CVE-2020-15992

CVE-2020-15992 affects Chromium-based browsers (Chromium/Google Chrome) before 86.0.4240.75, specifically the networking component. A remote attacker who already gained renderer-process access could bypass the same-origin policy via a crafted HTML page, with impacts including potential informatio...

CVE-2020-16019

CVE-2020-16019 is an issue in the Chromium filesystem component described as an inappropriate implementation that allowed a remote attacker, who had already compromised the browser process, to bypass noexec restrictions via a malicious file. Connected sources confirm the vulnerability affects Chr...

CVE-2020-16030

CVE-2020-16030 affects the Blink component in Chromium/Google Chrome prior to 87.0.4280.66. The issue is insufficient data validation in Blink, enabling a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. Publicly cited sources in the provided documents confirm C...

CVE-2020-6473

CVE-2020-6473 is a Blink/WebKit policy-enforcement error in Google Chrome prior to 83.0.4103.61 that could allow a remote attacker to obtain potentially sensitive information from a process’s memory via a crafted HTML page. Documents from Debian and Arch Linux confirm the vulnerability in Chrome/...

CVE-2020-6480

CVE-2020-6480 is documented as an access restriction bypass in Chromium/Google Chrome’s enterprise component, caused by insufficient policy enforcement. The Arch Linux ASA-202005-12 details multiple issues with chromium before 83.0.4103.61-1, including the CVE-2020-6480 bypass of navigation restr...

CVE-2021-21114

CVE-2021-21114 affects the Chromium-based browser (Chromium/Google Chrome family) with an issue in the audio component prior to version 87.0.4280.141 . The root cause is described as a use-after-free leading to potential heap corruption when processing crafted HTML pages, enabling a remote attack...

CVE-2021-21144

CVE-2021-21144 is a vulnerability in Chromium’s Tab Groups feature, where a heap buffer overflow prior to 88.0.4324.146 could allow a malicious extension to trigger heap corruption and potentially execute arbitrary code. Affected software is the Chromium browser (before 88.0.4324.146). The root c...

CVE-2021-30596

CVE-2021-30596 is a Chromium-based browser vulnerability affecting Google Chrome/Chromium before version 92.0.4515.131. The issue is an incorrect security UI in the Navigation component that allows a remote attacker to spoof the Omnibox (URL bar) from a crafted HTML page. Public advisories (Arch ...

CVE-2021-30627

CVE-2021-30627 describes a type confusion in Blink layout in Google Chrome prior to 93.0.4577.82, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. The connected documents identify the same description across multiple sources (Astra Linux security...

CVE-2021-37974

CVE-2021-37974 affects Google Chrome's Safebrowsing component and is a use-after-free vulnerability that could allow a remote attacker who compromises the renderer process to cause heap corruption via a crafted HTML page. The issue is rooted in Safe Browsing handling prior to version 94.0.4606.71...

CVE-2022-1132

CVE-2022-1132 affects Google Chrome on Chrome OS; the issue is an Inappropriate implementation in Virtual Keyboard that allowed a local attacker with physical access to bypass navigation restrictions prior to Chrome OS 100.0.4896.60. The Chrome 100 stability update (100.0.4896.60) and Debian/ Mag...

CVE-2022-1855

The CVE-2022-1855 entry corresponds to a memory misreference/use-after-free vulnerability in the Messaging component of Google Chrome, exploitable via a crafted HTML page to trigger heap corruption. Affected product: Google Chrome (Messaging component). Root cause: use-after-free causing memory m...

CVE-2022-2622

CVE-2022-2622 affects Google Chrome on Windows (Safe Browsing component). The issue is “insufficient validation of untrusted input,” allowing a remote attacker to bypass download restrictions with a crafted file. Public documents corroborate the vulnerability and reference Chrome versions around ...

CVE-2023-2459

CVE-2023-2459 affects Chromium-based browsers (Google Chrome/Chromium). The vulnerability is an inappropriate implementation in Prompts that allows a remote attacker to bypass permission restrictions through a crafted HTML page. Severity is described as Medium. Technical details across connected ...

CVE-2023-3215

The CVE-2023-3215 vulnerability affects Google's Chromium-based WebRTC: a use-after-free in WebRTC can lead to heap corruption when processing crafted HTML pages. Exploitable in Chrome/Chromium prior to version 114.0.5735.133. Remediation is to upgrade to 114.0.5735.133 or newer (as reflected in ...

CVE-2025-3619

CVE-2025-3619 affects Google Chrome (Windows) and Chromium code paths dealing with codecs. A heap buffer overflow in Codecs allowed a remote attacker to potentially trigger heap corruption via a crafted HTML page, enabling likely arbitrary code execution or crash as described in the entry. Public...

CVE-2026-13024

CVE-2026-13024 : The issue is in Google Chrome’s Navigation logic, where insufficient validation of untrusted input in the renderer allows a remote attacker who has compromised the renderer process to bypass site isolation via a crafted HTML page. Affected product: Google Chrome (Chromium-based)....

