CVE-2017-5045

CVE-2017-5045 affects Chromium/Google Chrome’s XSS Auditor, described in connected docs as an information disclosure vulnerability. The issue is within the XSS Auditor component of Chromium/Chrome, enabling leakage of sensitive data via crafted HTML interactions. The Debian/Arch Linux advisories ...

CVE-2017-5087

CVE-2017-5087 is a use-after-free in Blink in Google Chrome that enables a remote attacker to perform an out-of-bounds memory read via a crafted HTML page (IndexedDB sandbox escape). Affected Chrome versions: prior to 59.0.3071.104 on Mac/Windows/Linux and 59.0.3071.117 on Android. Impact describ...

CVE-2018-16087

CVE-2018-16087 involves Google Chrome/Chromium where a lack of proper state tracking in Permissions allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. The issue affects Chromium/Chrome versions prior to 69.0.3497.81 and is triggered by manipulating permission sta...

CVE-2018-17461

CVE-2018-17461 affects Google Chrome via PDFium. An out-of-bounds read in PDF rendering could be triggered by a crafted PDF file, allowing a remote attacker to read memory. Affected: Google Chrome prior to 68.0.3440.75 (PDFium component). Impact per CVSS3: High (partial confidentiality/integrity/...

CVE-2018-6176

CVE-2018-6176 affects Google Chrome/Chromium: insufficient file-type enforcement in the Extensions API enables privilege escalation via a crafted extension when the renderer is compromised. Several advisories (Debian DSA, Gentoo GLSA, CNVD) confirm local privilege escalation via the Extensions me...

CVE-2022-0294

CVE-2022-0294 refers to an “Inappropriate implementation in Push messaging” in Google Chrome before version 97.0.4692.99. The publicly provided data states that a remote attacker who had already compromised the renderer process could bypass site isolation via a crafted HTML page. The linked Chrom...

CVE-2022-0300

CVE-2022-0300 affects Google Chrome on Android: Use-after-free in Text Input Method Editor could allow a remote attacker who persuades a user to perform specific interactions to trigger heap corruption via a crafted HTML page. The advisory notes this as a potential exploit path. Remediation: upda...

CVE-2022-2860

CVE-2022-2860 affects Google Chrome/Chromium with insufficient cookie-prefix policy enforcement that could bypass restrictions via a crafted HTML page. Connected sources (Debian, Gentoo/Gentoo GLSA, Astra Linux) confirm the issue and provide the remediation: upgrade Chromium/Chrome to 104.0.5112....

CVE-2022-3314

CVE-2022-3314 is a use-after-free vulnerability in the Logging component of Chromium/Google Chrome. Public records in the connected docs identify Chrome/Chromium as affected, including ChromeOS-related components, with a fix released in the 106.x branch. Debian security advisories (DSA-5244-1) st...

CVE-2022-3315

CVE-2022-3315 is confirmed in multiple connected sources as a Type Confusion in Blink affecting Chromium/Google Chrome. It describes a vulnerability in Blink where a crafted HTML page could trigger heap corruption, allowing potential arbitrary code execution. Affected product line is Chromium-bas...

CVE-2022-4955

CVE-2022-4955 concerns Google Chrome before 108.0.5359.71, where an improper DevTools implementation could allow a user who installs a crafted extension via a malicious HTML page to bypass file access restrictions. The vulnerability stems from DevTools behavior and enables an attacker to exploit ...

CVE-2023-2313

CVE-2023-2313 concerns Google Chrome on Windows with an insecure Sandbox implementation in the Chromium-based renderer before version 112.0.5615.49. The vulnerability allows a remote attacker who has already compromised the renderer process to perform arbitrary read/write via a malicious file, in...

CVE-2023-3729

CVE-2023-3729 affects Google Chrome on ChromeOS (Splitscreen) and is caused by a use-after-free that can lead to heap corruption when a user is induced to perform specific UI interactions. The issue is tied to ChromeOS builds prior to version 115.0.5790.131. The vulnerability’s impact is describe...

