CVE-2020-6405

CVE-2020-6405 is an out-of-bounds read in the SQLite component of Chromium-based Chrome prior to 80.0.3987.87, enabling a remote attacker to disclose potentially sensitive information from process memory via a crafted HTML page. Affected: Chrome/Chromium with SQLite. Impact: information disclosur...

CVE-2023-4075

CVE-2023-4075 describes a use-after-free in Cast within Chromium-based browsers (Google Chrome) prior to 115.0.5790.170, enabling a remote attacker to potentially induce heap corruption via a crafted HTML page. The issue affects Chromium/Chrome versions before the fixed point and is rated High se...

CVE-2023-4077

CVE-2023-4077 affects Google Chrome (and Chromium-derived browsers) via insufficient data validation in Extensions, allowing a user-driven attacker to inject scripts/HTML into a privileged page through a crafted Chrome Extension. The vulnerability is triggered when a user installs a malicious ext...

CVE-2023-4429

CVE-2023-4429 affects Google Chrome (Chromium-based) Loader use-after-free vulnerabilities prior to Chrome 116.0.5845.110. The issue allows a remote attacker to potentially trigger heap corruption via a crafted HTML page, with impact described as high. Connected advisories confirm Chromium/Chrome...

CVE-2024-10488

CVE-2024-10488 describes a use-after-free in WebRTC within Google Chrome, exploitable via a crafted HTML page to trigger heap corruption. Affected: Google Chrome (Chromium-based) before version 130.0.6723.92. Impact: potential remote code execution or corruption with high severity; exploitation r...

CVE-2024-3843

The CVE-2024-3843 entry concerns Google Chrome/Chromium where insufficient data validation in Downloads allows a remote attacker to perform UI spoofing via a crafted HTML page. The connected documents corroborate that Chromium-based Chrome is affected and that the vulnerability enables a UI spoof...

CVE-2024-3845

In Google Chrome versions prior to 124.0.6367.60 , an inappropriate implementation in Networks allowed a remote attacker to bypass the mixed content policy via a crafted HTML page. The vulnerability is categorized as having Low severity by Chromium. While several other vulnerabilities exist in th...

CVE-2024-3846

CVE-2024-3846 affects Chromium-based Chrome/Chromium, where an Inappropriate implementation in Prompts allows UI spoofing via a crafted HTML page when users engage certain UI gestures. Connected sources confirm the issue targets Chromium/Chrome components related to prompts and UI handling, with ...

CVE-2024-5499

CVE-2024-5499 is a Chromium/Google Chrome vulnerability described as an out-of-bounds write in the Streams API that could allow a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Connected documents corroborate affected software (Google Chrome/Chromium) and pr...

CVE-2025-4052

An inappropriate implementation in the DevTools component of Google Chrome (prior to version 136.0.7103.59 ) allows a remote attacker to bypass discretionary access control . The attack is initiated via a crafted HTML page that convinces a user to perform specific UI gestures . While the Chromium...

CVE-2026-76033

A high-severity vulnerability exists in Google Chrome and Microsoft Edge (Chromium-based) due to an inappropriate implementation in CORS . A remote attacker who has already compromised the renderer process can bypass site isolation by serving a crafted HTML page. This vulnerability also affects O...

CVE-2023-4071

CVE-2023-4071 corresponds to a heap-buffer-overflow in the Chrome/Chromium Visuals component, allowing remote code execution via a crafted HTML page. Affected software is Google Chrome/Chromium before version 115.0.5790.170. Root cause is heap corruption triggered by Visuals. Public details consi...

CVE-2024-5497

CVE-2024-5497 is a Chromium/Google Chrome security issue describing an out-of-bounds memory access in the Browser UI that could allow a remote attacker to trigger heap corruption via a crafted HTML page when a user interacts with specific UI gestures. Affected product lines are Chromium-based Chr...

CVE-2024-6101

CVE-2024-6101 affects Google Chrome components (V8/WebAssembly) with an out-of-bounds memory access vulnerability caused by an inappropriate implementation. According to multiple sources, including Chromium blog updates and Debian security advisories, the issue was fixed in Chrome 126.0.6478.114 ...

CVE-2024-7535

CVE-2024-7535 affects Google Chrome/Chromium’s V8 engine prior to version 127.6533.99, enabling potential heap corruption via a crafted HTML page. Severity is High. Remediation observed in connected sources recommends upgrading Chromium to 127.6533.99 (e.g., Debian/Fedora updates). Exploitation s...

CVE-2023-2938

CVE-2023-2938 affects Google Chrome/Chromium’s Picture In Picture feature. An inappropriate implementation allowed a remote attacker who had compromised the renderer process to spoof the Omnibox (URL bar) via a crafted HTML page. The issue is tied to Chrome/Chromium before version 114.0.5735.90. ...

CVE-2024-7255

CVE-2024-7255 affects Google Chrome (WebTransport) with an out-of-bounds read in Chromium before 127.6533.88. The root cause is an out-of-bounds memory access via a crafted HTML page, enabling a remote attacker to potentially read memory. Impact is described as high severity (C/H/I/H/A/H). Public...

