CVE-2026-1862

CVE-2026-1862 is a Type Confusion in V8 affecting Google Chrome before 144.0.7559.132. The vulnerability arises from a V8 type-confusion in the JIT/optimized path (via JSObject::GetProperty) that can lead to heap corruption, enabling a remote attacker to achieve arbitrary read/write and potential...

CVE-2026-8537

CVE-2026-8537 is a Chrome/Chromium vulnerability: insufficient policy enforcement in the ViewTransitions component could allow a remote attacker to leak cross-origin data via a crafted HTML page. Affected version range is Chrome prior to 148.0.7778.168. Remediation is upgrade to the Chrome stable...

CVE-2009-2973

CVE-2009-2973 affects Google Chrome prior to 2.0.172.43, where SSL connections to a site with an X.509 certificate signed using MD2 or MD4 could be spoofed by a man-in-the-middle. This is related to CVE-2009-2409. Connected documents indicate MD2/MD4 hash-signature weaknesses and that mitigations...

CVE-2016-5200

Summary: CVE-2016-5200 affects Google Chrome/Chromium prior to 54.xGenerations where V8 incorrectly applied type rules, leading to heap corruption or out-of-bounds memory access. An attacker could exploit this remotely via a crafted HTML page, possibly leading to arbitrary code execution. Public ...

CVE-2016-9651

CVE-2016-9651 is a private-property access flaw in the V8 component of Chromium/Chrome prior to version 55.0.2883.75. The root cause is a missing check for whether a JS object property is private, enabling a remote attacker to bypass access restrictions and potentially execute arbitrary code insi...

CVE-2017-5040

CVE-2017-5040 affects Chromium/Chromium-based browsers. The issue is an information disclosure in the V8 JavaScript engine caused by a missing neutering check, enabling a remote attacker to read memory values via a crafted HTML page. The vulnerability is in the V8 component of Chromium before ver...

CVE-2017-5061

Google Chrome before 58.0.3029.81 on Linux/Windows/macOS is affected by a race condition during navigation that allowed a remote attacker to spoof the Omnibox (URL bar) contents via a crafted HTML page. The entry is supported by CVE-2017-5061 details and related advisories; remediation is to upgr...

CVE-2018-20066

CVE-2018-20066 affects Google Chrome Extensions: vulnerable component is the Extensions lifecycle, where an incorrect object lifecycle can lead to heap corruption via a crafted HTML page. Affected: Chrome versions prior to 71.0.3578.80. Impact: remote code execution/heap corruption as described. ...

CVE-2018-6060

CVE-2018-6060 describes a use-after-free in Chrome/Chromium’s Blink/WebKit (WebAudio) prior to version 65.0.3325.146. The issue allows a remote attacker to potentially cause heap corruption via a crafted HTML page. The Debian advisories and Chromium security updates indicate fixes in Chromium/Chr...

CVE-2018-6152

CVE-2018-6152 is a Chrome/Chromium developer tools vulnerability where the Page.downloadBehavior backend could cause downloaded files to be treated as safe, enabling a crafted HTML page and user interaction to potentially escape the sandbox. Connected sources indicate this issue affected Chromium...

CVE-2018-6174

CVE-2018-6174 : An integer overflow in the SwiftShader library used by Google Chrome/Chromium prior to 68.0.3440.75 allows remote code execution via a crafted HTML page. Public notes across connected sources confirm the issue in Chromium/Chrome’s SwiftShader component, with Debian/DSA and Gentoo ...

CVE-2022-3052

The CVE-2022-3052 issue affects Google Chrome on ChromeOS (Lacros) before 105.0.5195.52, tied to a heap-buffer/heap-corruption risk in Window Manager when processing crafted UI interactions. The vulnerability requires a user to perform specific UI actions and could enable remote exploitation via ...

CVE-2026-12033

CVE-2026-12033 affects Google Chrome’s VideoCapture component. The issue is an out-of-bounds read in VideoCapture that could allow a remote attacker who has compromised the GPU process to read potentially sensitive data from process memory via a crafted HTML page. The vulnerability is tied to Chr...

CVE-2026-12440

CVE-2026-12440 concerns a use-after-free in Google Chrome’s DigitalCredentials on Windows, prior to version 149.0.7827.155. The issue allows a remote attacker to potentially escape the Chrome sandbox via a crafted HTML page, classified as Critical. Affected software is Chrome with the DigitalCred...

CVE-2026-13969

CVE-2026-13969 affects Google Chrome on Android: an uninitialized UI state in the renderer allows reading potentially sensitive memory via a crafted HTML page when the renderer is compromised. Exploitation involves a network attack with user interaction required; impact is confidentiality (high)....

CVE-2026-13998

Impact: Affected software is Google Chrome on macOS. The vulnerability stems from an incorrect security UI in the File Input component, enabling UI spoofing when a user is induced to perform specific UI gestures via a crafted HTML page. Root cause: flawed security UI handling in Chrome/Chromium’s...

