CVE-2012-0724

CVE-2012-0724 affects Adobe Flash Player prior to 11.2.202.229 in Google Chrome prior to 18.0.1025.151. The vulnerability enables memory corruption leading to a possible denial of service or other unspecified impact via unknown vectors (distinct from CVE-2012-0725). Connected advisories corrobora...

CVE-2013-2882

CVE-2013-2882 affects Google V8 (used by Google Chrome) prior to Chrome/Chromium 28.0.1500.95, where type confusion could lead to remote denial of service and possibly other unspecified impact. Connected sources reference the same CVE in relation to Chromium/V8 vulnerabilities, but none of the do...

CVE-2015-1258

CVE-2015-1258 affects Google Chrome up to 43.0.2357.65. The issue arises from libvpx not being built with an appropriate --size-limit value, which can allow remote attackers to trigger a negative value for a size field in VP9 data, potentially causing a denial of service or other impact via a cra...

CVE-2015-1277

CVE-2015-1277 is a use-after-free vulnerability in Google's Chrome/Chromium accessibility implementation (Chromium project). The issue arises from invalid memory handling in accessibility-tree structures, enabling a remote attacker to trigger a denial of service and possibly other unspecified imp...

CVE-2016-1612

CVE-2016-1612 affects Google Chrome (V8) prior to version 48.0.2564.82. The issue is a logic error in LoadIC::UpdateCaches in ic/ic.cc where receiver compatibility is not ensured before casting an unspecified variable, enabling a remote attacker to cause a denial of service via crafted JavaScript...

CVE-2016-1614

The CVE-2016-1614 entry affects Google's Blink/WebKit code path used by Chrome prior to 48.0.2564.82, specifically the UnacceleratedImageBufferSurface class in WebKit/Source/platform/graphics/UnacceleratedImageBufferSurface.cpp. The vulnerability arises from mishandling the initialization mode, e...

CVE-2016-2052

HarfBuzz contains CVE-2016-2052: a buffer over-read due to an inverted length check in hb-ot-font.cc, affecting HarfBuzz up to 1.0.6 and used by Google Chrome prior to 48.0.2564.82. Affected data could cause a denial of service or other impact. The issue is fixed in HarfBuzz 1.0.6 and later; upgr...

CVE-2016-5137

CVE-2016-5137 affects Chrome/Blink CSPSource::schemeMatches in Blink’s CSP implementation prior to 52.0.2743.82, where http:80 on https:443 and ws:80 on wss:443 policies are not applied, enabling a remote attacker to infer whether an HSTS site was visited via CSP reports. Debian security advisori...

CVE-2017-15417

The CVE-2017-15417 issue affects Google Chrome (Chromium) involving Skia canvas operations. The flaw is described as an inappropriate implementation in Skia canvas composite operations that allowed a remote attacker to disclose cross-origin data via a crafted HTML page. CNVD-2018-20145 confirms t...

CVE-2017-5108

CVE-2017-5108 is a type-confusion vulnerability in the PDFium component of Chromium, affecting Google Chrome/Chromium before 60.0.3112.78 on Mac, Windows, Linux and Android. The connected documents corroborate an arbitrary code execution risk via a crafted PDF file due to PDFium weaknesses, with ...

CVE-2018-20065

CVE-2018-20065 affects Google Chrome prior to 71.0.3578.80 via the PDFium component. The vulnerability arises from how Chrome handles URI actions in PDFs, allowing a remote attacker to trigger potentially unsafe navigations without user gesture through a crafted PDF file. Connected sources specif...

CVE-2022-0296

CVE-2022-0296 is a Use-after-Free in Printing in Google Chrome prior to 97.0.4692.99, enabling a remote attacker to exploit heap corruption via a crafted HTML page after convincing the user to engage in specific interactions. Affected product: Google Chrome (desktop). Root cause: use-after-free i...

