CVE-2026-17731

The CVE-2026-17731 entry describes an Inappropriate implementation in Autofill in Google Chrome on Android, prior to version 151.0.7922.72, that allowed a remote attacker to leak cross-origin data via a crafted HTML page. The underlying issue is the Autofill implementation, with a security impact...

CVE-2026-17739

CVE-2026-17739 describes insufficient policy enforcement in Google Chrome Extensions, allowing UXSS when a user installs a malicious extension. Affected software is Google Chrome (desktop/mobile) with the vulnerability present in versions before 151.0.7922.72. The underlying issue is insecure han...

CVE-2026-17994

CVE-2026-17994 : Affected product: Google Chrome on Android. Vulnerable component: Media handling in Chrome. Root cause: Inappropriate implementation allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Impact: Bypass of navigation restrictions (low severities note...

CVE-2026-87635

Google Chrome 's Payments component is vulnerable to UI misrepresentation , where a remote attacker can spoof UI elements via a crafted HTML page. The flaw is classified as Medium severity by Chromium (CVSS v3.1 base score 5.4 , requiring user interaction with low impacts on confidentiality and a...

CVE-2026-9874

CVE-2026-9874 is a use-after-free in Chrome’s Dawn component (Chromium) that could allow a sandbox escape via a crafted HTML page. Affected product: Google Chrome (Dawn in Chromium). Version history: fixed in Chrome stable channel as of 148.0.7778.216 (Windows/Linux/macOS varied builds; subsequen...

CVE-2013-6632

Google Chrome/Chromium affected: Chrome versions prior to 31.0.1650.57 (Chromium-based) show multiple memory corruption issues, including CVE-2013-6632. The initial entry cites an integer overflow as a trigger vector that could lead to remote code execution or memory corruption (DoS), demonstrate...

CVE-2014-3177

CVE-2014-3177 affects Google Chrome prior to 37.0.2062.94. The vulnerability arises from the interaction between extensions, IPC, the sync API, and Google V8, allowing remote code execution via unspecified vectors (a different issue from CVE-2014-3176). Public references (NVD entry) describe the ...

CVE-2015-1263

The CVE-2015-1263 entry concerns Google Chrome and its Spellcheck API: the Hunspell dictionary download was not performed over HTTPS, enabling potential MITM manipulation of spelling suggestions. Connected records corroborate the same issue for CVE-2015-1288 (and related Debian security advisorie...

CVE-2015-1285

The CVE-2015-1285 issue affects the Blink XSS auditor (XSSAuditor.cpp) used by Google Chrome up to version 44.0.2403.89. Root cause: the XSSAuditor::canonicalize function fails to properly select a truncation point, enabling an information leak via an unspecified linear-time attack. Impact: remot...

CVE-2016-1643

CVE-2016-1643 is a type confusion vulnerability in Blink/WebKit used by Google Chrome prior to version 49.0.2623.87. It affects ImageInputType::ensurePrimaryContent in WebKit/Blink, allowing remote attackers to cause a denial of service or other impact via crafted content. Public advisories confi...

CVE-2016-1660

CVE-2016-1660 affects the Blink component in Google Chrome (pre-50.0.2661.94). The issue is an out-of-bounds write in Blink’s WTF::BitArray and WTF::double_conversion::Vector, allowing remote attackers to crash the browser or potentially cause more impact via crafted web pages. Public notices acr...

CVE-2016-1665

CVE-2016-1665 is an information-leak vulnerability in Google Chrome’s V8 JavaScript engine. The issue arises in the JSGenericLowering path (compiler/js-generic-lowering.cc) where Chrome before 50.0.2661.94 mishandled certain comparison operators, enabling remote attackers to obtain sensitive info...

CVE-2016-1668

CVE-2016-1668 concerns a cross-origin bypass in the V8 bindings to Blink/WebKit via the forEachForBinding function in WebKit/Source/bindings/core/v8/Iterable.h. Affected software is Google Chrome prior to 50.0.2661.102, with the impact described as bypassing the Same Origin Policy through a craft...

CVE-2016-1674

CVE-2016-1674 is a cross‑origin bypass vulnerability in Chrome/Chromium extensions bindings. The issue is described in the official Chrome security release notes for Chrome 51 (51.0.2704.63) and is listed among multiple CVEs fixed in that build. Debian security advisories also note fixes for chro...

CVE-2016-1690

CVE-2016-1690 affects Google Chrome Autofill: the interaction between field updates and JavaScript that triggers a frame deletion allows remote attackers to cause a use-after-free DoS (and possibly other impact) via a crafted website. Affected versions are prior to 51.0.2704.63 (and related advis...

CVE-2016-1710

CVE-2016-1710 affects Google Chrome/Chromium before 52.0.2743.82. The vulnerability is in Blink’s ChromeClientImpl::createWindow, where deferred frames can create windows, allowing remote attackers to bypass the Same Origin Policy via crafted sites. Public reports in multiple advisories (e.g., De...

