CVE-2026-19166

CVE-2026-19166 is a Use-after-free in Chrome’s Web Authentication (Chromium) prior to 151.0.7922.109 that could allow a remote attacker to sandbox-escape via a crafted HTML page. The vulnerability affects Google Chrome/Chromium’s WebAuth component and is addressed in the Chrome stable update to 1...

CVE-2026-7934

CVE-2026-7934 in Google Chrome’s Popup Blocker: Insufficient validation of untrusted input allowed a remote attacker who had access to the renderer process to bypass navigation restrictions via a crafted HTML page. Affected component: Popup Blocker in Chrome prior to version 148.0.7778.96. Root c...

CVE-2010-4008

CVE-2010-4008 affects libxml2 prior to 2.7.8 and is triggered by malformed XPath expressions, causing an application crash via invalid memory access. It is noted in advisories tied to libxml2 updates for platforms using the library (e.g., Chrome and Safari stacks). The connected records reference...

CVE-2017-15418

CVE-2017-15418 concerns Google Chrome (Skia) prior to 63.0.3239.84, where use of uninitialized memory in Skia could allow a remote attacker to read sensitive data from a process memory via a crafted HTML page. Technical details across sources consistently identify Skia’s uninitialized values as t...

CVE-2017-5053

CVE-2017-5053 describes an out-of-bounds read in V8 that could allow remote code execution in Google Chrome. Affected: Google Chrome on Linux/Windows/macOS older than 57.0.2987.133, and Android older than 57.0.2987.132; vulnerability linked to Array.prototype.indexOf. Impact: arbitrary code execu...

CVE-2018-17458

CVE-2018-17458 affects Google Chrome WebAssembly: an improper update of the WebAssembly dispatch table in WebAssembly (Chrome before 69.0.3497.92) allowed a remote attacker to execute arbitrary code in a sandbox via a crafted HTML page. This is evidenced by NVD details and CNVD entries, which des...

CVE-2018-6039

CVE-2018-6039 describes an issue in Google Chrome’s DevTools where insufficient data validation could allow a remote attacker to leak user cross-origin data via a crafted Chrome Extension. Affected software: Google Chrome with DevTools. Root cause: inadequate input validation in DevTools leading ...

CVE-2018-6158

CVE-2018-6158 refers to a race condition in Google Chrome’s Oilpan component that could lead to heap corruption via a crafted HTML page. The vulnerability affects Chrome/Chromium before version 68.0.3440.75 (the Debian security advisories indicate fixed in 68.0.3440.75 for the stretch release). T...

CVE-2021-21200

CVE-2021-21200 describes an out-of-bounds read in Chrome’s WebUI Settings prior to 89.0.4389.72. A remote attacker could trigger an out-of-bounds memory read by presenting a crafted HTML page. According to the provided documents, the attack requires user interaction and does not grant privileges ...

CVE-2021-38013

CVE-2021-38013 : Heap buffer overflow in the fingerprint recognition component of the Chromium engine (Chrome/ChromeOS) before version 96.0.4664.45 allows a remote attacker who can reach a WebUI renderer to potentially escape the sandbox via a crafted HTML page. Multiple vendor advisories confirm...

CVE-2021-4061

CVE-2021-4061 describes a type confusion in V8 within Chromium/Google Chrome prior to 96.0.4664.93, enabling a remote attacker to potentially exploit heap corruption via a crafted HTML page. The vulnerability affects Chromium-based browsers and is tracked in multiple advisories; upgrade to versio...

CVE-2022-0120

CVE-2022-0120 affects Google Chrome Passwords with an inappropriate implementation that could allow a remote attacker to leak cross-origin data via a malicious website. Affected product: Chrome (Passwords); vulnerable component: Password handling implementation prior to 97.0.4692.71. Impact: pote...

