CVE-2026-8553

Affected product: Google Chrome (GPU/renderer path). Issue: Use-after-free in GPU code leading to an out-of-bounds memory write when a crafted HTML page is processed after compromise of the renderer. Impact: remote attacker could exploit via the compromised renderer process; severity is indicated...

CVE-2013-0894

CVE-2013-0894 affects FFmpeg’s libavcodec vorbis decoding (vorbisdec.c) where a buffer overflow in vorbis_parse_setup_hdr_floors can be triggered by a zero bark-map size. This can cause a denial of service via divide-by-zero or out-of-bounds access, with possible other impact. The description exp...

CVE-2016-5129

CVE-2016-5129 refers to a memory corruption vulnerability in Google V8 (the JavaScript engine) used by Google Chrome. According to the sources, V8 before 5.2.361.32 on Chrome before 52.0.2743.82 fails to properly process left-trimmed objects, which could be exploited by crafted JavaScript to caus...

CVE-2018-17459

CVE-2018-17459 describes an issue in Google Chrome where the Omnibox (URL bar) could be spoofed due to incorrect handling of clicks in the omnibox during Navigation. A crafted HTML page could trigger this to mislead users. The vulnerability affects Chrome versions prior to 69.0.3497.92, with impa...

CVE-2018-18343

CVE-2018-18343 affects Chromium/Chrome with a use-after-free in Skia prior to 71.0.3578.80. The issue is triggered via crafted HTML and can lead to heap corruption and remote code execution. Affected component: Skia (Chromium/WebKit rendering stack). The Arch Linux ASA-201812-2 entry confirms a s...

CVE-2018-18352

CVE-2018-18352 affects Chromium/Google Chrome Media handling, where cross-origin audio could be accessed due to an inappropriate implementation that bypassed the same-origin policy for audio content via crafted HTML. The issue is fixed in Chromium up to version 71.0.3578.80; upstream patches exis...

CVE-2018-6081

CVE-2018-6081 affects Google Chrome interstitials; a cross-site scripting flaw in Chrome prior to 65.0.3325.146 could be triggered by convincing a user to install a malicious extension or open Developer Console, via a crafted HTML page. Connected advisories confirm patches: Debian fixes in Chrome...

CVE-2018-6093

CVE-2018-6093 affects Google Chrome/Chromium Blink: a vulnerability in origin checks that could allow a remote attacker to bypass same-origin protections and leak cross-origin data via crafted HTML. The issue is listed as a Same Origin Policy bypass in Service Worker/Blink components. Debian and ...

CVE-2018-6123

CVE-2018-6123 is a use-after-free in Blink of Google Chrome prior to 67.0.3396.62, enabling a remote attacker to potentially corrupt the heap via a crafted HTML page. CNVD catalogs this Chrome/Blink memory misuse; Debian advisories note fixes in Chrome 67.0.3396.87 and later. Remediation: upgrade...

CVE-2018-6166

CVE-2018-6166: Google Chrome (Omnibox/URL Formatter) contains a URL spoofing vulnerability due to incorrect handling of confusable characters, enabling domain spoofing via IDN homographs. Affects Chrome up to 68.0.3440.75; fixed in 68.0.3440.75 (Chromium) with security updates across distribution...

CVE-2021-4052

CVE-2021-4052 describes a use-after-free bug in the Chromium-based Chrome engine before version 96.0.4664.93, affecting the web apps component. An attacker could convince a user to install a crafted extension, potentially enabling heap corruption and arbitrary code execution. Publicly documented ...

CVE-2022-0305

CVE-2022-0305 involves an Inappropriate implementation in Chrome’s Service Worker API. Multiple connected advisories confirm the vulnerability affects Google Chrome prior to 97.0.4692.99, where a compromised renderer process could bypass site isolation via a crafted HTML page. The issue is identi...

