CVE-2018-20067

CVE-2018-20067 affects Google Chrome prior to 71.0.3578.80 in the browser’s Navigation/renderer flow. A crafted HTML page can cause a renderer-initiated back navigation to incorrectly cancel a browser-initiated navigation, enabling a remote attacker to confuse users about the origin of the curren...

CVE-2018-6117

CVE-2018-6117 affects Google Chrome prior to 66.0.3359.117, where confusing Autofill settings could allow a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Public references in the CVE indicate Chrome/Chromium impact and that fixes were rel...

CVE-2018-6151

CVE-2018-6151 concerns a bad cast in Chrome DevTools that allowed an attacker, by convincing a user to install a crafted Chrome extension, to trigger an out-of-bounds memory read. Affected software: Google Chrome with DevTools prior to 66.0.3359.117. The issue is addressed in later Chrome release...

CVE-2020-16045

CVE-2020-16045 : A use-after-free in the Payments component of Google Chrome on Android (before 87.0.4280.66) allowed a remote attacker who had compromised the renderer process to potentially escape the Chrome sandbox via a crafted HTML page. The issue is documented in multiple feeds (including R...

CVE-2020-6498

CVE-2020-6498 is described in the initial document as a user interface error in Google Chrome on iOS prior to 83.0.4103.88, with domain spoofing via a crafted HTML page (as per the description). Connected documents confirm CVE-2020-6498 is among multiple Chrome vulnerabilities listed in Debian se...

CVE-2022-0105

The CVE-2022-0105 entry corresponds to a Use-after-Free in PDF Accessibility in Google Chrome/Chromium prior to 97.0.4692.71, allowing remote attackers to potentially exploit heap corruption via a crafted HTML page. Public references show affected software as Google Chrome/Chromium components, wi...

CVE-2022-0118

The CVE-2022-0118 issue affects Google Chrome/Chromium’s WebShare implementation. A bug allowed a remote attacker to potentially hide the Omnibox contents via a crafted HTML page. Public materials trace the vulnerability to WebShare behavior and indicate fixes were shipped in Chrome/Chromium arou...

CVE-2022-0309

CVE-2022-0309 corresponds to an insecure implementation in Chrome’s Autofill feature that allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. The issue affects Google Chrome prior to version 97.0.4692.99. The referenced advisories indicate this vulnerability is ad...

CVE-2024-6995

CVE-2024-6995 describes an inappropriate Fullscreen implementation in Google Chrome on Android before 127.0.6533.72, which could allow a remote attacker who entices a user to perform specific UI gestures to spoof the Omnibox (URL bar) contents via a crafted HTML page. Connected advisories indicat...

CVE-2025-1006

CVE-2025-1006 is a Chrome/Chromium vulnerability: a use-after-free in the Network component could allow a remote attacker to trigger heap corruption via a crafted web app. Affects Google Chrome (Chromium-based) before version 133.0.6943.126. Impact is described as high (CVSS 3.1 base score 8.8; A...

CVE-2026-13775

CVE-2026-13775: In Google Chrome, a use-after-free in the GPU component (prior to 150.0.7871.47) could be triggered by a crafted HTML page by a renderer-compromised attacker to potentially escape the sandbox. Impact is a remote, sandbox-escape risk with high severity. Remediation: update Chrome t...

CVE-2026-17652

CVE-2026-17652 describes a use-after-free in the Views component of Google Chrome prior to 151.0.7922.72. The issue could allow a remote attacker who has compromised the renderer process to potentially escape the Chrome sandbox via a crafted HTML page. Affected software is Google Chrome (Views/Ch...

CVE-2026-17849

In Chrome for iOS (Google Chrome on iOS), CVE-2026-17849 arises from an inappropriate implementation that allowed a remote attacker to spoof the Omnibox (URL bar) by sending malicious network traffic. The issue affects Chrome on iOS prior to version 151.0.7922.72. Root cause is described as an un...

CVE-2026-17858

CVE-2026-17858 concerns Google Chrome WebNN on Windows with uninitialized use in WebNN. Affects Chrome versions prior to 151.0.7922.72; exploitation could allow a remote attacker to leak cross-origin data via a crafted HTML page. Upstream bug referenced: chromium issue 520191468. Red Hat and Debi...

CVE-2026-17899

CVE-2026-17899 refers to insufficient policy enforcement in Chrome DevTools before version 151.0.7922.72, enabling privilege escalation if a user installs a crafted malicious Chrome extension. Affected software is Google Chrome (DevTools component) with the root cause described as weak policy enf...

CVE-2026-79193

CVE-2026-79193 is an information leak in the Canvas component of Google Chrome prior to 152.0.7977.65 . A remote attacker can exploit this by delivering a crafted HTML page , enabling the leak of cross-origin data to a victim who interacts with the page. The flaw is rated Medium severity by both ...

CVE-2026-84355

CVE-2026-84355 is an incorrect authorization vulnerability in the Navigation component of Google Chrome prior to 152.0.7977.75 . A remote attacker who had already compromised the renderer process could leverage a crafted HTML page to bypass the web origin policy . The Chromium project rates this ...

