CVE-2024-5840

Summary of CVE-2024-5840: Google Chrome/Chromium prior to 126.0.6478.54 is affected by a CORS policy bypass vulnerability that can let remote attackers bypass discretionary access control via a crafted HTML page. The vulnerability target is the browser’s CORS handling (Chromium component). Report...

CVE-2024-6779

CVE-2024-6779 : Out-of-bounds memory access in the V8 component of Google Chrome prior to 126.0.6478.182 may allow a remote attacker to potentially escape the sandbox via a crafted HTML page. Multiple connected sources confirm the issue exists in Chromium/Chrome up to the 126.0.6478.182 update an...

CVE-2023-2938

CVE-2023-2938 affects Google Chrome/Chromium’s Picture In Picture feature. An inappropriate implementation allowed a remote attacker who had compromised the renderer process to spoof the Omnibox (URL bar) via a crafted HTML page. The issue is tied to Chrome/Chromium before version 114.0.5735.90. ...

CVE-2023-5481

CVE-2023-5481 : Affected component is Google Chrome/Chromium Downloads. The root cause is an inappropriate implementation that permits a remote attacker to spoof the security UI via a crafted HTML page, leading to a spoofing risk. The vulnerability is associated with Chrome/Chromium versions prio...

CVE-2024-10488

CVE-2024-10488 describes a use-after-free in WebRTC within Google Chrome, exploitable via a crafted HTML page to trigger heap corruption. Affected: Google Chrome (Chromium-based) before version 130.0.6723.92. Impact: potential remote code execution or corruption with high severity; exploitation r...

CVE-2024-5839

CVE-2024-5839 corresponds to Google Chrome/V8/Chromium memory allocator issue: Inappropriate Implementation in Memory Allocator in Chrome prior to 126.0.6478.54 can enable a remote attacker to cause heap corruption via a crafted HTML page (Chromium security severity: Medium). The Chrome 126 relea...

CVE-2023-4429

CVE-2023-4429 affects Google Chrome (Chromium-based) Loader use-after-free vulnerabilities prior to Chrome 116.0.5845.110. The issue allows a remote attacker to potentially trigger heap corruption via a crafted HTML page, with impact described as high. Connected advisories confirm Chromium/Chrome...

CVE-2026-7340

CVE-2026-7340 concerns an integer overflow in ANGLE within Google Chrome on Windows before 147.0.7727.138 . The vulnerability could allow a remote attacker to trigger an out-of-bounds memory read via a crafted HTML page , as described in multiple sources (NVD/OSV/Chromium notes). The issue is tie...

CVE-2023-4073

CVE-2023-4073: Out of bounds memory access in ANGLE used by Google Chrome on macOS before 115.0.5790.170 permits remote exploitation leading to potential heap corruption via a crafted HTML page. Affected product: Google Chrome (Chromium-based) on macOS; vulnerable component: ANGLE within the brow...

CVE-2024-6101

CVE-2024-6101 affects Google Chrome components (V8/WebAssembly) with an out-of-bounds memory access vulnerability caused by an inappropriate implementation. According to multiple sources, including Chromium blog updates and Debian security advisories, the issue was fixed in Chrome 126.0.6478.114 ...

CVE-2019-5789

CVE-2019-5789 is a use-after-free in Chrome's WebMIDI implementation on Windows caused by an integer overflow. A remote attacker who can run crafted HTML in a renderer could execute arbitrary code prior to Chrome 73.0.3683.75. Mitigation: upgrade to 73.0.3683.75 or later (Chromium/Chrome patches)...

CVE-2024-7255

CVE-2024-7255 affects Google Chrome (WebTransport) with an out-of-bounds read in Chromium before 127.6533.88. The root cause is an out-of-bounds memory access via a crafted HTML page, enabling a remote attacker to potentially read memory. Impact is described as high severity (C/H/I/H/A/H). Public...

