CVE-2021-30560

CVE-2021-30560 is a use-after-free vulnerability in the Blink XSLT component of the Chromium/Google Chrome rendering engine prior to version 91.0.4472.164. The documented impact is potential heap corruption/execution of arbitrary code via a crafted HTML page. Connected advisories consistently ref...

CVE-2020-6463

CVE-2020-6463 is a use-after-free in ANGLE (affecting Chrome up to version 81.x, per the CVE page). Connected advisories show the same CVE listed in Thunderbird/Firefox-related updates with fixes in 68.11.0 ESR lines and related Red Hat/CentOS advisories. Practical takeaway: to remediate, upgrade...

CVE-2024-7021

An inappropriate implementation in the Autofill component of Google Chrome on Windows (versions prior to 124.0.6367.60 ) allows a remote attacker to perform UI spoofing . By using a specially crafted HTML page , an attacker can replace or misrepresent the user interface to display fraudulent info...

CVE-2025-13097

Google Chrome versions prior to 136.0.7103.59 are affected by an inappropriate implementation in the DevTools component. This flaw stems from a deficiency in the security handling of the sandboxing mechanism , specifically related to an access control flaw in an isolated environment. A remote att...

CVE-2025-13107

A vulnerability in the Compositing component of Google Chrome (prior to version 140.0.7339.80 ) allows a remote attacker to perform UI spoofing or an interface masquerade attack via a specially crafted HTML page. The root cause is an inappropriate implementation and a flaw in the compositing modu...

CVE-2020-6447

CVE-2020-6447 describes an inappropriate implementation in the developer tools of Chromium/Google Chrome prior to 81.0.4044.92, which could allow a remote attacker who convinces a user to use DevTools to potentially exploit heap corruption via a crafted HTML page. Public sources (Arch Linux secur...

CVE-2023-2941

CVE-2023-2941 affects Google Chrome (Extensions API). Inappropriate implementation in the Extensions API prior to 114.0.5735.90 allowed an attacker to spoof the UI contents when a user installed a crafted malicious extension. Impact stated as low severity by Chromium, with exploitation requiring ...

CVE-2025-0434

Google Chrome versions prior to 132.0.6834.83 are vulnerable to an out of bounds memory access in the V8 JavaScript engine. A remote attacker could exploit this to cause heap corruption by navigating to a crafted HTML page . Remediation includes upgrading to the latest stable version; for example...

CVE-2024-11395

A Type Confusion vulnerability exists in the V8 engine of Google Chrome prior to version 131.0.6778.85 . A remote attacker can potentially exploit heap corruption by interacting with a crafted HTML page . This issue has been identified in Chromium , Google Chrome , Microsoft Edge , and Opera brow...

CVE-2024-11920

Google Chrome on Mac is vulnerable to an out-of-bounds memory access due to an inappropriate implementation in the Dawn component. A remote attacker can exploit this by viewing a crafted HTML page , which could lead to unauthorized access to protected information via out-of-bounds write operation...

CVE-2026-19161

A vulnerability exists in the Skia graphic library used by Google Chrome (prior to version 151.0.7922.109 ) due to an uninitialized use error. A remote attacker who has already compromised the renderer process can exploit this flaw to leak cross-origin data by navigating the user to a crafted HTM...

CVE-2026-3909

CVE-2026-3909 is a Google Chrome/Skia vulnerability: an out-of-bounds write in Skia could allow a remote attacker to trigger out-of-bounds memory access via a crafted HTML page. Affects Chrome before 146.0.7680.75; exploits are known to exist in the wild. Chrome/Chromium advisories note that fixe...

CVE-2024-3156

CVE-2024-3156 affects Chromium/Google Chrome via an inappropriate implementation in V8, allowing remote memory-out-of-bounds access through a crafted HTML page on versions prior to 123.0.6312.105. Debian security advisory confirms the fix is in chromium 123.0.6312.105-1~deb12u1 for stable (bookwo...

CVE-2024-2173

CVE-2024-2173 is an out-of-bounds memory access vulnerability in V8 used by Google Chrome/Chromium, with the affected public fix version 122.0.6261.111. Multiple connected sources (Chromium/Chrome release notes, Fedora/Debian security updates, and FreeBSD electron references) confirm the issue an...

CVE-2024-3834

Concrete details found: CVE-2024-3834 affects Google Chrome/Chromium, describing a Use-after-Free in the Downloads component that could enable heap corruption via a crafted HTML page. Affected versions are prior to 124.0.6367.60. The issue has been addressed in newer Chromium/Chrome updates (e.g....

CVE-2024-8035

CVE-2024-8035 affects Google Chrome on Windows prior to 128.0.6613.84, due to an inappropriate implementation in Extensions that enables UI spoofing via a crafted HTML page. Debian security advisory confirms fixed version 128.0.6613.84-1~deb12u1. Remediation: upgrade to 128.0.6613.84 or newer (Ch...

CVE-2023-5346

CVE-2023-5346 affects Google Chrome/Chromium’s V8 engine prior to 117.0.5938.149. A type confusion in V8 could allow a remote attacker to trigger heap corruption via a crafted HTML page, with high severity (CVSS 3.1: 8.8, network attack vector, user interaction required). Affected component is Ch...