CVE-2011-0480

CVE-2011-0480 involves FFmpeg’s Vorbis decoder (libavcodec/vorbis_dec.c) with multiple buffer overflows that can be triggered by a crafted WebM file, leading to memory corruption and possible denial of service or other impact. The vulnerability affects FFmpeg as used in browsers (e.g., Chrome pri...

CVE-2013-2857

CVE-2013-2857 is a use-after-free in Google Chrome/Chromium prior to 27.0.1453.110, related to image handling. The vulnerability could allow a remote attacker to cause a denial of service or potentially other unspecified impacts. Public advisories (e.g., Debian security notices) confirm multiple ...

CVE-2015-1242

CVE-2015-1242 describes a type-confusion vulnerability in Google V8’s ReduceTransitionElementsKind (hydrogen-check-elimination.cc) exploited via crafted JavaScript, affecting Google Chrome before 42.0.2311.90. It is triggered by the check-elimination optimization and can lead to denial of service...

CVE-2016-1672

CVE-2016-1672 affects Google Chrome up to version 51.0.2704.63, where the ModuleSystem::RequireForJsInner function in extension bindings mishandles properties, enabling remote cross-origin bypass via unspecified vectors. Public advisories and vendor fixes (e.g., Chromium 51.0.2704.63) address the...

CVE-2016-1677

CVE-2016-1677 refers to a type confusion in the V8 JavaScript engine used by Google Chrome/Chromium prior to version 51.0.2704.63. The flaw could allow a remote attacker to obtain sensitive information by calling decodeURI, via the affected V8 bindings, as part of the Chromium/Chrome stack. The c...

CVE-2017-15393

CVE-2017-15393 affects Chromium/Chromium-based browsers, describing an information disclosure (referrer leak) in the Devtools remote debugging feature prior to 62.0.3202.62. A remote attacker could obtain access to remote debugging functionality via a crafted HTML page, enabling potential exposur...

CVE-2017-5038

CVE-2017-5038 : Affected product is Google Chrome/Chromium prior to 57.0.2987.98. The vulnerability is a use-after-free in the GuestView component of Chrome/Chromium, leading to an out-of-bounds memory read via a crafted Chrome extension. Public documentation in connected sources confirms a fixed...

CVE-2017-5101

CVE-2017-5101 concerns Google Chrome’s Omnibox content spoofing vulnerability. The public description specifies an inappropriate Omnibox implementation that allows a remote attacker to spoof the Omnibox contents via a crafted HTML page on Chrome versions before 60.0.3112.78 (Linux, Windows, Mac)....

CVE-2017-5109

CVE-2017-5109 affects Chromium before version 60.0.3112.78, where a UI spoofing vulnerability was identified in the browser’s UI components (per Arch/Debian advisories). The issue is fixed in 60.0.3112.78 (upstream) with the Debian/Arch advisories confirming remediation. Affected product: Chromiu...

CVE-2017-5119

CVE-2017-5119 concerns the Skia component of Chromium. The initial description notes an uninitialized value in Skia on Chromium before 61.0.3163.79 (and Android 61.0.3163.81), enabling a remote attacker to read potentially sensitive process-memory data via a crafted HTML page (information disclos...

CVE-2018-6097

CVE-2018-6097 describes an issue in Google Chrome for macOS where improper handling of asynchronous methods in the Fullscreen UI could allow a remote attacker to enter full screen without showing a warning via a crafted HTML page. The root cause is an incorrect handling of asynchronous fullscreen...

CVE-2020-6503

CVE-2020-6503 affects Google Chrome before 74.0.3729.108 in the accessibility component. The root cause is an inappropriate implementation that allows a remote attacker to extract potentially sensitive information from a process’s memory via a crafted HTML page. The impact is exposure of memory-r...

CVE-2023-7013

CVE-2023-7013 affects Google Chrome’s Compositing component. The vulnerability arises from an inappropriate implementation that could allow a remote attacker to spoof the security UI via a crafted HTML page. Affected software is Chrome; root cause is within the Compositing path leading to UI spoo...

CVE-2026-13916

Chrome for iOS prior to 150.0.7871.47 allows UI spoofing via a crafted HTML page due to an inappropriate implementation in Chrome for iOS. Affected: Google Chrome on iOS (Chromium-based). Impact: UI spoofing risk; Severity: Medium (CVSS v3.1 base 4.3). Root cause: inappropriate implementation as ...

CVE-2026-17733

In Chrome on Android, CVE-2026-17733 is tied to an inappropriate QUIC implementation that could allow a remote attacker to leak cross-origin data via a crafted HTML page. Affected product/component: Google Chrome (Android) with QUIC; root cause: insecure QUIC handling leading to cross-origin data...

CVE-2026-17885

CVE-2026-17885 affects Google Chrome’s Paint component. The issue arises from an inappropriate implementation that allows a remote attacker to leak cross-origin data via a crafted HTML page, reported for Chrome versions prior to 151.0.7922.72. The provided sources indicate a Medium severity impac...

CVE-2026-17944

CVE-2026-17944 : In Chrome for iOS (Google Chrome on iOS), an inappropriate implementation allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. The issue is described as present in versions prior to 151.0.7922.72. Root cause: flawed navigation restriction handling ...