CVE-2026-16806

CVE-2026-16806 affects Google Chrome WebMCP. A use-after-free in WebMCP can be triggered by visiting a crafted HTML page, allowing a remote attacker to execute arbitrary code inside the sandbox. The public sources confirm this vulnerability and tie it to the Chrome stable release update LP to 150...

CVE-2026-17900

CVE-2026-17900 : In Google Chrome for Windows, an inappropriate Enterprise implementation allowed a remote attacker to leak cross-origin data via a malicious file. Affected versions are prior to 151.0.7922.72. Chromium security severity is Low. Remediation: update to 151.0.7922.72 or later.

CVE-2026-8565

CVE-2026-8565 affects Google Chrome on macOS. The issue is an inappropriate implementation in the Downloads component that, before version 148.0.7778.168, could allow an attacker who persuades a user to install a malicious Chrome Extension to perform UI spoofing via that extension. The vulnerabil...

CVE-2026-8578

CVE-2026-8578 affects Google Chrome on Linux, with an out-of-bounds read in the GPU component of Chromium. The issue arises in the GPU path of Chromium’s rendering stack and can allow a remote attacker who has already compromised the renderer process to leak cross-origin data through a crafted HT...

CVE-2014-1705

CVE-2014-1705 affects Google Chrome’s V8 engine. Chrome versions before 33.0.1750.152 (OS X/Linux) and 33.0.1750.154 (Windows) are affected by a memory corruption bug in V8 that could be exploited remotely to cause a denial of service or other impacts. Public documentation in the provided sources...

CVE-2015-1243

CVE-2015-1243 affects Google's Blink DOM (MutationObserver.cpp, MutationObserver::disconnect) in Chrome up to 42.0.2311.135. The vulnerability is a use-after-free that can be triggered by unregistering a MutationObserver not currently registered, enabling remote DoS or unspecified impact. Documen...

CVE-2016-1688

CVE-2016-1688 is an out-of-bounds read in the V8 JavaScript library used by Google Chrome/Chromium prior to 51.0.2704.63. The root cause involves mishandling external string sizes, enabling a remote attacker to trigger a denial of service via crafted JavaScript. Remediation: upgrade to Chrome/Chr...

CVE-2017-5083

CVE-2017-5083: In Google Chrome Blink, an inappropriate implementation allowed a remote attacker to display UI on a non-attacker-controlled tab via a crafted HTML page. Affected versions are Chrome desktop/macOS/Linux prior to 59.0.3071.86 and Android prior to 59.0.3071.92. Mitigation is to upgra...

CVE-2018-16070

CVE-2018-16070 : Concrete details show integer/heap issues in Skia used by Google Chrome before 69.0.3497.81, allowing a remote attacker to potentially cause heap corruption via a crafted HTML page. Connected sources confirm this CVE is tracked across Chrome/Chromium releases and tied to Chromium...

CVE-2018-6037

CVE-2018-6037 concerns Google Chrome before 64.0.3282.119, where an insufficient user gesture requirement in the autofill feature could allow a remote attacker to obtain autofill data via a crafted HTML page. Connected sources corroborate the issue as an autofill/IP privacy bypass rooted in insuf...

CVE-2018-6119

CVE-2018-6119 affects Google Chrome prior to 64.0.3282.119, where an incorrect security UI in the Omnibox (URL bar) allowed a remote attacker to spoof the Omnibox content via a crafted HTML page. The vulnerability originates from the Omnibox security UI handling and is confirmed in connected sour...

CVE-2022-0290

CVE-2022-0290 is a use-after-free vulnerability in Chrome/Chromium’s Site isolation that could enable a remote attacker to escape the sandbox via a crafted HTML page. The issue affects Chrome/Chromium prior to version 97.0.4692.99 and is categorized with high severity in multiple advisories. Expl...

CVE-2022-3058

CVE-2022-3058 affects Google Chrome (Sign-In Flow) with a use-after-free in the UI interaction path that could lead to heap corruption. The issue is reported across multiple records and is mitigated by upgrading to Chrome 105.0.5195.52 or newer (as noted by Debian security advisory for Chromium)....

CVE-2024-9954

CVE-2024-9954 affects Chromium-based Google Chrome prior to 130.0.6723.58, with a use-after-free in the AI component that could allow a remote attacker to cause heap corruption via a crafted HTML page. Affected product scope includes Google Chrome/Chromium (desktop), with ChromeOS updates also ad...

CVE-2025-1923

CVE-2025-1923 concerns Google Chrome (Chromium-based) and is caused by an insecure implementation in the Permission Prompts mechanism. A user convinced to install a crafted Chrome Extension could trigger a UI spoofing scenario, allowing deception without network abuse beyond user interaction. The...

CVE-2025-3620

CVE-2025-3620 is a use-after-free in USB handling within Google Chrome/Chromium, fixed in 135.0.7049.95 for Chromium-based builds. The vulnerability allows a remote attacker to trigger heap corruption via a crafted HTML page, with high impact across confidentiality, integrity, and availability as...