CVE-2026-9113

CVE-2026-9113: Out-of-bounds memory read in the GPU of Google Chrome on macOS, prior to 148.0.7778.179. A remote attacker could exploit this via a crafted HTML page. The issue affects Chrome’s GPU path and is mitigated by updating to the patched version (148.0.7778.179). The vulnerability is desc...

CVE-2016-5139

CVE-2016-5139 involves multiple integer overflows in the OpenJPEG library (opj_tcd_init_tile in tcd.c) used by PDFium within Google Chrome prior to 52.0.2743.116. The flaw can cause a heap-based buffer overflow and denial of service via crafted JPEG 2000 data; some reports also indicate possible ...

CVE-2020-16031

CVE-2020-16031 is a vulnerability in Chromium/Chrome related to the tab-Preview UI. Multiple connected sources (e.g., Arch Linux security advisory ASA-202011-11) describe it as a content spoofing issue in the tab preview component caused by an incorrect security UI, allowing a remote attacker to ...

CVE-2020-6384

CVE-2020-6384 is a use-after-free in WebAudio of Google Chrome/Chromium prior to version 80.0.3987.116, potentially enabling heap corruption via a crafted HTML page. Connected advisories confirm this issue is fixed in later Chromium/Chrome updates (e.g., Chromium 80.0.3987.132 and newer, with Red...

CVE-2020-6553

CVE-2020-6553 is described as a use-after-free in offline mode in Google Chrome on iOS prior to 84.0.4147.125, potentially enabling heap corruption via a crafted HTML page. Connected sources tie this entry to Chromium security updates; Debian advisories reference updating Chromium to 84.0.4147.12...

CVE-2021-21110

CVE-2021-21110 concerns Chromium/Chrome: a use-after-free in the safe browsing component of the Chromium browser before version 87.0.4280.141 could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Connected advisories consistently tie this CVE to Chromium u...

CVE-2021-21169

CVE-2021-21169 is a real vulnerability: an out-of-bounds memory access in the V8 JavaScript engine used by Chromium/Chrome. Connected advisories confirm the issue affects Chromium before version 89.0.4389.72 and has been fixed in newer Chrome/Chromium releases. Debian Security Advisories and Arch...

CVE-2022-1127

CVE-2022-1127 concerns Google Chrome prior to version 100.0.4896.60, with a use-after-free in the QR Code Generator that could allow a remote attacker, after convincing a user to perform specific interactions, to potentially exploit heap corruption. The issue is tied to Chrome’s QR Code Generator...

CVE-2022-2616

CVE-2022-2616 affects Google Chrome prior to 104.0.5112.79 due to an inappropriate Extension API implementation that allowed a user tricked into installing a malicious extension to spoof the Omnibox. The issue is tied to Extensions API handling and could enable spoofing of the URL bar content. De...

CVE-2023-1222

CVE-2023-1222: Heap buffer overflow in the Web Audio API of Google Chrome/Chromium before 111.0.5563.64 allows remote exploitation via a crafted HTML page, risking heap corruption. Affected: Chromium-based browsers; root cause is a heap buffer overflow in Web Audio API handling. Remediation: upgr...

CVE-2023-3728

CVE-2023-3728 is a use-after-free vulnerability in WebRTC components of Google Chrome/Chromium before version 115.0.5790.98. The issue, tied to heap corruption via a crafted HTML page, affects Chrome/Chromium WebRTC handling and has a high severity with potential for remote exploitation. The conn...

CVE-2023-4360

CVE-2023-4360 affects Color in Google Chrome (Chromium) prior to 116.0.5845.96. A remote attacker could craft an HTML page to obfuscate security UI. The issue is confirmed public in Chromium’s advisory and Chrome/Debian updates note the fix in version 116.0.5845.96 (and later). Remediation: upgra...

CVE-2024-2628

CVE-2024-2628: Google Chrome/Chromium downloads UI can be spoofed due to an inappropriate implementation in the Downloads flow. This allowed remote attackers to induce UI spoofing via a crafted URL (Impact: Medium as per CVSS). Affected software is Chromium-based (Chrome/Chromium) prior to versio...

CVE-2026-13952

CVE-2026-13952 describes an inappropriate implementation in Chrome's PerformanceAPIs prior to 150.0.7871.47, allowing a remote attacker to leak cross-origin data through a crafted HTML page. The issue affects Google Chrome (Chromium-based). The vulnerability’s root cause is an insecure data expos...

CVE-2026-14130

CVE-2026-14130 concerns a security UI issue in Chrome’s Omnibox. A remote attacker could trigger UI spoofing by serving a crafted HTML page, affecting Chrome builds prior to 150.0.7871.47. The CVE’s sources (NVD, Debian OSV, EUVD/ENISA, CVE list, etc.) consistently describe an incorrect security ...

CVE-2020-16001

CVE-2020-16001 is a use-after-free vulnerability in Chrome’s media component (video/multimedia stack) that could allow remote code execution via a crafted HTML page. It was fixed in the Chromium/Chrome stable channel with version 86.0.4240.111. The associated advisory notes this as a high-severit...

CVE-2021-21139

CVE-2021-21139 : In Chromium/Google Chrome, an incorrect implementation in the iframe sandbox allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Affected: Chromium/Chrome before 88.0.4324.96. Impact: potential navigation bypass; remote exploitation risk is descri...