CVE-2022-2587

CVE-2022-2587 refers to an out-of-bounds write in the ChromeOS CRAS (Chrome OS Audio Server) component of Google Chrome on ChromeOS before 102.0.5005.125. The underlying cause is an unsafe strcpy-based copy of a user-controlled identity string, allocated as 128 bytes on the heap, allowing a remot...

CVE-2022-4919

CVE-2022-4919 is a use-after-free in Base Internals of Google Chrome (Chromium) prior to 101.0.4951.41, allowing a remote attacker to cause arbitrary read/write via a crafted HTML page. The issue affects Chrome/Chromium components as described in multiple connected sources; the vulnerability is s...

CVE-2024-3171

CVE-2024-3171 affects Google Chrome (Chromium) before 122.0.6261.57. It is a use-after-free in Accessibility that can lead to heap corruption when a user is persuaded to perform specific UI gestures. The issue requires user interaction and is mitigated by updating to Chrome 122.0.6261.57 or later...

CVE-2025-1916

CVE-2025-1916 is a use-after-free flaw in Google Chrome profiles that may allow heap corruption when a user is enticed to install a malicious extension, via a crafted HTML page. Affected: Google Chrome/Chromium profiles prior to 134.0.6998.35. Impacted component: Profiles handling in Chrome; root...

CVE-2026-13994

CVE-2026-13994 describes an issue in Google Chrome on Android related to Credential Management: an inappropriate implementation allows a remote attacker to perform UI spoofing via a crafted HTML page. The vulnerability affects Chrome versions prior to 150.0.7871.47 (Chromium security severity: Me...

CVE-2026-16804

Google Chrome prior to 150.0.7871.186 is affected by a use-after-free in Input that, if the renderer process is compromised, could permit a sandbox escape via a crafted HTML page (high severity; CVSSv3.1: 8.3). The issue is addressed in the Stable Channel update to 150.0.7871.186/187, with four r...

CVE-2026-17717

CVE-2026-17717 : Integer overflow in ANGLE within Google Chrome leads to a potential sandbox escape via a crafted HTML page. Affected software is Google Chrome (ANGLE component in Chromium). The described impact is high/critical, with exploitation described as remote and requiring a crafted HTML ...

CVE-2011-2834

CVE-2011-2834 is a double-free flaw in libxml2 related to XPath handling. The vulnerability could allow a remote attacker to crash the application or, potentially, execute arbitrary code when processing crafted XML data. Public references in Debian and Red Hat advisories note that this issue affe...

CVE-2012-5134

CVE-2012-5134 is a heap-based buffer underflow in libxml2’s xmlParseAttValueComplex (parser.c) present in libxml2 2.9.0 and earlier, used by Google Chrome up to 23.0.1271.91 and other products. The flaw allows a remote attacker to cause a crash or possibly execute arbitrary code via crafted XML e...

CVE-2013-6640

The CVE-2013-6640 issue affects the Google V8 JavaScript engine (used in Google Chrome) where the function DehoistArrayIndex in hydrogen-dehoist.cc allows an attacker to trigger an out-of-bounds read via a crafted array index. This vulnerability is associated with V8 builds before version 3.22.24...

CVE-2016-1667

CVE-2016-1667 describes a cross-origin bypass in the DOM implementation of Blink/WebKit used by Google Chrome before 50.0.2661.102. The vulnerability stems from the TreeScope::adoptIfNeeded function in WebKit/Source/core/dom/TreeScope.cpp, which failed to prevent script execution during node adop...

CVE-2016-5224

CVE-2016-5224 affects Chromium/Blink SVG handling. The Debian advisory and related feeds describe a same-origin policy bypass in the SVG component of the Chromium browser, with historical references to a timing-attack-derived bypass in denormalized floating-point SVG filters (Chrome prior to 55.0...

CVE-2017-15411

CVE-2017-15411 affects Google Chrome’s PDFium component. A use-after-free/memory misreference in PDFium prior to 63.0.3239.84 can allow a remote attacker to trigger heap corruption via a crafted PDF file. The exploit could be remotely triggered with no user interaction (per CVSS metrics), leading...

