CVE-2026-9919

CVE-2026-9919: Out of bounds read in WebGL in Google Chrome on Android (before 148.0.7778.216) allows a remote attacker to leak cross-origin data via a crafted HTML page. Root cause: WebGL out-of-bounds read. Impact: cross-origin data leakage. Exploitation status is not provided in the linked doc...

CVE-2014-1730

CVE-2014-1730 concerns Google V8 type confusion in i18n.js/runtime.cc used by Chrome/Chromium. The vulnerability allows remote attackers to bypass access restrictions by reading property values, via crafted content. Affected software includes Chromium/Chrome builds prior to 34.0.1847.132 (Linux) ...

CVE-2015-1209

CVE-2015-1209 is a use-after-free in Blink’s DOM implementation (VisibleSelection::nonBoundaryShadowTreeRootNode) affecting Google Chrome prior to 40.0.2214.111 (Windows/macOS/Linux) and prior to 40.0.2214.109 on Android. Exploitation could cause denial of service or other unspecified impact via ...

CVE-2015-1276

The CVE-2015-1276 issue affects Google Chrome’s IndexedDB implementation (content/browser/indexed_db/indexed_db_backing_store.cc). Description: a use-after-free in IndexedDB can allow remote attackers to cause a denials of service or potentially other impact by leveraging an abort action before a...

CVE-2015-6763

Google Chrome/Chromium (CVE-2015-6763): Multiple vulnerabilities were fixed in Chrome 46, addressing issues identified during internal audits and in the v8 engine (4.6.85.23). The CVE entry relates to Chrome before 46.0.2490.71, with fixes shipped in the 46.0.2490.71 release. Impact in the CVE no...

CVE-2015-6777

CVE-2015-6777 is a use-after-free in Chrome/Chromium’s DOM implementation. The vulnerability resides in ContainerNode::notifyNodeInsertedInternal (WebKit source), enabling a remote attacker to trigger a denial of service (and possibly other impact) via DOMCharacterDataModified events when inserti...

CVE-2016-1696

CVE-2016-1696 affects Google Chrome prior to 51.0.2704.79, where the extensions subsystem did not properly restrict bindings access, enabling a cross-origin bypass of the Same Origin Policy via unspecified vectors. Multiple connected sources (Chromium security advisories and Debian/arch updates) ...

CVE-2016-5133

CVE-2016-5133 describes a proxy authentication origin confusion in Google Chrome/Chromium prior to 52.0.2743.82, enabling MITM attackers to spoof a proxy-login prompt or trigger incorrect credential storage by altering the client–server data stream. Affected software is Chromium/Chrome (proxy aut...

CVE-2016-5177

CVE-2016-5177 is a use-after-free in Chrome/Chromium’s V8 engine prior to 53.0.2785.143. Public records (Debian, Arch, Gentoo, Gentoo GLSA) describe it as enabling remote arbitrary code execution with a remote attacker potentially gaining code execution, and in some sources a possible crash. The ...

CVE-2016-5203

CVE-2016-5203 is a use-after-free in PDFium within the Chromium/browser stack. Affects PDFium in Chromium-based builds prior to version 55.0.2883.75 on desktop platforms (Mac/Windows/Linux) and 55.0.2883.84 on Android; root cause is a use-after-free in PDF rendering via crafted PDFs, enabling rem...

CVE-2017-15390

Affected software: Google Chrome/Chromium Omnibox component. Vulnerability: insufficient policy enforcement allows domain spoofing via IDN homographs in crafted domain names when using Chromium/Chrome before version 62.0.3202.62. Root cause: Omnibox URL handling failure enabling spoofed display o...

CVE-2017-15398

Chromium (Chrome) before version 62.0.3202.89 is affected by CVE-2017-15398 and CVE-2017-15399 per the connected Arch Linux advisory. The issue for CVE-2017-15398 is a stack-based buffer overflow in the QUIC component, enabling remote code execution. CVE-2017-15399 is a use-after-free in the V8 J...