CVE-2021-30597

CVE-2021-30597 is a use-after-free vulnerability in the Browser UI of the Chromium/Chrome stack prior to version 92.0.4515.131. The issue, located in the Browser UI component, enables a remote attacker to potentially trigger heap corruption and execute arbitrary code via crafted web content or in...

CVE-2022-0108

CVE-2022-0108 describes an iframe sandbox/navigation handling issue in WebKit-based components. Connected documents show concrete details across multiple products: Google Chrome before 97.0.4692.71: leakage of cross-origin data via crafted HTML navigation (Description: Inappropriate implementatio...

CVE-2022-1306

CVE-2022-1306 affects Chromium/Google Chrome via an inappropriate implementation in compositing prior to version 100.0.4896.88, enabling a remote attacker to spoof the Omnibox (URL bar) with a crafted HTML page. Public sources confirm the vulnerability in Chrome/Chromium and document that updates...

CVE-2024-2885

Chromium-based Dawn use-after-free in Google Chrome before 123.0.6312.86 can allow a remote attacker to trigger heap corruption via a crafted HTML page. Affected component: Dawn in Chrome/Chromium. Root cause: use-after-free in Dawn logic. Impact: high (confidentiality, integrity, availability). ...

CVE-2026-13947

CVE-2026-13947 concerns Google Chrome’s XR handling. The vulnerability is described as an uninitialized use in XR that affects Chrome prior to version 150.0.7871.47 . A remote attacker who had already compromised the renderer process could potentially read sensitive information from the process m...

CVE-2020-15984

CVE-2020-15984 affects Google Chrome on iOS before 86.0.4240.75, where the Omnibox (URL bar) does not enforce policies correctly, enabling a remote attacker to spoof the Omnibox via a crafted URL. Several advisories (Debian, FreeBSD, Arch) indicate the fixed version is 86.0.4240.75 or later, impl...

CVE-2020-16028

CVE-2020-16028 is a heap-based buffer overflow in the WebRTC component of the Chromium browser before version 87.0.4280.66. A remote attacker could potentially exploit heap corruption via a crafted HTML page. Affected upstream is Chromium/Chrome; fixes were released in Chrome/Chromium 87.0.4280.6...

CVE-2020-16041

CVE-2020-16041 affects Chromium-based Google Chrome before 87.0.4280.88. The issue is an out-of-bounds read in the networking component, enabling a remote attacker who has compromised the renderer process to potentially read memory from the process via a crafted HTML page. The vulnerability is do...

CVE-2020-6391

CVE-2020-6391 concerns Blink in Google Chrome. The vulnerability arises from insufficient validation of untrusted input in Blink, allowing a local attacker to bypass Content Security Policy via a specially crafted HTML page on Chrome versions prior to 80.0.3987.87. Affected product: Google Chrome...

CVE-2020-6529

CVE-2020-6529 involves an inappropriate WebRTC implementation in Google Chrome versions prior to 84.0.4147.89. An attacker positioned on an privileged network could leak cross-origin data via a crafted HTML page. The CVE is tied to WebRTC data handling in Chrome, with a base impact characterized ...

CVE-2021-21107

CVE-2021-21107 is a Use-After-Free in the Chromium drag-and-drop path affecting Google Chrome/Chromium on Linux prior to 87.0.4280.141. The vulnerability could allow a remote attacker who compromises the renderer process to escape the sandbox via a crafted HTML page. Public advisories (Arch Linux...

CVE-2021-21108

CVE-2021-21108 is a use-after-free in the Chromium media component prior to version 87.0.4280.141. The flaw could allow a remote attacker who already compromised the renderer process to potentially escape the sandbox via a crafted HTML page. Impact is described as enabling arbitrary code executio...

CVE-2021-30604

CVE-2021-30604 corresponds to a use-after-free in ANGLE used by Google Chrome (Chromium). The vulnerability is described as enabling a remote attacker to potentially trigger heap corruption via a crafted HTML page in Chrome prior to 92.0.4515.159. Connected sources corroborate the same "Use after...

CVE-2021-37971

CVE-2021-37971 affects Google Chrome up to 94.0.4606.54 where the Web Browser UI could be spoofed in the Omnibox via a crafted HTML page due to an incorrect security UI. The vulnerability allows a remote attacker to mislead users by altering the URL bar contents. The initial and connected documen...

CVE-2022-3653

CVE-2022-3653 is a Chrome/Chromium vulnerability: a heap buffer overflow in Vulkan that could be triggered by a crafted HTML page, impacting Google Chrome prior to 107.0.5304.62. The issue affects Chromium’s Vulkan path and was addressed in the Chrome 107 stable update (Windows: 107.0.5304.62/63;...

CVE-2023-1216

CVE-2023-1216 corresponds to a Use-After-Free in Chrome/Chromium DevTools (prior to 111.0.5563.64) that can allow a remote attacker to potentially exploit heap corruption via a crafted HTML page after social-engineering a user into direct UI interaction. The connected Astra Linux bulletin and Fed...