CVE-2023-6703

CVE-2023-6703 is a use-after-free in Blink affecting Chromium-based browsers (notably Google Chrome) before version 120.0.6099.109. The issue enables potential heap corruption via a crafted HTML page and is rated High. Publicly documented fixes include Chromium/Chromium-derived patches in various...

CVE-2026-14136

CVE-2026-14136 affects Chrome for iOS (Google Chrome on iOS) prior to 150.0.7871.47, due to insufficient validation of untrusted input. A remote attacker could trigger UI spoofing by presenting a crafted HTML page. The vulnerability is documented across multiple feeds (NVD, Debian, EUVD, CVE list...

CVE-2017-5110

CVE-2017-5110 affects Chromium/Chrome Web Payments, specifically the payments dialog spoofing vulnerability in the Omnibox/payment UI. The root cause is an inappropriate implementation of the web payments API on blob: and data: schemes, enabling a remote attacker to spoof the Omnibox contents via...

CVE-2018-6069

CVE-2018-6069: Stack overflow in Skia used by Google Chrome prior to 65.0.3325.146 allows remote code access via a crafted HTML page (out-of-bounds read). Affected software is Google Chrome/Chromium with Skia; remediation is upgrading to Chrome 65.0.3325.146+ or Chromium package versions that inc...

CVE-2018-6140

CVE-2018-6140 affects Google Chrome’s debugger extension API: before 67.0.3396.62, a crafted Chrome Extension could bypass restrictions and lead to arbitrary code execution if a user installs the malicious extension. The issue is tied to the debugger extension API in DevTools. Remediation in the ...

CVE-2021-4066

CVE-2021-4066 is an integer underflow in the ANGLE component of the Chromium browser engine, present before version 96.0.4664.93. The vulnerability could allow a remote attacker to cause heap corruption through crafted HTML/web content, potentially enabling arbitrary code execution. Concrete refe...

CVE-2022-0117

Consolidated details for CVE-2022-0117: A policy bypass in Blink (Chrome) prior to 97.0.4692.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Affected component is Blink in Google Chrome; underlying issue is policy restrictions bypass. Impact is cross-origin data di...

CVE-2022-1308

CVE-2022-1308 affects Google Chrome (BFCache) with use-after-free in BFCache prior to 100.0.4896.88, enabling potential heap corruption via a crafted HTML page. The issue is associated with Chrome/Chromium family components and is reflected in multiple advisories (Chromium/Chrome updates). Affect...

CVE-2022-3307

CVE-2022-3307 affects Google Chrome/Chromium media module: Use after free leading to potential heap corruption via a crafted HTML page. Affected versions prior to 106.0.5249.62. The Chrome update to 106.x (stable channel 106.0.5249.61/62 and later) includes fixes for this use-after-free in Media;...

CVE-2023-0704

CVE-2023-0704 affects Google Chrome/Chromium DevTools. The issue is an insufficient policy enforcement flaw that allowed a remote attacker to bypass the same-origin policy and proxy settings via a crafted HTML page. Affected versions are prior to 110.0.5481.77. Chrome’s security fixes released in...

CVE-2025-1915

CVE-2025-1915 affects Google Chrome on Windows with a DevTools path handling issue. An attacker could entice a user to install a crafted Chrome Extension to bypass file access restrictions, enabling high-impact access (CVE score 8.1, HIGH) when the user is convinced to install the malicious exten...

CVE-2026-13981

CVE-2026-13981: In Chrome for iOS, Google Chrome on iOS contains an inappropriate implementation that enables UI spoofing via a crafted HTML page. Affected product is Chrome for iOS; root cause is an implementation flaw in the iOS build. Impact stated: remote attacker could perform UI spoofing. R...

CVE-2026-5289

CVE-2026-5289 affects Google Chrome prior to version 146.0.7680.178, describing a use-after-free in the Navigation component that could allow a remote attacker who already compromised the renderer process to escape the sandbox via a crafted HTML page. The vulnerability is categorized as High seve...