CVE-2017-15413

CVE-2017-15413 corresponds to a type confusion in WebAssembly within Google Chrome’s V8 engine. The vulnerability affects Chrome before version 63.0.3239.84 and is described as enabling a remote attacker to potentially trigger heap corruption via a crafted HTML page. The root cause is a type conf...

CVE-2017-15419

CVE-2017-15419 describes an information-disclosure vulnerability in Google Chrome’s Resource Timing API before 63.0.3239.84. The root cause is insufficient policy enforcement, allowing a remote attacker to leak cross-origin URLs via a crafted HTML page and infer browsing history. Affected product...

CVE-2017-5076

CVE-2017-5076 affects the Omnibox (address bar) in Chromium/Google Chrome prior to 59.0.3071.86 (Desktop) and 59.0.3071.92 (Android); a domain spoofing vulnerability via IDN homographs is disclosed, enabling a remote attacker to misrepresent a domain. Connected sources confirm this as a content s...

CVE-2018-16072

CVE-2018-16072 relates to Chrome/Blink where a missing origin check in HLS manifests could bypass the same-origin policy via a crafted HTML page. Affected software is Google Chrome (Blink engine); vulnerable builds are prior to Chrome/Chromium version 69.0.3497.81. The underlying issue is a failu...

CVE-2018-6160

CVE-2018-6160 concerns Google Chrome (iOS) where JavaScript/HTML crafted content allowed a remote attacker to spoof the Omnibox (URL bar). The connected Chrome/Chromium notes confirm this as a URL spoof issue in Chrome on iOS and tie the vulnerability to the Chromium 68.0.3440.75 release family. ...

CVE-2020-6499

The CVE-2020-6499 entry concerns Google Chrome’s AppCache implementation. It describes an inappropriate AppCache implementation that, on Chrome versions prior to 80.0.3987.87, allowed a remote attacker to bypass AppCache security restrictions via a crafted HTML page. The vulnerability is triggere...

CVE-2022-3318

CVE-2022-3318 is a use-after-free in ChromeOS Notifications affecting Google Chrome on ChromeOS prior to 106.0.5249.62. Exploitation would require user interaction (a reboot lure) and could enable heap corruption via UI. Remediation: update to Chrome/Chromium 106.0.5249.61 or later (as reflected ...

CVE-2022-4906

CVE-2022-4906 concerns Blink/Chromium in Google Chrome prior to 108.0.5359.71. The vulnerability arises from an inappropriate implementation in Blink that permits a remote attacker to perform arbitrary read/write via a crafted HTML page, with high impact (C/H, I/H, A/H) and network attack vector....

CVE-2024-7003

CVE-2024-7003 affects Google Chrome/Chromium FedCM: an inappropriate FedCM implementation allowed UI spoofing via a crafted HTML page after a user gesture. The issue is limited to the FedCM UI flow and requires user interaction. Remediation: upgrade to Chromium/Chrome version 127.0.6533.72 or lat...

CVE-2025-8292

CVE-2025-8292 is a use-after-free in Media Stream of Google Chrome/Chromium leading to potential heap corruption via a crafted HTML page. Affected software: Chromium/Chrome up to version 138.0.7204.183. Root cause: use-after-free in Media Stream. Impact per sources: high (execution of code, heap ...

CVE-2026-11276

CVE-2026-11276 concerns Google Chrome (Cast) with an inappropriate implementation allowing a local-network attacker to bypass discretionary access control through malicious traffic, prior to version 149.0.7827.53. Public references in NVD/EUVD/CVEs reiterate the same underlying issue and confirm ...

CVE-2026-11701

The CVE-2026-11701 entry describes an insecure implementation in Chrome’s Guest View prior to version 149.0.7827.103, enabling a remote attacker to perform UI spoofing via a crafted HTML page. Affected software: Google Chrome (Guest View component). Root cause: inappropriate/defective Guest View ...

CVE-2026-15776

CVE-2026-15776 affects Google Chrome/V8: an inappropriate implementation in V8 allowed remote code execution inside the sandbox via a crafted HTML page before Chrome 150.0.7871.125. The issue is addressed in the Chrome Stable Channel Update, which upgrades to 150.0.7871.125 (Windows/Mac) and 150....

