CVE-2023-4902

CVE-2023-4902 affects Google Chrome and Chromium. The issue is an inappropriate implementation in Input that lets a remote attacker spoof security UI via a crafted HTML page. Root cause: flawed handling in the Input module prior to version 117.0.5938.62. Impact: spoofed UI could mislead users; ex...

CVE-2025-3619

CVE-2025-3619 affects Google Chrome (Windows) and Chromium code paths dealing with codecs. A heap buffer overflow in Codecs allowed a remote attacker to potentially trigger heap corruption via a crafted HTML page, enabling likely arbitrary code execution or crash as described in the entry. Public...

CVE-2026-13952

CVE-2026-13952 describes an inappropriate implementation in Chrome's PerformanceAPIs prior to 150.0.7871.47, allowing a remote attacker to leak cross-origin data through a crafted HTML page. The issue affects Google Chrome (Chromium-based). The vulnerability’s root cause is an insecure data expos...

CVE-2026-14020

CVE-2026-14020 affects Google Chrome WebXR prior to 150.0.7871.47. The root cause is insufficient validation of untrusted input in WebXR, allowing a remote attacker who has compromised the renderer process to perform UI spoofing via a crafted HTML page. Impact is UI spoofing with medium severity ...

CVE-2026-87575

An incorrect authorization vulnerability in the Loader component of Google Chrome prior to version 153.0.8010.36 allowed a remote attacker, leveraging social engineering and a crafted HTML page, to bypass system access restrictions. The flaw is rated Low severity by Chromium and scores 5.4 (Mediu...

CVE-2019-13675

CVE-2019-13675 affects Google Chrome/Chromium: insufficient data validation in the extensions subsystem allows a remote attacker to disable extensions via a crafted HTML page. Publicly cited in Debian/Fedora advisories, with fixes implemented in Chromium/Chrome 78.x (as seen in Fedora/security ad...

CVE-2020-16000

CVE-2020-16000 refers to an Inappropriate implementation in Blink in Google Chrome before 86.0.4240.111, enabling remote exploitation via a crafted HTML page that could lead to heap corruption. Affected component: Blink in Chrome; root cause: inappropriate implementation in Blink; impact: potenti...

CVE-2020-6445

CVE-2020-6445 discusses an insufficient policy enforcement vulnerability in the trusted types component of the Chromium/Chrome browser before version 81.0.4044.92, enabling a remote attacker to bypass Content Security Policy via a crafted HTML page. Public references in Debian/Arch/Fedora advisor...

CVE-2020-6496

CVE-2020-6496 : Use-after-free in the payments component of Google Chrome on macOS before 83.0.4103.97 allows a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Affected: Chrome/macOS; Root cause: use-after-free in payments. Impact: sandbox escape possible; Exploit...

CVE-2020-6544

CVE-2020-6544 affects Google Chrome (media component) with a use-after-free in media leading to potential heap corruption via a crafted HTML page. The vulnerability is exploitable remotely and, per the supplied documents, is addressed by upgrading to Chrome 84.0.4147.125 or newer. Connected advis...

CVE-2020-6575

The CVE-2020-6575 vulnerability affects Google Chrome’s Mojo component in the renderer path, described as a race condition that could allow a sandbox escape when a crafted HTML page is loaded. The issue requires the renderer process to be compromised to exploit the sandbox escape vector. Exploita...

CVE-2021-21170

CVE-2021-21170 is a content spoofing/UX UI issue in Chromium-based browsers (Chrome/Chromium) prior to 89.0.4389.72. The vulnerability affects the Loader/URL bar UI and could allow a renderer-compromised attacker to spoof the Omnibox via a crafted HTML page. A fix exists in Chrome/Chromium 89.0.4...

CVE-2021-21180

CVE-2021-21180 is a use-after-free vulnerability in Google Chrome’s tab search component, allowing a remote attacker to potentially trigger heap corruption via a crafted HTML page. The publicly documented impact is a remote code execution/heap corruption risk, with the vulnerability existing in C...

CVE-2022-1640

CVE-2022-1640 is a Google Chrome/Chromium vulnerability: a Use-after-free in Sharing path in Chrome prior to version 101.0.4951.64 could enable heap corruption when a user interacted with a crafted HTML page. The issue is listed in Chrome’s May 2022 stable-channel update (and Debian/Gentoo/Fedora...

CVE-2022-2607

CVE-2022-2607 is a use-after-free in the Tab Strip of Google Chrome on Chrome OS, prior to 104.0.5112.79, permitting heap corruption via specific user interactions. The issue affects Chrome/Chromium components on ChromeOS according to the CVE entry; Debian advisory confirms a fix in 104.0.5112.79...

CVE-2023-0933

CVE-2023-0933 describes an integer overflow in PDF parsing in Google Chrome (Chromium) prior to 110.0.5481.177, which could allow a remote attacker to potentially cause heap corruption via a crafted PDF file. The CVSS metrics provided assign a base score of 8.8 (HIGH) with network attack vector, ...