CVE-2022-0455

CVE-2022-0455 affects Google Chrome on Android before 98.0.4758.80, where an improper Full Screen Mode implementation allowed a crafted HTML page to spoof the Omnibox (URL bar). The issue is documented in Chrome release notes and CVE trackers, with Chrome/Chromium security fixes in the 98.0.4758....

CVE-2022-4176

CVE-2022-4176 refers to an out-of-bounds write in Lacros Graphics for Google Chrome on Chrome OS and Lacros builds prior to 108.0.5359.71. The issue could enable heap corruption via user-driven UI interactions, with the Chrome/Chromium advisory cycle noting a high severity and remote-exploitation...

CVE-2022-4187

CVE-2022-4187 affects Google Chrome/DevTools on Windows prior to 108.0.5359.71, where insufficient policy enforcement in DevTools could allow a remote attacker to bypass filesystem restrictions via a crafted HTML page. The vulnerability is listed with a Chromium/Chrome Medium severity and is amon...

CVE-2025-1917

CVE-2025-1917 affects Google Chrome on Android with an inappropriate UI implementation that enables UI spoofing via a crafted HTML page, up to version 134.0.6998.35. The vulnerability is described as a medium-severity issue (CVSS 4.3, UI interaction required, no confidentiality impact, low integr...

CVE-2026-11264

CVE-2026-11264 : Chrome/Chromium CSP policy bypass identified as a vulnerability affecting Chrome prior to 149.0.7827.53. A remote attacker could bypass the Content Security Policy via a crafted HTML page. Severity is low; attack vector is network with user interaction required. The remediation i...

CVE-2026-13905

Chrome for iOS on Google Chrome (iOS) is affected by a race in versions prior to 150.0.7871.47, allowing a local attacker with physical access to potentially read confidential data from process memory. The issue is documented across CVE-2026-13905 and EUVD-2026-40591. Remediation is to upgrade to...

CVE-2026-17870

CVE-2026-17870 affects Google Chrome (Cast component) with insufficient validation of untrusted input, allowing a local-network attacker to leak cross-origin data via malicious network traffic. Vulnerable in Chrome builds prior to 151.0.7922.72 (Chromium security severity: Medium). The issue is f...

CVE-2026-17957

The CVE-2026-17957 entry concerns Google Chrome with an improper CORS implementation in the renderer prior to version 151.0.7922.72. The issue could allow a remote attacker who has compromised the renderer process to leak cross-origin data via a crafted HTML page. According to the provided data, ...

CVE-2015-1291

CVE-2015-1291 is a concrete Chrome/Blink vulnerability: the ContainerNode::parserRemoveChild function in core/dom/ContainerNode.cpp fails to validate node types, enabling a remote attacker to bypass same-origin policy or trigger a denial of service (DOM tree corruption) through crafted JavaScript...

CVE-2016-1663

CVE-2016-1663 refers to a use-after-free in Blink’s V8 bindings (SerializedScriptValue transfer logic) within Chromium/Chrome prior to 50.0.2661.94. The vulnerability arises from mishandling certain array-buffer data structures in the V8 bindings used by Blink, allowing a remote attacker to explo...

CVE-2017-15399

Chromium/Google Chrome prior to version 62.0.3202.89 is affected by CVE-2017-15399 (use-after-free in V8) and CVE-2017-15398 (QUIC stack-based buffer overflow), enabling a remote attacker to potentially execute arbitrary code via a crafted page. Debian security advisories and Arch Linux security ...

CVE-2017-5062

CVE-2017-5062 : A use-after-free in Chrome Apps in Google Chrome (desktop: Mac/Windows/Linux; Android: 58.0.3029.83+) allowed remote memory corruption via a crafted Chrome extension. Root cause: use-after-free in the Chrome Apps code path leading to possible out-of-bounds access. Impact per descr...

CVE-2017-5071

CVE-2017-5071 : Insufficient validation of untrusted input in the V8 component of Google Chrome/Chromium allowed a remote attacker to trigger an out-of-bounds memory read via a crafted HTML page. Affected: V8 in Chromium/Chrome prior to 59.0.3071.86 on Linux/Windows/macOS and prior to 59.0.3071.9...

