CVE-2026-9963

Uninitialized Use in iOS Google Chrome (on iOS) prior to version 148.0.7778.216 allows a remote attacker to trigger arbitrary code execution inside the Chrome sandbox via a crafted HTML page after convincing a user to perform specific UI gestures. Affected product: Google Chrome on iOS; root caus...

CVE-2008-5749

CVE-2008-5749 affects Google Chrome 1.0.154.36 on Windows XP SP3 and is an argument-injection vulnerability in the chromehtml URI via the --renderer-path option, enabling remote command execution. OpenVAS entries corroborate a Google Chrome argument-injection vulnerability; the core issue is the ...

CVE-2011-3111

CVE-2011-3111 affects Chromium/Chrome's V8 engine. The vulnerability is an invalid read in V8 that could allow a remote attacker to cause a denial of service via unspecified vectors, with impact described as partial availability loss. Affected software: Google Chrome before 19.0.1084.52 and Chrom...

CVE-2015-1262

CVE-2015-1262 affects Blink (HarfBuzzShaper.cpp) in Google Chrome before 43.0.2357.65, where a width field is not initialized. This can lead to a denial of service or potentially other impact via crafted Unicode text. Affected software is Chrome (Blink) prior to the fixed build; remediation is to...

CVE-2015-1280

Affected software: Google Chrome (Skia). CVE-2015-1280 is a memory corruption issue in SkPictureShader.cpp within Skia used by Chrome before 44.0.2403.89. Root cause: crafted serialized data provided to the renderer can trigger memory corruption, leading to a possible denial of service and unspec...

CVE-2015-1289

CVE-2015-1289 refers to multiple vulnerabilities found in Google Chrome prior to 44.0.2403.89. The connected records confirm this CVE as part of the Chromium/Chrome fixes, with the Chrome 44 stable update (44.0.2403.89) addressing these issues. The user-visible impact from the sources is a denial...

CVE-2015-1299

The CVE-2015-1299 entry affects Google Chrome/Blink: a use-after-free in the shared-timer implementation (Blink/WebKit) that can be triggered by erroneous timer firing, related to ThreadTimers.cpp and Timer.cpp, potentially allowing remote DoS or other impact as described. Exploitation details ar...

CVE-2015-6778

CVE-2015-6778 affects PDFium in Chrome before 47.0.2526.73. The vulnerability is an out-of-bounds read in CJBig2_SymbolDict.cpp (JBIG2 data in PDFs) that could allow a remote attacker to cause a denial of service or other impact via crafted JBIG2 data. Public references corroborate the flaw in PD...

CVE-2016-1615

CVE-2016-1615 affects Google Chrome’s Omnibox prior to 48.0.2564.82. An attacker could spoof a document’s origin via unspecified vectors, enabling origin confusion. Root cause relates to Omnibox handling in Chromium/Blink; multiple vendors reference the same CVE across advisories. The primary rem...

CVE-2016-1623

CVE-2016-1623 affects Google Chrome before 48.0.2564.109. The DOM implementation does not properly restrict frame-attach operations during or after frame-detach, allowing remote attackers to bypass the Same Origin Policy via a crafted site. Root cause involves functions/files cited: FrameLoader.c...

CVE-2016-1682

The CVE-2016-1682 entry covers a CSP bypass in ServiceWorker registration via Blink/WebKit used by Google Chrome prior to 51.0.2704.63. Affected component is ServiceWorkerContainer::registerServiceWorkerImpl in Blink; root cause is CSP protection bypass during ServiceWorker registration. Impact i...

CVE-2016-1685

CVE-2016-1685 affects PDFium (as used in Google Chrome). The vulnerability is an out-of-bounds read in pdfium/fxge/ge/fx_ge_text.cpp due to miscalculated index values, enabling remote attackers to trigger a denial of service via crafted PDF documents. Public advisories/entries (e.g., Debian/Chrom...