CVE-2015-1283

The material confirms CVE-2015-1283 is an Expat XML_GetBuffer integer/heap overflow issue, with impact on multiple products using expat up to 2.1.0 (e.g., Chrome before 44.0.2403.89). Related CVEs include CVE-2015-2716 and CVE-2016-4472 (note: the latter indicates the overflow protection was remo...

CVE-2023-4071

CVE-2023-4071 corresponds to a heap-buffer-overflow in the Chrome/Chromium Visuals component, allowing remote code execution via a crafted HTML page. Affected software is Google Chrome/Chromium before version 115.0.5790.170. Root cause is heap corruption triggered by Visuals. Public details consi...

CVE-2024-5497

CVE-2024-5497 is a Chromium/Google Chrome security issue describing an out-of-bounds memory access in the Browser UI that could allow a remote attacker to trigger heap corruption via a crafted HTML page when a user interacts with specific UI gestures. Affected product lines are Chromium-based Chr...

CVE-2024-6290

CVE-2024-6290 is a use-after-free in Dawn within Google Chrome prior to 126.0.6478.126, leading to potential heap corruption via a crafted HTML page. The connected sources confirm this as a Chrome/Chromium vulnerability affecting Dawn, with the issue publicly tracked and fixed in the Chrome 126.0...

CVE-2021-30517

CVE-2021-30517 describes a type confusion in the V8 engine within the Chromium browser, fixed before version 90.0.4430.212. The vulnerability, present in the Chromium/WebKit stack used by Google Chrome and related builds, could allow a remote attacker to trigger heap-related issues via a crafted ...

CVE-2024-7535

CVE-2024-7535 affects Google Chrome/Chromium’s V8 engine prior to version 127.6533.99, enabling potential heap corruption via a crafted HTML page. Severity is High. Remediation observed in connected sources recommends upgrading Chromium to 127.6533.99 (e.g., Debian/Fedora updates). Exploitation s...

CVE-2023-2939

CVE-2023-2939 concerns Google Chrome on Windows, where insufficient data validation in the Chrome Installer component allows privilege escalation via a crafted symbolic link. Connected advisories confirm the issue is real in Chrome’s installer flow and that public remediation is to update Chrome ...

CVE-2024-8905

CVE-2024-8905 affects Google Chrome/Chromium (V8). An inappropriate implementation in V8 prior to 129.0.6668.58 may allow a remote attacker to trigger stack corruption via a crafted HTML page. The CVE has a high base score (8.8) with network attack vector and required user interaction. Remediatio...

CVE-2024-5847

CVE-2024-5847 is a Use-after-Free in PDFium affecting Google Chrome/Chromium prior to 126.0.6478.54. The underlying issue is heap corruption triggered by crafted PDF files, enabling remote code execution possibilities as described in the CVE entry. The Chrome 126 security release (126.0.6478.54) ...

CVE-2024-6293

CVE-2024-6293 affects Google Chrome (Dawn component) with a use-after-free leading to potential heap corruption via a crafted HTML page. Affected version: Chrome prior to 126.0.6478.126. Remediation: update to Chrome 126.0.6478.126 or later (e.g., Debian package chromium fixed to 126.0.6478.126-1...

CVE-2019-5845

CVE-2019-5845: Out-of-bounds access in SwiftShader within Google Chrome prior to 73.0.3683.75 can enable remote heap corruption via a crafted HTML page. The available documents confirm this vulnerability and its association with Chrome/SwiftShader, but do not provide additional exploit details, a...

CVE-2024-5845

CVE-2024-5845: A use-after-free in the Audio path of Google Chrome (Chromium) prior to 126.0.6478.54 could allow a remote attacker to trigger heap corruption via a crafted PDF file. Public data in connected documents confirms the affected software as Google Chrome/Chromium, with the issue categor...

CVE-2025-0451

CVE-2025-0451 describes an inappropriate implementation in the Extensions API of Google Chrome prior to version 133.0.6943.53. A remote attacker could induce a user to perform specific UI gestures, enabling UI spoofing via a crafted Chrome Extension. The core issue is in the Extensions API implem...