CVE-2026-16416

CVE-2026-16416 : Integer overflow in Chromecast within Chromium (Google Chrome/Chromium) potentially allows a local attacker to escape the sandbox via crafted network traffic. Affected versions include Chrome/Chromium prior to 150.0.7871.182; fixed in Chromium updates across distributions (e.g., ...

CVE-2026-17712

CVE-2026-17712 refers to a race condition in the Skia graphics library used by the Chromium-based Google Chrome browser. The upstream flaw allows a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page, with the impact described as high severity. Affected pr...

CVE-2026-17970

CVE-2026-17970 : Google Chrome contains insufficient validation of untrusted input related to the Passwords component, allowing a privileged network attacker to trigger UI spoofing via malicious network traffic. Affects Chrome builds prior to 151.0.7922.72. No exploitation details are provided in...

CVE-2026-78896

CVE-2026-78896 is an information leak in the StorageAccessAPI of Google Chrome prior to 152.0.7977.65 . A remote attacker can obtain cross-origin data by serving a crafted HTML page to the victim, requiring user interaction but no prior authentication. Chromium rates the severity as Low ; CVSS 3....

CVE-2013-2855

CVE-2013-2855 affects Chromium/Google Chrome via the Developer Tools API. The flaw allows remote attackers to trigger memory corruption, resulting in a denial of service or potentially other impact, using unknown vectors. Affected products/versions: Chromium before 27.0.1453.110 (Chrome prior to ...

CVE-2014-7926

The CVE-2014-7926 entry concerns the Regular Expressions component of ICU. It describes a memory corruption vulnerability triggered by a zero-length quantifier in ICU 52 (before SVN r292944) and affects software bundling that ICU, notably Google Chrome prior to 40.0.2214.91. Public advisories in ...

CVE-2015-1272

CVE-2015-1272 affects Google Chrome before 44.0.2403.89; a race condition in the GPU process (GPUChannelHost during Blink shutdown) could allow remote denial of service or unspecified impact. Mitigation: upgrade to Chrome 44.0.2403.89 or later (as fixed in the Debian/Chromium advisories and Chrom...

CVE-2015-6761

FFmpeg CVE-2015-6761 affects libavcodec/vp8.c (update_dimensions) up to FFmpeg 2.8.1, used by Chrome prior to 46.0.2490.71. Root cause: multi-threaded operation relying on a coefficient-partition count, enabling a race condition that can lead to memory corruption or DoS via crafted WebM files. Mi...

CVE-2015-6767

CVE-2015-6767 is a use-after-free vulnerability in Google Chrome’s AppCache (AppCache Dispatcher) caused by incorrect pointer maintenance, allowing a remote attacker to cause a denial of service and potentially other impacts. Affected software is Google Chrome prior to version 47.0.2526.73. The i...

CVE-2016-1681

The CVE-2016-1681 issue is a heap-based buffer overflow in the opj_j2k_read_SPCod_SPCoc function (j2k.c) in OpenJPEG, as used by PDFium in Google Chrome. Exploitation could allow a remote attacker to cause a denial of service or potentially other impact via a crafted PDF document. Connected advis...

CVE-2016-5141

CVE-2016-5141 affects Blink in Google Chrome prior to 52.0.2743.116 and concerns address-bar spoofing via a provisional URL for an initially empty document, related to FrameLoader.cpp and ScopedPageLoadDeferrer.cpp. Connected vendor/debian advisories confirm this CVE and describe the exposure as ...

CVE-2016-5186

CVE-2016-5186: An information disclosure/out-of-bounds read flaw in Chromium DevTools was triggered by crafted PDF files. Affected: Chromium-based browsers with DevTools prior to the upstream fix. Remediation: upgrade to Chromium 55.0.2883.75+ (as referenced in Debian security advisory DSA-3731-1...

CVE-2016-5207

CVE-2016-5207 affects Chromium-based browsers (Blink) on Windows/macOS/Linux (Chrome before 55.0.2883.75; Android before 55.0.2883.84). Root cause: DOM tree corruption during removal of a full-screen element, enabling remote code execution via a crafted HTML page. Impact per sources: arbitrary co...

