CVE-2026-17662

CVE-2026-17662 records an Insufficient policy enforcement in Prefetch in Google Chrome, allowing a remote attacker to leak cross-origin data via a crafted HTML page. The issue is tied to Chrome before version 151.0.7922.72 (Windows/Mac) with Chromium security severity High. Public docs confirm th...

CVE-2022-4922

CVE-2022-4922 affects Google Chrome (Blink) prior to 99.0.4844.51. Description: In Blink, an inappropriate implementation allowed a remote attacker to spoof the UI via a crafted HTML page, with CVSS:3.1 base score 6.5 (UI: REQUIRED, C:I=HIGH). The connected documents confirm the same description ...

CVE-2024-7001

CVE-2024-7001 affects Google Chrome/Chromium: an inappropriate HTML implementation could enable UI spoofing when a user is induced to perform specific UI gestures on a crafted HTML page. Affected component is the Chromium HTML/UI layer; root cause is improper handling of UI gestures in HTML rende...

CVE-2025-13228

CVE-2025-13228 affects Google Chrome prior to 142.0.7444.59. The issue is a Type Confusion in V8 that can enable a remote attacker to trigger a heap corruption via a crafted HTML page, potentially allowing code execution. The Chrome 142.0.7444.59 update (and later) fixes this vulnerability; affec...

CVE-2025-1922

CVE-2025-1922 affects Google Chrome on Android prior to 134.0.6998.35. Inappropriate implementation in Selection allows UI spoofing when a user engages in specific UI gestures on a crafted HTML page. The CVSS v3.1 base score is 4.3 (Medium). Remediation: upgrade to Chrome 134.0.6998.35 or newer (...

CVE-2026-11287

CVE-2026-11287 : Google Chrome on Android is affected (before 149.0.7827.53). The issue is insufficient policy enforcement in Navigation, allowing a renderer-compromised page to bypass navigation restrictions via a crafted HTML page. Root cause: policy enforcement gap in navigation. Impact per CV...

CVE-2026-16423

Google Chrome UI use-after-free (CVE-2026-16423) affects Chrome versions prior to 150.0.7871.182. Root cause: use-after-free in the UI code, enabling a remote attacker to craft an HTML page and, via user-initiated UI gestures, potentially heap-corrupt and execute arbitrary code. Impact is high (r...

CVE-2026-17836

CVE-2026-17836: Use-after-free in V8 within Google Chrome before 151.0.7922.72 allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Affected software is Google Chrome (V8 component); root cause is a use-after-free in V8. Impact is arbitrary code execution...

CVE-2026-17902

CVE-2026-17902 refers to an inappropriate implementation in Editing in Google Chrome on Linux, before version 151.0.7922.72, that could allow a remote attacker to leak cross-origin data via a crafted HTML page. The CVE is rated Low (CVSS 3.1: 3.5) with network attack vector, low complexity, requi...

CVE-2026-17925

CVE-2026-17925 affects Google Chrome on Android, specifically the Cast component. An inappropriate implementation in Cast allows a remote attacker to bypass the same-origin policy via a crafted HTML page, as described in upstream Chromium issue 513719671. The vulnerability is tied to Chrome versi...

CVE-2026-17928

Summary: CVE-2026-17928 concerns an inappropriate implementation in the DataTransfer component of Google Chrome, allowing a remote attacker to leak cross-origin data through a crafted HTML page. The issue is rooted in Chromium’s DataTransfer handling (upstream reference: chromium issue 513762372)...

CVE-2026-87563

CVE-2026-87563 is an origin validation error in the Paint component of Google Chrome (prior to 153.0.8010.36 ). A remote attacker could obtain cross-origin data by serving a crafted HTML page to a victim. The vulnerability is rated Medium severity by Chromium (CVSS 3.1 score 4.3 , requiring user ...