CVE-2013-0900

CVE-2013-0900 describes a race-condition vulnerability in the ICU library used by Google Chrome (and other ICU-dependent software). The issue could allow a remote attacker to cause a denial of service or potentially other impact via crafted ICU data, with remediation provided by upgrading ICU to ...

CVE-2018-16081

CVE-2018-16081 affects Chromium/Chrome where the chrome.debugger API could run on file:// URLs in DevTools, enabling a remote-style attacker who persuades a user to install a malicious extension to access local files without file access permission. The vulnerability stems from DevTools allowing l...

CVE-2018-6129

CVE-2018-6129 is a WebRTC-related out-of-bounds read affecting Google Chrome prior to 67.0.3396.62. A remote attacker could trigger memory access violations by-serving a crafted HTML page, via unverified RTP packet handling in WebRTC. The record states no exploit details beyond that the issue is ...

CVE-2018-6170

CVE-2018-6170 refers to a type confusion/bad cast in PDFium used by Google Chrome, affecting versions prior to 68.0.3440.75. The vulnerability enables a crafted PDF to trigger heap corruption, with CVSS3 base score 8.8 (HIGH) and CVSS2 6.8 (MEDIUM). Affected product: Google Chrome (PDFium compone...

CVE-2021-37990

CVE-2021-37990 describes an inappropriate implementation in the WebView component of the Chromium browser engine on Android prior to 95.0.4638.54. The issue allows a remote attacker to leak cross-origin data through a crafted Android app, i.e., data exfiltration from cross-origin contexts via Web...

CVE-2021-4067

CVE-2021-4067: A use-after-free in the Chromium window manager before version 96.0.4664.93 allows a remote attacker to potentially execute arbitrary code or spoof content through crafted web content. Affected product: Chromium browser engine (window manager component). Root cause: use-after-free ...

CVE-2022-2858

CVE-2022-2858 affects Google Chrome/Chromium: a use-after-free in the Sign-In Flow can lead to heap corruption via specific UI interactions. Affected products/versions are Chromium/Chrome before 104.0.5112.101; Debian and other trackers note the fix in 104.0.5112.101 (or later) for Chromium. Expl...

CVE-2022-3057

CVE-2022-3057 affects Google Chrome prior to 105.0.5195.52, where an inappropriate implementation in the iframe Sandbox could allow a remote attacker to leak cross-origin data via a crafted HTML page. Affected product: Google Chrome (iframe Sandbox component). Root cause per sources: flawed Sandb...

CVE-2022-4190

CVE-2022-4190 affects Google Chrome/Chromium prior to version 108.0.5359.71, due to insufficient data validation in Directory. A remote attacker could bypass file system restrictions via a crafted HTML page. The Chrome blog release notes document fixes for this and related CVEs; chromium/chrome m...

CVE-2022-4440

CVE-2022-4440 affects Google Chrome (Chromium-based) Profiles. It is a use-after-free vulnerability in Profiles that could allow a remote attacker to exploit heap corruption via a crafted HTML page. Affected versions are prior to 108.0.5359.124. Remediation (where applicable) includes upgrading t...

CVE-2026-14123

CVE-2026-14123 affects Google Chrome on iOS (Chrome for iOS) prior to version 150.0.7871.47. The flaw is an incorrect security UI that allows a remote attacker to spoof the Omnibox (URL bar) via a crafted HTML page. This is a UI rendering issue, not a network-processing flaw, potentially misleadi...

CVE-2026-16413

CVE-2026-16413 is an out-of-bounds write in ANGLE used by Google Chrome (Chromium-based) prior to 150.0.7871.182, potentially enabling a sandbox escape when a renderer process is compromised via a crafted HTML page. Connected sources confirm the issue in ANGLE and identify affected Chrome/Chromiu...