CVE-2022-4191

CVE-2022-4191 affects Google Chrome/Chromium Sign-In. Root cause: use-after-free leading to potential heap corruption on profile destruction. Vulnerable upstream builds prior to 108.0.5359.71; fixed in Chrome 108.0.5359.71 (and the corresponding Debian package update 108.0.5359.71-2~deb11u1). Exp...

CVE-2022-4907

CVE-2022-4907 describes an uninitialized-use flaw in FFmpeg used by Google Chrome prior to 108.0.5359.71, allowing a remote attacker to run arbitrary code in a sandbox via a crafted HTML page. Public connected advisories map this to FFmpeg and Chromium components and indicate remediation through ...

CVE-2026-11199

CVE-2026-11199 affects Google Chrome WebRTC. The issue is described as an “inappropriate implementation” in WebRTC that, in Chrome versions prior to 149.0.7827.53, could allow a privileged-network attacker to leak cross-origin data via malicious network traffic. The CVE is categorized with a Chro...

CVE-2026-18016

CVE-2026-18016 affects Chrome for iOS (Google Chrome on iOS) before version 151.0.7922.72. The issue is described as insufficient policy enforcement, enabling a remote attacker to perform UI spoofing via a crafted HTML page. The documented impact is limited to UI spoofing with a Low severity in C...

CVE-2026-7937

Summary (concrete details from sources): CVE-2026-7937 concerns insufficient policy enforcement in Chrome’s DevTools that could allow an attacker, if a user installs a crafted malicious Chrome Extension, to bypass navigation restrictions. The issue is tied to Chrome before version 148.0.7778.96. ...

CVE-2016-5128

CVE-2016-5128 refers to a Same-Origin Policy bypass in the V8 JavaScript engine used by Google Chrome/Chromium. Objects.cc in V8 before 5.2.361.27 allowed API interceptors to modify a store target without setting a property, enabling a crafted website to bypass SOP. Affected products/versions cit...

CVE-2018-18340

CVE-2018-18340 affects Chromium/Google Chrome MediaRecorder. The vulnerability is a use-after-free in the MediaRecorder implementation, leading to potential heap corruption and remote code execution via a crafted HTML page. Affected version range is before 71.0.3578.80 (the fix version per upstre...

CVE-2018-18355

Affected software: Google Chrome (and Chromium) prior to version 71.0.3578.80. Issue: CVE-2018-18355 is a policy enforcement/URL Formatter vulnerability caused by incorrect handling of confusable characters, allowing a remote attacker to spoof the Omnibox (address bar) with a crafted domain name....

CVE-2018-6088

CVE-2018-6088 affects Google Chrome/Chromium via a use-after-free in the PDFium library. The issue allows remote code execution inside the sandbox when processing crafted PDFs, currently mitigated by updating to Chrome/Chromium 66.0.3359.117 (and similarly updated Chromium packages in Debian/Fedo...

CVE-2018-6112

CVE-2018-6112 concerns Google Chrome/Chromium DevTools where the DevTools component mishandled URLs, enabling a remote attacker to bypass navigation restrictions via a crafted HTML page. The vulnerability is described as an incorrect handling of URLs in DevTools, leading to navigation bypass. Pub...

CVE-2018-6173

CVE-2018-6173 affects Google Chrome/Chromium Omnibox (URL bar) via URL spoofing by confusable characters in the URL Formatter, prior to version 68.0.3440.75. Connected sources confirm URL spoofing in Omnibox with Chrome/Chromium and list upgrades to 68.0.3440.75 as remediation; no explicit exploi...

CVE-2021-37994

CVE-2021-37994 affects the iFrame Sandbox component in Chromium/Google Chrome prior to version 95.0.4638.54. The root cause is an inappropriate implementation in iFrame Sandbox that lets a remote attacker bypass navigation restrictions via a crafted HTML page. The issue is mitigated by upgrading ...

CVE-2021-38010

CVE-2021-38010 : In Chromium (Google Chrome/Chromium) the service workers component had an inappropriate implementation flaw before version 96.0.4664.45 that allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. The practical impact i...