CVE-2016-5130

CVE-2016-5130 is a URL spoofing vulnerability in Google Chrome prior to 52.0.2743.82, arising from insufficient restriction of multiple uses of a JavaScript forward method in content/renderer/history_controller.cc. Exploitation could allow remote attackers to spoof the URL display on a crafted si...

CVE-2016-5135

Summary of CVE-2016-5135: In Blink’s HTMLPreloadScanner.cpp, the preload path did not take into account the referrer-policy within an HTML document, enabling a CSP bypass via a crafted site that uses a CSP header like Content-Security-Policy: referrer origin-when-cross-origin to override a meta r...

CVE-2016-5220

CVE-2016-5220: PDFium in Chromium/Google Chrome allowed local file access via a crafted PDF, affecting Chrome/Chromium up to version 55.0.2883.75 (Mac/Win/Linux) and 55.0.2883.84 on Android. Affected component is PDFium; the underlying issue is a local file access path in PDF rendering. Remediati...

CVE-2016-9650

CVE-2016-9650 refers to a CSP referrer disclosure vulnerability in the Chromium/Chrome Blink stack, allowing a remote attacker to bypass no-referrer protections via a crafted page that uses iframes. Affected software includes Chromium/Chrome prior to the fixed versions; the issue is categorized a...

CVE-2017-15424

Google Chrome Omnibox vulnerability CVE-2017-15424: insufficient policy enforcement allows domain spoofing via IDN homographs in crafted domain names, affecting versions prior to 63.0.3239.84. Debian and other advisories indicate fix to 63.0.3239.84-1~deb9u1 and related patches; upgrade to 63.0.3...

CVE-2017-15428

CVE-2017-15428 affects Google Chrome’s V8 engine, specifically the builtins string generator, where insufficient data validation can lead to out-of-bounds read/write. A crafted HTML page could allow a remote attacker to execute arbitrary code inside the browser sandbox on versions prior to 62.0.3...

CVE-2017-5011

Chrome prior to 56.0.2924.76 on Windows contains a DevTools URL sanitization flaw (CVE-2017-5011) that lets a user loaded with a malicious extension read local filesystem contents via a crafted HTML page. Root cause: insufficient sanitization of DevTools URLs in Chrome’s DevTools. Impact: unautho...

CVE-2017-5044

CVE-2017-5044 is a heap-buffer-overflow in Skia’s filter processing within Google Chrome prior to 57.0.2987.98 (Mac/Windows/Linux) and 57.0.2987.108 on Android. A crafted HTML page can cause an out-of-bounds memory read by the browser, enabling remote code execution according to the CVE entry. Th...

CVE-2017-5091

CVE-2017-5091 is a use-after-free in Chromium’s IndexedDB, affecting Chromium

CVE-2017-5095

CVE-2017-5095 corresponds to an out-of-bounds write in the pdfium library used by Chromium/Chrome. The Debian advisory links it to chromium-browser and notes fixes in version 60.0.3112.78-1~deb9u1 for stretch (and newer for sid). The Debian entry explicitly lists CVE-2017-5095 among multiple CVEs...

CVE-2017-5129

CVE-2017-5129 is a use-after-free vulnerability in the WebAudio component of the Chromium Blink stack used by Google Chrome, present in versions prior to 62.0.3202.62. A crafted HTML page can trigger a use-after-free that allows an out-of-bounds memory read. Multiple connected sources (including ...

CVE-2022-0292

Google Chrome: CVE-2022-0292 involves an Inappropriate implementation in Fenced Frames prior to 97.0.4692.99 that allows a remote attacker who has compromised the renderer process to bypass navigation restrictions via a crafted HTML page. The Chrome release notes confirm a security fix in 97.0.46...

CVE-2022-3317

CVE-2022-3317 refers to Google Chrome on Android with insufficient validation of untrusted input in Intents, allowing a remote attacker to bypass navigation restrictions via a crafted HTML page. The issue affects Chrome on Android prior to version 106.0.5249.62. Root cause per the available docum...

CVE-2022-4912

CVE-2022-4912 describes a type confusion in the MathML parser of Google Chrome/Chromium, prior to version 105.0.5195.52, which could allow a remote attacker to potentially cause heap corruption via a crafted HTML page. The issue is rated High severity with network attack vector and user interacti...

CVE-2024-9960

CVE-2024-9960 corresponds to a use-after-free in Dawn within Google Chrome/Chromium prior to version 130.0.6723.58, which can allow remote heap corruption via a crafted HTML page. Multiple connected sources confirm the flaw in Chromium’s Dawn component and reference the same fixed version 130.0.6...

CVE-2026-17682

CVE-2026-17682 is an integer overflow in ANGLE used by Google Chrome prior to 151.0.7922.72 that could enable a sandbox escape when a renderer process is compromised via a crafted HTML page. The vulnerability affects Chrome’s ANGLE component and is listed among a large set of security fixes in th...

CVE-2026-17684

CVE-2026-17684 involves Chrome for iOS prior to 151.0.7922.72, where insufficient validation of untrusted input in the renderer could enable a sandbox escape via a crafted HTML page. The issue arises from input handling within Chrome on iOS (renderer process) and is described as a high-severity, ...

