CVE-2017-15391

CVE-2017-15391 targets the Chromium/Chrome extensions component. The vulnerability arises from insufficient policy enforcement in extensions, allowing a remote attacker to bypass extension limitations and access Extension pages without authorization via a crafted HTML page. Multiple vendor adviso...

CVE-2017-5039

CVE-2017-5039 describes a use-after-free in the pdfium component of Google Chrome/Chromium prior to version 57.0.2987.98 (Android 57.0.2987.108 for some builds). The underlying issue is a use-after-free in PDF rendering code which could potentially lead to heap corruption and remote exploitation ...

CVE-2017-5073

CVE-2017-5073 is a vulnerability in the Chromium-based Google Chrome browser’s print preview feature (Blink). The issue is a use-after-free in print preview, affecting Chrome up to 59.0.3071.86 on Linux, Windows, and macOS, and 59.0.3071.92 on Android. The underlying fault is a memory-management ...

CVE-2017-5081

CVE-2017-5081 concerns a Chromium/Chrome extension verification bypass due to lack of validation of an extension’s locale folder. The issue permits a locally privileged attacker (local write access) to modify extension files, bypassing extension verification and potentially manipulating extension...

CVE-2022-2415

CVE-2022-2415 : The vulnerability is a heap buffer overflow in WebGL within Google Chrome before 103.0.5060.53. This allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. The provided documents identify Chrome/WebGL as the affected component and note a patch/ver...

CVE-2022-2742

This CVE-2022-2742 describes a use-after-free in Exosphere affecting Google Chrome on Chrome OS and Lacros prior to 104.0.5112.79. The issue could allow a remote attacker, who lures a user into specific UI interactions, to potentially trigger heap corruption via crafted UI interactions. Evidence ...

CVE-2022-3842

CVE-2022-3842 refers to a use-after-free in the Passwords component of Google Chrome on Chromium-based engines, with the underlying issue described as heap corruption. The publicly documented impact states that a remote attacker who has compromised the renderer process could potentially exploit t...

CVE-2022-4923

CVE-2022-4923 describes an Inappropriate implementation in Omnibox of Google Chrome before 99.0.4844.51, enabling a privileged network-position attacker to perform a man-in-the-middle via malicious traffic. Affected component: Omnibox within Chrome/Chromium; underlying cause cited as improper Omn...

CVE-2024-7005

CVE-2024-7005 concerns Google Chrome/Chromium where insufficient validation of untrusted input in Safe Browsing allowed a remote attacker to bypass discretionary access control by convincing a user to perform specific UI gestures with a malicious file. The vulnerability affects Chrome/Chromium pr...

CVE-2025-12429

The CVE concerns Google Chrome’s V8: an inappropriate implementation allowed arbitrary read/write via a crafted HTML page in versions prior to 142.0.7444.59. It is rated High severity with a network vector and no user interaction required. Remediation is to upgrade to 142.0.7444.59 or newer (Chro...

CVE-2026-10000

CVE-2026-10000 is a use-after-free vulnerability in Google Chrome on Windows affecting the Passwords component. The underlying issue occurs when the renderer process is compromised, enabling a crafted HTML page to potentially escape the Chrome sandbox. Impact is described as high, with remote cod...

CVE-2026-11293

CVE-2026-11293 affects Google Chrome (desktop) with Chromium, involving a use-after-free in Input that could allow a remote attacker to potentially escape the sandbox via a crafted HTML page. The issue references Chrome versions prior to 149.0.7827.53 and indicates the vulnerability is tied to th...

CVE-2026-12025

CVE-2026-12025 affects Google Chrome and involves insufficient validation of untrusted input in the Network stack. A malicious actor who had already compromised the renderer process could exfiltrate cross-origin data via a crafted HTML page. The public write-up confirms the impact as data leakage...