CVE-2016-5212

CVE-2016-5212 affects Google Chrome/Chromium DevTools URLs that were insufficiently sanitized, enabling a remote attacker to read local files via a crafted HTML page. The issue is in the DevTools component of Chromium/Chrome prior to 55.0.2883.75 (desktop) and 55.0.2883.84 (Android). Impact is lo...

CVE-2017-15394

CVE-2017-15394 affects the Chromium/Google Chrome extensions UI prior to 62.0.3202.62. The issue is described as a URL spoofing/domain spoofing vulnerability in permission dialogs caused by insufficient policy enforcement and IDN homographs in a crafted extension. The known remediation is to upgr...

CVE-2017-5026

CVE-2017-5026 affects Google Chrome prior to 56.0.2924.76. The vulnerability is a user interface spoofing issue where alerts displayed by swapped out frames could be shown on pages an attacker does not control. Exploitation could allow spoofing of UI via a crafted HTML page. Public advisories (e....

CVE-2017-5031

Chromium (Chromium/ANGLE) CVE-2017-5031 is a use-after-free vulnerability in ANGLE affecting the Chromium browser prior to version 57.0.2987.98. The underlying flaw is a use-after-free in the ANGLE component, enabling a remote attacker to potentially execute arbitrary code on the affected system....

CVE-2017-5036

CVE-2017-5036 is a use-after-free in the PDFium component of Chromium/Google Chrome. Affects desktop Chrome prior to 57.0.2987.98 and Android prior to 57.0.2987.108, exploitable via a crafted PDF file with the impact described as unspecified in the initial entry. Connected sources corroborate the...

CVE-2017-5057

CVE-2017-5057 affects Google Chrome components that use PDFium. The vulnerability is a type confusion in PDFium, allowing a crafted PDF file to trigger an out-of-bounds memory read in Chrome on Mac, Windows, Linux (before 58.0.3029.81) and Android (before 58.0.3029.83). Reported impact (per CVSS)...

CVE-2017-5098

CVE-2017-5098 is a use-after-free in V8 (Chromium) prior to 60.0.3112.78, affecting Chrome on Mac, Windows, Linux and Android. This vulnerability allows a remote attacker to trigger an out-of-bounds memory read via a crafted HTML page. The connected advisories indicate the fix was released with C...

CVE-2018-17457

The CVE-2018-17457 issue is a Blink WebAudio object lifecycle use-after-free in Google Chrome before 69.0.3497.81. The vulnerability stems from an object lifecycle mismanagement in Blink that could allow a remote attacker to execute arbitrary code inside the Chrome sandbox via a crafted HTML page...

CVE-2022-0297

CVE-2022-0297 affects Google Chrome’s Vulkan code path and is a use-after-free vulnerability that can lead to heap corruption via a crafted HTML page. Affected product: Google Chrome (Chromium-based). Vulnerable component/file: Vulkan integration in Chrome prior to version 97.0.4692.99. Root caus...

CVE-2022-0308

CVE-2022-0308 is a use-after-free in Data Transfer in Google Chrome (Chromium) on desktop, exposed in versions prior to 97.0.4692.99. The description indicates potential heap corruption when a user interacts with a crafted HTML page. The issue was addressed in the Chrome Stable Channel Update to ...

CVE-2022-2399

CVE-2022-2399 : Affected software is Google Chrome with WebGPU; the issue is a use-after-free in WebGPU that allows a remote attacker to cause heap corruption via a crafted HTML page. Product: Chrome (WebGPU component); root cause: use-after-free in WebGPU implementation; impact: potential heap c...

CVE-2022-4922

CVE-2022-4922 affects Google Chrome (Blink) prior to 99.0.4844.51. Description: In Blink, an inappropriate implementation allowed a remote attacker to spoof the UI via a crafted HTML page, with CVSS:3.1 base score 6.5 (UI: REQUIRED, C:I=HIGH). The connected documents confirm the same description ...