CVE-2017-5068

CVE-2017-5068: In Google Chrome (Chromium-based) prior to 58.0.3029.96, WebRTC’s handling of picture IDs could trigger a race condition via a crafted HTML page on Mac/Windows/Linux. This is the concrete vulnerability: the race condition could be exploited remotely by a crafted page. Affected soft...

CVE-2017-5077

CVE-2017-5077: Insufficient validation of untrusted input in Skia within Chromium allowed out-of-bounds memory reads via crafted HTML. Affects Chrome/Chromium builds on Linux, Windows, and macOS prior to 59.0.3071.86 and Android up to 59.0.3071.92. Root cause: inadequate bounds checking in Skia c...

CVE-2017-5127

The CVE-2017-5127 entry describes a use-after-free in the PDFium component of Google Chrome, exploitable via crafted PDF files and affecting Chrome versions prior to 62.0.3202.62. The underlying issue is a PDFium use-after-free that could allow remote code execution (heap corruption). Impact is d...

CVE-2018-6115

CVE-2018-6115 affects Google Chrome (and Chromium) prior to 66.0.3359.117. The issue is an inappropriate setting of the SEE_MASK_FLAG_NO_UI flag in file downloads, which could allow a remote, crafted HTML page to bypass operating system malware checks. Public advisories and vendor updates indicat...

CVE-2019-5873

CVE-2019-5873 affects Google Chrome on iOS prior to 77.0.3865.75, where insufficient policy validation in navigation allows a remote attacker to spoof the Omnibox (URL bar) contents via a crafted HTML page. Connected advisories corroborate the same vulnerability and indicate the fixed version is ...

CVE-2022-3043

The CVE-2022-3043 entry describes a heap/buffer overflow in Screen Capture for Google Chrome on Chrome OS, prior to version 105.0.5195.52. The vulnerability could be triggered by a crafted HTML page and user interaction, potentially enabling heap corruption and remote code execution. Affected pro...

CVE-2022-3044

CVE-2022-3044 describes an insecure implementation of Site Isolation in Google Chrome prior to 105.0.5195.52, allowing a remote attacker who already compromised a renderer process to bypass site isolation via a crafted HTML page. Affected product: Google Chrome (Chromium-based). Root cause: inapp...

CVE-2025-1921

CVE-2025-1921 affects Google Chrome (Chromium-based) via the Media Stream component. The root cause is an inappropriate implementation that allows a remote attacker to obtain information about a peripheral through a crafted HTML page. The vulnerability is fixed in Chrome/Chromium 134.0.6998.35 an...

CVE-2026-11062

CVE-2026-11062 affects Google Chrome extensions: insufficient policy enforcement in Extensions allows an attacker to inject scripts/HTML into a privileged page when a user installs a crafted malicious extension. Impact is partial integrity compromise of privileged pages; exploit not confirmed in ...

CVE-2026-11684

CVE-2026-11684 affects Google Chrome’s Network policy enforcement. Affected component: network policy handling in Chrome before 149.0.7827.103. Root cause: insufficient policy enforcement allowed a remote attacker who had compromised the utility process to leak cross-origin data via a crafted HTM...

CVE-2026-13975

CVE-2026-13975 affects ANGLE in Google Chrome on macOS. The vulnerability is an out-of-bounds read in ANGLE that could allow a remote attacker who has compromised the renderer process to read potentially sensitive data from process memory via a crafted HTML page. The issue arises in Chrome prior ...

CVE-2026-17799

CVE-2026-17799 describes insufficient validation of untrusted input in Chrome/Chromium Safe Browsing, allowing a remote attacker to bypass discretionary access control via a malicious file. Affects Chrome/Chromium's Safe Browsing component prior to 151.0.7922.72; upstream issue 514461031 referenc...

