CVE-2018-6067

CVE-2018-6067 is a vulnerability in Google Chrome/Chromium where the Skia library contains a buffer/heap overflow issue. Affected component: Skia inside Chrome/Chromium prior to version 65.0.3325.146. Root cause: unspecified in the provided documents beyond “buffer overflow in the Skia library.” ...

CVE-2018-6102

CVE-2018-6102 affects Google Chrome/Chromium, enabling an attacker to spoof the Omnibox (URL bar) via a crafted domain name. The vulnerability is described as a URL spoofing issue in Omnibox and is fixed in Chrome/Chromium around version 66.0.3359.117 (example Debian update notes reference 66.0.3...

CVE-2018-6154

CVE-2018-6154 affects Google Chrome/Chromium WebGL: insufficient data validation in WebGL leads to heap/buffer overflow. A remote attacker could exploit via a crafted HTML page to trigger heap corruption and potential code execution. Public references in connected docs confirm the WebGL heap over...

CVE-2021-21217

CVE-2021-21217 affects Google Chrome via the PDFium component. The issue is uninitialized memory in PDFium that could allow a remote attacker to obtain potentially sensitive information from a process’s memory when processing a crafted PDF file. It applies to Chrome versions prior to 90.0.4430.72...

CVE-2021-21218

CVE-2021-21218 maps to a memory-disclosure flaw in PDFium used by Google Chrome before 90.0.4430.72. A crafted PDF could let remote attackers read potentially sensitive data from process memory. Remediation is to upgrade Chrome to 90.0.4430.72 or newer as indicated by multiple advisories.

CVE-2021-37991

CVE-2021-37991 is a race condition in the V8 component of the Chromium browser engine prior to version 95.0.4638.54 that could enable a remote attacker to potentially cause heap corruption via a crafted HTML page. The connected advisories confirm the issue affects Chromium/Chrome builds before th...

CVE-2021-37995

CVE-2021-37995 affects Chromium-based browsers (e.g., Google Chrome/Chromium) via an inappropriate implementation in the WebApp Installer before 95.0.4638.54. A remote attacker could potentially overlay and spoof the Omnibox (URL bar) contents with a crafted HTML page. The vulnerability is part o...

CVE-2021-4062

CVE-2021-4062 is a heap buffer overflow in the BFCache component of Chromium/ Google Chrome prior to 96.0.4664.93. The issue affects the BFCache path, enabling a remote attacker who has compromised the renderer process to potentially trigger heap corruption via a crafted HTML page. The vulnerabil...

CVE-2022-3657

CVE-2022-3657 is a Chrome/Chromium vulnerability in the Extensions component: Use-after-free in Extensions in Google Chrome prior to 107.0.5304.62, potentially enabling heap corruption via a crafted extension after a user visit/install. The connected Chrome release notes confirm the fix was shipp...

CVE-2023-0697

CVE-2023-0697: In Google Chrome for Android, prior to 110.0.5481.77, an inappropriate Fullscreen implementation allows a remote attacker to spoof the security UI via a crafted HTML page. The issue is fixed in Chrome 110.0.5481.77+. Affected product: Google Chrome on Android; root cause: Fullscree...

CVE-2023-2463

CVE-2023-2463 : In Google Chrome (Android), an inappropriate implementation in Full Screen Mode could allow a remote attacker to hide the contents of the Omnibox (URL bar) via a crafted HTML page. Affected software is Chrome/Chromium family, with the issue linked to Full Screen handling. The vuln...

CVE-2024-10230

CVE-2024-10230 is a Type Confusion in V8 affecting Google Chrome/Chromium prior to 130.0.6723.69. The flaw can enable remote heap corruption via a crafted HTML page. Affected component: V8 (JavaScript engine) within Chrome/Chromium; impact is High for confidentiality, integrity, and availability....

CVE-2024-3174

The CVE-2024-3174 entry describes an issue in Google Chrome/Chromium’s V8: an inappropriate implementation allowed remote attackers to potentially trigger object corruption via a crafted HTML page. Affected version set is before 119.0.6045.105 (Chromium), with High severity per NVD. The vulnerabi...