CVE-2026-17981

CVE-2026-17981: In Blink (Google Chrome), an inappropriate implementation allowed a remote attacker to leak cross-origin data via a crafted HTML page. Affected: Chrome prior to 151.0.7922.72. Impact per provided metrics: Confidentiality: Low; Integrity/Availability: None. Severity: Medium (CVSS 3...

CVE-2026-19140

CVE-2026-19140 is a GPU use-after-free vulnerability in Google Chrome prior to 151.0.7922.109 that could allow a remote attacker who compromised the renderer process to potentially escape the sandbox via a crafted HTML page. The issue affects Chrome's GPU path and is documented across the CVE/NVD...

CVE-2026-19164

CVE-2026-19164 concerns Google Chrome: insubstantial validation of untrusted input in the Codecs component allowed a remote attacker to potentially escape the sandbox via a crafted HTML page. Affected software is Chrome prior to version 151.0.7922.109 (stable channel). The underlying issue is in ...

CVE-2026-79041

CVE-2026-79041 is a missing authorization flaw in the Browser component of Google Chrome on Mac , affecting versions prior to 152.0.7977.65 . A remote attacker can leverage social engineering to trick a user into opening a crafted HTML page, which bypasses the web origin policy and grants access ...

CVE-2017-5088

CVE-2017-5088 refers to an out-of-bounds read vulnerability in the V8 JavaScript engine of Google Chrome/Chromium before version 59.0.3071.104 (Android: 59.0.3071.117). The issue arises from insufficient validation in V8, allowing a remote attacker to read memory via a crafted HTML page. Public a...

CVE-2018-18348

CVE-2018-18348 concerns the Chrome/Chromium Omnibox: a bug in the handling of bidirectional domain names with RTL characters allowed remote spoofing of the URL bar. The issue arises from an incorrect Omnibox implementation in Chromium-based browsers before version 71.0.3578.80, enabling a crafted...

CVE-2018-6072

CVE-2018-6072 is a PDFium-related vulnerability in Google Chrome prior to 65.0.3325.146. Description: an integer overflow in the PDFium library could lead to heap corruption, potentially exploitable via a crafted PDF file. Connected sources confirm PDFium involvement and the Chrome 65.0.3325.146 ...

CVE-2018-6074

Google Chrome prior to version 65.0.3325.146 is vulnerable to a Mark-of-the-Web bypass in downloads. The root cause is the failure to apply the Mark-of-the-Web on downloaded pages, enabling a remote attacker to bypass OS-level protections via a crafted HTML page. The vulnerability is addressed in...

CVE-2018-6078

CVE-2018-6078 describes a URL spoofing vulnerability in Google Chrome’s Omnibox (URL bar) caused by incorrect handling of confusable characters. The issue affects Chrome prior to version 65.0.3325.146, enabling a remote attacker to spoof the displayed URL via a crafted domain name. The vulnerabil...

CVE-2018-6082

CVE-2018-6082 affects Google Chrome/Chromium prior to 65.0.3325.146. The entry describes a vulnerability where including port 22 among allowed FTP ports in Chrome’s Networking could let a remote attacker enumerate internal host services via a crafted HTML page. The connected Chrome security updat...

CVE-2018-6094

CVE-2018-6094 affects Google Chrome/Chromium, where a regression in GarbageCollection (Oilpan) could enable a remote attacker to exploit heap corruption via a crafted HTML page. The vulnerability is documented as fixed in Chrome/Chromium around version 66.0.3359.117 (e.g., Debian/ Gentoo advisori...

CVE-2018-6133

CVE-2018-6133 affects Google Chrome/Chromium URL formatting: incorrect handling of confusable characters in the URL Formatter allowed domain spoofing via IDN homographs. Affected versions are Chrome prior to 67.0.3396.62 (Chromium before 67.0.3396.62). The CNVD entry notes an attacker could explo...

