CVE-2026-19558

The CVE-2026-19558 vulnerability is a Use-After-Free in Google Chrome Extensions. Affected software: Google Chrome before version 151.0.7922.137 (and related entries mention 151.0.7922.137/138). Vulnerable component: Chrome Extensions, where a crafted malicious extension could trigger the UAF con...

CVE-2017-5024

CVE-2017-5024 reflects a heap overflow in FFmpeg used by Google Chrome prior to 56.0.2924.76 (Linux/Windows/macOS), caused by improper bounds checking and exploitable via crafted multimedia content. Multiple advisories (Arch Linux ASA-201702-10; Alpine Linux CVE-2017-5024; Debian security notes) ...

CVE-2018-18341

CVE-2018-18341 affects Chromium/Google Chrome prior to 71.0.3578.80. The Blink/WebKit component contains a heap-based buffer overflow that could allow a remote attacker to exploit heap corruption via a crafted HTML page. Impact is remote code execution potential as part of heap corruption; exploi...

CVE-2018-6071

CVE-2018-6071 is a heap/buffer overflow in Skia used by Google Chrome (pre-65.0.3325.146). Connected sources confirm a Skia-related overflow that could trigger an out-of-bounds memory access via a crafted HTML page. Affected context appears in Chrome/Chromium release notes and Debian/Gentoo advis...

CVE-2018-6092

The CVE-2018-6092 entry relates to an integer overflow in Chrome’s WebAssembly implementation on 32‑bit systems, allowing remote code execution inside the sandbox via a crafted HTML page. Affected software from the connected advisories includes Google Chrome/Chromium up to version 66.0.3359.117 (...

CVE-2018-6138

CVE-2018-6138 affects Google Chrome/Chromium extensions via insufficient policy enforcement in the Extensions API, enabling a user-assisted bypass of navigation restrictions by installing a malicious extension. Affected are versions prior to 67.0.3396.62; remediation per advisories is to upgrade ...

CVE-2023-6704

Use-after-free in libavif in Google Chrome (Chromium) prior to 120.0.6099.109 can allow a remote attacker to potentially trigger heap corruption via a crafted image file. Official advisories and vendor updates indicate the fix is included in Chrome/Chromium version 120.0.6099.109 and later. Affec...

CVE-2026-9986

The CVE-2026-9986 entry concerns the Chromium-based Google Chrome component OptimizationGuide. Affected product: Google Chrome (OptimizationGuide in Chromium). The flaw is insufficient validation of untrusted input, exploitable when an attacker who has compromised the renderer process crafts an H...

CVE-2018-16068

CVE-2018-16068 concerns a missing validation in Mojo within Google Chrome before 69.0.3497.81, which could allow a remote attacker to perform a sandbox escape via a crafted HTML page. The vulnerability is tied to the Mojo component in Chrome’s architecture and is addressed in Chromium/Chrome upda...

CVE-2018-18342

Chromium before version 71.0.3578.80 is affected by CVE-2018-18342 (and related CVEs listed in ASA-201812-2). The vulnerability for CVE-2018-18342 is an out-of-bounds write in the V8 JavaScript engine, enabling a remote attacker to execute arbitrary code inside the Chrome sandbox via a crafted HT...

CVE-2018-18351

CVE-2018-18351 is a Chromium/Google Chrome vulnerability described in connected sources as an access restriction bypass in the Navigation component, caused by insufficient policy enforcement that allows bypassing the SameSite cookie policy via a crafted HTML page. Affected product: Chromium/Chrom...

CVE-2018-18354

CVE-2018-18354 affects Google Chrome on Windows prior to 71.0.3578.80. The root cause is insufficient validation of external protocols in the Shell Integration component, enabling a remote attacker to launch external programs via a crafted HTML page. The vulnerability allows potential arbitrary c...