CVE-2025-1914

CVE-2025-1914 corresponds to a vulnerability in Google Chrome/Chromium where an out-of-bounds read in V8 could allow a remote attacker to perform memory access via a crafted HTML page. The issue affects Chrome versions prior to 134.0.6998.35 (Chromium parity), as indicated by multiple sources. Th...

CVE-2026-11254

Affected software: Google Chrome. The CVE-2026-11254 describes an insecure implementation in Permissions that allowed a remote attacker to perform UI spoofing via a crafted HTML page. The issue is tied to Chrome/Chromium before version 149.0.7827.53, with a stated remediation path implied by the ...

CVE-2026-14066

CVE-2026-14066 affects Chrome for iOS (Google Chrome on iOS) prior to 150.0.7871.47. The issue is insufficient validation of untrusted input in a crafted HTML page, allowing a remote attacker to bypass navigation restrictions. This is described across multiple feeds (NVD, Debian, EUVD, CVE listin...

CVE-2026-7968

CVE-2026-7968 affects Google Chrome prior to 148.0.7778.96. The vulnerability arises from insufficient input validation in Cross-Origin Resource Sharing (CORS), which could let a remote attacker who already compromised a renderer process bypass the same-origin policy via a crafted HTML page. Affe...

CVE-2026-9921

Summary: CVE-2026-9921 is a WebGL-related flaw in the Chromium-based Google Chrome browser for Android. The issue is described as an uninitialized use in WebGL that allows a remote attacker to leak cross-origin information via a crafted HTML page. Affected product/area: Google Chrome on Android, ...

CVE-2016-1697

CVE-2016-1697 affects Google Chrome (Blink/WebKit) prior to 51.0.2704.79. The FrameLoader::startLoad path in FrameLoader.cpp does not prevent frame navigations during DocumentLoader detach, enabling a remote attacker to bypass the Same Origin Policy via crafted JavaScript. A patch was released in...

CVE-2017-5033

CVE-2017-5033 affects Chromium-based browsers including Google Chrome and Chromium before versions 57.0.2987.98 (desktop) and 57.0.2987.108 (Android). The issue is a CSP bypass caused by improper propagation of content security policy to local scheme pages, related to the unsafe-inline keyword, a...

CVE-2018-16075

CVE-2018-16075 concerns the Blink component in Google Chrome. The vulnerability arises from insufficient file type enforcement, allowing a crafted HTML page to obtain local file data. The initial Chrome/Blink issue is described as affecting versions prior to 69.0.3497.81. Public fixes are documen...

CVE-2018-17467

CVE-2018-17467 refers to a URL spoofing vulnerability in Chromium/Google Chrome’s Omnibox due to insufficiently quick clearing of stale rendered content in navigation, allowing a remote attacker to spoof the URL bar via a crafted HTML page. The issue affects Chromium before version 70.0.3538.67 (...

CVE-2018-17475

CVE-2018-17475 is a URL-spoofing vulnerability in Chromium/Google Chrome’s Omnibox stemming from an incorrect handling of history during Navigation, reported for Chrome/Chromium builds before 70.0.3538.67. The issue enables a remote attacker to spoof the URL bar via a crafted HTML page. Affected ...

CVE-2018-6034

CVE-2018-6034 originates from an integer overflow in Blink/WebGL leading to an out-of-bounds memory read in Google Chrome before version 64.0.3282.119. The Initial description states the vulnerability as an insufficient data validation in WebGL causing the out-of-bounds read via a crafted HTML pa...

CVE-2018-6096

CVE-2018-6096 is a Fullscreen UI spoof vulnerability in Google Chrome/Chromium where a JavaScript window could overlap the fullscreen notification, enabling a remote attacker to obscure the fullscreen warning via a crafted HTML page. Public details confirm the issue affects Chromium/Chrome prior ...