CVE-2026-13842

CVE-2026-13842 (Chrome for iOS) : Inappropriate implementation in Google Chrome on iOS (Chrome for iOS) prior to 150.0.7871.47 allows a remote attacker to spoof the Omnibox (URL bar) via a crafted HTML page. Affected product: Chrome for iOS / Google Chrome on iOS. Root cause: improper handling in...

CVE-2026-17734

CVE-2026-17734 affects Google Chrome’s Autofill on all platforms. The root cause is an inappropriate Autofill implementation that allows a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. Impact is limited to a UXSS scenario with Medium severity; no exploit deta...

CVE-2026-17871

Technical details for CVE-2026-17871 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-76036

Affected: Dawn, the open-source WebGPU implementation library bundled in Chrome on Android, versions prior to 151.0.7922.169. Cause: A buffer overflow in Dawn allows writing beyond memory boundaries. Impact: A remote attacker can execute arbitrary code outside the Chrome sandbox by luring a victi...

CVE-2026-8528

CVE-2026-8528 affects Google Chrome’s SiteIsolation in Chromium. The issue is "insufficient validation of untrusted input" in SiteIsolation, allowing a remote attacker who has already compromised the renderer process to bypass Site Isolation via a crafted HTML page. The vulnerability is present i...

CVE-2026-8546

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-8561

The CVE-2026-8561 entry concerns Google Chrome (Chromium-based) and its Fullscreen UI: an incorrect security UI in Fullscreen allowed a remote attacker to spoof UI via a crafted HTML page. Transcripted details across sources confirm the vulnerable component is the fullscreen security UI, with the...

CVE-2013-0904

CVE-2013-0904 affects Google Chrome Web Audio in versions prior to 25.0.1364.152, with memory corruption issues identified as the underlying impact. The connected OpenVAS entries corroborate a set of Chrome/Chromium Web Audio related flaws and document memory-corruption paths linked to this CVE. ...

CVE-2016-1676

CVE-2016-1676 affects Google Chrome/Chromium before 51.0.2704.63. The issue is a cross-origin bypass in extension bindings (bindings.js) caused by improper prototype handling in the extensions framework, enabling remote bypass of Same Origin Policy via unspecified vectors. Debian security advisor...

CVE-2017-15420

CVE-2017-15420 describes a URL spoofing issue in Google Chrome/Chromium’s Omnibox caused by incorrect handling of back navigations on error pages, allowing a crafted HTML page to spoof the URL bar. Affected products/versions: Chrome prior to 63.0.3239.84 (per the CVE description). Remediation: up...

CVE-2017-5116

CVE-2017-5116 is a type-confusion vulnerability in Google Chrome/Chromium’s V8 engine. A race-condition based flaw allowed remote attackers to execute arbitrary code by enticing a user to open a crafted HTML page. Affected product family is Chromium/Chrome with V8 in the browser’s JavaScript engi...

CVE-2017-5122

CVE-2017-5122 is an out-of-bounds memory access in Google Chrome/Chromium’s V8 engine prior to 61.0.3163.100 (Windows and Chromium) that could be triggered by a crafted HTML page, enabling remote code execution. Public notices from Debian, Arch Linux, Gentoo, Fedora, and others confirm the issue ...

CVE-2018-16069

CVE-2018-16069 affects SwiftShader in Google Chrome/Chromium. The initial description ties the vulnerability to unintended floating-point error accumulation that could leak cross-origin data via a crafted HTML page. Several connected advisories corroborate that this CVE was addressed in Chromium ...

CVE-2018-6033

CVE-2018-6033 is listed in Debian security notes as affecting the Chromium/Google Chrome stack with a race condition in the Downloads handling when opening downloaded files. The connected documents confirm the vulnerability is associated with chromium-browser and describe it as a race condition, ...

CVE-2018-6161

CVE-2018-6161 affects Chromium/Google Chrome Blink WebAudio: a Same-Origin Policy bypass via a crafted HTML page was reported, with affected versions prior to 68.0.3440.75. Debian and FreeBSD security listings confirm the CVE and note the fix in 68.0.3440.75 (stretch) / updated package lines; no ...

CVE-2018-6169

CVE-2018-6169 relates to Google Chrome/Chromium where a lack of timeout on the extension install prompt allowed a remote attacker to bypass permission checks and trigger installation of a unwanted extension via a crafted HTML page. Affected software is the Chrome/Chromium extension installation f...

CVE-2020-6419

CVE-2020-6419 : In Google Chrome, the V8 engine contains an out-of-bounds write prior to 81.0.4044.92, which could allow a remote attacker to induce heap corruption via a crafted HTML page. The description notes heap corruption as the impact and mentions the affected browser version; no explicit ...

CVE-2022-3660

CVE-2022-3660 is described as an Inappropriate implementation in Full screen mode affecting Google Chrome on Android prior to 107.0.5304.62, allowing a remote attacker to hide the Omnibox contents via a crafted HTML page (Chromium security severity: Medium). Connected documents corroborate the is...