CVE-2024-3168

CVE-2024-3168 corresponds to a Use-after-free vulnerability in Chrome DevTools prior to 122.0.6261.57 that could allow a remote attacker to cause heap corruption via a crafted HTML page. Affected product is Google Chrome (DevTools component); root cause is a use-after-free in DevTools as describe...

CVE-2026-13992

The CVE-2026-13992 entry applies to Google Chrome on macOS prior to version 150.0.7871.47 . The issue is an inappropriate UI implementation that enables UI spoofing when a user is persuaded to perform certain UI gestures via a crafted HTML page. The vulnerability is described as a remote, UI-base...

CVE-2026-17857

The CVE-2026-17857 entry affects Google Chrome’s Network component, with an inappropriate implementation that could allow a remote attacker to leak cross-origin data via a crafted HTML page. Affected versions are Chrome prior to 151.0.7922.72 (and related builds noted in the linked advisories). T...

CVE-2026-17934

CVE-2026-17934 involves insufficient validation of untrusted input in Chrome’s DevTools, enabling a remote attacker to bypass navigation restrictions via a crafted HTML page. Affected product: Google Chrome (DevTools). The issue is tied to versions before 151.0.7922.72 (Chromium security severity...

CVE-2013-0912

CVE-2013-0912 , present in WebKit used by Google Chrome, enables remote code execution via type confusion in WebKit prior to 25.0.1364.160. Affected products span multiple platforms (Linux, Windows, macOS) per OpenVAS entries; impact is arbitrary code execution without user interaction. Public de...

CVE-2016-1629

Google Chrome before 48.0.2564.116 is affected by CVE-2016-1629, a vulnerability in the Blink/Same Origin Policy and sandbox where a remote attacker could bypass SOP and escape the sandbox via unspecified vectors. The issue is mitigated by upgrading to Chrome 48.0.2564.116 or later (as reflected ...

CVE-2016-1691

CVE-2016-1691 affects the Skia library used by Google Chrome prior to 51.0.2704.63. The issue arises from mishandling of coincidence runs in SkOpCoincidence.cpp and SkPathOpsCommon.cpp, enabling a remote attacker to trigger a heap-based buffer overflow and cause a denial of service (with possible...

CVE-2017-5043

CVE-2017-5043 : Affected software is Chromium/Chrome Apps in Google Chrome prior to 57.0.2987.98. The root cause is a use-after-free in GuestView, leading to a remote memory read (out-of-bounds) via a crafted extension. Public advisories indicate fixes in Chromium/Chrome updates; Debian and openS...

CVE-2017-5111

CVE-2017-5111 is a use-after-free vulnerability in the PDFium component of Chromium/Google Chrome prior to 61.0.3163.79. It allows remote memory corruption via a crafted PDF file. Connected advisories confirm the issue affects Chromium/Chromium-derived packages and that the fix was introduced in ...

CVE-2018-6036

CVE-2018-6036 is an integer underflow in WebAssembly within Google Chrome64-bit era (V8) that could allow a remote attacker to leak user data via a crafted HTML page. The vulnerability was fixed in the Chrome stable update 64.0.3282.119; affected products are Google Chrome released before that v...

CVE-2019-5866

CVE-2019-5866 describes an out-of-bounds memory access in JavaScript in Google Chrome prior to 75.0.3770.142, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. Affected product: Google Chrome (JS engine). Root cause: out-of-bounds memory access. I...

CVE-2020-6497

CVE-2020-6497 is a policy enforcement issue in Omnibox on Google Chrome for iOS, allowing domain spoofing via a crafted URI. The connected Nessus entries confirm this CVE is part of the Chrome 83.0.4103.88– era fixes set. Affected component: Omnibox URL handling; root cause: insufficient policy e...