CVE-2018-6124

CVE-2018-6124 is a type confusion vulnerability in Blink ReadableStreams in Google Chrome (Chromium) prior to 67.0.3396.62. The underlying issue is a type confusion in Blink’s ReadableStreams, allowing a remote attacker to potentially cause object corruption via a crafted HTML page. Affected soft...

CVE-2018-6136

CVE-2018-6136 is an out-of-bounds read in V8 (Chrome/Chromium) prior to version 67.0.3396.62, enabling remote exploitation via a crafted HTML page to read memory. Publicly disclosed within multiple advisories (CNVD-2018-11486, CVE lists) and linked to Chrome/Chromium updates. Affected product: Go...

CVE-2021-37969

CVE-2021-37969 affects Google Chrome/Chromium components on Windows prior to 94.0.4606.54 due to an inappropriate implementation in Google Updater, enabling local privilege escalation via a crafted file. Remediation is to update to a patched version; Chrome/Chromium updates have been released (e....

CVE-2021-38019

CVE-2021-38019 is a Chromium/Chromium-based browser vulnerability describing insufficient policy enforcement in the CORS component prior to 96.0.4664.45, allowing a remote attacker to leak cross-origin data via a crafted HTML page. Connected advisories (Arch Linux ASA/AVGs, Debian DSA, and AS/AST...

CVE-2022-3447

CVE-2022-3447 refers to an issue in Google Chrome on Android prior to 106.0.5249.119 where an inappropriate implementation in Custom Tabs allowed a remote attacker to spoof the Omnibox (URL bar) contents via a crafted HTML page. The vulnerability is associated with Chromium’s High severity and is...

CVE-2023-1813

CVE-2023-1813 refers to an Inappropriate implementation in Extensions in Google Chrome, fixed by Chrome/Chromium in version 112.0.5615.49 and later. A malicious extension could bypass file access restrictions via a crafted HTML page when the user is convinced to install the extension. Affected pr...

CVE-2024-10231

CVE-2024-10231 is a Type Confusion in V8 affecting Google Chrome/Chromium before version 130.0.6723.69, enabling potential heap corruption via a crafted HTML page and classified as High risk. Connected sources confirm the same issue across Chromium-based releases, with patches provided in downstr...

CVE-2026-19177

CVE-2026-19177 affects Google Chrome UI components prior to 151.0.7922.109, due to insufficient validation of untrusted input, potentially enabling a sandbox escape when a renderer process is compromised via a crafted HTML page. The impact is a high-severity sandbox escape with same-origin and da...

CVE-2026-7935

CVE-2026-7935 concerns an Inappropriate implementation in the Speech component of Google Chrome, affecting Chrome versions prior to 148.0.7778.96. A remote attacker could induce UI spoofing via a crafted HTML page. The Debian OSV, ENISA EUVD, CVE lists, and PT Security entry corroborate the issue...

CVE-2016-1669

The vulnerability CVE-2016-1669 affects Google V8’s Zone::New in zone.cc, with V8 versions before 5.0.71.47 used by Google Chrome older than 50.0.2661.102. A mis-timed expansion of memory allocations can allow a remote attacker to trigger a buffer overflow, causing denial of service and potential...

CVE-2016-5172

CVE-2016-5172 : The V8 parser used in Google Chrome/Chromium mishandles scopes, enabling a remote attacker to obtain sensitive information from arbitrary memory locations via crafted JavaScript. Affected product scope includes Google Chrome and Chromium builds prior to 53.0.2785.113. Remediation ...

CVE-2018-6139

CVE-2018-6139 affects Google Chrome/Chromium’s debugger extension API in DevTools, before 67.0.3396.62. An attacker convincing a user to install a malicious extension could bypass restrictions and execute arbitrary code. Public exploits exist. Remediation: upgrade to 67.0.3396.62 or newer. Affect...

CVE-2018-6142

CVE-2018-6142 describes an out-of-bounds read vulnerability in Google Chrome’s V8 engine (pre-67.0.3396.62) that can be triggered by a crafted PDF file, allowing remote memory access. Connected advisories (Debian DSA-4237-1) indicate a fix in Chromium-based packages and note updates to version 67...