CVE-2018-6098

CVE-2018-6098 refers to a URL spoofing vulnerability in Google Chrome's URL Formatter caused by incorrect handling of confusable characters in IDN homographs. The issue affects Chrome prior to 66.0.3359.117, enabling a remote attacker to perform domain spoofing via a crafted domain name. The publ...

CVE-2018-6132

CVE-2018-6132 corresponds to an uninitialized memory issue in WebRTC within Google Chrome/Chromium prior to 67.0.3396.62. The description states that a remote attacker could obtain potentially sensitive information from process memory via a crafted video file. The connected Debian advisory notes ...

CVE-2021-4053

CVE-2021-4053 affects Chromium-based browsers: a use-after-free in the UI of the Chromium engine before version 96.0.4664.93. Impact per connected sources: remote code execution or content spoofing through crafted content. Affected component: Chromium UI/web UI layer; root cause: use-after-free i...

CVE-2021-4056

CVE-2021-4056 is a type-confusion vulnerability in the loader component of the Chromium browser engine, present in Chrome/Chromium prior to version 96.0.4664.93. A remote attacker could potentially cause arbitrary code execution through a crafted HTML page, as described in multiple vendor advisor...

CVE-2022-3195

The CVE-2022-3195 entry affects Google Chrome/Chromium before version 105.0.5195.125, with an Out-of-bounds write in Storage that enables a remote attacker to trigger memory corruption via a crafted HTML page. The vulnerability is categorized with High severity (CVSSv3.1: AV:N/AC:L/PR:N/UI:R/S:U/...

CVE-2023-4367

CVE-2023-4367 affects Google Chrome/Chromium’s Extensions API. The vulnerability arises from insufficient policy enforcement, enabling a user who installs a crafted malicious extension to bypass enterprise policy. Public advisories and vendor updates reference Chrome/Chromium fixes in the 116.0.5...

CVE-2025-3067

CVE-2025-3067 affects Google Chrome/Chromium on Android via an Inappropriate implementation in Custom Tabs, prior to version 135.0.7049.52. Root cause: flawed handling of UI gestures enabling privilege escalation via a crafted app. Impact per CVE: high confidentiality, integrity, and availability...

CVE-2026-17689

CVE-2026-17689 : Uninitialized Use in ANGLE within Google Chrome prior to 151.0.7922.72 allows a remote attacker to leak cross-origin data via a crafted HTML page. Affected software: Google Chrome (ANGLE component). Root cause: uninitialized use in ANGLE. Impact: cross-origin data leakage as desc...

CVE-2016-5152

CVE-2016-5152 affects OpenJPEG as used by PDFium in Google Chrome prior to 53.0.2785.89 (Windows/OS X) and prior to 53.0.2785.92 (Linux). Root cause: integer overflow in opj_tcd_get_decoded_tile_size in tcd.c, leading to a heap-based buffer overflow when processing crafted JPEG 2000 data, enablin...

CVE-2016-5199

CVE-2016-5199 is a heap corruption issue in the FFmpeg MP4 decoder used by Chromium/Chrome. The off-by-one error can lead to a 0-size allocation and heap-pointer corruption via a crafted video file, potentially allowing remote code execution. Affected software includes Chrome as shipped on Mac, W...

CVE-2018-16077

The CVE-2018-16077 entry concerns Google Chrome (Blink) and is caused by an object lifecycle issue in Blink that allowed a remote attacker to bypass content security policy via a crafted HTML page. Affected: Chrome versions prior to 69.0.3497.81. Impact: content security policy bypass; exploitati...

CVE-2018-17471

CVE-2018-17471 affects Google Chrome/Chromium before 70.0.3538.67, due to a WebContents full-screen UI issue that could enable content spoofing or UI occlusion. Debian and Arch Linux advisories (DSA-4330-1, ASA-201810-12) confirm a remediation by upgrading to 70.0.3538.67-1 (Chromium). Other repo...