CVE-2021-4100

CVE-2021-4100 affects Chromium/ANGLE in Google Chrome prior to 96.0.4664.110. The connected documents describe an object lifecycle issue in ANGLE that could allow a remote attacker to trigger heap corruption via a crafted HTML page, potentially enabling arbitrary behavior. The vulnerability is ad...

CVE-2022-3313

CVE-2022-3313 : Affects Google Chrome prior to 106.0.5249.62 where the Full Screen security UI can be spoofed via a crafted HTML page. The Chromium/Chrome update fixed this in Chrome 106 (106.0.5249.61/62 in the release notes; fixed version noted as 106.0.5249.62+). Affected product: Google Chrom...

CVE-2026-12034

The CVE-2026-12034 entry describes an issue in Google Chrome on Linux where Linux Toolkit Theming mishandles untrusted input, allowing a renderer process in a compromised sandbox to escape via a malicious file. Affected software: Google Chrome on Linux (pre-149.0.7827.115). Root cause: insufficie...

CVE-2026-12437

CVE-2026-12437 describes a use-after-free in WebShare for Google Chrome on Windows before 149.0.7827.155. A remote attacker who already has renderer compromise could exploit a crafted HTML page to attempt a sandbox escape. The vulnerability is rated Critical. Affected software is Google Chrome (W...

CVE-2026-13987

CVE-2026-13987 affects Google Chrome for Android (Mobile UI) prior to 150.0.7871.47, where an incorrect security UI could allow a remote attacker to perform UI spoofing via a crafted HTML page. The issue is described with a Medium severity and is tied to Chromium components. The available connect...

CVE-2026-17694

CVE-2026-17694: Use-after-free in the DOM of Google Chrome before 151.0.7922.72 allows remote code execution inside the sandbox via a crafted HTML page. Affected software: Google Chrome (desktop). Root cause: use-after-free in DOM handling. Impact: arbitrary code execution in sandboxed context wi...

CVE-2026-17746

CVE-2026-17746 is a use-after-free in the GPU component of Google Chrome on macOS, affecting versions before 151.0.7922.72. The issue permits a remote attacker who already compromised the renderer process to potentially escape the Chrome sandbox via a crafted HTML page. The connected sources corr...

CVE-2026-17809

CVE-2026-17809 involves insufficient validation of untrusted input in the Chrome Extensions component, allowing a remote attacker who compromises the renderer to potentially escape the sandbox via a crafted HTML page. Upstream details point to Chromium issue 516813317. Affected software is Google...

CVE-2026-17961

CVE-2026-17961 refers to an Inappropriate implementation in Session in Google Chrome on Android prior to 151.0.7922.72 that allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. The issue affects Google Chrome on Android and is described with a Chromium security sev...

CVE-2010-1772

The CVE-2010-1772 issue is a use-after-free in WebKit WebCore (Geolocation.cpp) that can be triggered by a crafted page, allowing remote code execution or a denial of service. Affected: WebKit/WebCore before r59859, used by Google Chrome before 5.0.375.70. Root cause: failure to stop timers assoc...

CVE-2011-3102

CVE-2011-3102 is an off-by-one error in libxml2. The flaw can cause a denial of service or potentially arbitrary code execution when parsing certain XML inputs. It is associated with libxml2 used in applications (e.g., Google Chrome before 19.0.1084.46). Remediation across the affected ecosystems...

CVE-2013-2913

CVE-2013-2913 is a use-after-free in Blink’s XMLDocumentParser::append within Chromium-based browsers (Chrome/Chromium 30 era). The flaw in XML document parsing can lead to denial of service or other unspecified impact. Public references in the initial description indicate the issue affected Chro...

CVE-2016-9652

CVE-2016-9652 concerns Google Chrome/Chromium with multiple vulnerabilities reported in the Chromium project prior to version 55.0.2883.75. The connected advisories confirm this CVE is addressed by upgrading to 55.0.2883.75 (e.g., Debian: 55.0.2883.75-1~deb8u1; Gentoo GLSA 201612-11; Debian DSA-3...

