CVE-2022-2859

CVE-2022-2859: Use-after-free in Chrome OS Shell within Google Chrome prior to 104.0.5112.101 can be triggered by a user-engaged UI interaction, potentially leading to heap corruption and remote code execution. Debian security advisory confirms a fix in Chromium 104.0.5112.101-1~deb11u1; updating...

CVE-2022-3046

CVE-2022-3046 is a memory-corruption vulnerability in Google Chrome’s Browser Tag, where a Use-after-Free allows heap corruption via a crafted HTML page if a user is persuaded to install a malicious extension. Affected software is Chrome prior to 105.0.5195.52. The issue can enable high-impact ou...

CVE-2025-3069

CVE-2025-3069 affects Google Chrome/Chromium Extensions: an inappropriate implementation in the Extensions component allows privilege escalation via a crafted HTML page. Vulnerable before 135.0.7049.52; exploitation requires user interaction and a crafted HTML page, with a remote (network) attack...

CVE-2026-19144

CVE-2026-19144 is a Google Chrome use-after-free vulnerability in HTML leading to potential heap corruption. Affected software: Google Chrome prior to version 151.0.7922.109. Root cause: use-after-free in HTML handling within the browser’s rendering/HTML code path (Chromium-based). Impact: high s...

CVE-2026-5280

CVE-2026-5280 affects Google Chrome’s WebCodecs component. A use-after-free in WebCodecs prior to 146.0.7680.178 allows a remote attacker to run arbitrary code in the sandbox via a crafted HTML page. The issue is acknowledged across multiple advisories (Chromium/Chrome updates and trackers). The ...

CVE-2026-7347

CVE-2026-7347 affects Google Chrome (Chromoting component) prior to 147.0.7727.138. Description from connected sources indicates a use-after-free in Chromoting that could allow a remote attacker to execute arbitrary code via malicious network traffic. The Chrome update 147.0.7727.137/138 for Wind...

CVE-2026-8572

CVE-2026-8572 : In Google Chrome on Android, versions prior to 148.0.7778.168 suffer from insufficient policy enforcement in the Network component. A renderer-process compromise could leak cross-origin data via a crafted HTML page. This is supported by multiple vendors: Upstream Chromium report (...

CVE-2009-2816

Technical details for CVE-2009-2816 are not provided in the connected documents. The materials mention WebKit/CORS context and related products, but no concrete exploit specifics, impacted versions, or fixes are included. Monitor for updates.

CVE-2011-3905

CVE-2011-3905 is a libxml2 out-of-bounds memory read vulnerability. It affects libxml2 used by Chrome before 16.0.912.63 and can be triggered by processing crafted XML, potentially crashing the application or enabling arbitrary code execution. Mitigations documented in multiple advisories (e.g., ...

CVE-2015-1284

The CVE-2015-1284 entry concerns Google Chrome/Blink: LocalFrame::isURLAllowed in core/frame/LocalFrame.cpp did not properly cap the maximum number of frames on a page, allowing crafted JavaScript that creates many IFRAME elements to trigger a denial of service (invalid count value) and potential...

CVE-2016-1626

CVE-2016-1626 affects Google Chrome (before 48.0.2564.109) via OpenJPEG used in PDFium. The opj_pi_update_decode_poc function in pi.c miscalculates a layer index value, enabling a remote attacker to cause a denial of service (out-of-bounds read) through a crafted PDF document. Remediation: update...

CVE-2017-15392

CVE-2017-15392 relates to Google Chrome/Chromium on Windows and is caused by an incorrect registry key handling in the PlatformIntegration component prior to 62.0.3202.62. A crafted Windows Registry entry could allow heap corruption, potentially enabling code execution or stability issues as desc...

CVE-2017-15415

Google Chrome IPC Pointer Information Disclosure vulnerability (CVE-2017-15415) stems from incorrect serialization in the IPC component, allowing a remote attacker to leak a pointer value via a crafted HTML page on affected builds prior to 63.0.3239.84. Public descriptions in CNVD-2018-22403 corr...

