CVE-2022-3653

CVE-2022-3653 is a Chrome/Chromium vulnerability: a heap buffer overflow in Vulkan that could be triggered by a crafted HTML page, impacting Google Chrome prior to 107.0.5304.62. The issue affects Chromium’s Vulkan path and was addressed in the Chrome 107 stable update (Windows: 107.0.5304.62/63;...

CVE-2023-1216

CVE-2023-1216 corresponds to a Use-After-Free in Chrome/Chromium DevTools (prior to 111.0.5563.64) that can allow a remote attacker to potentially exploit heap corruption via a crafted HTML page after social-engineering a user into direct UI interaction. The connected Astra Linux bulletin and Fed...

CVE-2023-2935

CVE-2023-2935 involves a type confusion in Chrome/Chromium’s V8 engine that could allow a remote attacker to trigger heap corruption via a crafted HTML page. Affected: Google Chrome (Chromium-based) prior to 114.0.5735.90. Impact is rated high (C/H/I/A all). Remediation in provided documents poin...

CVE-2023-4351

CVE-2023-4351 is a use-after-free in Chromium/Google Chrome networking path exploited via a crafted HTML page, allowing remote heap corruption. The issue affects Google Chrome before version 116.0.5845.96 and is classed with High severity. Multiple connected advisories (e.g., Debian DSA-5479, Gen...

CVE-2026-15108

CVE-2026-15108: In Google Chrome, an Integer overflow in the Extensions API prior to 150.0.7871.115 allows an attacker to trigger an out-of-bounds memory read by convincing a user to install a crafted extension. Affected product: Google Chrome (Extensions API). Root cause: integer overflow in the...

CVE-2026-5906

CVE-2026-5906 affects Google Chrome/Chromium on Android, where an incorrect Omnibox security UI could allow spoofing of the URL bar via a crafted HTML page. The issue is tied to Chromium’s Omnibox handling and is described as Low severity (CVSS ~4.3). Remediation appears to be upgrading to Chromi...

CVE-2019-5850

CVE-2019-5850 affects Chromium/Google Chrome’s offline page fetcher. A use-after-free in the offline page fetcher before version 76.0.3809.87 could allow a remote attacker with a compromised renderer to potentially escape the sandbox via a crafted HTML page. Affected product/component: Chromium’s...

CVE-2020-16014

CVE-2020-16014 is a use-after-free in the PPAPI component of Chromium/Google Chrome, affecting Chrome/Chromium before 87.0.4280.66 (as noted by Debian/Gentoo/Arch/Fedora advisories). The advisory set indicates that a renderer-compromised remote attacker could potentially escape the sandbox via a ...

CVE-2020-6474

CVE-2020-6474 is a use-after-free in Blink/WebKit within Chromium/Google Chrome before version 83.0.4103.61. The issue can allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. Affected component is Blink/WebKit (Chromium-based browsers). The connected sources co...

CVE-2020-6568

CVE-2020-6568 affects Google Chrome on Android prior to 85.0.4183.83, where insufficient policy enforcement in the intent handling could allow a remote attacker to bypass navigation restrictions via a crafted HTML page. The issue is tied to Chrome/Chromium ecosystem; Debian/Fedora advisories refe...

CVE-2021-21115

CVE-2021-21115 : In Google Chrome before 87.0.4280.141, a use-after-free in the Safe Browsing component could allow a renderer-compromised remote attacker to escape the sandbox via a crafted HTML page. This is confirmed in connected advisories (e.g., Arch Linux ASA-202101-6) referencing Chromium ...

CVE-2021-21134

CVE-2021-21134 is a Chromium/Chrome Page Info UI security issue reported as content spoofing. Affected software: Chromium/Chrome prior to version 88.0.4324.96. Root cause: incorrect security UI handling in Page Info allowed a remote attacker to spoof security UI via a crafted page. Impact stateme...

