CVE-2021-37967

CVE-2021-37967 describes an insecure implementation in the Background Fetch API in Google Chrome/Chromium, where a remote attacker who had already compromised the renderer process could leak cross-origin data via a crafted HTML page. The issue affects Chrome/Chromium prior to version 94.0.4606.54...

CVE-2022-2617

CVE-2022-2617 affects Google Chrome/Chromium via a Use-after-Free in the Extensions API prior to 104.0.5112.79, enabling a user-assisted heap corruption path when a malicious extension is installed. Public updates exist: Debian fixes Chromium to 104.0.5112.79-1~deb11u1; Fedora/GLSA advisories sho...

CVE-2022-4181

CVE-2022-4181 is a use-after-free in Google Chrome’s Forms component via Chromium. The concrete details show a heap-corruption vulnerability in Chrome/Chromium’s Forms handling, exploitable through a crafted HTML page and rated High severity. Affected product: Google Chrome (Chromium base); vulne...

CVE-2023-1215

CVE-2023-1215 describes a type confusion in CSS in Google Chrome/Chromium before 111.0.5563.64, enabling a remote attacker to potentially trigger heap corruption via a crafted HTML page. The CVSS v3.1 base score is 8.8 (High), with network exposure, no privileges required, user interaction requir...

CVE-2023-3421

CVE-2023-3421 is a use-after-free in Media in Google Chrome/Chromium prior to 114.0.5735.198 that could allow a remote attacker to cause heap corruption via a crafted HTML page. The vulnerability is documented across multiple advisories confirming the affected component as Chromium’s media handli...

CVE-2023-3422

The CVE-2023-3422 issue affects Chromium-based browsers (notably Google Chrome) and is triggered by a use-after-free in Guest View on versions before 114.0.5735.198. An attacker could persuade a user to install a malicious extension, potentially exploiting heap corruption via a crafted HTML page,...

CVE-2024-0225

The CVE affects Google Chrome (Chromium/WebGPU) with a use-after-free in WebGPU, leading to potential heap corruption via a crafted HTML page. Affected versions are prior to 120.0.6099.199; remediation is to update to 120.0.6099.199 or newer, as reflected by multiple advisories (e.g., Fedora/Debi...

CVE-2024-0804

CVE-2024-0804 affects Google Chrome/Chromium: Insufficient policy enforcement in the iOS Security UI allows a crafted HTML page to leak cross-origin data. Public references indicate the issue is tied to Chrome/Chromium’s UI policy enforcement and was addressed in Chrome 121.0.6167.85 (and related...

CVE-2026-14012

This CVE describes a side-channel information leakage in CSS within Google Chrome (Chromium) prior to version 150.0.7871.47. The vulnerability allows a remote attacker to exfiltrate potentially sensitive data from process memory via a crafted HTML page. The affected component is the CSS handling ...

CVE-2026-14049

CVE-2026-14049 affects Google Chrome versions with an inappropriate GPU implementation prior to 150.0.7871.47. A remote attacker who has compromised the renderer process can obtain potentially sensitive information from process memory via a crafted HTML page. Impact is described as Low severity; ...

CVE-2019-13681

CVE-2019-13681 affects Google Chrome prior to 77.0.3865.75, where insufficient data validation in downloads could let a remote attacker bypass download restrictions via a crafted HTML page. The issue is documented with a vulnerability description and CVSS scores; connected sources indicate Chrome...

CVE-2020-15983

CVE-2020-15983 affects the Chromium browser’s webUI component and is tied to insufficient data validation before version 86.0.4240.75 (ChromeOS) that could allow a local attacker to bypass content security policy with a crafted HTML page. Public advisories and vendor notes show fixes in the 86.0....

CVE-2020-6472

CVE-2020-6472 affects Chromium-based browsers (e.g., Chrome/Chromium) through the developer tools policy enforcement component. Affected version lineage is before 83.0.4103.61, per multiple advisories. The vulnerability is a policy enforcement error in the developer tools that could allow an atta...

CVE-2020-6528

CVE-2020-6528 affects Google Chrome/iOS with a vulnerability in basic authentication that allowed spoofing the Omnibox. The issue is fixed in Chrome 84.0.4147.89 (stable channel); update to that release or newer. Other connected advisories confirm a fix in the corresponding Chromium/Chrome releas...

CVE-2021-21124

CVE-2021-21124 is a use-after-free vulnerability in the Speech Recognizer component of the Chromium browser (tracked across multiple advisories). Impacted versions are Chromium before 88.0.4324.96. The issue could allow a remote attacker to escape sandbox and execute arbitrary code via a crafted ...

CVE-2021-30600

CVE-2021-30600 — Google Chrome (Printing) Use-after-free : The issue lies in the Printing path of Chrome, where a use-after-free in the rendering process could allow a remote attacker who already footholds the renderer to trigger heap corruption via a crafted HTML page. Affected versions prior to...

CVE-2022-1864

CVE-2022-1864 : In Google Chrome, a use-after-free in WebApp Installs (prior to 102.0.5005.61) can allow heap corruption when a user is convinced to install a malicious extension and performs specific interactions. The issue affects Chrome’s handling of WebApp Installs and is tied to a post-relea...

