CVE-2026-79282

CVE-2026-79282 is a critical use-after-free vulnerability in ANGLE (Almost Native Graphics Layer Engine), the component Chrome uses to translate graphics commands for the OS and GPU. It affects Google Chrome on Android prior to 152.0.7977.65 and allows a remote attacker to execute arbitrary code ...

CVE-2026-7962

CVE-2026-7962 describes insufficient policy enforcement in Chrome’s DirectSockets, allowing a remote attacker to trigger arbitrary read/write via a crafted Chrome Extension. Public documents identify the vulnerable component as DirectSockets in Google Chrome, with the root cause tied to policy en...

CVE-2026-84323

CVE-2026-84323 is a missing authorization flaw in the FileSystem component of Google Chrome prior to 152.0.7977.75 (and 152.0.7977.76 on Windows/Mac). A remote attacker who had already compromised the renderer process could leverage social engineering to obtain sensitive information via a crafted...

CVE-2014-3192

CVE-2014-3192 is a use-after-free in the Blink DOM implementation (ProcessingInstruction::setXSLStyleSheet) that affects Google Chrome before 38.0.2125.101. The vulnerability can lead to remote denial of service or possibly unspecified impact via unknown vectors. The initial description specifies...

CVE-2016-1684

CVE-2016-1684 is a libxslt vulnerability listed in Apple advisories and related OS X/iOS updates. Connected documents indicate libxslt multiple memory corruption issues were addressed (no explicit root-cause or fix version provided in the sources). Affected products include libxslt in Apple platf...

CVE-2017-15410

CVE-2017-15410 describes a use-after-free in PDFium used by Google Chrome before version 63.0.3239.84, leading to potential heap corruption via a crafted PDF file. Related sources (CNVD-2018-22400) corroborate a memory misreference in PDFium prior to 63.0.3239.84, enabling remote exploitation. Th...

CVE-2017-5046

CVE-2017-5046 (Chrome/Blink): V8 policy enforcement flaw allowed a remote attacker to spoof the location object via a crafted HTML page, related to Blink information disclosure. Affected: Google Chrome prior to 57.0.2987.98 on Mac/Windows/Linux and 57.0.2987.108 on Android. Impact is information ...

CVE-2018-6101

CVE-2018-6101 affects Google Chrome DevTools (the DevTools remote debugging protocol). The issue is a lack of host validation in DevTools prior to 66.0.3359.117, enabling a remote attacker to execute arbitrary code via a crafted HTML page when a user is running a remote DevTools debugging server....

CVE-2018-6111

CVE-2018-6111 corresponds to a memory misreference/object lifetime issue in Google Chrome’s DevTools network handler, prior to version 66.0.3359.117. A local attacker could run arbitrary code via a crafted HTML page. Affected: Chrome/Chromium DevTools. Root cause: memory misreference in DevTools ...

CVE-2019-13691

CVE-2019-13691: Google Chrome prior to 77.0.3865.75 is affected by insufficient validation of untrusted input in navigation, enabling a remote attacker to spoof the Omnibox (URL bar) via a crafted HTML page. The issue affects Chrome’s Omnibox rendering logic and is documented across multiple sour...

CVE-2019-5783

CVE-2019-5783 corresponds to an "insufficient validation of untrusted input" vulnerability in Google Chrome’s DevTools prior to version 72.0.3626.81. The flaw enables a remote attacker to perform a Dangling Markup Injection attack by delivering a crafted HTML page, as described in the public CVE ...

CVE-2021-38004

CVE-2021-38004 affects Chromium-based Google Chrome Autofill: insufficient policy enforcement allows a remote attacker to leak cross-origin data via a crafted HTML page, prior to version 95.0.4638.69. Affected component: Autofill in Chromium/Chrome; root cause is policy enforcement gaps. Impact: ...