CVE-2018-17472

CVE-2018-17472 : In Google Chrome for iOS (Intents), the handling of the googlechrome:// URL scheme before version 70.0.3538.67 could allow a remote attacker to escape the iframe sandbox via a crafted HTML page. The vulnerability is tied to the browser’s iOS Intents handling and could lead to san...

CVE-2018-20070

CVE-2018-20070 describes a vulnerability in Google Chrome’s URL Formatter (Omnibox) where incorrect handling of confusable characters allowed a remote attacker to spoof the Omnibox via a crafted domain name. Affected releases are Chrome versions prior to 71.0.3578.80; exploitation could mislead u...

CVE-2018-6162

CVE-2018-6162 is a heap buffer overflow in WebGL within Google Chrome (Mac) prior to 68.0.3440.75, exploitable via crafted HTML to trigger heap corruption. Debian and other advisories confirm a fix in Chrome/Chromium 68.0.3440.75 (and later); remediation is to upgrade to the fixed version. The co...

CVE-2025-13224

CVE-2025-13224 is a Type Confusion in V8 affecting Google Chrome prior to 142.0.7444.175, leading to potential heap corruption via a crafted HTML page. The issue affects Chrome’s V8 and was addressed in the 142.0.7444.175+ stable channel releases (Windows/macOS/Linux). Debian/Alpine security advi...

CVE-2025-3071

CVE-2025-3071 concerns Google Chrome (Chromium project). The vulnerability is described as an inappropriate implementation in Navigations that allowed a remote attacker to bypass the same-origin policy when a user engaged specific UI gestures on a crafted HTML page, before version 135.0.7049.52. ...

CVE-2026-13038

Use-after-free in Chrome’s Autofill on Windows exploited via a crafted HTML page could allow remote code execution. Affected versions are Chrome on Windows before 149.0.7827.197. If exploiting, attacker could take arbitrary code execution; impact is severe (CVE-2026-13038). The cited sources indi...

CVE-2026-17660

CVE-2026-17660 : In Google Chrome, the vulnerability stems from insufficient validation of untrusted input in the Network module, potentially enabling a sandbox escape when a compromised renderer processes a crafted HTML page. Affects Chrome prior to version 151.0.7922.72 (on desktop; Windows/mac...

CVE-2026-17673

CVE-2026-17673: An integer overflow in QUIC within Google Chrome’s renderer can, via a crafted HTML page, potentially allow a sandbox escape. Affected: Google Chrome (desktop) prior to 151.0.7922.72. Root cause: integer overflow in QUIC handling. Impact: remote code execution with sandbox escape ...

CVE-2026-5865

CVE-2026-5865 is a confirmed type confusion in the V8 engine used by Google Chrome prior to version 147.0.7727.55, allowing a remote attacker to execute arbitrary code inside the Chrome sandbox via a crafted HTML page. The issue is addressed in the Chrome 147 release; Debian notes fixes in 147.0....

CVE-2026-6919

CVE-2026-6919 is a use-after-free in Google Chrome’s DevTools prior to 147.0.7727.117 that could allow a remote attacker who already compromised the renderer process to escape the Chrome sandbox via a crafted HTML page. Documents from NVD/NVD mirrors and Debian/EU data confirm the vulnerability d...

CVE-2026-8576

CVE-2026-8576 concerns an inappropriate CORS implementation in Google Chrome on Linux and ChromeOS, traced to the Chromium CORS component. Upstream bug reference points to a chromium issue (496231853). The vulnerability allows a remote attacker to leak cross-origin data via a crafted HTML page; i...

CVE-2010-1029

CVE-2010-1029 is a stack-consumption vulnerability in WebKit’s WebCore::CSSSelector, affecting Apple Safari 4.0.4, Safari on iPhone OS and iPhone OS for iPod touch, and Google Chrome 4.0.249. An attacker can cause a denial-of-service (crash) or potentially execute arbitrary code via a STYLE eleme...

