CVE-2018-17479

CVE-2018-17479 is a Chrome GPU use-after-free vulnerability caused by incorrect object lifetime handling in GPU code, potentially leading to heap corruption. It affects Google Chrome prior to 70.0.3538.110. Public references describe an in-the-wild risk and indicate remediation via updating to ve...

CVE-2022-0466

CVE-2022-0466 involves Google Chrome’s Extensions Platform, with an Inappropriate implementation in Chrome’s Extensions Platform prior to 98.0.4758.80. An attacker convincing a user to install a malicious extension could trigger a sandbox escape via a crafted HTML page. Affects Chrome desktop rel...

CVE-2022-3041

CVE-2022-3041: Use-after-free in WebSQL of Google Chrome before 105.0.5195.52 allows remote attacker to potentially cause heap corruption via a crafted HTML page. Impacts include high severity across confidentiality, integrity, and availability. Affected software is Google Chrome (WebSQL). Remedi...

CVE-2023-6512

The CVE-2023-6512 issue affects Google Chrome’s Web Browser UI, where an inappropriate implementation in the UI could allow a remote attacker to spoof the contents of an iframe dialog context menu via a crafted HTML page. Affected product/versions include Chrome prior to 120.0.6099.62. The underl...

CVE-2024-4559

CVE-2024-4559 is a heap buffer overflow in WebAudio used by Google Chrome before version 124.0.6367.155. Multiple connected sources (Debian DSA-5683-1, CNVD-2024-36094, GLSA entries, Astra Linux security bulletin) corroborate this vulnerability in Chromium-based Chrome/WebAudio. Impact is describ...

CVE-2026-19157

CVE-2026-19157 : Out-of-bounds write in ANGLE affecting Google Chrome on Android before 151.0.7922.109. The issue could allow a remote attacker to potentially escape the Chrome sandbox via a crafted HTML page. Affects the ANGLE component within Chrome; no specific vendor/version details beyond th...

CVE-2018-6116

CVE-2018-6116 concerns a null pointer dereference in WebAssembly within Google Chrome before 66.0.3359.117, enabling a remote attacker to potentially trigger out-of-bounds memory access via a crafted HTML page. Connected advisories confirm the vulnerability as part of Chrome/WebAssembly issues an...

CVE-2018-6148

CVE-2018-6148 affects Google Chrome/chromium prior to version 67.0.3396.79, where incorrect handling of the Content Security Policy (CSP) header allowed a remote attacker to bypass navigation restrictions with a crafted HTML page. The vulnerability is due to CSP header handling and is mitigated b...

CVE-2021-30586

CVE-2021-30586 is a use-after-free vulnerability in Chrome’s dialog-box handling on Windows, affecting Chrome versions before 92.0.4515.107. A remote attacker could exploit this by convincing a user to install a malicious extension and by presenting a crafted HTML page, potentially triggering hea...

CVE-2021-37961

CVE-2021-37961 is a use-after-free vulnerability in Google Chrome/Chromium’s Tab Strip that could allow remote code execution via a crafted HTML page (heap corruption). Public references indicate this CVE is part of Chromium security fixes; Debian notes a fix in later Chromium versions (bullseye:...

CVE-2021-4078

The CVE-2021-4078 entry pertains to Google Chrome/V8 with a type-confusion vulnerability in V8 that was present in Chrome up to version 96.0.4664.93. The underlying issue is described as a type confusion in V8, which could allow a remote attacker to potentially trigger heap corruption via a craft...

CVE-2023-1821

CVE-2023-1821: A low-severity vulnerability in Google Chrome’s WebShare (Chromium) stems from an improper WebShare implementation, potentially allowing a remote attacker to hide the Omnibox (URL bar) contents via a crafted HTML page. Affected products are Google Chrome/Chromium-based browsers pri...

CVE-2023-1823

CVE-2023-1823 concerns Google Chrome's FedCM: an improper FedCM implementation allows a remote attacker to bypass navigation restrictions via a crafted HTML page. Affected product/component: Chrome/Chromium FedCM integration. Root cause: Inappropriate implementation in FedCM. Impact: navigation r...