CVE-2016-1706

CVE-2016-1706 concerns the Chrome/Chromium PPAPI sandbox escape: the PPAPI implementation did not validate the origin of IPC messages to the plugin broker that should have originated from the browser process, enabling a sandbox bypass via an unexpected message type. Affected product family: Googl...

CVE-2016-2843

CVE-2016-2843 affects Google V8 used in Google Chrome up to version 49.0.2623.75. The issue covers multiple unspecified vulnerabilities in V8 before 4.9.385.26 that could cause a denial of service or potentially other impact via unknown vectors. According to the CVSSv3 data, this entry is rated C...

CVE-2016-5156

CVE-2016-5156 concerns Google Chrome before 53.0.2785.89 on Windows/OS X and before 53.0.2785.92 on Linux, where event_bindings.cc in the event bindings may process filtered events after a failed attempt to add an event matcher. This use-after-free condition can lead to a denial of service and po...

CVE-2016-5194

CVE-2016-5194 is listed among multiple Chromium/Chromium-derivative vulnerabilities (Google Chrome) with no public technical details provided in the initial description. Debian and Debian-based advisories (DSA-3731-1) associate CVE-2016-5194 with chromium-browser and indicate remediation in Jessi...

CVE-2017-1000460

CVE-2017-1000460 affects libav (libavcodec/h264dec.c) and is described across multiple sources as a NULL dereference caused by calling get_ue_golomb(&gb) on an uninitialized get_bits context after ignoring the return value of init_get_bits in get_last_needed_nal() (libavformat/h264.c). The issue ...

CVE-2017-15389

CVE-2017-15389 is a URL-spoofing vulnerability in the Omnibox (URL bar) of Chromium/Google Chrome prior to 62.0.3202.62. The root cause is an insufficient watchdog timer in navigation, enabling a remote attacker to spoof the contents of the Omnibox via a crafted HTML page. Affected software inclu...

CVE-2017-5104

CVE-2017-5104 concerns Google Chrome on macOS, where an improper interstitial implementation allowed a remote attacker to spoof the omnibox contents via crafted HTML. Multiple connected advisories confirm a UI/spoofing issue in Chromium/Chrome prior to version 60.0.3112.78, with remediation by up...

CVE-2019-13768

Use-after-free in Chrome's FileAPI (CVE-2019-13768) affects Google Chrome

CVE-2022-3042

Use-after-free in PhoneHub within Google Chrome on Chrome OS (CVE-2022-3042) allows heap corruption via a crafted HTML page on versions prior to 105.0.5195.52. Affected software is Google Chrome/Chromium with PhoneHub integration; root cause is use-after-free in the PhoneHub component. Impact is ...

CVE-2022-3658

CVE-2022-3658 affects Google Chrome on Chrome OS, specifically the Feedback service. Description: Use-after-free in Feedback service can lead to heap corruption when a user installs a malicious extension via UI interaction. Impact: potential arbitrary code execution or system compromise as noted ...

CVE-2022-3863

CVE-2022-3863 affects Google Chrome on desktop versions prior to 100.0.4896.75. The vulnerability is a Use-after-free in Browser History that can lead to heap corruption when processing a crafted HTML page, enabling a remote attacker to trigger abnormal memory behavior. The reported impact is a h...

CVE-2022-4911

CVE-2022-4911 : A vulnerability in Google Chrome’s DevTools involves insufficient data validation, allowing a remote attacker to bypass the Content Security Policy via a crafted HTML page. Affected product: Google Chrome (DevTools component); affected versions are prior to 106.0.5249.62. Underlyi...

CVE-2022-4921

CVE-2022-4921 is a use-after-free in Google Chrome’s Accessibility implementation (Chromium) prior to 99.0.4844.51. The flaw allows a remote attacker to cause arbitrary read/write via a crafted HTML page when a user is convinced to perform specific UI gestures. Root cause is a use-after-free in A...

CVE-2022-4926

Technical details about CVE-2022-4926 are not publicly available in the provided documents; monitor for updates.