CVE-2018-6038

CVE-2018-6038 describes a heap buffer overflow in WebGL on Google Chrome, allowing a remote attacker to cause an out-of-bounds read via a crafted HTML page. Affected product: Google Chrome (WebGL component). Root cause: heap overflow in WebGL leading to memory corruption. Impact: information disc...

CVE-2018-6052

The CVE-2018-6052 entry documents a vulnerability in Google Chrome (Blink) where the no-referrer policy policy was incompletely implemented, allowing a remote attacker to obtain referrer details from a page that believed it opted out. Affected software is Google Chrome (Blink component); impact i...

CVE-2022-1141

CVE-2022-1141: Use-after-free in Chrome File Manager affecting Google Chrome versions before 100.0.4896.60. The vulnerability could allow heap corruption via a specific user gesture after convincing a user to engage in certain interaction. Impact is described as high for confidentiality, integrit...

CVE-2024-5500

CVE-2024-5500 affects Google Chrome prior to 1.3.36.351, due to an inappropriate Sign-In implementation that could allow a remote attacker to bypass navigation restrictions via a crafted HTML page. The vulnerability impacts Chrome across platforms and is documented in the Chrome release notes and...

CVE-2026-11249

The CVE-2026-11249 entry describes a use-after-free in the Network component of Google Chrome affecting versions prior to 149.0.7827.53 . A remote attacker who has already compromised the renderer process could craft an HTML page to read potentially sensitive data from process memory. The connect...

CVE-2026-17666

CVE-2026-17666 is a cryptographic flaw in Google Chrome (Enterprise) that affected Chrome versions prior to 151.0.7922.72. An attacker in a privileged network position could bypass discretionary access control via malicious network traffic. The CVSS v3.1 base score is 9.1 (CRITICAL). Remediation:...

CVE-2026-19152

Google Chrome vulnerability CVE-2026-19152 affects Chrome releases prior to 151.0.7922.109, where insufficient policy enforcement in the Navigation component could allow a remote attacker who compromises the renderer to escape the sandbox via a crafted HTML page. The issue is tied to the Navigati...

CVE-2026-84353

CVE-2026-84353 is a critical use-after-free vulnerability in Shared Tab Groups of Google Chrome prior to version 152.0.7977.75 (Android/Linux) and 152.0.7977.76 (Windows/Mac). A remote attacker leveraging social engineering (e.g., luring a user to a malicious website or HTML email) can execute ar...

CVE-2015-6792

The CVE-2015-6792 entry affects Google Chrome’s MIDI subsystem prior to 47.0.2526.106. The issue concerns improper handling of MIDI data sent by the MIDI subsystem, enabling a remote attacker to cause a crash or execute arbitrary code via unspecified vectors (cited in midi_manager.cc, midi_manage...

CVE-2016-1661

CVE-2016-1661 affects Blink in Google Chrome prior to 50.0.2661.94. The issue arises because frames are not only checked against Same Origin Policy but also against the renderer process, enabling remote attackers to trigger memory corruption in cross‑process frames. Related components: BindingSec...

CVE-2017-5060

CVE-2017-5060 affects Google Chrome/Chromium Omnibox prior to version 58.0.3029.81 (desktop) and 58.0.3029.83 (Android) due to insufficient policy enforcement, enabling domain spoofing via IDN homographs in crafted domain names. Public details in connected docs verify affected Chromium releases (...

CVE-2018-20067

CVE-2018-20067 affects Google Chrome prior to 71.0.3578.80 in the browser’s Navigation/renderer flow. A crafted HTML page can cause a renderer-initiated back navigation to incorrectly cancel a browser-initiated navigation, enabling a remote attacker to confuse users about the origin of the curren...