CVE-2024-9120

CVE-2024-9120 is a use-after-free in Dawn within Chromium-based Chrome on Windows, enabling potential heap corruption via a crafted HTML page. Affected software is Google Chrome/Chromium with Dawn integration; the issue has a CVSS v3.1 base score of 8.8 (HIGH) with network attack vector, no privi...

CVE-2018-16071

CVE-2018-16071 is a use-after-free in WebRTC processing (VP9) within Google Chrome’s WebRTC stack. The vulnerability arises when an untrusted index extracted from an RTP packet is used as the upper bound for vector erase, potentially dereferencing memory beyond the allocated range and causing hea...

CVE-2018-18338

CVE-2018-18338 affects Chromium/Google Chrome’s canvas renderer. Arch Linux ASA-201812-2 documents a heap-based buffer overflow in the Canva component before 71.0.3578.80, enabling arbitrary code execution on a remote attacker. The fix is to upgrade to Chromium 71.0.3578.80-1 (or newer).

CVE-2018-6057

CVE-2018-6057 affects Google Chrome/Chromium prior to 65.0.3325.146, due to improper permissions handling of shared memory (ashmem). The issue permitted a renderer-compromised page to bypass inter-process read-only guarantees. Public documents confirm the vulnerability and list Chrome/Chromium 65...

CVE-2019-5859

CVE-2019-5859 : Google Chrome on Windows prior to 76.0.3809.87 was vulnerable due to insufficient filtering in URI schemes, allowing a crafted HTML page to bypass navigation restrictions by loading alternative browsers. The issue was fixed in the 76.0.3809.87 (or later) Chrome update; Debian/Arch...

CVE-2021-30628

CVE-2021-30628 affects ANGLE in Google Chrome, with a stack buffer overflow leading to potential stack corruption via a crafted HTML page prior to Chrome 93.0.4577.82. The vulnerability is triggered remotely over the network and can impact partial confidentiality, integrity, and availability as d...

CVE-2021-37983

CVE-2021-37983: A use-after-free vulnerability in Dev Tools of Chromium (Chrome/Chromium) before version 95.0.4638.54 can allow a remote attacker to cause heap corruption via a crafted HTML page. Exploitation could enable arbitrary code execution or impact memory integrity. Remediation is to upgr...

CVE-2022-0462

CVE-2022-0462 involves Google Chrome (Chromium-based) where an inappropriate implementation in Scroll could allow a remote attacker to leak cross-origin data via a crafted HTML page, affecting versions prior to 98.0.4758.80. The issue was addressed in Chrome 98.0.4758.80/98.0.4758.81/98.0.4758.82...

CVE-2022-1872

CVE-2022-1872 concerns Google Chrome’s Extensions API, where insufficient policy enforcement allowed a user-assisted attacker to bypass downloads policy via a crafted HTML page and a malicious extension. The issue affects Chrome/Chromium prior to version 102.0.5005.61, with fixes released in the ...

CVE-2022-3200

The CVE-2022-3200 entry corresponds to a Heap buffer overflow in Chrome/Chromium internals prior to 105.0.5195.125, enabling remote heap corruption via a crafted HTML page. Affected software shown in connected sources includes Chromium/Chrome updates (e.g., Chromium 105.0.5195.125). Root cause: h...

CVE-2022-4180

CVE-2022-4180 affects Google Chrome prior to 108.0.5359.71, involving a use-after-free in the Mojo component that can be triggered when a user is lured into installing a malicious Chrome extension. The underlying issue is heap corruption via crafted Extension payloads. The vulnerability is rated ...

CVE-2022-4452

CVE-2022-4452 affects Google Chrome’s crosvm component. Prior to 107.0.5304.62, insufficient data validation could enable a remote attacker to cause object corruption via a crafted HTML page. Impact is described as High (remote, no user privileges, high confidentiality/integrity/availability impa...