CVE-2022-0793

CVE-2022-0793 is a Use-After-Free in the Cast component of Google Chrome prior to 99.0.4844.51 that can be triggered by convincing a user to install a malicious extension and perform specific interactions, potentially causing heap corruption. The issue is documented across multiple sources (e.g.,...

CVE-2022-3045

CVE-2022-3045 describes insufficient validation of untrusted input in V8 affecting Google Chrome/Chromium prior to 105.0.5195.52, enabling potential heap corruption via a crafted HTML page. Connected documents corroborate the same issue in Chromium/Chrome and reference fixes in the 105.0.5195.52 ...

CVE-2023-0701

CVE-2023-0701 describes a heap buffer overflow in the WebUI of Google Chrome before 110.0.5481.77. The flaw can be triggered by a remote attacker who convinces a user to perform specific UI interactions, potentially leading to heap corruption via the UI. Affected software: Google Chrome/Chromium ...

CVE-2023-0702

CVE-2023-0702 affects Google Chrome/Chromium: Type Confusion in Data Transfer leading to potential heap corruption via a crafted HTML page, exploitable after user interactions. Fixed in Chrome/Chromium updates (110.0.5481.77+. Users should upgrade to the latest Chrome/Chromium release (e.g., 110....

CVE-2009-2416

CVE-2009-2416 is a use-after-free in libxml2 (versions 2.5.10, 2.6.16, 2.6.26, 2.6.27, 2.6.32) and libxml 1.8.17 triggered by crafted Notation/Enumeration attribute types in a DTD; leads to denial of service (application crash). Related CVE-2009-2414 is a stack-growth DoS via deep DTD structures....

CVE-2017-5094

CVE-2017-5094: Type confusion in the extensions JavaScript bindings of Chromium/Google Chrome before 60.0.3112.78. Affected component is the extensions subsystem; root cause described as a type confusion. Impact stated across connected advisories: remote attacker could potentially maliciously mod...

CVE-2018-16074

CVE-2018-16074 affects Google Chrome/Chromium site isolation: insufficient policy enforcement allowed a remote attacker to bypass site isolation via a crafted HTML page. Affected versions are before 69.0.3497.81. Remediation: update to Chrome/Chromium 69.0.3497.81 or newer. Exploitation details a...

CVE-2018-18347

CVE-2018-18347 affects Chromium/WebKit’s Navigation component. A flaw in handling failed navigations with invalid URLs allowed a remote attacker to craft an HTML page that tricks a user into running JavaScript in an arbitrary origin. The Arch Linux advisory (ASA-201812-2) and Debian advisories no...

CVE-2018-6076

CVE-2018-6076 affects Google Chrome (Blink) where URL fragment identifiers were not encoded correctly, enabling a remote attacker to trigger a DOM-based XSS via a crafted HTML page. Concrete details in connected records place the vulnerable component in Blink/Chrome prior to version 65.0.3325.146...

CVE-2018-6127

CVE-2018-6127 affects Chromium/Google Chrome before version 67.0.3396.62, where a use-after-free in IndexedDB could be triggered by a crafted HTML page from a compromised renderer, potentially enabling sandbox escape and arbitrary code execution. Public advisories (e.g., Debian DSA-4237-1) indica...

CVE-2018-6134

Chrome Blink vulnerability CVE-2018-6134: information leak via bypass of the No-Referrer policy in a crafted HTML page, affecting Chrome prior to 67.0.3396.62. Remediation demonstrated by Debian advisories: update to 67.0.3396.87-1~deb9u1 (and newer).

CVE-2018-6172

CVE-2018-6172 affects Google Chrome (Omnibox/URL Formatter). The vulnerability arises from incorrect handling of confusable characters in the URL formatter, allowing a remote attacker to spoof a domain via IDN homographs in a crafted domain name. Affected product/versions: Google Chrome prior to ...