CVE-2022-2861

CVE-2022-2861 affects Google Chrome prior to 104.0.5112.101. An improper implementation in the Extensions API allows an attacker who persuades a user to install a malicious extension to inject arbitrary scripts into WebUI via a crafted HTML page, enabling likely impact described as an arbitrary s...

CVE-2023-2135

CVE-2023-2135 : Use-after-free in Chromium/Google Chrome DevTools prior to 112.0.5615.137 could allow a remote attacker to trigger heap corruption via a crafted HTML page after convincing a user to enable preconditions. Impact aligns with a high-severity heap corruption scenario. Affected product...

CVE-2023-2933

The CVE-2023-2933 issue affects Google Chrome/Chromium: a Use-After-Free in the PDF component could lead to heap corruption via a crafted PDF file. Root cause is use-after-free in PDF handling; impact is high (remote code execution/compromise of confidentiality, integrity, and availability) as re...

CVE-2024-0333

CVE-2024-0333 involves Google Chrome/Chromium where the vulnerability resides in the Extensions subsystem. The root cause is insufficient data validation in Extensions, allowing a crafted HTML page to cause installation of a malicious extension when the user is in a privileged network position. A...

CVE-2024-3516

CVE-2024-3516 describes a heap buffer overflow in ANGLE used by Google Chrome, exploitable via a crafted HTML page, affecting Chrome

CVE-2020-6460

CVE-2020-6460 concerns insufficient data validation in URL formatting in Chromium/Google Chrome prior to 81.0.4044.122, enabling domain spoofing via crafted domain names. Connected advisories show downstream fixes and versions: Debian/DSA-4714-1 notes Chromium updates around 83.0.4103.116 for sta...

CVE-2020-6466

CVE-2020-6466 is a use-after-free vulnerability in Google Chrome’s media component (pre-83.0.4103.61). The issue could allow a remote attacker who has renderer access to potentially execute arbitrary code or escape the sandbox via a crafted HTML page. Debian/Arch advisories confirm mitigation by ...

CVE-2021-21109

Chromium-based Chrome up to version 87.0.4280.141 is affected by CVE-2021-21109. The issue is a use-after-free in the payments component that can be triggered when the renderer process is compromised via a crafted HTML page, potentially enabling a sandbox escape. Impact is use of arbitrary code a...

CVE-2021-37992

CVE-2021-37992 affects the WebAudio component of Chromium/Google Chrome, with an out-of-bounds read that could enable a remote attacker to cause heap corruption via a crafted HTML page. Affected product: Chromium/Chrome prior to 95.0.4638.54. Mitigation: upgrade to Chromium 95.0.4638.54 or newer ...

CVE-2022-3199

CVE-2022-3199 concerns a Use-after-Free in Chrome/Chromium frames. The issue arises in Chrome prior to 105.0.5195.125, enabling a remote attacker to potentially trigger heap corruption via a crafted HTML page (high impact). Affected software is Chromium/Chrome's rendering frames subsystem; root c...

CVE-2023-0698

CVE-2023-0698 involves an out-of-bounds memory read in WebRTC within Google Chrome before version 110.0.5481.77. The flaw could be triggered by a crafted HTML page to allow a remote attacker to read memory. The Chrome advisory (and Debian security advisory) confirm a fix in version 110.0.5481.77-...

CVE-2023-1219

CVE-2023-1219: The connected Astra Linux bulletin confirms a heap buffer overflow in Chrome/Chromium’s Metrics prior to 111.0.5563.64, allowing a renderer-compromised, remote attacker to potentially trigger heap corruption via a crafted HTML page. Affected software is Google Chrome/Chromium (Chro...

CVE-2023-1225

CVE-2023-1225 affects Google Chrome on iOS before version 111.0.5563.64, due to insufficient policy enforcement in Navigation that could bypass the same-origin policy via a crafted HTML page. The Fedora update indicates a chromium 111.0.5563.64-1.fc36/111.0.5563.64+ fix exists, aligning with the ...

CVE-2020-16021

CVE-2020-16021 describes a race condition in the ImageBurner component of Chromium/Google Chrome prior to 87.0.4280.66 (ChromeOS context). If a attacker could compromise the browser process and trigger handling of a malicious file, it could lead to OS‑level privilege escalation. Public mentions i...

CVE-2021-21143

CVE-2021-21143 is a heap buffer overflow in the Chromium browser’s Extensions component, fixed in versions before 88.0.4324.146. The incident description from multiple sources indicates an attacker could exploit this via a crafted extension to achieve arbitrary code execution. Public references i...

CVE-2021-30626

CVE-2021-30626 affects the ANGLE component used by Google Chrome. It describes a memory out-of-bounds access in ANGLE prior to Chrome 93.0.4577.82, which could allow a remote attacker to cause heap corruption via a crafted HTML page. The vulnerability impact is described as potentially allowing h...