CVE-2010-3246

CVE-2010-3246 affects Google Chrome

CVE-2015-1233

CVE-2015-1233/1234 affect Chromium/Google Chrome up to 41.0.2272.118: remote code execution via a combination of V8, Gamepad, and IPC bugs, and a race-condition in GPU commands could cause DoS or other impact. Multiple Nessus/Gentoo/OpenSUSE/Mageia advisories confirm the issues and cite version 4...

CVE-2015-1278

Google Chrome up to 44.0.2403.89 is affected by CVE-2015-1278 due to content/browser/web_contents/web_contents_impl.cc not closing a PDF document's modal dialog when navigating to an interstitial page, enabling URL spoofing via a crafted PDF (alert_dialog.pdf). Remediation: upgrade to Chrome 44.0...

CVE-2015-6763

Google Chrome/Chromium (CVE-2015-6763): Multiple vulnerabilities were fixed in Chrome 46, addressing issues identified during internal audits and in the v8 engine (4.6.85.23). The CVE entry relates to Chrome before 46.0.2490.71, with fixes shipped in the 46.0.2490.71 release. Impact in the CVE no...

CVE-2016-1698

In CVE-2016-1698, Google Chrome’s extensions/renderer/resources/binding.js createCustomType did not validate module types, causing an information disclosure via a poisoned definition. Affected is Chrome before 51.0.2704.79; the issue could allow loading arbitrary modules or exposing sensitive dat...

CVE-2016-5133

CVE-2016-5133 describes a proxy authentication origin confusion in Google Chrome/Chromium prior to 52.0.2743.82, enabling MITM attackers to spoof a proxy-login prompt or trigger incorrect credential storage by altering the client–server data stream. Affected software is Chromium/Chrome (proxy aut...

CVE-2017-5133

CVE-2017-5133 is an out-of-bounds write vulnerability in the Skia component of the Chromium browser prior to 62.0.3202.62. The connected Debian security advisory notes this CVE as part of a collection affecting chromium-browser, with the Skia bug allowing arbitrary code execution in remote scenar...

CVE-2018-16072

CVE-2018-16072 relates to Chrome/Blink where a missing origin check in HLS manifests could bypass the same-origin policy via a crafted HTML page. Affected software is Google Chrome (Blink engine); vulnerable builds are prior to Chrome/Chromium version 69.0.3497.81. The underlying issue is a failu...

CVE-2018-6113

This CVE (CVE-2018-6113) concerns Google Chrome on iOS (pre-66.0.3359.117) where improper handling of pending navigation entries in Navigation allows a remote attacker to spoof the domain via a crafted HTML page. The issue is categorized as a URL spoofing/domain spoofing vulnerability in the Navi...

CVE-2018-6160

CVE-2018-6160 concerns Google Chrome (iOS) where JavaScript/HTML crafted content allowed a remote attacker to spoof the Omnibox (URL bar). The connected Chrome/Chromium notes confirm this as a URL spoof issue in Chrome on iOS and tie the vulnerability to the Chromium 68.0.3440.75 release family. ...

CVE-2019-5797

CVE-2019-5797 is a Chrome/Chromium DOMStorage issue prior to 73.0.3683.75. Connected sources describe a race condition in the DOMStorage component (archlinux ASA-201903-8; Debian security context), with the advisory stating it can lead to arbitrary code execution and upgrading to 73.0.3683.75-1 f...

CVE-2022-1142

CVE-2022-1142 : Heap buffer overflow in WebUI of Google Chrome prior to 100.0.4896.60. A remote attacker could trigger heap corruption via specific input in DevTools after convincing a user to perform certain interactions. The vulnerability affects Google Chrome’s WebUI and is rated high severity...

CVE-2025-8011

CVE-2025-8011 is a type-confusion in V8 affecting Google Chrome/Chromium up to version 138.0.7204.168, enabling heap corruption via a crafted HTML page and allowing a remote attacker to potentially achieve arbitrary code execution. Connected sources corroborate a Chromium-based impact and list af...