CVE-2026-17972

The CVE-2026-17972 entry describes an inappropriate implementation in Chrome for iOS (Google Chrome on iOS) before version 151.0.7922.72 that allows a remote attacker to perform UI spoofing via a crafted HTML page. The vulnerability impacts Chrome on iOS and is categorized with a Chromium-based r...

CVE-2026-18002

CVE-2026-18002 concerns insufficient validation of untrusted input in Google Lens within Chromium-based Google Chrome. The vulnerability, described across multiple feeds, occurs when a renderer process is compromised and a crafted HTML page could enable a sandbox escape through Google Lens compon...

CVE-2026-76038

CVE-2026-76038 is a type confusion vulnerability in the V8 JavaScript engine of Google Chrome prior to 151.0.7922.169 . A remote attacker can exploit it via a crafted HTML page to execute arbitrary code inside the sandbox . Chromium rates this High severity; CVSS 3.1 scores it 8.8 (AV:N/AC:L/PR:N...

CVE-2015-1212

CVE-2015-1212 affects Google Chrome before 40.0.2214.111 on Windows/macOS/Linux and before 40.0.2214.109 on Android, with multiple unspecified vulnerabilities that can cause a denial of service or other impact via unknown vectors. The connected documents corroborate a specific issue described as ...

CVE-2017-5079

CVE-2017-5079 affects Blink in Chromium/Chrome on Mac, Windows and Linux (desktop) and Android, allowing a remote attacker to spoof UI by crafting HTML in a non-attacker tab. Desktop impact reported as UI spoofing; affected Chrome versions before 59.0.3071.86 (and Android before 59.0.3071.92). Re...

CVE-2020-6453

CVE-2020-6453 affects Google Chrome’s V8 engine. An inappropriate implementation allowed a remote attacker to potentially trigger heap corruption with a crafted HTML page. This is tied to Chrome versions prior to 80.0.3987.162. The vulnerability is addressed by upgrading to 80.0.3987.162 or later...

CVE-2022-0112

CVE-2022-0112 describes an issue in Chrome/Chromium where the Browser UI could display a missing or misleading URL due to an incorrect security UI. Affected software: Google Chrome/Chromium prior to version 97.0.4692.71 (Chrome/Chromium on desktop). Root cause (as stated): an incorrect security U...

CVE-2022-2620

CVE-2022-2620 : Use-after-free in WebUI of Google Chrome on Chrome OS, under versions prior to 104.0.5112.79. The vulnerability could allow a remote attacker who tricks a user into specific UI interactions to potentially trigger heap corruption. Affected product/component: Google Chrome/Chrome OS...

CVE-2022-4916

Affected software: Google Chrome (Media component) with Chromium-based engine. Vulnerability: Use-after-free in Media leading to arbitrary read/write via a crafted HTML page. Root cause: use-after-free condition in Chrome’s media handling prior to version 103.0.5060.53. Impact: remote attacker co...

CVE-2022-4920

CVE-2022-4920 is a heap-based buffer overflow in Blink affecting Google Chrome up to version 101.0.4951.41. A remote attacker could lure a user into specific UI gestures via a crafted HTML page to potentially escape the Chrome sandbox. The vulnerability is confirmed across multiple connected advi...

CVE-2024-9965

CVE-2024-9965 concerns Google Chrome/Chromium DevTools on Windows prior to 130.0.6723.58. The Debian advisory confirms the vulnerability allows remote code execution through a crafted HTML page after certain user UI interactions, due to insufficient data validation in DevTools. Affected user agen...

CVE-2025-10891

CVE-2025-10891 relates to an integer overflow in V8 of Google Chrome, prior to Chromium 140.0.7339.207, which could allow remote heap corruption via a crafted HTML page. The connected Fedora advisories show Chromium/CEF package updates shipping Chromium 140.0.7339.207 across FC41/FC42/FC43 editio...

CVE-2026-13907

CVE-2026-13907 describes an inappropriate implementation in iOSWeb in Google Chrome on iOS (versions prior to 150.0.7871.47) that could allow UI spoofing when a user is guided to perform specific UI gestures on a crafted HTML page. Impact is described as Medium (CVSS 4.2); remediation or patch de...

CVE-2026-17670

CVE-2026-17670: In Google Chrome, a Use-after-Free in the Views subsystem could allow a remote attacker, after compromising the renderer process, to potentially escape the sandbox via a crafted HTML page. The issue affects Chrome prior to version 151.0.7922.72.icio The root cause is tied to impro...

CVE-2026-17719

CVE-2026-17719 is a Use-after-free in Chrome’s Input handling (Chromium) affecting Google Chrome prior to 151.0.7922.72. The vulnerability allows a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page. The confirmed impact is remote code execution with high...

CVE-2026-17964

CVE-2026-17964 affects Google Chrome on Android prior to version 151.0.7922.72, where an incorrect security UI could allow a remote attacker to perform domain spoofing via a crafted HTML page. The vulnerability is categorized with a Chromium-based, low-severity impact (CVSSv3.1 base score 4.3; sc...