CVE-2021-37972

CVE-2021-37972 relates to an out-of-bounds read in libjpeg-turbo used by Google Chrome (Chromium) before 94.0.4606.54, enabling a remote attacker to potentially trigger heap corruption via a crafted HTML page. Affected product is Chrome/Chromium with libjpeg-turbo integration; root cause is a mem...

CVE-2022-2621

CVE-2022-2621 is a use-after-free in Chrome/Chromium extensions before 104.0.5112.79 that can be triggered when a user installs a malicious extension, potentially enabling heap corruption. Affected products include Google Chrome/Chromium with the Extensions component vulnerable to the described u...

CVE-2022-3445

CVE-2022-3445: Use-after-free in Skia within Google Chrome prior to 106.0.5249.119 allows remote exploitation via a crafted HTML page, enabling heap corruption (severity High). A Chrome stable update to 106.0.5249.119 addresses this vulnerability; systems should upgrade to this build to remediate...

CVE-2022-4182

CVE-2022-4182 concerns Google Chrome’s Fenced Frames implementation. Affected software: Google Chrome (Chromium-based) prior to version 108.0.5359.71. Root cause: Inappropriate implementation of Fenced Frames allowed a remote attacker to bypass fenced frame restrictions via a crafted HTML page. I...

CVE-2021-30593

CVE-2021-30593 corresponds to an out-of-bounds read in the Chromium-based Tab Strip component (Chrome/Chromium) before version 92.0.4515.131. The vulnerability allows a remote attacker to cause memory read access via a crafted HTML page and a user-wurnished extension, with impact described as inf...

CVE-2021-37968

The CVE-2021-37968 entry describes an insecure implementation in the Background Fetch API in Google Chrome, leading to potential cross-origin data leakage via a crafted HTML page. Affected software: Google Chrome (Background Fetch API); root cause: improper handling in the API implementation; imp...

CVE-2023-4366

The CVE-2023-4366 entry describes a Use-after-free vulnerability in Chrome/Chromium Extensions prior to version 116.0.5845.96, potentially allowing heap corruption when a user is tricked into installing a malicious extension via a crafted HTML page. The issue is tied to the Extensions component, ...

CVE-2023-4368

CVE-2023-4368 : In Google Chrome/Chromium, insufficient policy enforcement in the Extensions API prior to 116.0.5845.96 allowed a user-wacched to install a malicious extension to bypass an enterprise policy via a crafted HTML page. The issue is described as a Medium severity in the Chromium advis...

CVE-2024-0811

CVE-2024-0811 describes an insecure Extensions API implementation in Google Chrome prior to 121.0.6167.85 that could allow a user-assisted attacker to leak cross-origin data via a malicious extension. The issue is tied to Chrome/Chromium’s Extensions API and is labeled with a low severity. Affect...

CVE-2026-19560

CVE-2026-19560 is a use-after-free in Blink used by Google Chrome prior to 151.0.7922.137. The issue allows a remote attacker to execute arbitrary code inside the Chrome sandbox via a crafted HTML page. Affected component: Blink (core rendering engine); root cause: use-after-free in Blink on HTML...

CVE-2011-1440

CVE-2011-1440 affects Google Chrome prior to 11.0.696.57. The vulnerability is a use-after-free in handling the ruby element and CSS token sequences in the rendering pipeline (WebKit-based). Exploitation is remote and could cause a denial of service or possibly other unspecified impact. The avail...

CVE-2020-16007

CVE-2020-16007 is a vulnerability in the Chromium/Google Chrome installer: insufficient data validation in the installer can allow a local attacker to elevate privileges via a crafted filesystem. Public advisories indicate the fix was shipped in Chrome/Chromium around version 86.0.4240.183 (with ...

CVE-2020-16024

CVE-2020-16024 refers to a heap-based buffer overflow in the Chromium UI component (Chromium/Chrome before 87.0.4280.66) that could be triggered by a crafted HTML page, potentially enabling arbitrary code execution and sandbox escape if a renderer process is compromised. Public references confirm...

