CVE-2016-5145

Blink vulnerability in CVE-2016-5145 allows a Same Origin Policy bypass: after a structure-clone of an ImageBitmap created from a cross-origin image, a taint property is not preserved, enabling remote JavaScript to exfiltrate or access cross-origin data. Affected software: Google Chrome prior to ...

CVE-2016-5158

CVE-2016-5158 involves multiple integer overflows in the opj_tcd_init_tile function of OpenJPEG (tcd.c) used by PDFium in Google Chrome. The issue allows remote attackers to trigger a heap-based buffer overflow via specially crafted JPEG 2000 data, potentially causing a denial of service or other...

CVE-2016-5193

CVE-2016-5193 concerns Google Chrome/Chromium (Chromium-based browsers) with insufficient validation of URLs opened via DOM, allowing navigation to certain URL schemes through crafted HTML pages. The CVE is mapped to Chrome/Chromium variants around 54.x; Debian advisories note fixes in chromium-b...

CVE-2016-5205

CVE-2016-5205 affects Blink in Chromium-based browsers (Chrome/Linux/Windows/Mac) and is a cross-site scripting flaw caused by deferred page-load handling, enabling UXSS via crafted HTML. Affected releases before version 55.0.2883.75 were addressed; advisories indicate upstream fixes in 55.0.2883...

CVE-2017-5009

CVE-2017-5009 is a memory out-of-bounds vulnerability in Chrome’s WebRTC library. Affects Chrome prior to 56.0.2924.76 on Linux/Windows/macOS, and 56.0.2924.87 on Android. Root cause: failure to perform proper bounds checking in WebRTC leading to potential heap corruption via a crafted HTML page....

CVE-2017-5131

CVE-2017-5131 is an out-of-bounds write in the Skia component of Chromium/Google Chrome (pre-62.0.3202.62). The vulnerability was used to enable potential remote code execution in the browser via a crafted page. Mitigation: upgrade to Chromium/Chrome version 62.0.3202.62 or newer (Debian Arch Gen...

CVE-2022-3444

CVE-2022-3444 : Insufficient data validation in Chrome’s File System API allows remote bypass of file system restrictions via a crafted HTML page and malicious file. Affected: Google Chrome pre-106.0.5249.62 (Chromium engine). Impact: bypass of File System restrictions (privacy/mi) with no confid...

CVE-2023-2457

The CVE-2023-2457 issue is an out-of-bounds/write condition in the ChromeOS Audio Server on ChromeOS, linked to heap corruption via a crafted audio file. Affected product: ChromeOS Audio Server within Google Chrome on ChromeOS, with the vulnerability described as present in versions prior to 113....

CVE-2024-9955

CVE-2024-9955 affects Google Chrome/Chromium’s WebAuthentication in all builds prior to 130.0.6723.58. The vulnerability is a use-after-free that could enable a remote attacker to cause heap corruption via a crafted HTML page. Public advisories indicate that fixed versions exist (e.g., Chromium 1...

CVE-2025-13630

CVE-2025-13630 is a Type Confusion in V8 in Google Chrome that could enable remote heap corruption via a crafted HTML page. Affected product is Chromium/Chrome (V8 engine); the issue is fixed in a Chrome/Chromium update ≥ 143.0.7499.41 (ChromeOS notes show related patching in the 143.0.7499.x fam...

CVE-2025-8901

CVE-2025-8901 is a Google Chrome/Chromium ANGLE vulnerability: an out-of-bounds write that allows out-of-bounds memory access via a crafted HTML page. Affected are Chrome/Chromium builds with ANGLE prior to 139.0.7258.127. Impact is described as High; root cause is an out-of-bounds write in ANGLE...

CVE-2026-13944

CVE-2026-13944 concerns Google Chrome on macOS where an inappropriate DataTransfer implementation allows a remote attacker to leak cross-origin data via a crafted HTML page, given user-initiated UI gestures. The issue is tied to the DataTransfer handling in Chrome before version 150.0.7871.47. Im...