CVE-2026-17686

CVE-2026-17686 : In Google Chrome, insufficient validation of untrusted input in Passwords (Chromium-based) before version 151.0.7922.72 allowed a renderer-compromised, remote attacker to bypass site isolation via a crafted HTML page. This vulnerability is rated High (CVSS v3.1 base score 8.1) an...

CVE-2026-17758

CVE-2026-17758: Heap buffer overflow in Dawn component of Google Chrome. The vulnerability affects Chrome builds prior to 151.0.7922.72, enabling a remote attacker to potentially perform a sandbox escape through a crafted HTML page. This entry is supported by multiple sources in the connected doc...

CVE-2026-17761

CVE-2026-17761 affects Chrome for iOS (Google Chrome on iOS) prior to 151.0.7922.72. Root cause: insufficient validation of untrusted input enabling UXSS via malicious network traffic. Impact: ability to inject arbitrary scripts/HTML. Status: fixed in Chrome 151.0.7922.72 (or later); remediation ...

CVE-2026-17984

CVE-2026-17984 affects Google Chrome on Android (before 151.0.7922.72). The issue is an inappropriate implementation that allows a local attacker to leak cross-origin data via a crafted HTML page. CVSS shows Low impact (C/L, I/N, A/N) with local access and user interaction required. Remediation i...

CVE-2026-18017

CVE-2026-18017 is a use-after-free vulnerability in Dawn within Google Chrome prior to 151.0.7922.72. The issue could allow a remote attacker to execute arbitrary code inside a sandbox by presenting a crafted HTML page. Affected component is Dawn (Chromium project) used by Chrome; the root cause ...

CVE-2026-19142

CVE-2026-19142 is a Use-after-Free in Chrome’s Views component, leading to potential heap corruption via a crafted HTML page. Affected product: Google Chrome desktop (Views). Root cause: use-after-free in Views. Impact: potential high-severity compromise as described (heap corruption). Remediatio...

CVE-2026-19143

CVE-2026-19143 affects Google Chrome on Android WebAPKs, with insufficient validation of untrusted input in WebAPKs leading to potential local sandbox escape via a malicious file. The vulnerability is associated with a high severity (CVSS v3.1 base score 8.6) and is tied to Chrome versions prior ...

CVE-2026-87594

CVE-2026-87594 is an incorrect authorization flaw in the DataTransfer component of Google Chrome prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process could obtain sensitive information by delivering a crafted HTML page. The vulnerability is rated Medium seve...

CVE-2026-9889

CVE-2026-9889 refers to an out-of-bounds read and write in the Dawn component of Google Chrome on Android, fixed in the Chrome update that reaches 148.0.7778.216 (and later). The vulnerability potentially allowed a remote attacker to escape the Chrome sandbox via a crafted HTML page. Affected pro...

CVE-2011-1185

Google Chrome (

CVE-2013-2871

CVE-2013-2871 is a use-after-free in Google Chrome prior to 28.0.1500.71, exploitable via input-handling vectors that can cause denial of service or potentially other impact. Affected product: Google Chrome (before 28.0.1500.71). Root cause: use-after-free in handling of input. Impact: denial of ...

CVE-2014-1748

The vulnerability CVE-2014-1748 affects Blink in Google Chrome prior to 35.0.1916.114. It targets ScrollView::paint in platform/scroll/ScrollView.cpp, allowing a remote attacker to spoof the UI by extending scrollbar painting into the parent frame. Impact: UI spoofing could mislead users. Affecte...

CVE-2015-1247

The CVE-2015-1247 issue affects Google Chrome’s OpenSearch handling: the SearchEngineTabHelper::OnPageHasOSDD function did not sanitize file: URLs in OpenSearch descriptor XML, potentially allowing a remote site to read local files via a crafted http/https page. Affected: Chrome before 42.0.2311....

CVE-2015-1255

CVE-2015-1255 affects Google Chrome up to version 43.0.2357.65 in the WebAudio capturer path (content/renderer/media/webaudio_capturer_source.cc). The vulnerability is a use-after-free that can enable a remote attacker to cause a denial of service via heap memory corruption, triggered by improper...

CVE-2016-1649

CVE-2016-1649 affects Google Chrome’s ANGLE component (libANGLE/Program.cpp) and is caused by a data-type mismatch in Program::getUniformInternal, leading to a denial of service via a crafted shader stage buffer overflow in Chrome before 49.0.2623.108. The issue is associated with the ANGLE libra...

CVE-2016-5185

CVE-2016-5185 affects Blink/WebKit in Google Chrome (desktop) prior to 54.0.2840.59 and Android prior to 54.0.2840.85. Root cause is a use-after-free in FrameView::updateLifecyclePhasesInternal() that enables a remote attacker to cause an out-of-bounds memory read or other memory corruption via c...

CVE-2016-5202

CVE-2016-5202 affects Google Chrome/Chromium before versions around 54.x on various platforms. The issue involves browser/extensions/api/dial/dial_registry.cc failing to copy a device ID before an erase() call, which allows the erase to access data it will destroy. The Debian advisory confirms a ...