CVE-2020-16025

CVE-2020-16025 affects Google Chrome/Chromium before 87.0.4280.66. Description: a heap-based buffer overflow in the clipboard component could be triggered by a crafted HTML page, potentially enabling code execution and sandbox escape if the renderer process is compromised. Impact scope is limited...

CVE-2020-16026

CVE-2020-16026 is a use-after-free vulnerability in the WebRTC component of Chromium/Google Chrome prior to 87.0.4280.66. Evidence from multiple sources confirms it affects Chrome/Chromium and was addressed in Chrome 87 (and Chromium 87.0.4280.66+) with upstream fixes. Debian security tracker not...

CVE-2020-16033

CVE-2020-16033 affects Chromium/Google Chrome WebUSB. The issue is an inappropriate WebUSB implementation that enables content spoofing of the security UI via a crafted HTML page, allowing a remote attacker to trick users. Affected: Chromium/Chrome prior to 87.0.4280.66 (WebUSB component). Impact...

CVE-2020-16034

CVE-2020-16034 affects Google Chrome (Chromium/WebRTC component) and was caused by an inappropriate implementation in WebRTC prior to Chrome 87.0.4280.66. This allowed a local attacker to bypass policy restrictions via a crafted HTML page, potentially enabling UI/policy circumvention. Public advi...

CVE-2020-6531

CVE-2020-6531 describes a side-channel information leakage in Chrome/Chromium’s Scroll to Text feature. A crafted HTML page could allow a remote attacker to leak cross-origin data. Public details indicate the issue affects Chrome/Chromium versions prior to 84.0.4147.89, with Debian noting a fix i...

CVE-2022-0459

CVE-2022-0459 concerns a use-after-free vulnerability in Chrome’s Screen Capture code, leading to potential heap corruption. The issue affects Chrome/Chromium prior to version 98.0.4758.80, with exploitation described as requiring a crafted HTML page and user interaction to trigger the vulnerabil...

CVE-2022-4185

CVE-2022-4185 affects Google Chrome on iOS prior to 108.0.5359.71. The issue is an Inappropriate implementation in Navigation that allows a remote attacker to spoof the contents of a modal dialogue via a crafted HTML page. Impact is spoofing of modal content; no exploitation details are provided ...

CVE-2023-1814

CVE-2023-1814 affects Google Chrome/Chromium: insufficient validation of untrusted input in Safe Browsing allows bypassing download checking via a crafted HTML page. Public advisories note this as a Chrome/Chromium vulnerability; fixes were released in Chrome/Chromium 112.0.5615.49 (and related p...

CVE-2024-10229

CVE-2024-10229 affects Google Chrome/Chromium via an Inappropriate implementation in Extensions that bypasses site isolation when a crafted Chrome Extension is used, prior to patch version 130.0.6723.69. Public advisories (Debian, Fedora) confirm the fix is in 130.0.6723.69-1..., and Debian/Fedor...

CVE-2026-13860

Google Chrome on Windows is affected by CVE-2026-13860 due to an Incorrect security UI in Autofill, allowing UI spoofing when a user is induced to perform specific UI gestures via a crafted HTML page. The issue affects Chrome versions prior to 150.0.7871.47; exploitation requires user interaction...

CVE-2020-6402

CVE-2020-6402 affects Google Chrome on macOS (OS X) prior to 80.0.3987.87, where Insufficient policy enforcement in downloads could let a user who installed a crafted Chrome Extension execute arbitrary code. The root cause is a policy enforcement flaw in the Downloads component, enabling code exe...

CVE-2021-30592

CVE-2021-30592 is an out-of-bounds write in the Tab Groups component of the Chromium browser engine, fixed in Chromium 92.0.4515.131+. The initial CVE description notes an out-of-bounds write via a crafted HTML page when a user is convinced to install a malicious extension. Connected advisories f...

