payments. Impact: sandbox escape possible; Exploit...

CVE-2020-6544

CVE-2020-6544 affects Google Chrome (media component) with a use-after-free in media leading to potential heap corruption via a crafted HTML page. The vulnerability is exploitable remotely and, per the supplied documents, is addressed by upgrading to Chrome 84.0.4147.125 or newer. Connected advis...

CVE-2020-6563

CVE-2020-6563 affects Google Chrome on Android and is caused by insufficient policy enforcement in the intent-handling component, enabling a remote attacker to read potentially sensitive data from disk via a crafted HTML page. Affected: Chrome on Android versions prior to 85.0.4183.83. Impact: in...

CVE-2020-6565

CVE-2020-6565 affects Google Chrome on iOS (Omnibox/URL bar). Insecure/improper Omnibox handling allowed a remote attacker to spoof the URL bar contents using a crafted HTML page. Root cause: inappropriate Omnibox implementation. Impact: spoofed UI; potential user deception. Remediation: update t...

CVE-2021-21111

CVE-2021-21111 concerns Chromium/WebUI: insufficient policy enforcement prior to 87.0.4280.141 allows a user who installs a crafted malicious extension to potentially perform a sandbox escape. Affected: Chromium-based Chrome/Chromium up to the 87.0.4280.141 release. Impact: remote code execution ...

CVE-2021-21170

CVE-2021-21170 is a content spoofing/UX UI issue in Chromium-based browsers (Chrome/Chromium) prior to 89.0.4389.72. The vulnerability affects the Loader/URL bar UI and could allow a renderer-compromised attacker to spoof the Omnibox via a crafted HTML page. A fix exists in Chrome/Chromium 89.0.4...

CVE-2021-21173

CVE-2021-21173 describes a side-channel information leakage in Google Chrome/Chromium’s Network Internals, allowing a remote attacker to leak cross-origin data via a crafted HTML page. Affected component: Network Internals in Chromium before version 89.0.4389.72. Root cause: side-channel informat...

CVE-2022-0977

CVE-2022-0977 is a Use-After-Free in Chrome OS Browser UI affecting Google Chrome on Chrome OS before 99.0.4844.74, enabling heap corruption via a crafted HTML page when a user engages in specific interactions. The issue is part of a family of Chrome/Chromium UI and rendering vulnerabilities that...

CVE-2023-0696

CVE-2023-0696 describes a Type Confusion in V8 affecting Google Chrome/Chromium prior to 110.0.5481.77, enabling potential heap corruption via a crafted HTML page. The Chrome/Chromium release notes confirm security fixes for this and related CVEs, with Chrome 110.0.5481.77+ addressing the issue. ...

CVE-2023-0933

CVE-2023-0933 describes an integer overflow in PDF parsing in Google Chrome (Chromium) prior to 110.0.5481.177, which could allow a remote attacker to potentially cause heap corruption via a crafted PDF file. The CVSS metrics provided assign a base score of 8.8 (HIGH) with network attack vector, ...

CVE-2023-2460

CVE-2023-2460 is a Chromium/Chrome family issue: insufficient validation of untrusted input in Extensions could let a user-installed malicious extension bypass file access checks via a crafted HTML page. The vulnerability affects Google Chrome (and Chromium-based builds) up to version 113.0.5672....

CVE-2024-0808

The CVE-2024-0808 entry is supported by multiple connected documents: it describes an Integer underflow in Chromium’s WebUI that affects Google Chrome prior to 121.0.6167.85, enabling a remote attacker to potentially trigger heap corruption via a malicious file (High/CRITICAL via CVSS). Affected ...

CVE-2019-5819

CVE-2019-5819 corresponds to a vulnerability in Chromium/Google Chrome's Developer Tools. The root cause is insufficient data validation in the Developer Tools before version 74.0.3729.108, allowing a local attacker to execute arbitrary code by processing a crafted string copied to the clipboard....

CVE-2020-6515

CVE-2020-6515 describes a use-after-free in the tab strip of Google Chrome/Chromium prior to version 84.0.4147.89, potentially enabling remote code execution via a crafted HTML page and heap corruption. The connected documents confirm (1) affected product line: Google Chrome/Chromium; (2) vulnera...

CVE-2020-6522

CVE-2020-6522 affects Google Chrome (and Chromium) due to an inappropriate implementation in external protocol handlers, potentially allowing a sandbox escape via a crafted HTML page. The issue existed in Chrome prior to version 84.0.4147.89. Debian and FreeBSD advisories list this CVE among many...

CVE-2021-21180

CVE-2021-21180 is a use-after-free vulnerability in Google Chrome’s tab search component, allowing a remote attacker to potentially trigger heap corruption via a crafted HTML page. The publicly documented impact is a remote code execution/heap corruption risk, with the vulnerability existing in C...

CVE-2022-0791

CVE-2022-0791 describes a use-after-free in Google Chrome's Omnibox prior to 99.0.4844.51, enabling heap corruption when a user is coerced into specific interactions. The flaw allows remote code execution with a high impact (as reflected in multiple advisories) but exploitation requires user inte...

CVE-2022-1640

CVE-2022-1640 is a Google Chrome/Chromium vulnerability: a Use-after-free in Sharing path in Chrome prior to version 101.0.4951.64 could enable heap corruption when a user interacted with a crafted HTML page. The issue is listed in Chrome’s May 2022 stable-channel update (and Debian/Gentoo/Fedora...

CVE-2022-2607

CVE-2022-2607 is a use-after-free in the Tab Strip of Google Chrome on Chrome OS, prior to 104.0.5112.79, permitting heap corruption via specific user interactions. The issue affects Chrome/Chromium components on ChromeOS according to the CVE entry; Debian advisory confirms a fix in 104.0.5112.79...

CVE-2023-0474

CVE-2023-0474 affects Google Chrome/Chromium GuestView prior to 109.0.5414.119. The vulnerability is a Use-after-free in GuestView that could allow a user-assisted attacker who convinces a user to install a malicious extension to trigger heap corruption via a Chrome web app. The Chrome release no...

CVE-2023-3598

CVE-2023-3598 describes an out-of-bounds read/write flaw in ANGLE used by Google Chrome/Chromium prior to version 114.0.5735.90, potentially enabling heap corruption via a crafted HTML page and allowing remote code execution or crash. Connected sources (Astra Linux, Fedora advisories) confirm aff...

CVE-2023-3727

CVE-2023-3727 is a use-after-free in WebRTC of Google Chrome/Chromium, potentially enabling remote heap corruption in versions before 115.0.5790.98. Affected product: Google Chrome (Chromium-based). Impact: high severity; remote attacker could exploit to compromise memory. Remediation: update to ...

CVE-2023-4354

CVE-2023-4354 describes a heap buffer overflow in Skia used by Google Chrome prior to 116.0.5845.96. The vulnerability could allow a remote attacker who has already compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. Public references in the connected ...