CVE-2018-6063

CVE-2018-6063 refers to an issue in Google Chrome/Chromium before 65.0.3325.146 where Mojo's shared memory permissions were mishandled via mojo::WrapSharedMemoryHandle in Mojo. This allowed a remote attacker who had already compromised a renderer process to perform an out-of-bounds memory write v...

CVE-2018-6080

CVE-2018-6080 is an information-disclosure vulnerability in Google Chrome (Chromium base) where lack of access-control checks in Instrumentation allowed a renderer-compromised attacker to obtain memory metadata from privileged processes. The issue affects Chrome prior to 65.0.3325.146 and was cat...

CVE-2021-37998

CVE-2021-37998 is a use-after-free vulnerability in the Garbage Collection component of the Chromium browser engine (Chrome) prior to 95.0.4638.69. The issue could allow a remote attacker to cause heap corruption via a crafted HTML page, potentially enabling arbitrary code execution. Public recor...

CVE-2021-38002

CVE-2021-38002 is a use-after-free in Chrome/Chromium’s Web Transport prior to 95.0.4638.69 that could allow a remote attacker to escape the sandbox via a crafted HTML page. The issue is fixed upstream in version 95.0.4638.69, with advisories confirming upgrade as remediation. Arch Linux ASA entr...

CVE-2021-38022

CVE-2021-38022 affects Google Chrome’s WebAuthentication component in the Chromium engine, with an inappropriate implementation before 96.0.4664.45 that could allow a remote attacker to leak cross-origin data via a crafted HTML page. The issue is described in multiple security entries and advisor...

CVE-2022-0101

The CVE-2022-0101 entry describes a heap buffer overflow in Google Chrome's Bookmarks component, prior to version 97.0.4692.71. The vulnerability could allow a remote attacker to potentially exploit heap corruption if a user is convinced to perform a specific user gesture. Affected product line: ...

CVE-2022-0116

CVE-2022-0116 affects Google Chrome/Chromium. Root cause: inappropriate implementation in Compositing. Impact: remote attacker can spoof the Omnibox (URL bar) via a crafted HTML page. Affected: Chrome/Chromium builds prior to 97.0.4692.71. Mitigation: upgrade to 97.0.4692.71 or newer (per linked ...

CVE-2022-0458

CVE-2022-0458 is a Chrome use-after-free vulnerability in the Thumbnail Tab Strip prior to 98.0.4758.80 that could allow heap corruption via a crafted HTML page. The weakness affects Chrome/Chromium up to version 98.0.4758.80 and was publicly acknowledged in Chrome’s February 2022 stable-channel ...

CVE-2022-4193

CVE-2022-4193 affects Google Chrome/Chromium File System API. Root cause: insufficient policy enforcement allowing a crafted HTML page to bypass file system restrictions. Impact: remote bypass of file system policy with CVSS 3.1 base score 8.8 (High) per NVD; Chrome’s 108.0.5359.71 stable update ...

CVE-2023-1218

The connected Astra Linux security bulletin confirms CVE-2023-1218 affects Chromium/WebRTC, describing a Use-After-Free in Chrome before 111.0.5563.64 that could enable a remote attacker to exploit heap corruption via a crafted HTML page. The vulnerability impact is High, and the stated remediati...

CVE-2026-84359

CVE-2026-84359 is an information leak in the Skia rendering library within Google Chrome prior to 152.0.7977.75 . A remote attacker who had already compromised the renderer process could exploit a crafted HTML page to leak cross-origin data , bypassing same-origin isolation. The vulnerability was...

CVE-2026-8553

Affected product: Google Chrome (GPU/renderer path). Issue: Use-after-free in GPU code leading to an out-of-bounds memory write when a crafted HTML page is processed after compromise of the renderer. Impact: remote attacker could exploit via the compromised renderer process; severity is indicated...

CVE-2013-0894

CVE-2013-0894 affects FFmpeg’s libavcodec vorbis decoding (vorbisdec.c) where a buffer overflow in vorbis_parse_setup_hdr_floors can be triggered by a zero bark-map size. This can cause a denial of service via divide-by-zero or out-of-bounds access, with possible other impact. The description exp...