CVE-2026-17980

CVE-2026-17980 is tied to Google Chrome on Android, with an inappropriate UI implementation prior to version 151.0.7922.72 . The vulnerability allows a remote attacker to leak cross-origin data by persuading a user to perform specific UI gestures on a crafted HTML page. The impact is described as...

CVE-2026-7949

CVE-2026-7949 : Out-of-bounds read in Skia used by Google Chrome before 148.0.7778.96 allows a remote attacker who has compromised the renderer process to leak cross-origin data via a crafted Chrome Extension. Affected: Google Chrome/Skia stack; Root cause: out-of-bounds read in Skia. Impact: pot...

CVE-2026-84358

CVE-2026-84358 is a Medium -severity improper privilege management flaw in the Downloads component of Google Chrome prior to 152.0.7977.75 . A remote attacker who had already compromised the renderer process could use a crafted HTML page to spoof the address bar , potentially misleading users int...

CVE-2026-8541

CVE-2026-8541 describes an out-of-bounds read in Google Chrome UI that could allow a remote attacker—who has already compromised the renderer process—to read potentially sensitive data from process memory via a crafted HTML page. The issue affects Chrome versions prior to 148.0.7778.168. The vuln...

CVE-2017-5054

CVE-2017-5054 is an out-of-bounds read in V8 that affects Google Chrome prior to 57.0.2987.133 on Linux, Windows and macOS (57.0.2987.132 on Android). This vulnerability lets a remote attacker obtain heap memory contents via a crafted HTML page, with the desktop impact including potential arbitra...

CVE-2018-16085

CVE-2018-16085 describes a use-after-free in ResourceCoordinator in Google Chrome prior to 69.0.3497.81. This could enable a remote attacker to cause heap corruption via a crafted HTML page. A fix is available in Chrome 69.0.3497.81 and later. Other connected records corroborate the Chrome/Resour...

CVE-2018-6106

CVE-2018-6106 affects the Chromium/Google Chrome stack (Chromium project) and is tied to the V8 JavaScript engine. The issue arises with an asynchronous generator that may return an incorrect state, allowing a remote attacker to potentially exploit object corruption via a crafted HTML page. Publi...

CVE-2018-6108

CVE-2018-6108 affects Google Chrome/Chromium URL Formatter, where incorrect handling of confusable characters (IDN homographs) could enable domain spoofing via a crafted HTML page. Affected product: Google Chrome (and Chromium) prior to Chrome 66.0.3359.117. Root cause: misprocessing of internati...

CVE-2018-6159

CVE-2018-6159 affects Google Chrome/Chromium via an information-disclosure vulnerability in ServiceWorker caused by insufficient policy enforcement, allowing a crafted HTML page to access potentially sensitive data from process memory. Public references (including Debian security advisories) indi...

CVE-2018-6171

CVE-2018-6171 is a WebBluetooth use-after-free vulnerability in Google Chrome/Chromium before version 68.0.3440.75. The flaw occurs in the WebBluetooth implementation and could allow a remote attacker who convinces a user to install a malicious extension to read potentially sensitive information ...

CVE-2021-37999

CVE-2021-37999 stems from insufficient data validation in the Chromium-based New Tab Page component before version 95.0.4638.69, enabling a remote attacker to inject arbitrary scripts/HTML via a crafted HTML page. Connected advisories confirm the issue affects Google Chrome/Chromium, with remedia...

CVE-2022-2608

CVE-2022-2608 is a use-after-free in Chrome OS Overview Mode (Ash) of Google Chrome/Chromium. The issue can lead to heap corruption via specific UI interactions if a user is tricked into certain actions. Connected sources confirm the vulnerability in Chromium/Chrome with affected versions around ...

CVE-2022-4918

CVE-2022-4918 affects Google Chrome (Chromium UI) with a use-after-free in the UI, allowing a remote attacker to perform arbitrary read/write via a crafted HTML page. Affected versions are Chrome before 102.0.5005.61; the issue stems from a post-release reuse problem in the UI. The documented imp...

CVE-2024-3173

The CVE-2024-3173 entry describes an insufficient data validation in Chrome’s Updater, enabling OS‑level privilege escalation via a malicious file prior to Chrome 120.0.6099.62. Affected component: Updater in Google Chrome (Chromium). Root cause: insufficient input validation in updater workflow....

CVE-2026-8545

CVE-2026-8545 is an object-corruption in the Chromium-based Composite rendering path affecting Google Chrome. Public sources describe that an attacker who already compromised the renderer process could leak cross-origin data via a crafted HTML page. Affected product lineage is Google Chrome/Chrom...

CVE-2026-9967

CVE-2026-9967 affects Google Chrome's GPU/Chromium component. Out-of-bounds write in the GPU code prior to version 148.0.7778.216 enables a remote attacker to potentially escape the sandbox via a crafted HTML page. Public references indicate a Chromium/Chrome update addressing this in the 148.0.7...

CVE-2016-7152

CVE-2016-7152 is described in IBM Security Bulletin as a HEIST-related vulnerability affecting the Firefox component of the IBM Synthetic Playback agent used with IBM Application Performance Management (APM) 8.1.3 and IBM Cloud Application Performance Management. The root cause is that the HTTPS ...