CVE-2026-13774

CVE-2026-13774: Use-after-free in Chrome Extensions allows arbitrary code execution when a user installs a malicious extension. Affected: Google Chrome (Extensions). Root cause: use-after-free in Extensions. Impact: potential arbitrary code execution. Mitigation: update to Chrome 150.0.7871.47 or...

CVE-2026-14401

CVE-2026-14401 affects Google Chrome on Android through ANGLE, where insufficient validation of untrusted input in ANGLE prior to 150.0.7871.46 enables a renderer-Process-compromised remote attacker to potentially escape the sandbox via a crafted HTML page. The vulnerability is described as high ...

CVE-2026-17653

CVE-2026-17653: In Google Chrome, a use-after-free in Skia prior to 151.0.7922.72 allowed a renderer-compromised attacker to potentially escape the sandbox via a crafted HTML page. Affected component: Skia inside Chrome’s rendering stack. Root cause: use-after-free in Skia code paths used during ...

CVE-2026-17867

CVE-2026-17867 is an insufficient validation of untrusted input in Dawn (Chromium/Google Chrome) that could allow a remote attacker to escape the sandbox via a crafted HTML page. Upstream description ties this to Dawn in Chrome prior to 151.0.7922.72; Red Hat and Debian entries reference the same...

CVE-2026-76019

CVE-2026-76019 is an incorrect authorization vulnerability in the Workers component of Google Chrome prior to 151.0.7922.173 . A remote attacker who has already compromised the renderer process and leverages social engineering can bypass the web origin policy via a crafted HTML page. The CVSS 3.1...

CVE-2026-78942

CVE-2026-78942 is a Medium -severity vulnerability (CVSS 3.1: 4.3) in the Loader component of Google Chrome prior to version 152.0.7977.65 . An incorrect reference resolution allows a remote attacker to bypass the web origin policy via crafted network traffic, requiring user interaction. Accordin...

CVE-2026-79272

CVE-2026-79272 is an improper input validation flaw in the FindInPage component of Google Chrome , affecting versions prior to 152.0.7977.65 . A remote attacker who has already compromised the browser's renderer process can use a specially crafted HTML page to leak cross-origin data , bypassing s...

CVE-2011-3970

CVE-2011-3970 affects libxslt as used in Google Chrome prior to 17.0.963.46, enabling a remote attacker to cause a denial of service via an out-of-bounds read (vectors not specified in the entry). The issue has been addressed in downstream advisories and Chrome updates; Chrome/SUSE/Fedora advisor...

CVE-2012-5144

CVE-2012-5144 affects Google Chrome up to 23.0.1271.97 and Libav branches: 0.7.x before 0.7.7 and 0.8.x before 0.8.5. Root cause: an off-by-one overwrite when switching to the LTP profile from MAIN during AAC decoding. Impact: remote denial of service via stack memory corruption and potentially u...

CVE-2013-6650

CVE-2013-6650 affects Google V8 before 3.22.24.16, used in Google Chrome up to 32.0.1700.102. The StoreBuffer::ExemptPopularPages function may trigger memory corruption via handling of "popular pages", potentially enabling remote denial of service. Connected sources confirm a patched Chrome/OpenS...

CVE-2014-7933

CVE-2014-7933 is a use-after-free in libavformat/matroskadec.c (FFmpeg) at matroska_read_seek, before 2.5.1, enabling remote denial of service via crafted Matroska files when FFmpeg is used (e.g., in Chrome prior to 40.0.2214.91). The issue affects FFmpeg users and Chromium builds incorporating t...

CVE-2015-1238

CVE-2015-1238 affects Skia in Google Chrome/Chromium before 42.0.2311.90, enabling a remote out-of-bounds write that can cause a denial of service (and possibly other impact). The Debian advisory confirms a fix in 42.0.2311.90-1 for chromium-browser; upgrade to 42.0.2311.90 or newer. Other connec...