CVE-2026-87622

CVE-2026-87622 is a Medium -severity vulnerability (CVSS 4.3) in Google Chrome 's FedCM (Federated Credential Management) component. A missing authorization check allowed a remote attacker to bypass the web origin policy by serving a crafted HTML page that required user interaction. The flaw affe...

CVE-2009-1412

Google Chrome before 1.0.154.59 is affected by CVE-2009-1412 via the chromehtml: protocol handler. A web page could set document.location to a chromehtml: value and, when launched from Internet Explorer, allow enumeration of local files and opening tabs for non‑IsWebSafe URLs, enabling potential ...

CVE-2010-4203

CVE-2010-4203 affects WebM libvpx (VP8 Codec SDK) before 0.9.5 used in Google Chrome prior to 7.0.517.44. An input frame with invalid data can trigger memory corruption, leading to a crash or potential code execution. Multiple advisories (RHSA-2010:0999, ELSA-2010-0999, OpenVAS entries) document ...

CVE-2011-2859

CVE-2011-2859 maps to Google Chrome vulnerabilities described as multiple issues affecting Chrome prior to 14.0.835.163, with the specific entry noting incorrect permissions for non-gallery pages and an unspecified impact/vectors in the NVD description. Connected advisories (OpenVAS GLSA 201111-0...

CVE-2011-3046

CVE-2011-3046 affects Google Chrome’s extension subsystem prior to 17.0.963.78, where history navigation handling enables a Universal XSS (UXSS) that could allow remote code execution. Connected sources corroborate the vulnerability in Chrome/Chromium (UXSS and bad history navigation) and note pa...

CVE-2012-2870

CVE-2012-2870 affects libxslt 1.1.26 and earlier (as used in Google Chrome up to 21.0.1180.89). Root cause: memory management bugs in libxslt, specifically in xsltCompileLocationPathPattern (pattern.c) and xsltGenerateIdFunction (functions.c). Impact: remote attackers could trigger a denial of se...

CVE-2013-6623

CVE-2013-6623 affects Blink SVG handling in Chrome/Chromium prior to 31.0.1650.48, with the SVG implementation enabling an out-of-bounds read that could contribute to a remote denial of service. OpenSUSE advisories indicate remediation via Chromium updates to 31.0.1650.57 (and 31.0.1650.48 in ear...

CVE-2014-1713

CVE-2014-1713 is a use-after-free in the AttributeSetter function of bindings/templates/attributes.cpp within Blink used by Google Chrome. The flaw affects Chrome prior to 33.0.1750.152 on OS X/Linux and prior to 33.0.1750.154 on Windows, allowing a remote attacker to cause a denial of service or...

CVE-2015-1256

CVE-2015-1256 is a use-after-free in Blink’s SVG implementation (shadow tree handling for use elements) affecting Google Chrome prior to 43.0.2357.65. A remote attacker could trigger a denial of service or potentially other impact by a crafted document. Public advisories from multiple vendors con...

CVE-2015-6756

CVE-2015-6756 is a use-after-free in the PDFium CPDFSDK_PageView (fpdfsdk/src/fsdk_mgr.cpp) used by Google Chrome up to version 46.0.2490.71. Exploitation could lead to denial of service or heap memory corruption by mishandling a focused annotation in a PDF. The associated connected sources confi...

CVE-2015-6766

CVE-2015-6766 is a use-after-free vulnerability in Google Chrome's AppCache implementation. The issue arises from incorrect AppCacheUpdateJob behavior related to duplicate cache selection, allowing remote attackers with renderer access to cause a denial of service and potentially other impacts. P...

CVE-2015-6771

CVE-2015-6771 affects Google Chrome/Chromium using the V8 JavaScript engine. The vulnerability is an out-of-bounds read in V8 (js/array.js) related to array map/filter operations, exploitable via crafted JavaScript to cause remote DoS. Affected versions prior to Chrome/Chromium 47.0.2526.73 are f...