CVE-2018-6068

CVE-2018-6068 describes an object lifecycle issue in Chrome Custom Tab that could let a remote attacker spoof the Omnibox (URL bar) in Google Chrome prior to 65.0.3325.146. Related connected advisories indicate Chromium/Chrome updates fixed this family of issues around version 65.0.3325.146 (and ...

CVE-2018-6079

CVE-2018-6079 describes an information disclosure in WebGL within Google Chrome versions prior to 65.0.3325.146, allowing a remote attacker to leak cross-origin data via a crafted HTML page. Affected software is Google Chrome (WebGL implementation in Chrome’s rendering engine). The root cause is ...

CVE-2018-6121

CVE-2018-6121 affects Google Chrome (Blink/HTML rendering) prior to 66.0.3359.170 where Insufficient validation of input allows a remote attacker to escalate privileges via a crafted HTML page. In the provided documents, the vulnerability is tied to Chrome’s Blink component, with the impact descr...

CVE-2018-6157

CVE-2018-6157 is a type-confusion vulnerability in WebRTC within Google Chrome (pre-68.0.3440.75). A crafted video packet can cause the H264 parser to mis-handle data, leading to potential heap corruption. Affected product: Google Chrome/WebRTC; impact described as heap corruption via crafted vid...

CVE-2019-13692

CVE-2019-13692 relates to Google Chrome before 77.0.3865.75 where insufficient policy enforcement in reader mode allowed a remote attacker to bypass site isolation via a crafted HTML page. Affected software: Google Chrome (reader mode). Root cause: policy enforcement weakness enabling isolation b...

CVE-2021-38020

CVE-2021-38020 : A information-disclosure vulnerability in Chromium’s contacts picker (Chromium-based Chrome/Chromium) before 96.0.4664.45 arises from insufficient policy enforcement, allowing leakage of contact information via crafted content. Public advisories (Debian DSA-5046-1 and Arch Linux ...

CVE-2021-4064

CVE-2021-4064 affects Chromium-based browsers. A use-after-free in the screen capture component of the Chromium engine before version 96.0.4664.93 could allow a remote attacker to potentially trigger heap corruption and arbitrary code execution or content spoofing through a crafted HTML page. Ups...

CVE-2022-3310

CVE-2022-3310 : Affects Google Chrome/Chromium. The issue is described as insufficient policy enforcement in Custom Tabs, enabling a crafted app installed by the user to bypass the same-origin policy. Root cause: policy enforcement gap in Custom Tabs. Impact stated across sources includes potenti...

CVE-2026-13902

CVE-2026-13902 affects Chrome on iOS (Google Chrome on iOS) prior to version 150.0.7871.47 . The issue is described as an inappropriate implementation in Chrome for iOS that allows a remote attacker to perform UI spoofing via a crafted HTML page. The vulnerability is documented across multiple so...

CVE-2026-13995

CVE-2026-13995 : Insufficient validation of untrusted input in Autofill for Google Chrome on Android allows a remote attacker to perform UI spoofing via a crafted HTML page. Affected are Chrome builds prior to 150.0.7871.47; remediation is to update to 150.0.7871.47 or a later version once releas...

CVE-2026-19150

CVE-2026-19150 : In Google Chrome, an inappropriate implementation in V8 prior to 151.0.7922.109 allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Affected product: Chrome (V8 engine). Impact: high severity (remote code execution inside sandbox); explo...

CVE-2026-84331

CVE-2026-84331 is an incorrect authorization flaw in the Actor component of Google Chrome prior to version 152.0.7977.75 . A remote attacker who had already compromised the renderer process could leverage a crafted HTML page to bypass the web origin policy . Chromium rates the severity as Low ; t...