CVE-2026-17922

CVE-2026-17922 involves Inappropriate implementation in Google Chrome prior to 151.0.7922.72, where an issue in the Enterprise channel allowed a remote attacker to execute arbitrary code via a crafted HTML page. The vulnerability is tied to Chromium components and is described with a Chromium sec...

CVE-2026-17958

CVE-2026-17958 involves an inappropriate implementation in the Views component of Google Chrome before 151.0.7922.72, enabling a remote attacker to perform UI spoofing via a crafted HTML page. The referenced impact level is Chromium security severity: Low, with CVSS‑3.1 metrics showing Network ac...

CVE-2026-84329

A confused deputy vulnerability in the CredentialProvider component of Google Chrome on Windows (prior to 152.0.7977.75 ) allowed a remote attacker who had already compromised the renderer process to leak sensitive information via a crafted HTML page. Chromium rates the severity as Low ; the CVSS...

CVE-2013-2924

CVE-2013-2924 is a use-after-free vulnerability in the International Components for Unicode (ICU) library (ICU4C/ICU4J) used by multiple products, including Google Chrome. The issue can lead to remote denial of service and possibly other unspecified impacts via unknown vectors. Public references ...

CVE-2013-6668

CVE-2013-6668 refers to multiple vulnerabilities in the V8 JavaScript engine (before 3.24.35.10) as used in Google Chrome prior to 33.0.1750.146. The connected documents confirm that these issues were fixed in V8 version 3.24.35.10 and are reflected in Chromium/Chrome patches (e.g., Chrome 33.x s...

CVE-2015-6757

CVE-2015-6757 is a use-after-free vulnerability in Chrome’s ServiceWorker implementation (content/browser/service_worker/embedded_worker_instance.cc) that affects Chrome before 46.0.2490.71. The issue could allow a remote attacker to cause a denial of service or potentially other impact by manipu...

CVE-2016-7153

CVE-2016-7153 describes a vulnerability in the HTTP/2 protocol where the TCP congestion window is not considered when determining content length, potentially enabling an attacker to obtain cleartext data by leveraging a web browser configuration that sends third‑party cookies (HEIST). The connect...

CVE-2017-15386

The CVE-2017-15386 issue affects the Blink component in Google Chrome prior to 62.0.3202.62, where an incorrect implementation could allow a remote attacker to spoof the Omnibox (URL bar) via a crafted HTML page. The connected sources corroborate that this is a UI/content spoofing vulnerability i...

CVE-2017-5037

CVE-2017-5037: In Chromium/Chromium-based browsers, multiple out-of-bounds writes were reported in the ChunkDemuxer component. A remote attacker could exploit crafted media content to trigger issues; affected versions include Chromium up to 57.0.2987.98.x. Upgrading to 57.0.2987.98 or newer mitig...

CVE-2017-5126

CVE-2017-5126: A use-after-free in PDFium found in the Chromium/Chrome PDF rendering path prior to 62.0.3202.62 allows a remote attacker to cause heap corruption via a crafted PDF file, enabling arbitrary code execution. Affected software/component: PDFium inside Chromium/Chrome on versions

CVE-2019-13684

CVE-2019-13684: Chrome prior to 72.0.3626.81 has an inappropriate JavaScript implementation that allows a remote attacker to leak cross-origin data via a crafted HTML page. Affected product: Google Chrome (desktop/mobile), version not explicitly stated beyond the pre-72.0.3626.81 range in the pro...

CVE-2020-6502

Technical details about CVE-2020-6502 are not publicly provided in the connected documents. Monitor for updates from official advisories to learn affected components, root cause, impact, and mitigations as they become available.

CVE-2022-2859

CVE-2022-2859: Use-after-free in Chrome OS Shell within Google Chrome prior to 104.0.5112.101 can be triggered by a user-engaged UI interaction, potentially leading to heap corruption and remote code execution. Debian security advisory confirms a fix in Chromium 104.0.5112.101-1~deb11u1; updating...