CVE-2018-6178

CVE-2018-6178 is a UI spoofing vulnerability in Google Chrome/Chromium extensions. A crafted extension could elide or misrepresent UI in the DevTools/infobar flow, enabling a remote attacker to hide Chrome security UI. Affected product: Chromium/Chrome prior to 68.0.3440.75. Root cause: UI spoofi...

CVE-2021-4065

CVE-2021-4065 is a concrete Chrome/Chromium use-after-free in the autofill component, before version 96.0.4664.93. The connected advisories (Arch Linux ASA-202112-6 and ASA-202112-7, Debian DSA-5046-1) describe the issue as an arbitrary code execution risk via crafted content and note remediation...

CVE-2022-0113

The CVE-2022-0113 issue concerns Google Chrome/Blink: an inappropriate implementation in Blink prior to 97.0.4692.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Affected product: Chrome/Chromium (Blink). Root cause as stated: improper Blink behavior enabling cross...

CVE-2022-0114

CVE-2022-0114 affects Google Chrome/Chromium through the Blink Serial API. The flaw is an out-of-bounds memory access in Blink Serial API that could allow a remote attacker to perform an out-of-bounds memory read via a crafted HTML page and virtual serial port driver. Affected versions are Chrome...

CVE-2022-3316

CVE-2022-3316 describes an Insufficient validation of untrusted input in Safe Browsing in Google Chrome (Chromium) prior to 106.0.5249.62. The vulnerability allows a remote attacker to bypass a security feature via a crafted HTML page, with network attack vector, low severity, and a medium base C...

CVE-2023-1226

The CVE-2023-1226 entry concerns Google Chrome’s Web Payments API: insufficient policy enforcement allowed CSP bypass via a crafted HTML page, affecting Chromium prior to 111.0.5563.64. The Connected Astra Linux bulletin mirrors this Chrome vulnerability. The impact is a bypass of content securit...

CVE-2023-1227

CVE-2023-1227 impact: Use-after-free in Core of Google Chrome on Lacros prior to 111.0.5563.64, enabling potential heap corruption via crafted UI interaction. Documents indicate a Chromium/Chrome fix packaged as Chromium 111.0.5563.64 (and related Fedora Chromium update), addressing the vulnerabi...

CVE-2026-13939

CVE-2026-13939 concerns Google Chrome on Android. The issue arises from insufficient validation of untrusted input in WebShare, allowing a remote attacker who has compromised the renderer process to perform UI spoofing via a crafted HTML page. Affected version range is Chrome on Android prior to ...

CVE-2026-14126

CVE-2026-14126 describes an issue in Google Chrome on Android prior to 150.0.7871.47 where an incorrect security UI could allow a remote attacker to spoof the domain through a crafted HTML page. The vulnerability is associated with Chromium security (severity: Low) and is exploitable via network ...

CVE-2026-1504

CVE-2026-1504 concerns the Background Fetch API in Chromium/Google Chrome, where an inappropriate implementation allowed a remote attacker to leak cross-origin data via a crafted HTML page. Affected software is Chromium/Chrome prior to 144.0.7559.110 (per the initial description). The root cause ...

CVE-2026-17875

CVE-2026-17875 is a use-after-free in PDFium used by Google Chrome (desktop) prior to 151.0.7922.72. The vulnerability allows a remote attacker to execute arbitrary code inside the Chrome sandbox via a crafted PDF file. The description and connected sources confirm the underlying issue as a PDFiu...

CVE-2026-17912

CVE-2026-17912 : In Chrome for iOS (Google Chrome on iOS), versions prior to 151.0.7922.72 are affected by an inappropriate implementation that allows a remote attacker to bypass navigation restrictions via a crafted HTML page. The vulnerability is described as low severity in Chromium, with expl...

CVE-2026-17980

CVE-2026-17980 is tied to Google Chrome on Android, with an inappropriate UI implementation prior to version 151.0.7922.72 . The vulnerability allows a remote attacker to leak cross-origin data by persuading a user to perform specific UI gestures on a crafted HTML page. The impact is described as...