CVE-2024-5496

This CVE (CVE-2024-5496) concerns a use-after-free in Media Session within Google Chrome/Chromium. The vulnerability exists in Chrome prior to version 125.0.6422.141 and could allow a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The Chrome 125.0.6422.141 r...

CVE-2024-5838

CVE-2024-5838: Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allows remote attacker to perform out-of-bounds memory access via a crafted HTML page. Affected software: Google Chrome/Chromium (V8 engine). Impact per sources: high confidentiality, integrity, and availability risks. Th...

CVE-2022-0971

CVE-2022-0971 is a use-after-free in Blink Layout in Google Chrome (Android) prior to 99.0.4844.74, exploited by a remote attacker who had compromised the renderer process to potentially cause heap corruption via a crafted HTML page. Affected: Google Chrome/Blink Layout; Root cause: use-after-fre...

CVE-2024-8198

CVE-2024-8198 is a heap buffer overflow in Skia used by Google Chrome/Chromium prior to 128.0.6613.113. The issue allows a remote attacker who has compromised the renderer process to trigger heap corruption via a crafted HTML page. Affected software is Chrome/Chromium with Skia; impact is high. R...

CVE-2024-5837

CVE-2024-5837 is a Type Confusion in V8 affecting Google Chrome/Chromium before version 126.0.6478.54, enabling a remote attacker to potentially cause out-of-bounds memory access via a crafted HTML page (severity High). Connected sources confirm the issue and provide remediation details: Chrome/C...

CVE-2019-5788

CVE-2019-5788 affects Chromium-based Chrome/Chromium before 73.0.3683.75. The sources describe use-after-free in the FileAPI component (and related issues in Blink Storage) triggered by crafted HTML, with an integer overflow contributing to exploitation. The Debian Arch Linux advisories confirm t...

CVE-2022-2010

CVE-2022-2010 corresponds to an Out-of-bounds read in Chrome/Chromium’s compositing path, exploitable when a renderer process is compromised to potentially escape the sandbox via a crafted HTML page. Affected software is Google Chrome/Chromium up to versions prior to 102.0.5005.115. Debian/Debian...

CVE-2010-1205

CVE-2010-1205 is a buffer overflow in libpng (pngpread.c) that could allow remote code execution via a crafted PNG image. Affected libpng versions are prior to 1.2.44 and prior to 1.4.3. The overflow is tied to the internal copy in pngpread.c and is described across advisories mentioning memory c...

CVE-2020-16042

CVE-2020-16042: Uninitialized Use in V8 within Google Chrome prior to 87.0.4280.88. This allows a remote attacker to potentially read sensitive information from a process’s memory via a crafted HTML page. The issue is tied to the Chromium/WebKit stack (V8) in Chrome, with confirmed remediation av...

CVE-2020-6404

CVE-2020-6404 is a heap-corruption/BLINK-related vulnerability in Google Chrome prior to 80.0.3987.87. Connected documents confirm that this flaw stems from an inappropriate Blink/WebKit implementation, enabling a remote attacker to potentially trigger heap corruption via a crafted HTML page. The...

CVE-2024-5836

CVE-2024-5836 affects Google Chrome DevTools by Inappropriate Implementation in DevTools, allowing code execution when a user is convinced to install a crafted Chrome Extension. Impact is High with attacker-controlled arbitrary code execution possible via a malicious extension, prior to Chrome 12...

CVE-2024-6291

CVE-2024-6291 concerns Google Chrome/Chromium, where a use-after-free in SwiftShader (a GPU-related component) could allow a remote attacker to cause heap corruption via a crafted HTML page. The issue is described as affecting Chrome before version 126.0.6478.126. Exploitability is implied by rem...