CVE-2022-0310

CVE-2022-0310 refers to a heap buffer overflow in Chrome’s Task Manager prior to version 97.0.4692.99, allowing a remote attacker to potentially trigger heap corruption via specific user interactions. Multiple connected sources confirm the same description and link the issue to Chrome revisions a...

CVE-2022-3197

CVE-2022-3197 affects Google Chrome/Chromium PDF rendering. The issue is a use-after-free in PDF handling that can lead to heap corruption when processing crafted PDFs, enabling a remote attacker to potentially exploit the vulnerability. Affected versions are Chrome/Chromium prior to 105.0.5195.1...

CVE-2022-4179

CVE-2022-4179 is a Use‑After‑Free in the Audio component of Google Chrome prior to 108.0.5359.71, allowing an attacker to potentially exploit heap corruption via a crafted Chrome Extension. Affected software is Chrome 108 and earlier; the fix was released as Chrome 108.0.5359.71 (and Debian/ALT/L...

CVE-2022-4192

CVE-2022-4192 affects Google Chrome/Chromium Live Caption and is a use-after-free in Live Caption leading to potential heap corruption. The issue is tied to Chrome 108-era code and is mitigated by upgrading to version 108.0.5359.71 or later (stable channel) where the fix is released. The provided...

CVE-2022-4438

CVE-2022-4438 describes a use-after-free in Blink Frames in Google Chrome/Chromium before 108.0.5359.124, where a remote attacker convincing a user to engage in specific UI interactions could trigger heap corruption via a crafted HTML page. Affected software: Google Chrome/Chromium (Blink Frames)...

CVE-2024-0809

The CVE concerns Google Chrome/Chromium: an inappropriate Autofill implementation allows a remote attacker to bypass Autofill restrictions via a crafted HTML page in Chrome/Chromium versions prior to 121.0.6167.85. Impact described in connected sources is limited to bypassing Autofill controls (n...

CVE-2011-3068

Technical details for CVE-2011-3068 are not available in the provided connected documents. The initial description mentions a use-after-free in Chrome's CSS engine but no further specifics are supplied.

CVE-2016-1683

CVE-2016-1683 affects libxslt prior to 1.1.29, as used in Google Chrome before 51.0.2704.63. The issue arises from numbers.c in libxslt, where namespace nodes are mishandled, enabling a remote attacker to trigger out-of-bounds heap memory access and cause a denial of service (with potential unspe...

CVE-2018-6083

CVE-2018-6083 affects Google Chrome and Chromium-based products due to an issue in AppManifests handling for CSP sandboxed pages, where the browser failed to disallow PWA installation from sandboxed contexts. The root cause is improper processing of AppManifests, enabling a remote attacker to acc...

CVE-2018-6137

CVE-2018-6137 is a Blink information-leak vulnerability in Google Chrome, present in Blink-based builds prior to 67.0.3396.62. A crafted HTML page could allow a remote attacker to disclose cross-origin data. Connected CNVD-2018-11487 describes the Chrome/Blink impact and mode of disclosure. Publi...

CVE-2018-6177

CVE-2018-6177 is a cross-origin information leak in Blink found in Chromium/Google Chrome before version 68.0.3440.75. The vulnerability allows leakage of cross-origin data via a crafted page. Debian security advisories and related entries reference this CVE among a set of Chromium/Blink fixes an...

CVE-2021-21215

CVE-2021-21215 affects Google Chrome Autofill: Inappropriately implemented Autofill allowed a remote attacker to spoof the security UI via a crafted HTML page (pre-90.0.4430.72). Concrete advisories across distributions confirm the issue in Chrome and Chromium-derived packages. Remediation: updat...

CVE-2021-38021

CVE-2021-38021 affects the Chromium engine used by Google Chrome/Chromium. The issue is an inappropriate implementation in the referrer handling component, before version 96.0.4664.45, which can allow a remote attacker to bypass navigation restrictions via a crafted HTML page, potentially leading...