CVE-2022-0097

CVE-2022-0097 involves an Inappropriate implementation in Chrome DevTools prior to 97.0.4692.71, where a user who installs a malicious extension could potentially allow the extension to escape the sandbox via a crafted HTML page. Reports in multiple sources (Chrome Release notes, Debian security ...

CVE-2022-0311

The CVE-2022-0311 entry concerns a heap buffer overflow in Google Chrome’s Task Manager. The vulnerability is triggered via a crafted HTML page and requires user interaction, enabling a remote attacker to potentially cause heap corruption. Affected product scope centers on Google Chrome, with the...

CVE-2024-3169

The CVE-2024-3169 issue affects Google Chrome (V8/Chromium) and is caused by a Use after free in V8, leading to potential heap corruption via a crafted HTML page. Affected software includes Google Chrome with V8, prior to 121.0.6167.139. Impact is high: remote attacker could potentially exploit t...

CVE-2024-7004

CVE-2024-7004 affects Google Chrome/Chromium Safe Browsing via insufficient validation of untrusted input, enabling a remote attacker to bypass discretionary access control by convincing a user to perform specific UI gestures with a malicious file. The issue is described in Chrome’s release notes...

CVE-2025-9478

CVE-2025-9478 : Use-after-free in ANGLE within Google Chrome prior to 139.0.7258.154 can enable a remote attacker to cause heap corruption via a crafted HTML page. Affected component: ANGLE/Chromium WebKit stack used by Chrome. Impact per sources: potential arbitrary code execution, heap corrupti...

CVE-2026-5272

CVE-2026-5272 is a heap buffer overflow in Chrome’s GPU code, allowing remote execution of code via a crafted HTML page. Affected product: Google Chrome; vulnerable component: GPU/ Heap handling in Chrome’s rendering pipeline; root cause per CNVD/CNNVD items: GPU heap failing to validate input le...

CVE-2016-1704

CVE-2016-1704 affects Google Chrome before 51.0.2704.103. The Debian advisory and Chrome release notes indicate multiple issues identified by the Chrome development team during internal audits and fuzzing, fixed in 51.0.2704.103. The NVD description notes a potential denial-of-service or other im...

CVE-2017-5059

CVE-2017-5059 describes a type confusion in Blink used by Google Chrome prior to 58.0.3029.81 on Linux/Windows/macOS (58.0.3029.83 on Android). The underlying issue could allow a remote attacker to potentially obtain code execution through a crafted HTML page. Desktop impact is listed as code exe...

CVE-2018-16064

CVE-2018-16064 concerns Google Chrome’s Extensions API. It states that insufficient data validation in the Extensions API, for Chrome versions prior to 68.0.3440.75, could let an attacker who tricks a user into installing a crafted extension bypass navigation restrictions. Affected: Google Chrome...

CVE-2018-6045

CVE-2018-6045 affects Google Chrome (DevTools) and is caused by Insufficient policy enforcement in DevTools from extensions, allowing a remote attacker to potentially leak user local file data via a crafted Chrome extension. The vulnerability is tied to Chrome versions prior to 64.0.3282.119. Pub...

CVE-2018-6047

Google Chrome WebGL vulnerability CVE-2018-6047 involves insufficient policy enforcement in WebGL that could leak a user’s redirect URL via a crafted page. Affected product: Google Chrome (WebGL component). Root cause: policy enforcement issue in WebGL. Impact: potential information disclosure of...

CVE-2018-6048

CVE-2018-6048 is a Chrome Blink vulnerability where insufficient enforcement of the referrer policy allowed leakage of referrer information via a crafted HTML page. Affected product: Google Chrome (Blink component). Root cause: bypass of the referrer policy in Blink leading to potential informati...

CVE-2018-6053

CVE-2018-6053 is an information-leak vulnerability in Google Chrome’s New Tab Page caused by an inappropriate implementation. In affected versions prior to 64.0.3282.119, a local attacker could view website thumbnail images after clearing browser data by presenting a crafted HTML page. The issue ...