CVE-2016-1628

CVE-2016-1628 affects OpenJPEG (pi.c) as used in PDFium within Google Chrome prior to 48.0.2564.109. The vulnerability arises from not validating a precision value in opj_pi_next_rpcl, opj_pi_next_pcrl, and opj_pi_next_cprl, leading to an out-of-bounds read or potentially arbitrary code execution...

CVE-2016-5201

The CVE-2016-5201 issue affects the Chromium/Chrome extensions component. A leak of privateClass in the extensions API could allow a remote attacker to access privileged JavaScript code via a crafted HTML page, constituting an information-disclosure vulnerability. Public advisories from Debian an...

CVE-2017-5008

CVE-2017-5008 is a Blink-based UXSS vulnerability in Google Chrome (up to 56.0.2924.76 for most platforms; 56.0.2924.87 for Android) where attacker-controlled JavaScript could be run during a private script method invocation, allowing remote injection of scripts/HTML via a crafted page. Connected...

CVE-2017-5010

CVE-2017-5010 is a use-after-attack surface in Google Chrome/Chromium’s Blink rendering that allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. According to the initial record, it affected Chrome on Linux, Windows and macOS prior to 56.0.2924.76 (Android...

CVE-2017-5041

CVE-2017-5041 affects Chromium/Chromium-browser. The vulnerability is an address spoofing issue in the Omnibox. Multiple advisories (e.g., Mageia update to 57.0.2987.133; openSUSE security update for Chromium; Ubuntu USN 3236-1) indicate a fix in the 57.x line; upgrading Chromium to 57.0.2987.133...

CVE-2017-5055

CVE-2017-5055 describes a use-after-free in Chrome’s printing path on Linux/Windows, before 57.0.2987.133, allowing a remote attacker to trigger an out-of-bounds memory read via a crafted HTML page. Root cause: use-after-free in printing code leading to memory corruption. Impact per CVE: potentia...

CVE-2017-5080

CVE-2017-5080 is a use-after-free in the chromium credit card autofill component. The initial description states an out-of-bounds memory read on a crafted HTML page could be triggered, affecting Chromium on Linux and Windows before version 59.0.3071.86. Connected documents corroborate that this C...

CVE-2017-5112

CVE-2017-5112 corresponds to a heap buffer overflow in WebGL (Chrome/Chromium) prior to version 61.0.3163.79, caused by a missing bounds check after calculating a user-controlled offset into a heap buffer. A remote attacker could exploit via a crafted HTML page to execute arbitrary code inside th...

CVE-2017-5117

CVE-2017-5117 relates to an uninitialized value in the Skia library used by Chromium/Chrome. The initial entry notes a remote attacker could obtain potentially sensitive information from process memory via a crafted HTML page in Chrome prior to 61.0.3163.79 (Linux/Windows). Connected Debian advis...

CVE-2018-17460

CVE-2018-17460 affects Google Chrome before 68.0.3440.75. The vulnerability arises from insufficient data validation in filesystem URIs, allowing a remote attacker to spoof the Omnibox (URL bar) content via a crafted domain name. Impact is spoofing of the URL bar, with no confidentiality impact b...

CVE-2018-18353

This CVE refers to Google Chrome/Chromium’s Network Authentication component, where failure to dismiss HTTP auth dialogs on navigation could let a remote attacker confuse the user about the origin of an auto dialog. Connected advisories indicate the issue affects Chromium/Chrome builds before ver...

CVE-2020-6501

CVE-2020-6501 affects Google Chrome versions prior to 80.0.3987.87, due to insufficient policy enforcement in CSP, which could allow a remote attacker to bypass the content security policy via a crafted HTML page. Impact: CSP bypass. Mitigation: update Chrome to 80.0.3987.87 or later. Connected d...

CVE-2020-6504

CVE-2020-6504 affects Google Chrome notifications, where insufficient policy enforcement allowed a remote attacker to bypass notification restrictions via a crafted HTML page. The issue applies to Chrome prior to 74.0.3729.108; remediation is to update to 74.0.3729.108 or later. The connected rec...