CVE-2022-0103

CVE-2022-0103 is a use-after-free in Google Chrome’s SwiftShader component, before version 97.0.4692.71. The vulnerability could allow a remote attacker to exploit heap corruption via a crafted HTML page. Some connected sources (CNVD) describe this as a code execution vulnerability, indicating po...

CVE-2022-0298

CVE-2022-0298 is a Google Chrome use-after-free in the Scheduling component that can lead to heap corruption via a crafted HTML page. Multiple connected advisories confirm the vulnerability in Chrome before version 97.0.4692.99, with Debian noting a fix in 97.0.4692.99-1~deb11u2 and Chrome releas...

CVE-2022-0460

CVE-2022-0460 affects Google Chrome (Windows, Mac, Linux): a use-after-free in Window Dialog handling allowed by a crafted HTML page to potentially trigger heap corruption. The vulnerability is tied to Chrome versions prior to 98.0.4758.80. Exploitation could be remote and require no user interac...

CVE-2022-3654

CVE-2022-3654 is a Google Chrome/Chromium use-after-free in Layout vulnerability (pre-107.0.5304.62). The description notes potential heap corruption and remote code execution via a crafted HTML page, with high severity. Connected sources confirm Chrome/Chromium fixes, including a Chrome 107 upda...

CVE-2022-4194

CVE-2022-4194 affects Google Chrome (Accessibility component) and is due to a use-after-free, enabling remote heap corruption via a crafted HTML page. The issue is listed in Chrome’s November 2022 security fixes and is among numerous Chromium CVEs addressed in Chrome 108.0.5359.71 and related upd...

CVE-2025-0999

CVE-2025-0999 is a real vulnerability affecting Google Chrome's V8 engine, with a heap buffer overflow in V8 prior to 133.0.6943.126 that could allow a remote attacker to trigger heap corruption via a crafted HTML page. Public advisories consistently tie this to high severity and potential arbitr...

CVE-2017-5058

CVE-2017-5058 describes a use-after-free in PrintPreview in Google Chrome prior to 58.0.3029.81 for Windows, allowing a remote attacker to potentially cause out-of-bounds memory access via a crafted HTML page. Connected advisories confirm Chromium/Chrome involvement with version 58.x as the fixed...

CVE-2018-17469

CVE-2018-17469 affects Google/Chromium’s PDFium component: a heap-based buffer overflow in PDFium prior to 70.0.3538.67 (in PDF filter chain handling) can enable a remote attacker to trigger out-of-bounds memory reads and potentially execute code. Public sources in connected docs confirm the issu...

CVE-2018-18349

CVE-2018-18349 affects Chromium/Chrome Blink prior to version 71.0.3578.80, where an insufficient policy enforcement in Blink allowed remote frame navigations to access local files via a crafted Chrome Extension. Connected advisories (Arch Linux ASA-201812-2, Debian DSA-4352-1, Debian DSA-4352-1:...

CVE-2018-6043

CVE-2018-6043 affects Google Chrome (Chromium project) via the External Protocol Handler. The root cause is insufficient data validation in the handler, allowing a remote attacker to potentially execute arbitrary code on a user’s machine by presenting a crafted HTML page. Publicly documented impa...

CVE-2018-6066

CVE-2018-6066 affects Google Chrome (Blink) due to lack of CORS checking in ResourceFetcher/ResourceLoader, enabling a remote attacker to leak cross-origin data via crafted HTML. Publicly reported as a Same Origin Policy bypass in Chrome/Chromium before 65.0.3325.146; multiple vendors referenced ...

CVE-2018-6067

CVE-2018-6067 is a vulnerability in Google Chrome/Chromium where the Skia library contains a buffer/heap overflow issue. Affected component: Skia inside Chrome/Chromium prior to version 65.0.3325.146. Root cause: unspecified in the provided documents beyond “buffer overflow in the Skia library.” ...