CVE-2018-6085

CVE-2018-6085 describes a use-after-free in Google Chrome’s Networking Disk Cache. The vulnerability affects Chrome/Chromium’s Disk Cache component and is triggered by a crafted HTML page, enabling a remote attacker to execute arbitrary code. The vulnerability is characterized as a use-after-free...

CVE-2018-6103

CVE-2018-6103 is a Chrome/Chromium UI spoofing vulnerability in the Permissions prompt, where an attacker could bypass permission policy via a crafted HTML page. Connected sources identify the issue as a permissions UI spoof in Chrome/Chromium and note remediation via upgrading to Chrome 66.0.335...

CVE-2018-6125

CVE-2018-6125 refers to an overly permissive policy in WebUSB within Chromium/Google Chrome on Windows, enabling a remote attacker to potentially access sensitive information via a crafted HTML page. The connected sources corroborate the issue as part of Chromium/Chrome updates and enumerate a fi...

CVE-2018-6150

CVE-2018-6150 is a Chrome/ServiceWorker information-disclosure flaw triggered by incorrect Cross-Origin Resource Sharing handling in Chrome’s Service Worker. Affected product: Google Chrome (pre-66.0.3359.117). Impact: potential leakage of cross-origin data via a crafted page. Root cause: imprope...

CVE-2018-6175

CVE-2018-6175 concerns Google Chrome URL handling: an incorrect handling of confusable characters in the Omnibox/URL Formatter allows domain spoofing via IDN homographs in Chrome versions before 68.0.3440.75. Public sources (Debian/DLA entries) indicate this vulnerability was addressed by upgradi...

CVE-2021-4098

CVE-2021-4098 affects Mojo in Google Chrome/Chromium prior to 96.0.4664.110, enabling a renderer-compromised remote attacker to potentially escape sandbox via a crafted HTML page. Affected: Chromium-based browsers; root cause: insufficient data validation in Mojo. Impact: sandbox escape risk as d...

CVE-2022-4915

CVE-2022-4915 is a Chrome/Chromium URL formatting vulnerability: an improper URL handling in Chrome prior to 103.0.5060.134 allowed a remote attacker to spoof domains via a crafted HTML page. Documents consistently reference Google Chrome/Chromium and a domain-spoofing impact; desktop Chrome vers...

CVE-2023-2314

CVE-2023-2314 affects Google Chrome DevTools (Chromium) with insufficient data validation, allowing a remote attacker to bypass navigation restrictions via a crafted HTML page. Affected component: DevTools in Chrome prior to 111.0.5563.64. Root cause: data validation flaw in DevTools. Impact: rem...

CVE-2024-3175

CVE-2024-3175 concerns insufficient data validation in the Chrome Extensions component, enabling privilege escalation via a crafted Chrome Extension. The primary documentation states vulnerable component as Extensions, with affected Chrome versions before 120.0.6099.62 (remediation: update to 120...

CVE-2025-1426

CVE-2025-1426 concerns a heap buffer overflow in the GPU path of Google Chrome on Android before 133.0.6943.126. A crafted HTML page could trigger heap corruption leading to code execution or a crash; this is rated High severity (CVSS 3.1 base 8.8). The issue affects Chromium-derived Chrome and h...

CVE-2026-17753

CVE-2026-17753 involves an insecure Autofill implementation in Google Chrome before 151.0.7922.72, which could allow a remote attacker to leak cross-origin data via a crafted HTML page. The issue is described as a Chromium security medium severity (base CVSS 4.3, AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A...

CVE-2026-5288

CVE-2026-5288 describes a use-after-free in WebView within Google Chrome on Android prior to 146.0.7680.178 that could allow a renderer-compromised attacker to potentially escape the sandbox via a crafted HTML page. The connected sources show Chromium/CEF/chromium package updates around version 1...