CVE-2026-14073

CVE-2026-14073 affects Google Chrome WebXR prior to 150.0.7871.47. The issue is insufficient validation of untrusted input in WebXR, which could let a remote attacker bypass navigation restrictions through a crafted HTML page. Affects Chrome components described across multiple sources (NVD, Debi...

CVE-2026-16807

Summary (concrete): CVE-2026-16807 is an out-of-bounds write in Chrome’s Codecs before version 150.0.7871.186 that could permit a remote attacker to escape the browser sandbox via a crafted HTML page. Affected software: Google Chrome (Desktop); vulnerable component: Codecs. Root cause: out-of-bou...

CVE-2026-17826

CVE-2026-17826 concerns Chrome for iOS (Google Chrome on iOS). The issue is an inappropriate implementation in Chrome for iOS prior to 151.0.7922.72 that could allow a remote attacker who persuades a user to perform specific UI gestures to leak cross-origin data via a crafted HTML page. The docum...

CVE-2026-19148

CVE-2026-19148: Out-of-bounds write in the GPU component of Google Chrome on Linux prior to 151.0.7922.109 can allow a remote attacker who compromises the renderer process to potentially escape the Chrome sandbox via a crafted HTML page. Affected software: Google Chrome (Linux). Root cause: GPU-r...

CVE-2026-7343

CVE-2026-7343 is a Use-after-free in Views in Google Chrome on Windows, exploitable if the renderer is compromised to escape sandbox via a crafted HTML page. Affected versions are Windows builds prior to 147.0.7727.138. The issue is addressed in the 147.0.7727.138 update (and later). If exploitin...

CVE-2011-1196

The CVE-2011-1196 issue affects the OGG container handling in Google Chrome prior to 10.0.648.127. Root cause: out-of-bounds write in the OGG container implementation. Impact: remote denial of service and possible unspecified impact via crafted inputs. Remediation: upgrade to Google Chrome 10.0.6...

CVE-2015-1235

CVE-2015-1235 affects the Blink HTML parser: ContainerNode::parserRemoveChild in core/dom/ContainerNode.cpp allows a Same Origin Policy bypass via a crafted HTML document with an IFRAME in Chrome before 42.0.2311.90. The vulnerability stems from the HTML parser logic in Blink, enabling cross-orig...

CVE-2015-1236

The CVE-2015-1236 entry refers to a Chrome/Blink vulnerability in the Web Audio API: MediaElementAudioSourceNode::process in Blink’s Web Audio implementation allows a remote site with a media element to bypass Same Origin Policy and access sensitive audio samples. Impact data from the sources con...

CVE-2015-1248

CVE-2015-1248 affects Google Chrome's FileSystem API prior to 40.0.2214.91, enabling a SafeBrowsing bypass by placing an .exe in a temporary filesystem and referencing it via a filesystem:http: URL. The issue is referenced in multiple advisories (Debian DSA-3238-1, Gentoo GLSA-201506-04, CNVD-201...

CVE-2015-1250

Google Chrome prior to 42.0.2311.135 contained multiple vulnerabilities that were fixed by the Chrome team during internal auditing; affecting Chrome/Chromium prior to the 42.0.2311.135 release and potentially enabling denial of service or other impacts via unknown vectors. Remediation observed i...

CVE-2015-1290

CVE-2015-1290 affects the Google V8 JavaScript engine used by Chrome (pre-44.0.2403.89) and QtWebEngineCore in Qt (pre-5.5.1). The vulnerability allows remote attackers to cause memory corruption or execute arbitrary code via a crafted website, leading to denial of service or code execution. Affe...

CVE-2015-6762

CVE-2015-6762 affects Chromium/Google Chrome engines prior to 46.0.2490.71. The vulnerability lies in the CSSFontFaceSrcValue::fetch path in Blink’s CSS font loading, where the CORS cross-origin request algorithm is not used for fonts with seemingly same-origin URLs, allowing a remote server to b...