CVE-2026-15107

CVE-2026-15107 concerns Google's Chrome browser: a use-after-free in IndexedDB allowed via a crafted HTML page to potentially execute arbitrary code inside the sandbox. Affected software is Chrome prior to 150.0.7871.115 (Windows/Mac) with Linux at 150.0.7871.114. The underlying issue is a use-af...

CVE-2026-17901

CVE-2026-17901 affects Google Chrome on Android (Sharing component). The flaw is insufficient validation of untrusted input that could bypass navigation restrictions via malicious network traffic, previously fixed in Chrome update to 151.0.7922.72+. Downstream advisories (Red Hat, Debian, EU/OSV,...

CVE-2026-17956

CVE-2026-17956 details (NORMAL mode) : In Google Chrome, an inappropriate implementation in the Scheduling component allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Affected family: Chrome releases prior to 151.0.7922.72. The root cause is tied to th...

CVE-2026-76018

CVE-2026-76018 is a privilege elevation vulnerability in the Import component of Google Chrome prior to 151.0.7922.173 (Windows/Mac) and 151.0.7922.173 (Linux). A remote attacker leveraging social engineering can potentially execute arbitrary code outside the sandbox via a crafted file. The vulne...

CVE-2026-78976

CVE-2026-78976 is an improper input validation flaw in the StorageAccessAPI component of Google Chrome , affecting versions prior to 152.0.7977.65 . The vulnerability allows a remote attacker who has already compromised the renderer process to bypass the web origin policy via a crafted HTML page,...

CVE-2026-8567

Summary: CVE-2026-8567 is an integer overflow in the ANGLE component of Google Chrome on Windows, prior to version 148.0.7778.168, enabling a remote attacker to trigger an out-of-bounds memory write via a crafted HTML page. Affected software: Google Chrome (Windows, Chromium-based). Vulnerable co...

CVE-2012-2807

CVE-2012-2807 is a libxml2 vulnerability involving multiple integer overflows that affect 64-bit Linux platforms. It is noted in the initial document as impacting Google Chrome before 20.0.1132.43 and potentially other products, enabling remote denial of service or unspecified impact via unknown ...

CVE-2012-2871

CVE-2012-2871 describes a memory handling issue in libxml2 (used in Chrome prior to 21.0.1180.89) where a bad cast during XSLT processing can lead to denial of service or potentially other impacts via a crafted document (root cause related to _xmlNs in include/libxml/tree.h). Connected advisories...

CVE-2013-2883

Chromium-derived browsers (Chrome before 28.0.1500.95; Chromium/chromium-browser) are affected by CVE-2013-2883 due to a use-after-free in MutationObserver handling. This vulnerability could allow a remote attacker to cause a denial of service or potentially other impact by manipulating the delet...

CVE-2013-6643

The CVE-2013-6643 issue affects Google Chrome prior to 32.0.1700.76 on Windows and 32.0.1700.77 on macOS/Linux. It stems from improper handling of the closing of an untrusted signin confirmation dialog in OneClickSigninBubbleView::WindowClosing, allowing an attacker to trigger a sync with an arbi...

CVE-2014-1704

CVE-2014-1704 concerns multiple unspecified vulnerabilities in Google's V8 JavaScript engine (pre-3.23.17.18) as used by Google Chrome before 33.0.1750.149. Reported impact includes denial of service and potentially other effects via unknown vectors. Public details in connected documents indicate...

CVE-2014-1731

CVE-2014-1731 affects Blink’s DOM implementation (HTMLSelectElement) in Google Chrome prior to 34.0.1847.131 on Windows/OS X and before 34.0.1847.132 on Linux. The vulnerability arises from insufficient renderer state checking during a focus event, enabling a remote attacker to trigger denial of ...

CVE-2016-1620

CVE-2016-1620 affects Google Chrome/Chromium prior to 48.0.2564.82. Multiple issues were addressed during internal auditing and fuzzing, with fixes described as internal and in the V8/Blink code paths (and related PDFium components). The notable external references show a fix in Chrome 48.0.2564....