CVE-2026-11686

The CVE-2026-11686 entry describes an issue in Dawn within Google Chrome on macOS before 149.0.7827.103. The root cause is insufficient validation of untrusted input in Dawn, which could allow a remote attacker who has compromised the renderer process to leak cross-origin data via a crafted HTML ...

CVE-2026-13983

CVE-2026-13983 affects Chrome for iOS prior to 150.0.7871.47. Affected component: Chrome on iOS/webview rendering Omnibox UI. Root cause: inappropriate implementation allowed a remote attacker to spoof the Omnibox contents via a crafted HTML page when a user is tricked into performing specific UI...

CVE-2026-17695

CVE-2026-17695 (ANGLE in Google Chrome on macOS) involves an inappropriate ANGLE implementation that allowed a remote attacker to potentially escape Chrome’s sandbox via a crafted HTML page. Affected software is Google Chrome on macOS with ANGLE prior to version 151.0.7922.72. The issue is descri...

CVE-2026-17939

CVE-2026-17939 affects Google Chrome (Passwords component in Chromium). The upstream description cites insufficient validation of untrusted input in Passwords, enabling a remote attacker to perform UI spoofing via malicious network traffic (Chromium severity: Low). Affected versions are prior to ...

CVE-2026-17945

CVE-2026-17945 affects Google Chrome’s Navigation in versions prior to 151.0.7922.72. The issue arises from insufficient validation of untrusted input, allowing a renderer-compromised attacker to perform UI spoofing via a crafted HTML page. The reported impact is UI spoofing with low severity; ex...

CVE-2010-1824

CVE-2010-1824 is a use-after-free vulnerability in WebKit used by Apple iTunes (Windows), Safari, and Chrome up to version 6.0.472.59. The flaw is triggered via SVG styles, the DOM tree, and error messages, allowing remote attackers to execute arbitrary code or cause a denial of service. The prov...

CVE-2013-0899

CVE-2013-0899 affects the Opus audio codec as used by Google Chrome (and other products) and is caused by an integer overflow in the padding handling within opus_packet_parse_impl in src/opus_decoder.c. This overflow can trigger an out-of-bounds read, potentially enabling a denial of service when...

CVE-2013-6630

CVE-2013-6630 affects libjpeg-turbo (get_dht in jdmarker.c) where the decoder fails to set all elements of a Huffman value array after DHT markers, enabling information disclosure from uninitialized memory via crafted JPEGs. Affected software: libjpeg-turbo up to 1.3.0 (used in Google Chrome prio...

CVE-2015-1264

CVE-2015-1264 is a cross-site scripting vulnerability in Google Chrome prior to 43.0.2357.65, triggered when data is mishandled by the Bookmarks feature. The connected documents confirm this flaw affects Chrome and emphasize that exploitation could arise from user-assisted actions to inject scrip...

CVE-2015-1272

CVE-2015-1272 affects Google Chrome before 44.0.2403.89; a race condition in the GPU process (GPUChannelHost during Blink shutdown) could allow remote denial of service or unspecified impact. Mitigation: upgrade to Chrome 44.0.2403.89 or later (as fixed in the Debian/Chromium advisories and Chrom...

CVE-2015-1276

The CVE-2015-1276 issue affects Google Chrome’s IndexedDB implementation (content/browser/indexed_db/indexed_db_backing_store.cc). Description: a use-after-free in IndexedDB can allow remote attackers to cause a denials of service or potentially other impact by leveraging an abort action before a...

CVE-2015-1281

CVE-2015-1281 is documented in multiple connected sources as a CSP bypass in Blink (core/loader/ImageLoader.cpp) used by Google Chrome/Chromium prior to 44.0.2403.89. The root cause is a failure to correctly determine the V8 context of a microtask, enabling remote CSP restrictions bypass via an i...