CVE-2023-2930

The CVE-2023-2930 entry describes a use-after-free in Google Chrome Extensions (Extensions component) prior to version 114.0.5735.90, enabling heap corruption when a user is persuaded to install a malicious extension via a crafted HTML page. Affected software: Google Chrome (Extensions handling);...

CVE-2024-1059

CVE-2024-1059 refers to a use-after-free in Chrome/Chromium’s WebRTC Peer Connection, prior to version 121.0.6167.139, enabling a remote attacker to potentially trigger stack corruption via a crafted HTML page. Connected sources confirm affected component as Chromium/WebRTC, with a High severity ...

CVE-2026-87571

CVE-2026-87571 is an improper certificate validation vulnerability in the Loader component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker leveraging social engineering could use crafted network traffic to bypass the web origin policy , resulting in low confidenti...

CVE-2020-15988

CVE-2020-15988 affects Chromium/Google Chrome on Windows prior to 86.0.4240.75, where insufficient policy enforcement in the downloads component could allow a remote attacker to bypass download restrictions and execute arbitrary code via a crafted HTML page if the user is tricked into opening a d...

CVE-2020-6522

CVE-2020-6522 affects Google Chrome (and Chromium) due to an inappropriate implementation in external protocol handlers, potentially allowing a sandbox escape via a crafted HTML page. The issue existed in Chrome prior to version 84.0.4147.89. Debian and FreeBSD advisories list this CVE among many...

CVE-2020-6547

CVE-2020-6547 affects Google Chrome/Chromium with an incorrect security UI issue in media that could allow a remote attacker to glean sensitive information via a crafted HTML page. The Debian advisory for chromium lists CVE-2020-6547 among multiple fixes and states the fix version as chromium 84....

CVE-2020-6565

CVE-2020-6565 affects Google Chrome on iOS (Omnibox/URL bar). Insecure/improper Omnibox handling allowed a remote attacker to spoof the URL bar contents using a crafted HTML page. Root cause: inappropriate Omnibox implementation. Impact: spoofed UI; potential user deception. Remediation: update t...

CVE-2021-21111

CVE-2021-21111 concerns Chromium/WebUI: insufficient policy enforcement prior to 87.0.4280.141 allows a user who installs a crafted malicious extension to potentially perform a sandbox escape. Affected: Chromium-based Chrome/Chromium up to the 87.0.4280.141 release. Impact: remote code execution ...

CVE-2021-21138

CVE-2021-21138 is a use-after-free in the Chromium DevTools component (Chromium before 88.0.4324.96) that could allow a local attacker to escape the sandbox via a crafted file. Public sources in the connected documents confirm the issue and its association with DevTools, and note that a fix is in...

CVE-2021-21151

CVE-2021-21151 is a use-after-free vulnerability in the Payments component of Chromium/Google Chrome, exploitable before version 88.0.4324.182. The issue could enable a remote attacker to potentially escape the sandbox, enabling arbitrary code execution. Affected product: Chromium-based browser (...

CVE-2023-2722

CVE-2023-2722 describes a use-after-free in Google Chrome’s Autofill UI on Android, prior to 113.0.5672.126, enabling heap corruption via a crafted HTML page. The vulnerability is tied to the Chromium Autofill UI implementation and has been classified as High severity. Public sources indicate the...

CVE-2023-2723

CVE-2023-2723 relates to a use-after-free in Chrome/Chromium DevTools prior to 113.0.5672.126. A remote attacker who already compromised the renderer could trigger heap corruption via a crafted HTML page. The vulnerability has a high security impact (C/H/I/A) and a network attack vector with user...

CVE-2023-4908

CVE-2023-4908: In Google Chrome/Chromium, an inappropriate implementation in Picture-in-Picture allowed a remote attacker to spoof the security UI via a crafted HTML page. Affected versions are prior to 117.0.5938.62 (Chrome/Chromium). The issue is rated Low severity by the Chromium/Chrome ecosys...

CVE-2023-6508

CVE-2023-6508 describes a use-after-free in Media Stream of Chromium-based browsers (Google Chrome) that could allow remote heap corruption via a crafted HTML page. Public details in the connected sources confirm affected products are Google Chrome/Chromium, with the issue triggered by Media Stre...

CVE-2026-13947

CVE-2026-13947 concerns Google Chrome’s XR handling. The vulnerability is described as an uninitialized use in XR that affects Chrome prior to version 150.0.7871.47 . A remote attacker who had already compromised the renderer process could potentially read sensitive information from the process m...

CVE-2019-13660

CVE-2019-13660 affects Chromium/Google Chrome prior to 77.0.3865.75. Root cause: a user interface issue in full screen mode enabling UI spoofing of notifications via a crafted HTML page. Published details in Debian security advisory (CVE-2019-13660) and similar vendor advisories indicate remediat...

CVE-2019-5819

CVE-2019-5819 corresponds to a vulnerability in Chromium/Google Chrome's Developer Tools. The root cause is insufficient data validation in the Developer Tools before version 74.0.3729.108, allowing a local attacker to execute arbitrary code by processing a crafted string copied to the clipboard....