CVE-2017-5069

CVE-2017-5069 affects Google Chrome (Blink) and its XSS-Protection reporting mime types. Root cause: incorrect MIME type handling in Blink, allowing a crafted HTML page to bypass Cross-Origin Resource Sharing checks. Impact: mitigates same-origin policy checks; versioned fixes exist in Chrome 58....

CVE-2018-17470

CVE-2018-17470 is a memory corruption bug in the GPU backend of Chromium/Google Chrome, before version 70.0.3538.67. A remote attacker who can render a crafted HTML page could potentially escape the sandbox. Publicly documented details across Debian security advisories and Arch Linux security not...

CVE-2018-17478

CVE-2018-17478 is a V8-related vulnerability in Chromium/Google Chrome prior to version 70.0.3538.102, caused by an out-of-bounds memory access that could lead to object corruption. Reports across multiple security advisories indicate the issue was fixed by upgrading Chromium to 70.0.3538.102 (e....

CVE-2018-6050

CVE-2018-6050: In Google Chrome, the Omnibox (URL bar) UI could be spoofed via a crafted HTML page, allowing a remote attacker to misrepresent the target URL. This affects Chrome versions prior to 64.0.3282.119. Root cause is a security UI weakness in Omnibox handling that permits spoofed content...

CVE-2018-6090

CVE-2018-6090 refers to a heap buffer overflow in Skia used by Google Chrome before 66.0.3359.117, allowing remote code execution inside the sandbox via a crafted HTML page. Connected sources confirm the flaw affects Chrome/Chromium’s Skia component and state that the fix is included in Chrome 66...

CVE-2018-6095

The CVE-2018-6095 entry relates to Google Chrome’s Blink component. It describes an issue where the file picker could be dismissed inappropriately on keyboard events, allowing a remote attacker to read local files via a crafted HTML page. Affected product: Google Chrome/Blink (before version 66.0...

CVE-2018-6107

CVE-2018-6107 is a URL spoofing vulnerability in Google Chrome/Chromium caused by incorrect handling of confusable characters in the URL Formatter (IDN homographs). A remote attacker could spoof domains via crafted domain names. The issue affected Chrome/Chromium versions prior to 66.0.3359.117 a...

CVE-2018-6143

CVE-2018-6143 is a Chrome/V8 vulnerability: an out-of-bounds memory read in the V8 engine that could be exploited remotely via a crafted HTML page to leak memory. Affected software is Google Chrome (and Chromium-derived builds) prior to 67.0.3396.62; exploitation is via malicious web content. Pub...

CVE-2018-6153

CVE-2018-6153 is a buffer/precision error in the Skia library used by Google Chrome prior to 68.0.3440.75. The issue allows a remote attacker who has already compromised the renderer process to perform an out-of-bounds memory write via a crafted HTML page, enabling potential arbitrary code execut...

CVE-2021-38006

CVE-2021-38006 affects Chromium’s storage foundation component prior to version 96.0.4664.45. Description in connected docs confirms a use-after-free vulnerability, enabling potential remote code execution or browser instability via crafted content. The issue is addressed upstream in Chromium 96....

CVE-2022-0098

CVE-2022-0098 involves a use-after-free in Chrome OS Screen Capture. The vulnerability can allow heap corruption when a user is convinced to perform specific gestures, potentially enabling arbitrary code execution. Affected software is Google Chrome/Chromium with the Screen Capture component prio...

CVE-2022-1861

CVE-2022-1861 affects Google Chrome on Chrome OS prior to 102.0.5005.61, with a use-after-free in the Sharing component that could lead to heap corruption after specific user interactions. Debian and Alpine advisories indicate fixes were released in version 102.0.5005.61 for Chromium/Chrome. Reme...

CVE-2022-4909

CVE-2022-4909 describes an inappropriate XML implementation in Google Chrome/Chromium that could allow a remote attacker to bypass ASLR via a crafted HTML page. The vulnerability is reported as affecting Chrome/Chromium versions prior to 107.0.5304.62 (NVD entry cites 107.0.5304.62; Fedora adviso...

CVE-2025-3072

CVE-2025-3072 describes an improper implementation in Google Chrome’s Custom Tabs prior to 135.0.7049.52, enabling a remote attacker to trigger UI spoofing via a crafted HTML page after user engagement with specific UI gestures. Affected component: Custom Tabs in Chrome/Chromium. Impact per sourc...

CVE-2025-8010

CVE-2025-8010 is a Type Confusion in V8 affecting Google Chrome prior to version 138.0.7204.168. The vulnerability allows a remote attacker to potentially trigger heap corruption via a crafted HTML page, with the documented impacts including remote code execution, high severity, and network-based...

CVE-2026-19169

CVE-2026-19169 refers to insufficient validation of untrusted input in Chrome’s Contextual Tasks, allowing remote privilege escalation via a crafted HTML page. Affected product: Google Chrome; affected versions are prior to 151.0.7922.109. Remediation: update to Chrome 151.0.7922.109 or later (St...