CVE-2016-1647

CVE-2016-1647 is a use-after-free in Chrome’s Navigation path, specifically in RenderWidgetHostImpl::Destroy within content/browser/renderer_host/render_widget_host_impl.cc, before version 49.0.2623.108. The vulnerability allows remote attackers to cause a denial of service and potentially other ...

CVE-2016-1666

CVE-2016-1666 affects Google Chrome/Chromium up to version 50.0.2661.94. The issue is listed among multiple Chrome vulnerabilities; the linked Debian advisory and Chrome release notes attribute it to broad fixes from internal audits, fuzzing, and related initiatives. The initial CVE summary state...

CVE-2016-1675

CVE-2016-1675 affects Google Chrome/Chromium up to 51.0.2704.63. It is a Same Origin Policy bypass in Blink/WebKit caused by mishandling of Document reattachment during destruction, related to FrameLoader.cpp and LocalFrame.cpp. The Chrome/Chromium 51 stable update (51.0.2704.63) fixes this and r...

CVE-2016-5150

CVE-2016-5150 affects Blink/WebKit’s IndexedDB implementation (V8BindingForModules.cpp) used by Chrome. The issue arises from improper restriction of key-path evaluation, enabling a crafted JavaScript sequence to trigger a use-after-free in IndexedDB, potentially causing a denial of service and o...

CVE-2016-5170

CVE-2016-5170 affects Blink in Chromium-based browsers (WebKit/Blink) via WebKit/Source/bindings/modules/v8/V8BindingForModules.cpp. The vulnerability arises when converting array keys, failing to account for getter side effects, enabling a remote attacker to trigger a denial-of-service through u...

CVE-2016-5188

CVE-2016-5188 affects Chromium/Blink: UI spoofing via crafted HTML pages allowing a remote attacker to spoof parts of the browser UI. The public description notes Chrome/Blink-era UI spoofing in the Blink component for Windows, Mac, and Linux prior to version 54.0.2840.59. Debian security advisor...

CVE-2016-5222

CVE-2016-5222 is a content spoofing vulnerability in the Omnibox (URL bar) of Chromium-based browsers. It arises from incorrect handling of invalid URLs that allowed a crafted HTML page to spoof the Omnibox contents. Public references in connected documents confirm impact on Chromium/Chrome up to...

CVE-2017-15388

CVE-2017-15388 affects Chromium's Skia component; an out-of-bounds read on crafted HTML pages in Chromium versions earlier than 62.0.3202.62. The issue originates in Skia within the browser, enabling remote exploitation. Remediation: upgrade to Chromium 62.0.3202.62 or newer (as reflected by Debi...

CVE-2017-15409

CVE-2017-15409 describes a heap buffer overflow in Skia used by Google Chrome prior to 63.0.3239.84. The vulnerability can allow a remote attacker to potentially exploit heap corruption through a specially crafted HTML page, as indicated by the description. The affected component is Skia within C...

CVE-2017-5016

CVE-2017-5016 is a UI-forgery vulnerability in Blink/Chromium. Affected product: Google Chrome prior to 56.0.2924.76 on Linux, Windows and Mac, and 56.0.2924.87 on Android. Root cause: Chrome could fail to prevent certain UI elements from being displayed by non-visible pages, allowing a remote at...

CVE-2017-5035

CVE-2017-5035 affects Chromium/Google Chrome up to version 57.0.2987.98 (Windows/Mac) and is described in connected advisories as an Incorrect security UI issue in the Omnibox. The root concern is a UI-related vulnerability that could lead to displaying incorrect security/cert information for a s...

CVE-2017-5063

A numeric overflow in Skia within Google Chrome prior to 58.0.3029.81 for Linux/Windows/macOS and 58.0.3029.83 for Android allows a remote attacker to cause an out-of-bounds memory read via a crafted HTML page. Affected component: Skia in Chrome. Root cause: numeric overflow. Impact: memory read ...