CVE-2022-1496

CVE-2022-1496 : Use-after-free in File Manager of Google Chrome before 101.0.4951.41 can allow a remote attacker to potentially exploit heap corruption via specific and direct user interaction. Affected product: Google Chrome/Chromium File Manager. Root cause: use-after-free vulnerability in File...

CVE-2023-1817

CVE-2023-1817 is a Chromium/Google Chrome issue affecting Google Chrome on Android prior to 112.0.5615.49, arising from insufficient policy enforcement in Intents. The underlying vulnerability allows a remote attacker to bypass navigation restrictions via a crafted HTML page. Public advisories re...

CVE-2023-1818

CVE-2023-1818 is a use-after-free in Vulkan within Google Chrome’s rendering stack prior to version 112.0.5615.49, enabling potential heap corruption via a crafted HTML page. The vulnerability affects Chrome’s Vulkan-related code paths and has been reflected across multiple advisories (Debian DSA...

CVE-2024-0805

Summary: CVE-2024-0805 is an issue in Google Chrome/Chromium where an inappropriate implementation in the Downloads component allowed a remote attacker to perform domain spoofing via a crafted domain name in versions prior to 121.0.6167.85. The vulnerability is documented across multiple connecte...

CVE-2024-0814

CVE-2024-0814 describes an incorrect security UI in Google Chrome’s Payments component that could allow a remote attacker to spoof security UI via a crafted HTML page. Concrete details across connected sources specify: affected product/versions include Chrome/Chromium before 121.0.6167.85 (e.g., ...

CVE-2024-9121

Mode C: Concrete details found. CVE-2024-9121 affects Chromium-based Chrome/Chromium. In Chromium’s V8, an inappropriate implementation allowed out-of-bounds memory access via a crafted HTML page, with a High impact (memory corruption/potential code execution). Public references indicate Chrome/C...

CVE-2025-1920

CVE-2025-1920 affects Google Chrome/Chromium where a Type Confusion in V8 prior to 134.0.6998.88 can lead to heap corruption via a crafted HTML page. The vulnerability originates in V8’s handling of certain objects, with impact described as high for confidentiality, integrity, and availability. A...

CVE-2026-13945

CVE-2026-13945 concerns Google Chrome on Linux where insufficient policy enforcement in Extensions allows UI spoofing via a crafted extension. Affected: Chrome on Linux prior to version 150.0.7871.47. Impact is described as user interaction required for exploitation, enabling UI spoofing without ...

CVE-2026-14058

CVE-2026-14058 affects Google Chrome: insufficient policy enforcement in the HTML Parser allows a remote attacker to bypass Content Security Policy via a crafted HTML page. Affected version range is Chrome prior to 150.0.7871.47. The vulnerability is documented across multiple sources (NVD, Debia...

CVE-2021-38001

CVE-2021-38001 is a type confusion in V8 of the Chromium engine (Chromium-based browsers) prior to version 95.0.4638.69. The issue could allow a remote attacker to trigger heap corruption via crafted HTML, potentially enabling arbitrary code execution. Publicly documented impact includes remote c...

CVE-2022-0469

CVE-2022-0469 refers to a use-after-free in Cast within Google Chrome (pre-98.0.4758.80). The underlying issue allows a remote attacker to potentially trigger heap corruption through a crafted HTML page when a user is persuaded to perform specific interactions. The CVE entry is corroborated by mu...

CVE-2022-1130

CVE-2022-1130 affects Google Chrome on Android, specifically the WebOTP component. The vulnerability is caused by insufficient validation of trusted input, allowing a remote attacker to send arbitrary intents from any app via a malicious app. The issue is fixed in Chrome versions 100.0.4896.60 an...

CVE-2022-2609

CVE-2022-2609 describes a use-after-free in Nearby Share on Chrome OS Chrome/Chromium prior to 104.0.5112.79, allowing heap corruption via specific UI interactions after user engagement. Affected component: Nearby Share workflow in Chromium-based Chrome OS. Root cause: use-after-free leading to p...

CVE-2022-4910

CVE-2022-4910: In Google Chrome, an inappropriate Autofill implementation allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Affected product: Google Chrome (Chromium-based). Root cause: incorrect Autofill handling as described in the CVE entry. Impact: navigatio...

CVE-2023-1822

CVE-2023-1822 : A vulnerability in Chromium/Google Chrome’s navigation UI allowed domain spoofing via a crafted HTML page. Affected: Chromium/Chrome before version 112.0.5615.49. Root cause: incorrect security UI in Navigation. Impact: remote attacker could spoof domain; user interaction required...

CVE-2023-3732

CVE-2023-3732: Out of bounds memory access in Mojo within Google Chrome before 115.0.5790.98 allows a remote attacker who has compromised the renderer process to potentially cause heap corruption via a crafted HTML page. Connected sources confirm this is a Chromium/Chrome vulnerability affecting ...

CVE-2025-6192

CVE-2025-6192 is a Use-after-free vulnerability in Google Chrome/Chromium’s memory management related to Metrics/Profiler, allowing remote code execution via a crafted HTML page. Affected versions precede 137.0.7151.119 (Chrome stable channel; Chromium baseline). Debian security advisories confir...