CVE-2020-15975

CVE-2020-15975 affects Chromium/Google Chrome before 86.0.4240.75, caused by an integer overflow in the SwiftShader component that could enable remote code execution via crafted HTML. Debian/Arch advisories confirm the vulnerability in SwiftShader with the fix to version 86.0.4240.75 (or later) a...

CVE-2020-16015

CVE-2020-16015 affects Google Chrome/Chromium, specifically the WASM component. The issue is described as insufficient data validation in WASM prior to 87.0.4280.66, which could allow a remote attacker to trigger heap corruption via a crafted HTML page. Multiple connected sources corroborate that...

CVE-2020-6386

CVE-2020-6386 is a use-after-free in Chrome’s speech processing leading to potential heap corruption when processing crafted HTML. Affected: Google Chrome prior to version 80.0.3987.116. Impact: remote code execution or instability as described in public advisories, with the issue fixed in the Ch...

CVE-2021-30529

CVE-2021-30529 is a use-after-free in the Bookmarks component of the Chromium browser (Google Chrome) prior to 91.0.4472.77. An attacker who persuades a user to install a malicious extension could trigger heap corruption via a crafted HTML page, potentially leading to arbitrary code execution. Th...

CVE-2021-37979

CVE-2021-37979 is a Chrome/Chromium-related vulnerability describing a heap buffer overflow in the WebRTC component of the Chromium engine (before version 94.0.4606.81). The issue could allow a remote attacker to trigger heap corruption by convincing a user to visit a malicious page containing cr...

CVE-2022-3040

CVE-2022-3040 is a memory-safety issue in Google Chrome’s Layout component, described as a use-after-free leading to heap corruption on crafted HTML pages. Affected versions are Chrome prior to 105.0.5195.52. Connected sources confirm the issue and trace fixes in subsequent Chrome/Chromium update...

CVE-2022-4183

CVE-2022-4183 affects Google Chrome/Chromium components related to the Popup Blocker. The issue is described as insufficient policy enforcement in the Popup Blocker, enabling a remote attacker to bypass navigation restrictions via a crafted HTML page. The public fix is Chrome/Chromium 108.0.5359....

CVE-2023-0474

CVE-2023-0474 affects Google Chrome/Chromium GuestView prior to 109.0.5414.119. The vulnerability is a Use-after-free in GuestView that could allow a user-assisted attacker who convinces a user to install a malicious extension to trigger heap corruption via a Chrome web app. The Chrome release no...

CVE-2024-2628

CVE-2024-2628: Google Chrome/Chromium downloads UI can be spoofed due to an inappropriate implementation in the Downloads flow. This allowed remote attackers to induce UI spoofing via a crafted URL (Impact: Medium as per CVSS). Affected software is Chromium-based (Chrome/Chromium) prior to versio...

CVE-2026-9113

CVE-2026-9113: Out-of-bounds memory read in the GPU of Google Chrome on macOS, prior to 148.0.7778.179. A remote attacker could exploit this via a crafted HTML page. The issue affects Chrome’s GPU path and is mitigated by updating to the patched version (148.0.7778.179). The vulnerability is desc...

CVE-2020-6567

CVE-2020-6567 involves Google Chrome (Windows) prior to 85.0.4183.83, where insufficient validation of untrusted input in command line handling allowed bypassing navigation restrictions via a crafted HTML page. Connected advisories confirm Chromium updates to 85.0.4183.83 or later as the fix (e.g...

CVE-2021-21125

CVE-2021-21125 is a policy-enforcement vulnerability in the Chromium-based File System API of Google Chrome (Windows) before version 88.0.4324.96. The issue allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. Connected sources confirm this CVE occurs within Chromi...

CVE-2021-21136

CVE-2021-21136 affects Chromium WebView on Android (before 88.0.4324.96). Root cause: insufficient policy enforcement in WebView. Impact: remote attacker could leak cross-origin data via a crafted HTML page. Public fixes and references indicate upgrade to Chromium 88.0.4324.96+ (e.g., Chromium pa...

CVE-2021-21142

CVE-2021-21142 : A use-after-free in the Payments component of the Chromium/Google Chrome stack before version 88.0.4324.146 (macOS context in the CVE) could allow a remote attacker to execute arbitrary code via a crafted HTML page. Affected product: Chromium/Chrome; root cause is use-after-free ...

CVE-2022-1855

The CVE-2022-1855 entry corresponds to a memory misreference/use-after-free vulnerability in the Messaging component of Google Chrome, exploitable via a crafted HTML page to trigger heap corruption. Affected product: Google Chrome (Messaging component). Root cause: use-after-free causing memory m...

CVE-2023-0136

CVE-2023-0136 affects Google Chrome/Chromium’s Fullscreen API implementation. The issue is an inappropriate implementation in Fullscreen API that can allow a remote attacker to trigger an incorrect security UI via a crafted HTML page. Public source records consistently tie this CVE to Chrome/Chro...

CVE-2023-0139

CVE-2023-0139 affects Google Chrome/Chromium on Windows prior to 109.0.5414.74. It stems from insufficient validation of untrusted input in the Downloads feature, enabling a remote attacker to bypass download restrictions via a crafted HTML page. The Chrome/Chromium 109.0.5414.74 update (and rela...