Chrome Security Vulnerabilities and Issues — Page 2 of Chrome CVE List

Lucene search

GoogleChrome

162 matches found

CVE•added 2018/09/25 2:29 p.m.•117 views

CVE-2018-6041

Incorrect security UI in navigation in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.

4.3CVSS4.8AI score0.00945EPSS

CVE•added 2018/11/14 3:29 p.m.•117 views

CVE-2018-6067

Incorrect IPC serialization in Skia in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

8.8CVSS8.4AI score0.00991EPSS

CVE•added 2018/12/04 5:29 p.m.•117 views

CVE-2018-6092

An integer overflow on 32-bit systems in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

8.8CVSS8.6AI score0.19177EPSS

CVE•added 2018/05/04 8:29 p.m.•115 views

CVE-2018-10229

A hardware vulnerability in GPU memory modules allows attackers to accelerate micro-architectural attacks through the use of the JavaScript WebGL API.

5.8CVSS5AI score0.00325EPSS

CVE•added 2018/11/14 3:29 p.m.•115 views

CVE-2018-6083

Failure to disallow PWA installation from CSP sandboxed pages in AppManifest in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to access privileged APIs via a crafted HTML page.

8.8CVSS7.7AI score0.00991EPSS

CVE•added 2018/09/25 2:29 p.m.•114 views

CVE-2018-6040

Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially bypass content security policy via a crafted HTML page.

6.5CVSS5.7AI score0.0063EPSS

CVE•added 2018/11/14 3:29 p.m.•114 views

CVE-2018-6062

Heap overflow write in Skia in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.

8.8CVSS8.2AI score0.01265EPSS

CVE•added 2018/11/14 3:29 p.m.•113 views

CVE-2018-17474

Use after free in HTMLImportsController in Blink in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

8.8CVSS9AI score0.01411EPSS

CVE•added 2018/11/14 3:29 p.m.•113 views

CVE-2018-6075

Incorrect handling of specified filenames in file downloads in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page and user interaction.

6.5CVSS6.3AI score0.00773EPSS

CVE•added 2018/12/04 5:29 p.m.•113 views

CVE-2018-6105

Incorrect handling of confusable characters in Omnibox in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.

6.5CVSS6.5AI score0.00963EPSS

CVE•added 2018/09/25 2:29 p.m.•112 views

CVE-2018-6043

Insufficient data validation in External Protocol Handler in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially execute arbitrary programs on user machine via a crafted HTML page.

8.8CVSS6.2AI score0.01624EPSS

CVE•added 2018/11/14 3:29 p.m.•112 views

CVE-2018-6071

An integer overflow in Skia in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

8.8CVSS8.1AI score0.00732EPSS

CVE•added 2018/11/14 3:29 p.m.•112 views

CVE-2018-6078

Incorrect handling of confusable characters in Omnibox in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.

4.3CVSS4.8AI score0.00699EPSS

CVE•added 2018/11/14 3:29 p.m.•111 views

CVE-2018-17465

Incorrect implementation of object trimming in V8 in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page.

8.8CVSS8.4AI score0.01655EPSS

CVE•added 2018/09/25 2:29 p.m.•110 views

CVE-2018-6034

Insufficient data validation in WebGL in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

8.1CVSS5.8AI score0.01108EPSS

CVE•added 2018/11/14 3:29 p.m.•110 views

CVE-2018-6082

Including port 22 in the list of allowed FTP ports in Networking in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially enumerate internal host services via a crafted HTML page.

4.7CVSS5.2AI score0.00699EPSS

CVE•added 2018/12/04 5:29 p.m.•110 views

CVE-2018-6102

Missing confusable characters in Internationalization in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.

4.3CVSS4.8AI score0.00963EPSS

CVE•added 2018/12/04 5:29 p.m.•110 views

CVE-2018-6116

A nullptr dereference in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.

6.5CVSS6.6AI score0.01604EPSS

CVE•added 2018/09/25 2:29 p.m.•109 views

CVE-2018-6031

Use after free in PDFium in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.

8.8CVSS6.7AI score0.01624EPSS

CVE•added 2018/09/25 2:29 p.m.•109 views

CVE-2018-6046

Insufficient data validation in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user cross-origin data via a crafted Chrome Extension.

6.1CVSS5.8AI score0.00944EPSS

CVE•added 2018/11/14 3:29 p.m.•108 views

CVE-2018-17473

Incorrect handling of confusable characters in Omnibox in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.

4.3CVSS5AI score0.00963EPSS

CVE•added 2018/09/25 2:29 p.m.•107 views

CVE-2018-6048

Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak referrer information via a crafted HTML page.

4.3CVSS4.8AI score0.00804EPSS

CVE•added 2018/11/14 3:29 p.m.•107 views

CVE-2018-6074

Failure to apply Mark-of-the-Web in Downloads in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to bypass OS level controls via a crafted HTML page.

8.8CVSS7.7AI score0.00581EPSS

CVE•added 2018/12/04 5:29 p.m.•107 views

CVE-2018-6088

An iterator-invalidation bug in PDFium in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file.

8.8CVSS8.5AI score0.02538EPSS

CVE•added 2018/12/04 5:29 p.m.•107 views

CVE-2018-6098

Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.

6.5CVSS6.5AI score0.00963EPSS

CVE•added 2018/12/04 5:29 p.m.•107 views

CVE-2018-6107

Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.