CVE-2021-30543

CVE-2021-30543 affects Google Chrome’s Tab Strip in versions prior to 91.0.4472.77. A use-after-free in the Tab Strip component could be triggered when a user is convinced to install a malicious extension and visit a crafted HTML page, potentially enabling heap corruption and arbitrary code execu...

CVE-2021-37985

Chromium/Google Chrome 95.x before 95.0.4638.54 is affected by CVE-2021-37985 due to a use-after-free in the V8 engine. The issue enables arbitrary code execution or memory corruption when a user is coaxed into loading crafted content, with impact described as remote code execution and potential ...

CVE-2021-38011

CVE-2021-38011 is a use-after-free in the storage foundation of the Chromium browser engine, affecting Chromium before 96.0.4664.45. The initial description states a remote attacker could cause heap corruption via a crafted HTML page, enabling arbitrary code execution, with impact on at least the...

CVE-2021-4054

CVE-2021-4054 affects Google Chrome/Chromium autofill UI prior to 96.0.4664.93. The root cause is an incorrect security UI in the autofill path, allowing a remote attacker to spoof the displayed domain via a crafted HTML page. Affected component: Chromium browser engine’s autofill UI. Impact: dom...

CVE-2022-0295

CVE-2022-0295 is a Use-After-Free vulnerability in Chrome/Chromium’s Omnibox. The connected sources describe a heap-corruption risk when a user is enticed to perform specific interactions via a crafted HTML page, with the issue reported for Chrome prior to version 97.0.4692.99. The Chrome securit...

CVE-2022-0307

CVE-2022-0307 is a use-after-free in Google Chrome’s Optimization Guide component, potentially enabling heap corruption when a user is convinced to interact with crafted HTML. Affects Chrome prior to 97.0.4692.99. Google's Stable Channel and Chrome release notes confirm a security fix in version ...

CVE-2022-2853

CVE-2022-2853 : A heap buffer overflow in Google Chrome for Android, related to the Downloads component, exists in versions before 104.0.5112.101. The issue can be exploited by a remote attacker who has compromised the renderer process via a crafted HTML page, potentially causing heap corruption....

CVE-2022-2855

CVE-2022-2855 is a use-after-free in ANGLE affecting Google Chrome/Chromium prior to 104.0.5112.101, potentially enabling a remote attacker to trigger heap corruption via a crafted HTML page. The core issue is in ANGLE, leading to high-severity impact (CVE referenced with base score 8.8). Remedia...

CVE-2025-3068

CVE-2025-3068 – Google Chrome on Android : An inappropriate implementation in Intents allows privilege escalation via a crafted HTML page. Affected software is Chrome for Android (pre-135.0.7049.52). The underlying issue is in the Intents handling path, enabling a remote attacker to escalate priv...

CVE-2026-13973

CVE-2026-13973 affects Google Chrome UI handling: an inappropriate UI implementation prior to version 150.0.7871.47 allows a remote attacker to spoof UI via a crafted HTML page when a user is guided to perform specific UI gestures. The vulnerability is described across NVD/ENISA/CVE records with ...

CVE-2026-14075

Technical details are not publicly available in the provided documents; the reports describe the vulnerability at a high level (no specifics on affected products/versions, exploitability, or fixes). Monitor for updates.

CVE-2011-1187

CVE-2011-1187 affects Google Chrome prior to 10.0.648.127, allowing remote attackers to bypass the Same Origin Policy via an unspecified error-message leak vector. The vulnerability targets the browser’s SOP checks, enabling cross-origin access that should be restricted. Public sources within the...

CVE-2017-5121

CVE-2017-5121 concerns the Chromium/Google Chrome V8 component. Reports in the connected sources confirm an out-of-bounds memory access in V8 before version 61.0.3163.100, enabling a remote attacker to execute arbitrary code within the Chrome sandbox on Linux, Windows, and Mac via a crafted page....