CVE-2021-37977

CVE-2021-37977 is a use-after-free in the Garbage Collection of the Chromium browser engine (pre-94.0.4606.81). Exploitation could enable remote code execution via a crafted HTML page, with heap corruption as the underlying risk. The vulnerability affects Google Chrome/Chromium prior to the patch...

CVE-2023-2468

CVE-2023-2468 matches multiple sources reporting an insecure implementation in Chrome’s PictureInPicture feature. The vulnerability arises from an inappropriate implementation in PictureInPicture, which allowed a remote attacker who had compromised the renderer process to obfuscate the security U...

CVE-2023-2931

CVE-2023-2931 : A use-after-free in the PDF handling code of Google Chrome/Chromium allows a remote attacker to potentially cause heap corruption and execute arbitrary code via a crafted PDF file. Affected components include the PDF component of Chrome/Chromium before version 114.0.5735.90. The C...

CVE-2023-3216

CVE-2023-3216: Type confusion in V8/Chromium’s JavaScript engine causes heap corruption via a crafted HTML page, affecting Google Chrome pre-114.0.5735.133. The issue is documented across multiple feeds (Chromium/V8 type confusion with high impact). Affected software is Google Chrome/Chromium bro...

CVE-2024-1077

CVE-2024-1077 affects Google Chrome/Chromium’s Network module, with a use-after-free in the Network component leading to potential heap corruption via a malicious file. Vulnerable condition exists prior to version 121.0.6167.139. Debian Fedora advisories and Alpine/Linux security trackers referen...

CVE-2026-13857

CVE-2026-13857 describes an insecure implementation in Chrome’s Geometry handling that permits a remote attacker to spoof UI via a crafted HTML page, requiring the user to perform specific UI gestures. The vulnerability affects Chrome versions prior to 150.0.7871.47 and can be triggered when a us...

CVE-2026-15115

CVE-2026-15115 affects Google Chrome on Android prior to 150.0.7871.115, where insufficient validation of untrusted input in WebAppInstalls could allow a local attacker to bypass the same-origin policy via a crafted HTML page. The vulnerability stems from untrusted input handling within WebAppIns...

CVE-2018-17481

CVE-2018-17481 describes a use-after-free in PDFium used by Google Chrome before 71.0.3578.98, enabling potential heap corruption via a crafted PDF file. Affected software/components: Google Chrome and the PDFium library. Impact per sources: remote attacker could exploit heap corruption; Chrome’s...

CVE-2019-13755

CVE-2019-13755 : Google Chrome prior to 79.0.3945.79 suffers from insufficient policy enforcement in extensions, allowing a remote attacker to disable extensions via a crafted HTML page. Connected sources confirm this is a Chrome-extension policy issue, with public fixes in 79.0.3945.79 and later...

CVE-2020-16018

CVE-2020-16018 is a use-after-free in the payments component of Chromium/Google Chrome prior to 87.0.4280.66. Connected sources confirm exploitation can lead to arbitrary code execution and sandbox escape when a renderer process is compromised. Public fix status across distributions varies: upstr...

CVE-2020-16023

CVE-2020-16023 affects Chromium/WebCodecs prior to 87.0.4280.66. The underlying issue is a use-after-free in the WebCodecs component, which could allow remote code execution via a crafted page. Public entries confirm the vulnerability as arbitrary code execution in WebCodecs, with Debian noting t...

CVE-2021-37967

CVE-2021-37967 describes an insecure implementation in the Background Fetch API in Google Chrome/Chromium, where a remote attacker who had already compromised the renderer process could leak cross-origin data via a crafted HTML page. The issue affects Chrome/Chromium prior to version 94.0.4606.54...

CVE-2022-2617

CVE-2022-2617 affects Google Chrome/Chromium via a Use-after-Free in the Extensions API prior to 104.0.5112.79, enabling a user-assisted heap corruption path when a malicious extension is installed. Public updates exist: Debian fixes Chromium to 104.0.5112.79-1~deb11u1; Fedora/GLSA advisories sho...