CVE-2026-7945

CVE-2026-7945 refers to insufficient validation of untrusted input in Cross-Origin Opener Policy (COOP) for Google Chrome. A remote attacker who has compromised the renderer process could bypass site isolation by presenting a crafted HTML page, affecting Chrome versions prior to 148.0.7778.96. Pu...

CVE-2026-8543

CVE-2026-8543 describes an out-of-bounds read in the FileSystem component of Google Chrome on macOS. The issue exists before Chrome 148.0.7778.168 and can be triggered when a user is convinced to perform specific UI gestures on a crafted HTML page, potentially allowing access to sensitive data fr...

CVE-2026-8586

CVE-2026-8586 affects the Chromoting component in Google Chrome (upstream Chromium). The issue is an inappropriate implementation that allows a local attacker to bypass discretionary access control via a malicious file, with impact described as medium. Affected versions are Chrome prior to 148.0....

CVE-2015-1302

CVE-2015-1302 affects Google Chrome prior to 46.0.2490.86, where the PDF viewer could leak information and bypass Same Origin Policy by exposing scripting messages and APIs via pdf.js and out_of_process_instance.cc. This is a vulnerability in the PDF rendering path used by Chrome, enabling an inf...

CVE-2018-16084

CVE-2018-16084 affects Chromium/Google Chrome prior to 69.0.3497.81. Root cause: the default selected dialog button in CustomHandlers could be exploited via a crafted HTML page to trigger opening external programs. Impact: remote attacker could have the user open external programs, enabling possi...

CVE-2018-6055

Technical details about CVE-2018-6055 are not publicly provided in the connected documents. The Initial Description notes impact and fix version for Chrome, but no deeper technical specifics are given. Monitor for updates.

CVE-2018-6061

CVE-2018-6061: A race condition in Google's Chrome/Chromium WebAssembly/V8 stack (SharedArrayBuffers) could allow a remote attacker to trigger heap corruption via a crafted HTML page. Affected product: Google Chrome (65.x), fixed in Chrome 65.0.3325.146 (and related Chromium releases). Remediatio...

CVE-2018-6144

CVE-2018-6144 affects Google Chrome via the PDFium library, where an out-of-bounds memory access could be triggered by a crafted PDF. The vulnerability is in PDFium used by Chrome prior to version 67.0.3396.62 and could enable remote code execution or memory corruption. Public advisories and Debi...

CVE-2021-38014

CVE-2021-38014 describes an out-of-bounds write in the SwiftShader component of the Chromium/Google Chrome browser before version 96.0.4664.45. The vulnerability can enable a remote attacker to potentially trigger heap corruption via a crafted HTML page, leading to arbitrary code execution or bro...

CVE-2022-0798

CVE-2022-0798 is a use-after-free in Google Chrome/Chromium’s MediaStream pathway. The connected documents consistently describe a memory safety issue in Chrome’s MediaStream that can lead to heap corruption when a user is convinced to install a crafted Chrome Extension, with exploitation potenti...

CVE-2022-1144

CVE-2022-1144 is a use-after-free in Chrome's WebUI (pre-100.0.4896.60) that could enable heap corruption via specific input in DevTools, requiring user interaction. It affects Google Chrome (WebUI component) and is tracked with a high CVSS v3.1 base score (8.8; High). Related advisories confirm ...

CVE-2022-3655

CVE-2022-3655 describes a heap buffer overflow in Chrome/Chromium’s Media Galleries. Multiple sources (Chrome release notes and security trackers) confirm this affects Chrome before version 107.0.5304.62, with the risk that a user who installs a crafted malicious extension could trigger heap corr...

CVE-2026-13980

CVE-2026-13980 affects Chrome for iOS (Google Chrome on iOS). The vulnerability stems from an inappropriate implementation in Chrome for iOS prior to version 150.0.7871.47, enabling a remote attacker to perform UI spoofing via a crafted HTML page. Documents consistently describe the issue as a UI...

CVE-2026-19139

CVE-2026-19139 describes a race in CredentialProvider in Google Chrome on Windows that could allow a local attacker to achieve OS‑level privilege escalation via a malicious file. Affected software: Google Chrome for Windows prior to version 151.0.7922.109. Root cause: race condition in Credential...

CVE-2026-19145

CVE-2026-19145 : Use-after-free in Google Chrome’s Translate component prior to 151.0.7922.109 allows remote code execution in a sandbox via a crafted HTML page. Root cause: use-after-free in translation handling. Impact: arbitrary code execution with high severity; attacker requires no privilege...

CVE-2026-8536

CVE-2026-8536 affects Google Chrome on Mac, through the ReadingMode component in Chromium. Root cause: insufficient validation of untrusted input, enabling a renderer-compromised remote attacker to bypass Site Isolation via a crafted HTML page. The Chrome update released to 148.0.7778.167/168 fix...

CVE-2015-1271

CVE-2015-1271 is a confirmed vulnerability in Chromium’s pdfium component, described as a heap-buffer-overflow in pdfium associated with large memory allocations triggered by crafted PDFs. Public references in the connected documents indicate the issue was fixed in Chrome 44.0.2403.89 (stable cha...