CVE-2015-1252

Chrome CVE-2015-1252 affects the common/partial_circular_buffer.cc vulnerability in Google Chrome before 43.0.2357.65. The issue is an out-of-bounds write when handling wraps in PartialCircularBuffer::Write/PartialCircularBuffer::DoWrite, which could allow a sandbox escape or cause a denial of se...

CVE-2015-1253

CVE-2015-1253 affects Google Chrome (Blink DOM implementation). The vulnerability lies in core/html/parser/HTMLConstructionSite.cpp, allowing a cross-origin policy bypass by crafted JavaScript that appends to a SCRIPT element, related to insert and executeReparentTask. Impact is a Same Origin Pol...

CVE-2015-1260

CVE-2015-1260 affects Google Chrome up to version 43.0.2357.65, where multiple use-after-free vulnerabilities exist in the WebRTC interface (content/renderer/media/user_media_client_impl.cc). Exploitation via crafted JavaScript after getUserMedia can lead to denial of service and possibly other i...

CVE-2015-6768

CVE-2015-6768 affects Google Chrome/Chromium prior to 47.0.2526.73. The issue allows a remote attacker to bypass the Same Origin Policy via unspecified vectors (a separate vulnerability from CVE-2015-6770). Public references note this as a cross-origin bypass in the DOM/SOP handling within Chrome...

CVE-2015-6773

CVE-2015-6773 affects the convolution implementation in Skia as used by Google Chrome prior to 47.0.2526.73. The issue is an out-of-bounds read in Skia’s convolution path caused by not properly constraining row lengths, which can be exploited by remote attackers to trigger a denial of service (ou...

CVE-2015-8478

CVE-2015-8478 concerns multiple unspecified vulnerabilities in Google V8 prior to 4.7.80.23, used in Google Chrome up to version 47.0.2526.73. The description notes potential denial of service and possibly other impact via unknown vectors. The connected documents confirm affected component (V8) a...

CVE-2016-1630

The CVE-2016-1630 issue affects Blink/WebKit’s ContainerNode::parserRemoveChild in WebKit/Source/core/dom/ContainerNode.cpp, used by Google Chrome prior to 49.0.2623.75. The vulnerability mishandles widget updates, enabling a remote attacker to bypass the Same Origin Policy via a crafted web site...

CVE-2016-1632

CVE-2016-1632 is a vulnerability in Google Chrome/Chromium prior to 49.0.2623.75 where the Extensions subsystem fails to properly maintain its own properties, enabling a remote attacker to bypass access restrictions through crafted JavaScript that triggers an incorrect cast. Affected component pa...

CVE-2016-1648

Google Chrome vulnerability CVE-2016-1648 is a use-after-free in the Extensions implementation (renderer/loadtimes_extension_bindings.cc GetLoadTimes) that could allow remote disruption via crafted JavaScript. Affected product: Chrome before 49.0.2623.108; remediation: update to 49.0.2623.108 or ...

CVE-2016-1651

CVE-2016-1651 corresponds to an out-of-bounds read in the Pdfium JPEG2000 decoding path used by Chrome/Chromium (fxcodec/codec/fx_codec_jpx_opj.cpp) due to incorrect sycc420_to_rgb and sycc422_to_rgb implementations. This can allow a remote attacker to read sensitive process memory or cause a den...

CVE-2016-1653

CVE-2016-1653 is an out-of-bounds write in Google V8 used by Chrome up to version 50.0.2661.75. The issue, tied to compiler/pipeline.cc and compiler/simplified-lowering.cc, could cause a denial of service and possibly other impact via crafted JavaScript. Affected software includes Google Chrome/C...

CVE-2016-1703

CVE-2016-1703 refers to multiple unspecified vulnerabilities in Google Chrome/Chromium up to version 51.0.2704.79, which could allow a remote attacker to cause a denial of service or potentially other impact via unknown vectors. The Mageia advisory explicitly ties CVE-2016-1703 to Chromium 51.0.2...