CVE-2023-4365

CVE-2023-4365 is a Chrome/Chromium vulnerability due to an inappropriate implementation in Fullscreen. Root cause: Fullscreen handling allows a crafted HTML page to obfuscate the security UI. Affects Google Chrome/Chromium (and related Edge in some docs) prior to version 116.0.5845.96. Impact per...

CVE-2023-6509

CVE-2023-6509 describes a Use-After-Free vulnerability in Chrome/Chromium's Side Panel Search, where handling of specific UI interactions could lead to heap corruption. Affected product: Google Chrome/Chromium browsers (Chromium-based). Root cause: use-after-free in the Side Panel Search componen...

CVE-2026-12446

CVE-2026-12446 : In Chromium-based Google Chrome, an inappropriate implementation in Passwords prior to 149.0.7827.155 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Affected component: Passwords handling in Chrome/Chromium. Root cause: improper cross-origin data han...

CVE-2018-16076

CVE-2018-16076 affects the PDFium component used by Google Chrome/Chromium. The issue is a missing bounds check in PDFium that enables a remote attacker to trigger an out-of-bounds memory read through a crafted PDF file. Debian notes a fix in chromium-browser 69.0.3497.81 (and related updates), i...

CVE-2021-37964

CVE-2021-37964 is an Inappropriate implementation vulnerability in ChromeOS Networking within Google Chrome on ChromeOS, prior to version 94.0.4606.54. An attacker with a rogue wireless access point could perform a wifi impersonation attack via a crafted ONC file. Public references confirm the is...

CVE-2021-38012

CVE-2021-38012 : Type confusion in the V8 component of the Chromium-based engine (Chrome before 96.0.4664.45) allows a remote attacker to potentially exploit heap corruption via crafted HTML, enabling arbitrary code execution or browser instability. Connected advisories (Arch/DEBIAN/Vivaldi/Opera...

CVE-2022-0306

CVE-2022-0306 is a reported heap buffer overflow in PDFium used by Google Chrome, prior to version 97.0.4692.99. The issue allows a remote attacker to potentially cause heap corruption via a crafted HTML page. Multiple connected sources confirm the same description and link the vulnerability to C...

CVE-2022-0453

CVE-2022-0453 describes a use-after-free in Chrome/Chromium’s Reader Mode prior to 98.0.4758.80, allowing a remote attacker who already compromised the renderer process to potentially trigger heap corruption with a crafted HTML page. The vulnerability affects Chrome/Chromium’s rendering component...

CVE-2022-0468

CVE-2022-0468 affects Google Chrome (Chromium-based) Payments: Use-after-free in Payments leading to potential heap corruption via a crafted HTML page. Root cause: improper memory handling in Payments. Impact: remote attacker could exploit heap corruption; CVE entry has a high-risk profile (Chrom...

CVE-2022-3886

CVE-2022-3886 is a use-after-free in Google Chrome’s Speech Recognition feature, prior to 107.0.5304.106, allowing a remote attacker to potentially cause heap corruption via a crafted HTML page. The Chrome update notes indicate this and other fixes in Stable Channel 107.x, with the CVE listed as ...

CVE-2022-3887

Use-after-free in Web Workers in Google Chrome prior to 107.0.5304.106 (CVE-2022-3887) allows remote heap corruption via crafted HTML. Affected: Google Chrome/Web Workers. Root cause: use-after-free in Web Workers (Chromium). Impact: High severity per Chrome/NVD. Remediation: Chrome Stable channe...

CVE-2018-17468

CVE-2018-17468 affects Chromium/Google Chrome Blink prior to 70.0.3538.67. The issue is an information-disclosure in Blink during navigation caused by incorrect handling of timer information, allowing a remote attacker to obtain cross-origin URLs. Affected components: Blink in Chromium/Chrome bef...

CVE-2021-37958

CVE-2021-37958 affects Google Chrome/Chromium: Inappropriate implementation in Navigation on Windows before 94.0.4606.54 allows a remote attacker to inject scripts/HTML into a privileged page via a crafted HTML page. Connected sources reference Chrome/Chromium updates addressing this issue (e.g.,...