CVE-2015-1270

CVE-2015-1270 affects the ICU library used by Google Chrome prior to 44.0.2403.89. The issue arises in ucnv_io_getConverterName within common/ucnv_io.cpp, where converter names starting with x- are mishandled, allowing a remote attacker to trigger a read of uninitialized memory (denial of service...

CVE-2017-5007

CVE-2017-5007 is a Cross-Site Scripting (UXSS) vulnerability in Google Chrome/Chromium’s Blink component. The issue arises from incorrect handling of the sequence of events when closing a page, allowing a remote attacker to inject arbitrary scripts or HTML via a crafted HTML page. Affected produc...

CVE-2017-5089

CVE-2017-5089 is a domain spoofing vulnerability in the Chromium/Omnibox component. The issue is described as insufficient policy enforcement that allows a remote attacker to spoof a domain via a crafted domain name in Chrome/Chromium before version 59.0.3071.104 (e.g., Chromium/Chromium-browser)...

CVE-2018-16088

CVE-2018-16088 affects Google Chrome (Blink) due to a missing check for JS-simulated input events, allowing a remote attacker to download arbitrary files with no user input via a crafted HTML page. Chrome 69.0.3497.81 addresses the flaw; updating to that version or newer is the remediation descri...

CVE-2018-6051

CVE-2018-6051 affects Google Chrome prior to 64.0.3282.119. The XSS Auditor component could leak referrer information by reporting a URL to a crafted page from a page with a different origin, exposing potentially sensitive details. Public references in the Chrome 64 stable release note confirm CV...

CVE-2018-6070

CVE-2018-6070 is a CSP bypass vulnerability in Google Chrome/Chromium where an attacker could lure a user to install a crafted extension to bypass Content Security Policy. Technical details across connected records confirm the flaw resides in how extensions interact with WebUI CSP enforcement, en...

CVE-2018-6099

Concretely, CVE-2018-6099 affects Google Chrome/Chromium by a Cross-Origin Resource Sharing bypass in Service Workers (Blink). The root cause is a lack of proper CORS checks in Blink/ServiceWorker handling, enabling a remote attacker to leak limited cross-origin data via a crafted HTML page. The ...

CVE-2018-6135

CVE-2018-6135 affects Google ChromeBlink UI: prior to 67.0.3396.62, Chrome loaded alerts from a new site without clearing the previous site, enabling remote domain spoofing via crafted HTML. Affected: Blink UI loading flow; root cause: not clearing prior site context when loading new alerts. Impa...

CVE-2020-6500

CVE-2020-6500 affects Google Chrome interstitials prior to 80.0.3987.87. The vulnerability arises from an inappropriate implementation in interstitials, allowing a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. Exploitation would enable URL-bar spoofing wi...

CVE-2023-3738

CVE-2023-3738 affects Google Chrome (Chromium-based) where an Inappropriate implementation in Autofill allows a remote attacker to obfuscate security UI via a crafted HTML page. Connected advisories confirm affected products include Google Chrome/Chromium, with fixes in Chrome 115.0.5790.98 (and ...

CVE-2025-14372

CVE-2025-14372 is a Use-after-Free in Chrome/Chromium Password Manager that could enable a sandbox escape via a crafted HTML page. Affected component is Password Manager within Chrome/Chromium; root cause described as use-after-free. Impact per sources: remote attacker could escape sandbox; base ...

CVE-2026-13812

CVE-2026-13812 affects Chrome for iOS (Google Chrome on iOS) prior to version 150.0.7871.47. The issue is insufficient validation of untrusted input in a crafted HTML page, enabling UXSS if a user is induced to perform specific UI gestures. The vulnerability results in potential script/HTML injec...

CVE-2026-19166

CVE-2026-19166 is a Use-after-free in Chrome’s Web Authentication (Chromium) prior to 151.0.7922.109 that could allow a remote attacker to sandbox-escape via a crafted HTML page. The vulnerability affects Google Chrome/Chromium’s WebAuth component and is addressed in the Chrome stable update to 1...