CVE-2024-5840

Summary of CVE-2024-5840: Google Chrome/Chromium prior to 126.0.6478.54 is affected by a CORS policy bypass vulnerability that can let remote attackers bypass discretionary access control via a crafted HTML page. The vulnerability target is the browser’s CORS handling (Chromium component). Report...

CVE-2024-6101

CVE-2024-6101 affects Google Chrome components (V8/WebAssembly) with an out-of-bounds memory access vulnerability caused by an inappropriate implementation. According to multiple sources, including Chromium blog updates and Debian security advisories, the issue was fixed in Chrome 126.0.6478.114 ...

CVE-2023-4429

CVE-2023-4429 affects Google Chrome (Chromium-based) Loader use-after-free vulnerabilities prior to Chrome 116.0.5845.110. The issue allows a remote attacker to potentially trigger heap corruption via a crafted HTML page, with impact described as high. Connected advisories confirm Chromium/Chrome...

CVE-2024-5499

CVE-2024-5499 is a Chromium/Google Chrome vulnerability described as an out-of-bounds write in the Streams API that could allow a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Connected documents corroborate affected software (Google Chrome/Chromium) and pr...

CVE-2026-7340

CVE-2026-7340 concerns an integer overflow in ANGLE within Google Chrome on Windows before 147.0.7727.138 . The vulnerability could allow a remote attacker to trigger an out-of-bounds memory read via a crafted HTML page , as described in multiple sources (NVD/OSV/Chromium notes). The issue is tie...

CVE-2020-6519

CVE-2020-6519 is a policy bypass in the Content Security Policy (CSP) for Google Chrome, allowing a remote attacker to bypass CSP via a crafted HTML page in Chrome versions prior to 84.0.4147.89. Connected sources confirm public advisories and fixes across distributions: Debian notes a security u...

CVE-2024-10488

CVE-2024-10488 describes a use-after-free in WebRTC within Google Chrome, exploitable via a crafted HTML page to trigger heap corruption. Affected: Google Chrome (Chromium-based) before version 130.0.6723.92. Impact: potential remote code execution or corruption with high severity; exploitation r...

CVE-2023-2938

CVE-2023-2938 affects Google Chrome/Chromium’s Picture In Picture feature. An inappropriate implementation allowed a remote attacker who had compromised the renderer process to spoof the Omnibox (URL bar) via a crafted HTML page. The issue is tied to Chrome/Chromium before version 114.0.5735.90. ...

CVE-2019-13689

Affected software: Google Chrome on ChromeOS. The CVE-2019-13689 issue stems from an inappropriate OS implementation that allows a remote attacker with local access and user interaction to perform arbitrary read/write via a malicious file. Impact is high (confidentiality, integrity, availability)...

CVE-2019-5789

CVE-2019-5789 is a use-after-free in Chrome's WebMIDI implementation on Windows caused by an integer overflow. A remote attacker who can run crafted HTML in a renderer could execute arbitrary code prior to Chrome 73.0.3683.75. Mitigation: upgrade to 73.0.3683.75 or later (Chromium/Chrome patches)...

CVE-2023-4071

CVE-2023-4071 corresponds to a heap-buffer-overflow in the Chrome/Chromium Visuals component, allowing remote code execution via a crafted HTML page. Affected software is Google Chrome/Chromium before version 115.0.5790.170. Root cause is heap corruption triggered by Visuals. Public details consi...

CVE-2024-5497

CVE-2024-5497 is a Chromium/Google Chrome security issue describing an out-of-bounds memory access in the Browser UI that could allow a remote attacker to trigger heap corruption via a crafted HTML page when a user interacts with specific UI gestures. Affected product lines are Chromium-based Chr...

CVE-2024-7535

CVE-2024-7535 affects Google Chrome/Chromium’s V8 engine prior to version 127.6533.99, enabling potential heap corruption via a crafted HTML page. Severity is High. Remediation observed in connected sources recommends upgrading Chromium to 127.6533.99 (e.g., Debian/Fedora updates). Exploitation s...

CVE-2024-8905

CVE-2024-8905 affects Google Chrome/Chromium (V8). An inappropriate implementation in V8 prior to 129.0.6668.58 may allow a remote attacker to trigger stack corruption via a crafted HTML page. The CVE has a high base score (8.8) with network attack vector and required user interaction. Remediatio...