CVE-2024-6292

CVE-2024-6292 is a use-after-free in Dawn affecting Google Chrome (Chromium-based) before 126.0.6478.126, leading to potential heap corruption via a crafted HTML page. The vulnerability is categorized as High severity with network attack vector and user interaction required. The Chrome release no...

CVE-2024-7532

CVE-2024-7532 describes an out-of-bounds memory access in ANGLE within Google Chrome/Chromium, enabling potential heap corruption via a crafted HTML page. Affected software/versions: Chrome/Chromium prior to 127.0.6533.99. Impact per sources: critical severity with network attack vector and user ...

CVE-2023-4074

CVE-2023-4074 is a Chrome/Chromium-related vulnerability described as a use-after-free in Blink Task Scheduling. Affects Google Chrome’s Blink engine, with the root cause being a use-after-free condition that could allow a remote attacker to trigger heap corruption via a crafted HTML page. The vu...

CVE-2024-4949

CVE-2024-4949 affects Chromium-based Chrome builds due to a use-after-free in V8 prior to 125.0.6422.60, enabling potential heap corruption via a crafted HTML page. Connected advisories (Debian, Fedora, CHAINGUARD CGR, and vendor advisories) confirm this CVE and indicate updates to Chromium 125.0...

CVE-2023-5477

CVE-2023-5477 describes an inappropriate implementation in the Chrome/Chromium Installer prior to 118.0.5993.70 that could allow a local attacker to bypass discretionary access control via a crafted command. Connected advisories confirm affected products include Google Chrome/Chromium and note a ...

CVE-2024-5832

CVE-2024-5832 is a Use after free in Dawn in Google Chrome prior to 126.0.6478.54 that could allow remote attackers to trigger heap corruption via a crafted HTML page. The issue is listed among Chrome security fixes for the 126 release line, with 126.0.6478.54 (and subsequent patch versions) addr...

CVE-2024-5835

CVE-2024-5835 is a Chrome/Chromium vulnerability described as a heap buffer overflow in the Tab Groups UI, potentially allowing heap corruption via a crafted HTML page when a user is enticed to perform specific UI gestures. The Chrome blog confirms this CVE as part of the June 2024 stable-channel...

CVE-2024-5844

CVE-2024-5844 affects Google Chrome, specifically a heap buffer overflow in the Tab Strip module that allowed a remote attacker to read out-of-bounds memory via a crafted HTML page. The issue is fixed in Chrome 126.0.6478.56/57 (stable channel), with the vulnerable baseline cited as prior to 126....

CVE-2025-6557

The CVE-2025-6557 entry concerns Google Chrome on Windows with an insufficient DevTools data validation flaw that could allow arbitrary code execution via a crafted HTML page after user interaction with specific UI gestures. Affected component: DevTools in Chrome; root cause: inadequate input val...

CVE-2016-5131

CVE-2016-5131 is a use-after-free in libxml2 up to version 2.9.4 (as used in Chrome before 52.0.2743.82) triggered by XPointer range-to, leading to possible denial of service and potentially other impact. Connected advisories reaffirms libxml2 as the vulnerable component and references several ve...

CVE-2024-10826

Concretely affected: Chromium-based Chrome/Chromium on Android and various Linux distributions (Chromium) with version strings up to 130.0.6723.116. The root cause is a use-after-free in the Family Experiences component that can lead to heap corruption via a crafted HTML page. Impact is high (C/H...

CVE-2024-5834

CVE-2024-5834 affects Google Chrome (Dawn) prior to version 126.0.6478.54 . The root cause is an inappropriate implementation in Dawn that allowed a remote attacker to execute arbitrary code via a crafted HTML page . The issue was addressed in the Chrome 126 stable update (126.0.6478.54 for Linux...

CVE-2024-5841

CVE-2024-5841 is a Use-after-Free in V8 affecting Google Chrome (Chromium-based) prior to version 126.0.6478.54, enabling remote code execution via a crafted HTML page and potentially causing heap corruption. The issue is documented with a CVSSv3.1 base score of 8.8 (High), attack vector Network,...