CVE-2024-5838

CVE-2024-5838: Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allows remote attacker to perform out-of-bounds memory access via a crafted HTML page. Affected software: Google Chrome/Chromium (V8 engine). Impact per sources: high confidentiality, integrity, and availability risks. Th...

CVE-2024-5839

Google Chrome versions prior to 126.0.6478.54 are vulnerable to a heap corruption issue caused by an inappropriate implementation in the memory allocator . A remote attacker can exploit this by navigating the user to a crafted HTML page . While the Chromium security severity is Medium , the CISA ...

CVE-2022-0971

CVE-2022-0971 is a use-after-free in Blink Layout in Google Chrome (Android) prior to 99.0.4844.74, exploited by a remote attacker who had compromised the renderer process to potentially cause heap corruption via a crafted HTML page. Affected: Google Chrome/Blink Layout; Root cause: use-after-fre...

CVE-2024-6290

CVE-2024-6290 is a use-after-free in Dawn within Google Chrome prior to 126.0.6478.126, leading to potential heap corruption via a crafted HTML page. The connected sources confirm this as a Chrome/Chromium vulnerability affecting Dawn, with the issue publicly tracked and fixed in the Chrome 126.0...

CVE-2024-8198

CVE-2024-8198 is a heap buffer overflow in Skia used by Google Chrome/Chromium prior to 128.0.6613.113. The issue allows a remote attacker who has compromised the renderer process to trigger heap corruption via a crafted HTML page. Affected software is Chrome/Chromium with Skia; impact is high. R...

CVE-2023-4073

CVE-2023-4073: Out of bounds memory access in ANGLE used by Google Chrome on macOS before 115.0.5790.170 permits remote exploitation leading to potential heap corruption via a crafted HTML page. Affected product: Google Chrome (Chromium-based) on macOS; vulnerable component: ANGLE within the brow...

CVE-2023-5481

CVE-2023-5481 : Affected component is Google Chrome/Chromium Downloads. The root cause is an inappropriate implementation that permits a remote attacker to spoof the security UI via a crafted HTML page, leading to a spoofing risk. The vulnerability is associated with Chrome/Chromium versions prio...

CVE-2024-5845

CVE-2024-5845: A use-after-free in the Audio path of Google Chrome (Chromium) prior to 126.0.6478.54 could allow a remote attacker to trigger heap corruption via a crafted PDF file. Public data in connected documents confirms the affected software as Google Chrome/Chromium, with the issue categor...

CVE-2015-1283

The material confirms CVE-2015-1283 is an Expat XML_GetBuffer integer/heap overflow issue, with impact on multiple products using expat up to 2.1.0 (e.g., Chrome before 44.0.2403.89). Related CVEs include CVE-2015-2716 and CVE-2016-4472 (note: the latter indicates the overflow protection was remo...

CVE-2022-2010

CVE-2022-2010 corresponds to an Out-of-bounds read in Chrome/Chromium’s compositing path, exploitable when a renderer process is compromised to potentially escape the sandbox via a crafted HTML page. Affected software is Google Chrome/Chromium up to versions prior to 102.0.5005.115. Debian/Debian...

CVE-2024-4949

A use after free vulnerability exists in the V8 JavaScript engine of Google Chrome prior to version 125.0.6422.60 . This flaw allows a remote attacker to trigger heap corruption by navigating to a crafted HTML page . The vulnerability is associated with memory usage after it has been freed, which...

CVE-2019-5789

CVE-2019-5789 is a use-after-free in Chrome's WebMIDI implementation on Windows caused by an integer overflow. A remote attacker who can run crafted HTML in a renderer could execute arbitrary code prior to Chrome 73.0.3683.75. Mitigation: upgrade to 73.0.3683.75 or later (Chromium/Chrome patches)...

CVE-2024-5496

This CVE (CVE-2024-5496) concerns a use-after-free in Media Session within Google Chrome/Chromium. The vulnerability exists in Chrome prior to version 125.0.6422.141 and could allow a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The Chrome 125.0.6422.141 r...

CVE-2024-6293

CVE-2024-6293 affects Google Chrome (Dawn component) with a use-after-free leading to potential heap corruption via a crafted HTML page. Affected version: Chrome prior to 126.0.6478.126. Remediation: update to Chrome 126.0.6478.126 or later (e.g., Debian package chromium fixed to 126.0.6478.126-1...

CVE-2025-6557

Google Chrome on Windows versions prior to 138.0.7204.49 is vulnerable to a security bypass due to insufficient data validation within the DevTools component. A remote attacker could exploit this by convincing a user to perform specific UI gestures while visiting a crafted HTML page, potentially ...

CVE-2023-2939

CVE-2023-2939 concerns Google Chrome on Windows, where insufficient data validation in the Chrome Installer component allows privilege escalation via a crafted symbolic link. Connected advisories confirm the issue is real in Chrome’s installer flow and that public remediation is to update Chrome ...