CVE-2021-37982

CVE-2021-37982 is a use-after-free in the Incognito component of the Chromium browser engine before version 95.0.4638.54. The issue could allow an attacker to trigger arbitrary code execution via crafted HTML content; affected products cite Chromium-based browsers (e.g., Google Chrome/Chromium) b...

CVE-2021-37986

CVE-2021-37986 is a heap buffer overflow in the Settings component of the Chromium browser engine (Chrome/Chromium) prior to 95.0.4638.54. The issue could allow a remote attacker to trigger heap corruption via a crafted HTML page by interacting with DevTools. Affected product scope includes Chrom...

CVE-2021-4058

CVE-2021-4058 describes a heap buffer overflow in ANGLE used by Google Chrome, prior to version 96.0.4664.93, which could allow a remote attacker to exploit heap corruption via a crafted HTML page. The vulnerability affects Chrome’s ANGLE/WebGL/graphics handling path and has a high CVSS3.1 base s...

CVE-2023-0703

CVE-2023-0703 is a Type Confusion vulnerability in Chrome/Chromium DevTools. A remote attacker could trigger heap corruption via UI interactions, requiring user participation, in Chrome versions prior to 110.0.5481.77. The issue is fixed in the Chrome 110 security release (and related Debian secu...

CVE-2023-3734

CVE-2023-3734: In Google Chrome/Chromium, an inappropriate implementation in Picture in Picture allowed a remote attacker to potentially spoof the Omnibox via a crafted HTML page. The issue is described as affecting Chrome/Chromium prior to version 115.0.5790.98, with remediation by upgrading to ...

CVE-2023-4356

CVE-2023-4356 describes a use-after-free in Audio for Google Chrome prior to 116.0.5845.96, enabling a remote attacker who induces user UI interaction to potentially trigger heap corruption via a crafted HTML page. Public advisories (Debian, FreeBSD, Gentoo, Fedora, etc.) align on affected produc...

CVE-2026-13933

CVE-2026-13933 concerns insufficient policy enforcement in the Passwords feature of Google Chrome, prior to version 150.0.7871.47. A remote attacker who has already compromised the renderer process could exfiltrate potentially sensitive data from process memory via a crafted HTML page. The CVE is...

CVE-2026-85046

A type confusion in the V8 JavaScript engine in Google Chrome prior to 152.0.7977.82 allows a remote attacker to execute arbitrary code inside the browser sandbox by enticing a user to visit a crafted HTML page. The vulnerability was reported by Salvatore Gulizia (Serotav) on 2026-08-04 and is ra...

CVE-2018-18350

CVE-2018-18350 is part of a set of Chromium/browser CSP-policy issues fixed in the 71.0.3578.80 update. The described vulnerability is an access/ CSP enforcement bypass in Blink during navigations, allowing a crafted HTML page to bypass content security policy and potentially lead to arbitrary co...

CVE-2018-18359

CVE-2018-18359 affects chromium-browser/chromium before 71.0.3578.80. According to the Arch Linux ASA-201812-2 and Debian/Debian tracker entries, it is an information-disclosure vulnerability caused by an out-of-bounds read in the V8 JavaScript engine. Impact is that a remote attacker could acces...

CVE-2021-30580

The CVE-2021-30580 entry refers to a vulnerability in Chromium-based Google Chrome on Android, caused by Insufficient policy enforcement in Android intents. The issue allowed an attacker who could persuade a user to install a malicious application to exfiltrate potentially sensitive data via a cr...

CVE-2021-37957

The CVE-2021-37957 entry concerns a Use-after-Free in WebGPU in Google Chrome before 94.0.4606.54, allowing a remote attacker to potentially trigger heap corruption via a crafted HTML page. Affected component: Chrome/WebGPU. Root cause: use-after-free in WebGPU code paths leading to heap corrupti...