CVE-2015-6765

CVE-2015-6765 is a use-after-free in Google Chrome’s AppCache (file content/browser/appcache/appcache_update_job.cc) that could allow a remote attacker to execute arbitrary code or cause a denial of service on Chrome versions prior to 47.0.2526.73. The vulnerability was publicly disclosed in mult...

CVE-2015-6780

CVE-2015-6780 is a use-after-free vulnerability in Google Chrome’s Infobars component (early Chrome/Chromium builds) prior to 47.0.2526.73, related to browser/ui/views/website_settings/website_settings_popup_view.cc. The issue could allow a remote attacker to cause a denial of service via a craft...

CVE-2016-1615

CVE-2016-1615 affects Google Chrome’s Omnibox prior to 48.0.2564.82. An attacker could spoof a document’s origin via unspecified vectors, enabling origin confusion. Root cause relates to Omnibox handling in Chromium/Blink; multiple vendors reference the same CVE across advisories. The primary rem...

CVE-2016-1625

CVE-2016-1625 affects Google Chrome prior to 48.0.2564.109. The vulnerability arises because the Chrome Instant feature does not reliably ensure that a New Tab Page navigation target is on the most-visited or suggestions list, enabling a remote bypass of restrictions. Root cause references to ins...

CVE-2016-1631

CVE-2016-1631 affects the Chrome Pepper Plugin API (PPB_Flash_MessageLoop_Impl::InternalRun) in Chrome prior to 49.0.2623.75. The issue arises from mishandling nested message loops, enabling a remote attacker to bypass the Same Origin Policy via a crafted web site. Affected remediation is upgradi...

CVE-2016-1662

CVE-2016-1662 is a use-after-free in Google Chrome/Chromium extensions related to the GC callback (gc_callback.cc). The issue arises because Chrome, prior to version 50.0.2661.94, does not prevent fallback execution once the Garbage Collection callback has started, enabling denial-of-service via ...

CVE-2016-1679

CVE-2016-1679 affects Google Chrome prior to 51.0.2704.63, specifically the ToV8Value function in content/child/v8_value_converter_impl.cc used by the V8 bindings. The issue improperly restricts use of getters and setters, enabling remote attackers to trigger a denial-of-service via a use-after-f...

CVE-2016-1680

CVE-2016-1680 is a use-after-free in Skia (SkFontHost_FreeType.cpp) used by Google Chrome prior to 51.0.2704.63. The vulnerability could cause a denial of service via heap memory corruption. Chrome 51.0.2704.63 (and later) includes fixes for this issue. The available documents provide the vulnera...

CVE-2016-1692

CVE-2016-1692 concerns WebKit/Blink: StyleSheetContents.cpp in Blink, used by Google Chrome prior to 51.0.2704.63, allows a ServiceWorker to cause cross-origin loading of CSS stylesheets even when the stylesheet has an incorrect MIME type. This enables bypassing the Same Origin Policy via a craft...

CVE-2016-1699

CVE-2016-1699 affects WebKit/Blink DevTools front_end/devtools.js in Google Chrome prior to 51.0.2704.79. The vulnerability is a parameter sanitization failure in DevTools that could allow a remote attacker to bypass access restrictions by using a crafted URL (remoteFrontendUrl not properly valid...

CVE-2016-1711

CVE-2016-1711 is a Same-Origin Policy bypass in Blink used by Google Chrome prior to 52.0.2743.82. The root cause is that WebKit/Blink’s FrameLoader.cpp did not disable frame navigation during a detach operation on a DocumentLoader object, allowing a crafted website to bypass SOP. Public referenc...

CVE-2016-5134

CVE-2016-5134 affects Google Chrome/Chromium PAC handling. The vulnerability lies in net/proxy/proxy_service.cc where PAC URL information is not limited to scheme/host/port, allowing a PAC server to cause disclosure of sensitive credentials via the FindProxyForURL() function. This is classified a...

CVE-2016-5155

CVE-2016-5155 affects Chromium/Google Chrome. The vulnerability arises because Chromium does not properly validate access to the initial document, enabling remote attackers to spoof the address bar via a crafted webpage. Affected versions: Google Chrome before 53.0.2785.89 on Windows and OS X, an...