CVE-2022-3051

CVE-2022-3051: Heap/buffer overflow in Chrome/Exosphere (Chrome OS Lacros) prior to 105.0.5195.52 due to boundary errors handling untrusted UI input. Potential remote code execution; patched in Chrome/Chromium updates (e.g., 105.0.5195.52+). Connected sources also note vulnerability could enable ...

CVE-2022-4925

CVE-2022-4925 describes insufficient validation of untrusted input in QUIC handling in Google Chrome before 97.0.4692.71, allowing a remote attacker to perform header splitting via malicious network traffic. Affected product: Google Chrome (Chromium QUIC stack). Root cause: inadequate input valid...

CVE-2024-6999

Affected software: Google Chrome (FedCM implementation). Summary: The vulnerability arises from an inappropriate FedCM implementation in Chrome prior to 127.6533.72, enabling a remote attacker to cause UI spoofing by convincing a user to perform specific UI gestures on a crafted HTML page. Impact...

CVE-2025-3070

CVE-2025-3070 affects Google Chrome/Chromium extensions, where insufficient validation of untrusted input in Extensions enables privilege escalation via a crafted HTML page. Affected product surface is Chromium-based Extensions code prior to 135.0.7049.52. The vulnerability’s root cause is input ...

CVE-2026-13281

CVE-2026-13281 involves an integer overflow in Mojo, the Chromium IPC framework used by Google Chrome. A remote attacker who has already compromised the renderer process could potentially achieve a sandbox escape via a malicious file. Affected software: Google Chrome prior to 149.0.7827.201. Root...

CVE-2026-14153

CVE-2026-14153 affects Google Chrome (Chromium-based) due to an inappropriate implementation in the Glic component prior to Chrome 150.0.7871.47. This flaw allows a remote attacker to perform UI spoofing by convincing a user to engage specific UI gestures via a crafted HTML page. The issue’s impa...

CVE-2026-14382

CVE-2026-14382 affects Chrome’s ANGLE component. The issue is insufficient validation of untrusted input in ANGLE, enabling a remote sandbox-escape via a crafted HTML page. Product/versions: Google Chrome prior to 150.0.7871.46. Impact: sandbox escape potential with high severity (per Chromium ad...

CVE-2026-15110

The CVE-2026-15110 entry concerns Google Chrome: a use-after-free in the Extensions component that can lead to heap corruption. Affected software is Chrome prior to version 150.0.7871.115; the underlying cause is use-after-free within the Extensions handling, exploitable when a user is convinced ...

CVE-2026-17731

The CVE-2026-17731 entry describes an Inappropriate implementation in Autofill in Google Chrome on Android, prior to version 151.0.7922.72, that allowed a remote attacker to leak cross-origin data via a crafted HTML page. The underlying issue is the Autofill implementation, with a security impact...

CVE-2026-17739

CVE-2026-17739 describes insufficient policy enforcement in Google Chrome Extensions, allowing UXSS when a user installs a malicious extension. Affected software is Google Chrome (desktop/mobile) with the vulnerability present in versions before 151.0.7922.72. The underlying issue is insecure han...

CVE-2026-19155

CVE-2026-19155 affects Google Chrome (Payments component) and is due to a use-after-free in Payments prior to Chrome 151.0.7922.109. An attacker who can compromise the renderer could potentially escape the sandbox via a crafted HTML page. The Chrome security update (151.0.7922.108/109 for Windows...

CVE-2026-78946

An incorrect authorization vulnerability in the Select component of Google Chrome prior to version 152.0.7977.65 allowed a remote attacker to bypass the web origin policy via a crafted HTML page. Per Red Hat, this could lead to unauthorized access to sensitive information or actions across differ...

CVE-2013-6632

Google Chrome/Chromium affected: Chrome versions prior to 31.0.1650.57 (Chromium-based) show multiple memory corruption issues, including CVE-2013-6632. The initial entry cites an integer overflow as a trigger vector that could lead to remote code execution or memory corruption (DoS), demonstrate...