6.5CVSS6.5AI score0.00963EPSS

CVE•added 2018/08/28 8:29 p.m.•106 views

CVE-2017-15396

A stack buffer overflow in NumberingSystem in International Components for Unicode (ICU) for C/C++ before 60.2, as used in V8 in Google Chrome prior to 62.0.3202.75 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

6.5CVSS7.2AI score0.02027EPSS

CVE•added 2018/09/25 2:29 p.m.•106 views

CVE-2018-6050

Incorrect security UI in Omnibox in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.

6.5CVSS5.5AI score0.00945EPSS

CVE•added 2018/11/14 3:29 p.m.•106 views

CVE-2018-6061

A race in the handling of SharedArrayBuffers in WebAssembly in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

7.5CVSS7.6AI score0.01026EPSS

CVE•added 2018/11/14 3:29 p.m.•106 views

CVE-2018-6072

An integer overflow leading to use after free in PDFium in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.

8.8CVSS8.7AI score0.00991EPSS

CVE•added 2018/12/11 4:29 p.m.•105 views

CVE-2018-18345

Incorrect handling of blob URLS in Site Isolation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker who had compromised the renderer process to bypass site isolation protections via a crafted HTML page.

6.5CVSS6.3AI score0.00763EPSS

CVE•added 2018/09/25 2:29 p.m.•105 views

CVE-2018-6049

Incorrect security UI in permissions prompt in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the origin to which permission is granted via a crafted HTML page.

6.5CVSS5.7AI score0.00716EPSS

CVE•added 2018/12/04 5:29 p.m.•105 views

CVE-2018-6090

An integer overflow that lead to a heap buffer-overflow in Skia in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

8.8CVSS8.6AI score0.02016EPSS

CVE•added 2018/12/04 5:29 p.m.•105 views

CVE-2018-6094

Inline metadata in GarbageCollection in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

8.8CVSS8.3AI score0.01655EPSS

CVE•added 2018/12/04 5:29 p.m.•105 views

CVE-2018-6103

A stagnant permission prompt in Prompts in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass permission policy via a crafted HTML page.

6.5CVSS6.3AI score0.00662EPSS

CVE•added 2018/09/25 2:29 p.m.•104 views

CVE-2018-6032

Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user cross-origin data via a crafted HTML page.

6.5CVSS5.7AI score0.00828EPSS

CVE•added 2018/09/25 2:29 p.m.•104 views

CVE-2018-6045

Insufficient policy enforcement in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user local file data via a crafted Chrome Extension.

6.5CVSS5.7AI score0.00973EPSS

CVE•added 2018/12/04 5:29 p.m.•104 views

CVE-2018-6108

Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted HTML page.

6.5CVSS6.4AI score0.00963EPSS

CVE•added 2018/09/25 2:29 p.m.•103 views

CVE-2018-6051

XSS Auditor in Google Chrome prior to 64.0.3282.119, did not ensure the reporting URL was in the same origin as the page it was on, which allowed a remote attacker to obtain referrer details via a crafted HTML page.

4.3CVSS4.7AI score0.00593EPSS

CVE•added 2018/11/14 3:29 p.m.•103 views

CVE-2018-6077

Displacement map filters being applied to cross-origin images in Blink SVG rendering in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

6.5CVSS6.2AI score0.00773EPSS

CVE•added 2018/12/04 5:29 p.m.•103 views

CVE-2018-6086

A double-eviction in the Incognito mode cache that lead to a user-after-free in Networking Disk Cache in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted HTML page.

8.8CVSS8.2AI score0.02538EPSS

CVE•added 2018/09/25 2:29 p.m.•102 views

CVE-2018-6039

Insufficient data validation in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user cross-origin data via a crafted Chrome Extension.

6.1CVSS5.8AI score0.00944EPSS

CVE•added 2018/11/14 3:29 p.m.•102 views

CVE-2018-6079

Inappropriate sharing of TEXTURE_2D_ARRAY/TEXTURE_3D data between tabs in WebGL in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

6.5CVSS6.2AI score0.00712EPSS

CVE•added 2018/08/28 8:29 p.m.•101 views

CVE-2017-15429

Inappropriate implementation in V8 WebAssembly JS bindings in Google Chrome prior to 63.0.3239.108 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.

6.1CVSS6.2AI score0.00756EPSS

CVE•added 2018/02/07 11:29 p.m.•101 views

CVE-2017-5124

Incorrect application of sandboxing in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted MHTML page.

6.1CVSS6.4AI score0.34129EPSS

CVE•added 2018/09/25 2:29 p.m.•101 views

CVE-2018-6035

Insufficient policy enforcement in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user local file data via a crafted Chrome Extension.

8.8CVSS5.7AI score0.01624EPSS

CVE•added 2018/11/14 3:29 p.m.•101 views

CVE-2018-6060

Use after free in WebAudio in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

8.8CVSS8.8AI score0.01613EPSS

CVE•added 2018/11/14 3:29 p.m.•101 views

CVE-2018-6068

Object lifecycle issue in Chrome Custom Tab in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.

4.3CVSS4.7AI score0.00606EPSS

CVE•added 2018/11/14 3:29 p.m.•101 views

CVE-2018-6069

Stack buffer overflow in Skia in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

6.5CVSS6.9AI score0.00658EPSS

CVE•added 2018/12/04 5:29 p.m.•101 views

CVE-2018-6152

The implementation of the Page.downloadBehavior backend unconditionally marked downloaded files as safe, regardless of file type in Google Chrome prior to 66.0.3359.117 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted HT...

9.6CVSS8.2AI score0.00916EPSS

Total number of security vulnerabilities162