CVE-2024-8905

CVE-2024-8905 affects Google Chrome/Chromium (V8). An inappropriate implementation in V8 prior to 129.0.6668.58 may allow a remote attacker to trigger stack corruption via a crafted HTML page. The CVE has a high base score (8.8) with network attack vector and required user interaction. Remediatio...

CVE-2005-4900

The CVE-2005-4900 entry notes that SHA-1 is not collision resistant, enabling context-dependent spoofing attacks, with examples related to TLS 1.2. The provided materials do not specify affected products, versions, root causes within a specific product, or remediations. The entry serves as a gene...

CVE-2020-6519

CVE-2020-6519 is a policy bypass in the Content Security Policy (CSP) for Google Chrome, allowing a remote attacker to bypass CSP via a crafted HTML page in Chrome versions prior to 84.0.4147.89. Connected sources confirm public advisories and fixes across distributions: Debian notes a security u...

CVE-2021-30517

CVE-2021-30517 describes a type confusion in the V8 engine within the Chromium browser, fixed before version 90.0.4430.212. The vulnerability, present in the Chromium/WebKit stack used by Google Chrome and related builds, could allow a remote attacker to trigger heap-related issues via a crafted ...

CVE-2024-5847

CVE-2024-5847 is a Use-after-Free in PDFium affecting Google Chrome/Chromium prior to 126.0.6478.54. The underlying issue is heap corruption triggered by crafted PDF files, enabling remote code execution possibilities as described in the CVE entry. The Chrome 126 security release (126.0.6478.54) ...

CVE-2024-6291

CVE-2024-6291 concerns Google Chrome/Chromium, where a use-after-free in SwiftShader (a GPU-related component) could allow a remote attacker to cause heap corruption via a crafted HTML page. The issue is described as affecting Chrome before version 126.0.6478.126. Exploitability is implied by rem...

CVE-2024-7532

CVE-2024-7532 describes an out-of-bounds memory access in ANGLE within Google Chrome/Chromium, enabling potential heap corruption via a crafted HTML page. Affected software/versions: Chrome/Chromium prior to 127.0.6533.99. Impact per sources: critical severity with network attack vector and user ...

CVE-2024-7256

CVE-2024-7256 concerns Google Chrome/Chromium—Dawn component on Android pre-127.6533.88. The root cause is insufficient data validation in Dawn , enabling a remote attacker to execute arbitrary code via a crafted HTML page. Public references confirm the vulnerability exists in Chrome/Chromium wit...

CVE-2025-0451

An inappropriate implementation in the Extensions API of Google Chrome prior to version 133.0.6943.53 allows a remote attacker to perform UI spoofing . This attack requires the user to engage in specific UI gestures and is executed via a crafted Chrome Extension . The vulnerability is classified ...

CVE-2023-5996

CVE-2023-5996 affects Chromium/Google Chrome WebAudio, with a use-after-free in WebAudio prior to version 119.0.6045.123. An attacker could craft an HTML page to trigger heap corruption, potentially enabling remote code execution. The vulnerability is rated High severity (CVSS v3.1: 8.8, NETWORK/...

CVE-2024-6292

CVE-2024-6292 is a use-after-free in Dawn affecting Google Chrome (Chromium-based) before 126.0.6478.126, leading to potential heap corruption via a crafted HTML page. The vulnerability is categorized as High severity with network attack vector and user interaction required. The Chrome release no...

CVE-2016-5131

CVE-2016-5131 is a use-after-free in libxml2 up to version 2.9.4 (as used in Chrome before 52.0.2743.82) triggered by XPointer range-to, leading to possible denial of service and potentially other impact. Connected advisories reaffirms libxml2 as the vulnerable component and references several ve...

CVE-2023-4074

CVE-2023-4074 is a Chrome/Chromium-related vulnerability described as a use-after-free in Blink Task Scheduling. Affects Google Chrome’s Blink engine, with the root cause being a use-after-free condition that could allow a remote attacker to trigger heap corruption via a crafted HTML page. The vu...

CVE-2024-5835

CVE-2024-5835 is a Chrome/Chromium vulnerability described as a heap buffer overflow in the Tab Groups UI, potentially allowing heap corruption via a crafted HTML page when a user is enticed to perform specific UI gestures. The Chrome blog confirms this CVE as part of the June 2024 stable-channel...

CVE-2024-5837

CVE-2024-5837 is a Type Confusion in V8 affecting Google Chrome/Chromium before version 126.0.6478.54, enabling a remote attacker to potentially cause out-of-bounds memory access via a crafted HTML page (severity High). Connected sources confirm the issue and provide remediation details: Chrome/C...

CVE-2024-7966

CVE-2024-7966 : Out-of-bounds memory access in Skia used by Google Chrome prior to 128.0.6613.84. A remote attacker who had compromised the renderer process could trigger memory corruption via a crafted HTML page. Debian security advisory notes potential arbitrary code execution, DoS, or informat...

CVE-2019-5845

CVE-2019-5845: Out-of-bounds access in SwiftShader within Google Chrome prior to 73.0.3683.75 can enable remote heap corruption via a crafted HTML page. The available documents confirm this vulnerability and its association with Chrome/SwiftShader, but do not provide additional exploit details, a...