CVE-2026-84356

CVE-2026-84356 is a UI misrepresentation flaw in the FullScreen component of Google Chrome prior to version 152.0.7977.75 . A remote attacker could deliver a crafted HTML page that spoofs the address bar , allowing the victim to be tricked into believing they are on a different site. Chromium rat...

CVE-2026-9943

CVE-2026-9943 describes an out-of-bounds read in WebGL within the Chromium-based Google Chrome browser for Android, prior to version 148.0.7778.216. The flaw could allow a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability is rooted in WebGL handling in Chrome/Ch...

CVE-2011-2821

CVE-2011-2821 is a libxml2 double-free vulnerability triggered by crafted XPath expressions. The description notes impact as a denial of service and potential unspecified effects, with affected product usage including Google Chrome before 13.0.782.215. Connected documents corroborate this CVE acr...

CVE-2015-1274

CVE-2015-1274 affects Google Chrome/Chromium prior to 44.0.2403.89, where the auto-open list could still execute certain file types immediately after download. Root causes are described in download_commands.cc and download_prefs.cc. The vulnerability could allow remote attackers to run arbitrary ...

CVE-2016-5159

CVE-2016-5159 covers multiple integer overflows in OpenJPEG as used by PDFium in Google Chrome, exploitable via crafted JPEG2000 data that is mishandled during opj_aligned_malloc in dwt.c and t1.c. Affected: Chrome before 53.0.2785.89 on Windows/macOS and before 53.0.2785.92 on Linux. Consequence...

CVE-2017-5107

The CVE-2017-5107 entry describes a timing-based information disclosure in Google Chrome's SVG rendering prior to 60.0.3112.78, enabling a remote attacker to extract pixel values from a cross-origin page loaded in an iframe on Linux/Windows/macOS. The connected sources corroborate Chrome/Chromium...

CVE-2018-6032

CVE-2018-6032 affects Blink in Google Chrome (pre-64.0.3282.119). The vulnerability stems from insufficient policy enforcement, enabling a remote attacker to potentially bypass same-origin policy and leak cross-origin data via a crafted HTML page (Shared Worker context cited by Debian/RHSA/Gentoo...

CVE-2018-6054

Chromium-based Google Chrome WebUI vulnerability CVE-2018-6054 is a use-after-free in WebUI prior to 64.0.3282.119 that could enable remote heap corruption via crafted Chrome Extensions. Affected product: Google Chrome (Windows, macOS, Linux) with WebUI component; root cause: use-after-free in We...

CVE-2018-6104

CVE-2018-6104 affects Google Chrome/Chromium where the URL Formatter mishandled confusable characters (IDN homographs), enabling domain spoofing. The issue lies in the URL formatting component and could allow a remote attacker to lure users to a spoofed domain. Vulnerable versions are Chrome/Chro...

CVE-2021-4099

CVE-2021-4099 describes a use-after-free vulnerability in SwiftShader within Google Chrome, prior to version 96.0.4664.110. The underlying issue is heap corruption that could be exploited by a crafted HTML page, potentially enabling remote code execution. The connected documents corroborate the s...

CVE-2026-13946

CVE-2026-13946 concerns Google Chrome on iOS. The issue is an inappropriate implementation in ScriptInjections , allowing a remote attacker to leak cross-origin data via a crafted HTML page. Affected product: Google Chrome on iOS prior to version 150.0.7871.47. Impact is cross-origin data leakage...

CVE-2026-17700

The CVE-2026-17700 entry affects Google Chrome (Chromium component: Actor) with insufficient validation of untrusted input in the Actor, allowing a remote attacker who has compromised the renderer process to leak cross-origin data via a crafted HTML page. The issue’s impact is limited to leakage ...

CVE-2026-17879

CVE-2026-17879 affects Google Chrome Autofill. The vulnerability stems from an inappropriate implementation in Autofill prior to version 151.0.7922.72, allowing a remote attacker to leak cross-origin data via a crafted HTML page. The CVSS 3.1 base score is 4.3 (Medium) with network attack vector,...