CVE-2017-5066

CVE-2017-5066 : Google Chrome (Mac/Windows/Linux) affected up to 58.0.3029.81 and Android up to 58.0.3029.83. The root cause is insufficient consistency checks in the networking stack’s signature handling, allowing a remote attacker to incorrectly accept a badly formed X.509 certificate via a cra...

CVE-2017-5105

CVE-2017-5105 affects Chromium/Chromium-based browsers prior to version 60.0.3112.78. The issue is Insufficient Policy Enforcement in the Omnibox, allowing a remote attacker to spoof domains via IDN homographs in specially crafted domain names. Public advisories and security trackers (e.g., Arch ...

CVE-2017-5120

CVE-2017-5120 describes a downgrade of HTTPS during redirects in the Chromium/Chrome browser. Affected: Chromium/Chrome before 61.0.3163.79 on desktop (Mac/Windows/Linux) and 61.0.3163.81 on Android, with downstream advisories referencing Chromium builds. Root cause: a misdesign workaround for ww...

CVE-2019-5841

CVE-2019-5841 describes an out‑of‑bounds memory access in Google Chrome’s JavaScript engine prior to 75.0.3770.80, enabling a remote attacker to potentially trigger heap corruption via a crafted HTML page. The vulnerability affects Chrome’s JavaScript execution path and is documented with a CVSS ...

CVE-2021-4317

CVE-2021-4317 is a use-after-free in ANGLE within Google Chrome prior to 96.0.4664.93, enabling a remote attacker to perform arbitrary read/write via a crafted HTML page. The affected component is ANGLE in Chrome; root cause is a use-after-free vulnerability. The CVSS v3.1 base score is 8.8 (High...

CVE-2023-4860

CVE-2023-4860 affects Google Chrome (Skia) via an inappropriate Skia implementation in Chromium before 115.0.5790.98, allowing a remote attacker who has compromised the renderer process to potentially escape the sandbox by crafting an HTML page. The vulnerability is rooted in the Skia component a...

CVE-2024-9961

CVE-2024-9961 corresponds to a Use after Free in ParcelTracking in Google Chrome on iOS prior to 130.0.6723.58, potentially enabling heap corruption through a crafted HTML page after a user interaction. Public advisories and Debian security trackers confirm that this family of Chromium/Chrome CVE...

CVE-2025-1122

CVE-2025-1122 affects Google ChromeOS (ChromeOS, TPM2 Reference Library) on Cr50-based devices. The connected PT-2025-16388 entry provides concrete details: Out-of-Bounds Write in the TPM2 Reference Library, exploitable by a user with root access to gain persistence and bypass OS verification via...

CVE-2026-12448

CVE-2026-12448 affects WebView in Google Chrome on Android prior to 149.0.7827.155. The issue is an inappropriate implementation in WebView that allows a remote attacker to escalate privileges via a crafted HTML page. The vulnerability is tied to Chromium WebView behavior and is rated High severi...

CVE-2026-13036

The CVE-2026-13036 entry documents a use-after-free in Blink of Google Chrome before 149.0.7827.197, enabling a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Affected component: Blink (Chromium-based crawler). Root cause: use-after-free in Blink logic; impa...

CVE-2026-14431

CVE-2026-14431 describes a type confusion in the V8 JavaScript engine used by Google Chrome prior to version 150.0.7871.46 . The issue allows a remote attacker to execute arbitrary code inside Chrome’s sandbox via a crafted HTML page. Affected component: V8 within Chromium/Chrome. Root cause: typ...

CVE-2026-16805

CVE-2026-16805 is a use-after-free in Blink affecting Google Chrome prior to 150.0.7871.186, allowing a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The Chrome Stable Channel update mirrors this fix, upgrading to 150.0.7871.186 (Windows/Mac) or 150.0.7871....