CVE-2023-5481

CVE-2023-5481 : Affected component is Google Chrome/Chromium Downloads. The root cause is an inappropriate implementation that permits a remote attacker to spoof the security UI via a crafted HTML page, leading to a spoofing risk. The vulnerability is associated with Chrome/Chromium versions prio...

CVE-2024-5838

CVE-2024-5838: Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allows remote attacker to perform out-of-bounds memory access via a crafted HTML page. Affected software: Google Chrome/Chromium (V8 engine). Impact per sources: high confidentiality, integrity, and availability risks. Th...

CVE-2024-7255

CVE-2024-7255 affects Google Chrome (WebTransport) with an out-of-bounds read in Chromium before 127.6533.88. The root cause is an out-of-bounds memory access via a crafted HTML page, enabling a remote attacker to potentially read memory. Impact is described as high severity (C/H/I/H/A/H). Public...

CVE-2023-4073

CVE-2023-4073: Out of bounds memory access in ANGLE used by Google Chrome on macOS before 115.0.5790.170 permits remote exploitation leading to potential heap corruption via a crafted HTML page. Affected product: Google Chrome (Chromium-based) on macOS; vulnerable component: ANGLE within the brow...

CVE-2024-6290

CVE-2024-6290 is a use-after-free in Dawn within Google Chrome prior to 126.0.6478.126, leading to potential heap corruption via a crafted HTML page. The connected sources confirm this as a Chrome/Chromium vulnerability affecting Dawn, with the issue publicly tracked and fixed in the Chrome 126.0...

CVE-2015-1283

The material confirms CVE-2015-1283 is an Expat XML_GetBuffer integer/heap overflow issue, with impact on multiple products using expat up to 2.1.0 (e.g., Chrome before 44.0.2403.89). Related CVEs include CVE-2015-2716 and CVE-2016-4472 (note: the latter indicates the overflow protection was remo...

CVE-2024-5845

CVE-2024-5845: A use-after-free in the Audio path of Google Chrome (Chromium) prior to 126.0.6478.54 could allow a remote attacker to trigger heap corruption via a crafted PDF file. Public data in connected documents confirms the affected software as Google Chrome/Chromium, with the issue categor...

CVE-2024-5847

CVE-2024-5847 is a Use-after-Free in PDFium affecting Google Chrome/Chromium prior to 126.0.6478.54. The underlying issue is heap corruption triggered by crafted PDF files, enabling remote code execution possibilities as described in the CVE entry. The Chrome 126 security release (126.0.6478.54) ...

CVE-2020-6437

CVE-2020-6437 affects the WebView component in Chromium/Google Chrome prior to 81.0.4044.92. An inappropriate implementation/implementation error in WebView allowed a remote attacker to spoof the security UI via a crafted application. The issue is fixed upstream in 81.0.4044.92 (Debian notes also...

CVE-2023-2939

CVE-2023-2939 concerns Google Chrome on Windows, where insufficient data validation in the Chrome Installer component allows privilege escalation via a crafted symbolic link. Connected advisories confirm the issue is real in Chrome’s installer flow and that public remediation is to update Chrome ...

CVE-2019-5845

CVE-2019-5845: Out-of-bounds access in SwiftShader within Google Chrome prior to 73.0.3683.75 can enable remote heap corruption via a crafted HTML page. The available documents confirm this vulnerability and its association with Chrome/SwiftShader, but do not provide additional exploit details, a...

CVE-2021-30517

CVE-2021-30517 describes a type confusion in the V8 engine within the Chromium browser, fixed before version 90.0.4430.212. The vulnerability, present in the Chromium/WebKit stack used by Google Chrome and related builds, could allow a remote attacker to trigger heap-related issues via a crafted ...

CVE-2022-0971

CVE-2022-0971 is a use-after-free in Blink Layout in Google Chrome (Android) prior to 99.0.4844.74, exploited by a remote attacker who had compromised the renderer process to potentially cause heap corruption via a crafted HTML page. Affected: Google Chrome/Blink Layout; Root cause: use-after-fre...

CVE-2024-5496

This CVE (CVE-2024-5496) concerns a use-after-free in Media Session within Google Chrome/Chromium. The vulnerability exists in Chrome prior to version 125.0.6422.141 and could allow a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The Chrome 125.0.6422.141 r...