CVE-2024-8362

CVE-2024-8362 affects Google Chrome/Chromium WebAudio: a use-after-free in WebAudio leads to potential heap corruption on crafted HTML pages. Affected product/component: Chromium/WebAudio in Chrome prior to 128.0.6613.119. Root cause: use-after-free in WebAudio paths. Impact per sources: remote a...

CVE-2025-6555

Google Chrome versions prior to 138.0.7204.49 are vulnerable to a use after free flaw within the Animation component. This issue stems from a mix-up in instructions responsible for freeing memory, which could allow a remote attacker to exploit heap corruption via a crafted HTML page. Exploitation...

CVE-2018-17466

CVE-2018-17466: Incorrect texture handling in Angle in Chrome prior to 70.0.3538.67 can lead to a remote out-of-bounds memory read via a crafted HTML page. The connected advisories (ALAS2-2019-1168 and related security bulletins) confirm this CVE among a set of issues affecting Thunderbird/Firefo...

CVE-2024-8033

The CVE-2024-8033 issue affects Chromium-based Google Chrome (Windows) through an Inappropriate implementation in WebApp Installs that could allow UI spoofing via a crafted HTML page before the 128.0.6613.84 update. Connected advisories confirm this CVE is among the Chrome/Chromium security fixes...

CVE-2024-7976

CVE-2024-7976 relates to Google Chrome/Chromium FedCM, where an Inappropriate implementation flaw in FedCM prior to 128.0.6613.84 could allow a remote attacker to spoof the UI via a crafted HTML page. The CVE is documented as a Medium-severity issue with network attack vector, low integrity impac...

CVE-2024-7978

CVE-2024-7978 is a Chrome/Chromium vulnerability: Insufficient policy enforcement in Data Transfer allowed cross-origin data leakage via a crafted HTML page when a user engages specific UI gestures. Affected product: Google Chrome/Chromium-based browsers. Root cause: insufficient policy enforceme...

CVE-2024-8904

CVE-2024-8904: Type Confusion in V8 affecting Google Chrome’s Chromium-based stack prior to 129.0.6668.58, enabling potential heap corruption via a crafted HTML page. Connected sources confirm this impacts Chrome/V8 and Chromium builds; Debian and Linux distributions report fixes in 129.0.6668.58...

CVE-2020-6457

CVE-2020-6457 refers to a use-after-free in the speech recognizer of Google Chrome before 81.0.4044.113, which could allow a remote attacker to potentially escape the sandbox via a specially crafted HTML page. The CVE is listed in multiple sources (e.g., Debian security advisories) with remediati...

CVE-2024-3158

CVE-2024-3158 (Chromium/Google Chrome): Use-after-free in Bookmarks handling can lead to heap corruption via a crafted HTML page in Chrome/Chromium before version 123.0.6312.105. A remote attacker could potentially exploit this vulnerability. Affected software/version info in sources shows patche...

CVE-2024-5158

CVE-2024-5158 is a type confusion in V8 in Google Chrome prior to 125.0.6422.76, allowing a remote attacker to potentially perform arbitrary read/write via a crafted HTML page. The vulnerability is documented across multiple sources and mitigations indicate upgrading to Chrome 125.0.6422.76 (stab...

CVE-2025-6558

CVE-2025-6558 involves insufficient validation of untrusted input in ANGLE and GPU within Google Chrome, enabling a remote attacker to potentially escape the sandbox via a crafted HTML page. Connected sources specify Chrome components ANGLE and GPU as affected, with the patch previously shipped i...

CVE-2019-13751

CVE-2019-13751 is a SQLite-related information disclosure in Google Chrome/Chromium. The issue arises from an uninitialized value in the SQLite library, exploited via a crafted HTML page to read potentially sensitive data from the process memory. Publicly documented fixes are included in Chromium...

CVE-2024-3838

CVE-2024-3838 affects Google Chrome/Chromium Autofill: an inappropriate Autofill implementation allowed UI spoofing via a crafted app, when a user is lured to install malware. The issue exists in Chrome prior to 124.0.6367.60; remediation is to upgrade to 124.0.6367.60 or newer. Exploitation deta...

CVE-2024-7975

CVE-2024-7975 corresponds to an Inappropriate implementation in Permissions in Google Chrome/Chromium, enabling UI spoofing via a crafted HTML page. The connected sources confirm the issue affects Chrome/Chromium prior to version 128.0.6613.84, with Medium severity (CVSS 4.3). Debian security adv...

CVE-2025-0444

Use after free in Skia in Google Chrome prior to 133.0.6943.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2026-2323

Google Chrome versions prior to 145.0.7632.45 are vulnerable to a UI spoofing issue due to an inappropriate implementation in the Downloads component. A remote attacker can exploit this via a crafted HTML page to replace the user interface with a malicious one. Impact is categorized as Low severi...