CVE-2016-5221

CVE-2016-5221 refers to a type confusion in libGLESv2 within ANGLE used by Google Chrome on Mac/Windows/Linux (pre-55.0.2883.75) and Android (pre-55.0.2883.84). This could allow a remote attacker to bypass buffer validation via a crafted HTML page. Connected sources confirm the vulnerable compone...

CVE-2017-5013

CVE-2017-5013 affects Google Chrome (Linux) before 56.0.2924.76, where a non-selected tab’s navigation could spoof the Omnibox URL bar via a crafted HTML page. The issue is a content spoofing vulnerability in Omnibox linked to the Chromium Chromium stack (Omnibox/URL spoofing). Public references ...

CVE-2017-5099

Google Chrome for Mac PPAPI Plugins were vulnerable due to insufficient validation of untrusted input, enabling privilege elevation via a crafted HTML page. Affected component: PPAPI Plugins in Chrome on macOS; root cause: input validation failure; impact: remote privilege elevation with user int...

CVE-2018-6100

CVE-2018-6100 : Google Chrome on macOS prior to 66.0.3359.117 is affected by an issue in the URL Formatter/Omnibox where confusable characters were mishandled, enabling domain spoofing via IDN homographs with a crafted domain name. Connected sources corroborate the CVE as a URL spoofing vulnerabi...

CVE-2022-3659

CVE-2022-3659 refers to a use-after-free vulnerability in Chrome OS Accessibility in Google Chrome, prior to version 107.0.5304.62, allowing a remote attacker to potentially trigger heap corruption via specific UI interactions. Connected sources confirm the issue is categorized as a Chrome/Chromi...

CVE-2026-17705

CVE-2026-17705 describes an integer overflow in the libxml component used by Google Chrome before 151.0.7922.72. The issue allows a remote attacker to execute arbitrary code inside the browser sandbox when processing a crafted HTML page. The known impact is a high-severity vulnerability (Chromium...

CVE-2026-17722

CVE-2026-17722 corresponds to an object lifecycle issue in WebView of Google Chrome on Android, affecting versions prior to 151.0.7922.72. A remote attacker who has already compromised the renderer process could potentially escape the Chrome sandbox via a crafted HTML page, per NVD and related fe...

CVE-2026-17995

CVE-2026-17995 is a Google Chrome/Chromium vulnerability affecting Dawn (Chrome rendering path). Out-of-bounds read via a crafted HTML page allows a remote attacker to read memory. Affected software: Dawn in Chrome before version 151.0.7922.72. Impact: high for confidentiality and availability pe...

CVE-2026-19141

CVE-2026-19141 is a use-after-free in the Chromium-based Google Chrome Android renderer. The issue affects Resources in Chrome on Android prior to 151.0.7922.109, where a remote attacker with renderer access could potentially escape the sandbox via a crafted HTML page. The vulnerability’s impact ...

CVE-2026-3920

CVE-2026-3920 describes an out-of-bounds memory access in WebML within Google Chrome/Chromium, enabling potential heap corruption via a crafted HTML page. The flaw affects Chrome before version 146.0.7680.71 and is described with a High severity. According to connected sources, the issue arises f...

CVE-2026-76019

CVE-2026-76019 is an incorrect authorization vulnerability in the Workers component of Google Chrome prior to 151.0.7922.173 . A remote attacker who has already compromised the renderer process and leverages social engineering can bypass the web origin policy via a crafted HTML page. The CVSS 3.1...

CVE-2026-76045

CVE-2026-76045 is a use after free vulnerability in WebGL in Google Chrome prior to 151.0.7922.169 . A remote attacker can execute arbitrary code inside the sandbox via a crafted HTML page. The Chromium security severity is High , with a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R). The vulne...

CVE-2026-79090

CVE-2026-79090 is an improper privilege management flaw in the Actor component of Google Chrome prior to 152.0.7977.65 . A remote attacker, leveraging social engineering, could craft an HTML page to bypass system access restrictions . Google classifies this as Chromium severity: Low , yet the CNA...