CVE-2019-5785

CVE-2019-5785: An integer overflow in Skia led to potential arbitrary code execution via a crafted HTML page. Affected products include Google Chrome (Skia) prior to 72.0.3626.81 and Mozilla components used by Thunderbird/Firefox (e.g., Skia in Thunderbird before 60.5.1). Mitigation: patch Chrome...

CVE-2026-87491

Google Chrome's V8 engine contains an out-of-bounds write vulnerability (CVE-2026-87491) in the JavaScript script handler. A remote attacker can exploit this by hosting a crafted HTML page to execute arbitrary code inside the sandbox. This vulnerability is confirmed to be exploited in the wild an...

CVE-2024-3847

Google Chrome versions prior to 124.0.6367.60 are vulnerable to a content security policy bypass due to insufficient policy enforcement in the WebUI . A remote attacker can exploit this by navigating the victim to a crafted HTML page . While the Chromium security severity is rated as Low , the vu...

CVE-2024-5830

CVE-2024-5830 is a Type Confusion in V8 affecting Google Chrome/Chromium prior to 126.0.6478.54. A remote attacker could trigger an out-of-bounds memory write via a crafted HTML page. Impact is High (C/H/I/A). Mitigations: update to Chrome 126.0.6478.54 or newer; Debian security advisory shows fi...

CVE-2026-19146

Google Chrome on Android (prior to version 151.0.7922.109 ) is vulnerable to an Uninitialized Use in the GPU component. A remote attacker who has already compromised the renderer process can leverage a crafted HTML page to extract sensitive information from process memory. This vulnerability has ...

CVE-2024-12381

CVE-2024-12381 is a type confusion vulnerability in V8 for Google Chrome before 131.0.6778.139 that could allow a remote attacker to cause heap corruption via a crafted HTML page. The connected release notes confirm the flaw and assign high severity; Debian security advisory also references the i...

CVE-2024-7970

CVE-2024-7970: Out-of-bounds write in V8 used by Google Chrome prior to 128.0.6613.119 can allow a remote attacker to potentially cause heap corruption via a crafted HTML page. Affected component is Chrome/Chromium’s V8 engine; impact is high (remote code execution/compromise of confidentiality, ...

CVE-2019-5782

Google Chrome is vulnerable to arbitrary code execution within a sandbox due to incorrect optimization assumptions in the V8 JavaScript engine 's TurboFan typer module. Specifically, the compiler incorrectly infers the type range for the arguments.length property during Function.prototype.apply, ...

CVE-2023-5485

CVE-2023-5485 affects Google Chrome/Chromium: an inappropriate Autofill implementation prior to 118.0.5993.70 allows a remote attacker to bypass Autofill restrictions via a crafted HTML page. The vulnerability is characterized with a Low Chromium security severity and a Medium CVSS v3.1 base scor...

CVE-2024-8636

Summary: CVE-2024-8636 describes a heap buffer overflow in Skia used by Google Chrome/Chromium, before version 128.0.6613.137, allowing a remote attacker to trigger heap corruption via a crafted HTML page (Chromium severity: High). Affected software (per connected docs): Google Chrome/Chromium wi...

CVE-2025-0612

Google Chrome versions prior to 132.0.6834.110 are vulnerable to an out-of-bounds memory access within the V8 engine. This flaw allows a remote attacker to potentially exploit heap corruption by hosting a crafted HTML page. The vulnerability has been identified in Chromium , Google Chrome , Micro...

CVE-2026-3941

A security bypass vulnerability exists in the DevTools component of Google Chrome (and related Chromium projects) due to insufficient policy enforcement . A remote attacker can exploit this by using a crafted HTML page to bypass navigation restrictions. This issue affects versions prior to 146.0....

CVE-2024-3837

CVE-2024-3837 is a Chrome/Chromium vulnerability described as a use-after-free in QUIC that could allow heap corruption when a renderer process is compromised. Affected software is Google Chrome/Chromium prior to version 124.0.6367.60. The underlying issue is triggered by crafted HTML pages, with...

CVE-2024-6990

CVE-2024-6990 concerns Google Chrome on Android (Dawn) with uninitialized use, allowing potential out-of-bounds memory access via a crafted HTML page. Affected component: Dawn in Chromium-based Chrome; root cause per sources is uninitialized use. Impact as described: potential remote code executi...

CVE-2024-7969

CVE-2024-7969 is a Type Confusion in V8 affecting Google Chrome/Chromium up to version 128.0.6613.113, enabling remote heap corruption via a crafted HTML page. Public notices indicate fixes in Chrome/Chromium channels to 128.0.6613.113 (and 128.0.6613.114 for some channels); Debian advisories als...

CVE-2025-2476

A use-after-free vulnerability in the Lens component of Google Chrome prior to version 134.0.6998.117 allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This issue is classified as Critical by Chromium security. Impacted software includes Chromium , Google Ch...

CVE-2024-3839

CVE-2024-3839 describes an out-of-bounds read in Fonts in Google Chrome/Chromium, allowing a remote attacker to potentialy read sensitive data from process memory via a crafted HTML page. Connected sources corroborate the issue across Chromium-based products (Astra Linux, Debian chromium security...