CVE-2024-6293

CVE-2024-6293 affects Google Chrome (Dawn component) with a use-after-free leading to potential heap corruption via a crafted HTML page. Affected version: Chrome prior to 126.0.6478.126. Remediation: update to Chrome 126.0.6478.126 or later (e.g., Debian package chromium fixed to 126.0.6478.126-1...

CVE-2022-2010

CVE-2022-2010 corresponds to an Out-of-bounds read in Chrome/Chromium’s compositing path, exploitable when a renderer process is compromised to potentially escape the sandbox via a crafted HTML page. Affected software is Google Chrome/Chromium up to versions prior to 102.0.5005.115. Debian/Debian...

CVE-2024-4949

CVE-2024-4949 affects Chromium-based Chrome builds due to a use-after-free in V8 prior to 125.0.6422.60, enabling potential heap corruption via a crafted HTML page. Connected advisories (Debian, Fedora, CHAINGUARD CGR, and vendor advisories) confirm this CVE and indicate updates to Chromium 125.0...

CVE-2024-5837

CVE-2024-5837 is a Type Confusion in V8 affecting Google Chrome/Chromium before version 126.0.6478.54, enabling a remote attacker to potentially cause out-of-bounds memory access via a crafted HTML page (severity High). Connected sources confirm the issue and provide remediation details: Chrome/C...

CVE-2024-8198

CVE-2024-8198 is a heap buffer overflow in Skia used by Google Chrome/Chromium prior to 128.0.6613.113. The issue allows a remote attacker who has compromised the renderer process to trigger heap corruption via a crafted HTML page. Affected software is Chrome/Chromium with Skia; impact is high. R...

CVE-2025-0451

CVE-2025-0451 describes an inappropriate implementation in the Extensions API of Google Chrome prior to version 133.0.6943.53. A remote attacker could induce a user to perform specific UI gestures, enabling UI spoofing via a crafted Chrome Extension. The core issue is in the Extensions API implem...

CVE-2019-5788

CVE-2019-5788 affects Chromium-based Chrome/Chromium before 73.0.3683.75. The sources describe use-after-free in the FileAPI component (and related issues in Blink Storage) triggered by crafted HTML, with an integer overflow contributing to exploitation. The Debian Arch Linux advisories confirm t...

CVE-2024-6291

CVE-2024-6291 concerns Google Chrome/Chromium, where a use-after-free in SwiftShader (a GPU-related component) could allow a remote attacker to cause heap corruption via a crafted HTML page. The issue is described as affecting Chrome before version 126.0.6478.126. Exploitability is implied by rem...

CVE-2020-6443

Chromium/Google Chrome before 81.0.4044.92 is affected by CVE-2020-6443 due to an insufficient data validation flaw in the DevTools component, enabling a remote attacker to execute arbitrary code via a crafted HTML page after convincing a user to use DevTools. Affected product: Chromium/Chrome; r...

CVE-2024-5832

CVE-2024-5832 is a Use after free in Dawn in Google Chrome prior to 126.0.6478.54 that could allow remote attackers to trigger heap corruption via a crafted HTML page. The issue is listed among Chrome security fixes for the 126 release line, with 126.0.6478.54 (and subsequent patch versions) addr...

CVE-2024-5835

CVE-2024-5835 is a Chrome/Chromium vulnerability described as a heap buffer overflow in the Tab Groups UI, potentially allowing heap corruption via a crafted HTML page when a user is enticed to perform specific UI gestures. The Chrome blog confirms this CVE as part of the June 2024 stable-channel...

CVE-2024-5836

CVE-2024-5836 affects Google Chrome DevTools by Inappropriate Implementation in DevTools, allowing code execution when a user is convinced to install a crafted Chrome Extension. Impact is High with attacker-controlled arbitrary code execution possible via a malicious extension, prior to Chrome 12...

CVE-2024-6292

CVE-2024-6292 is a use-after-free in Dawn affecting Google Chrome (Chromium-based) before 126.0.6478.126, leading to potential heap corruption via a crafted HTML page. The vulnerability is categorized as High severity with network attack vector and user interaction required. The Chrome release no...

CVE-2024-7256

CVE-2024-7256 concerns Google Chrome/Chromium—Dawn component on Android pre-127.6533.88. The root cause is insufficient data validation in Dawn , enabling a remote attacker to execute arbitrary code via a crafted HTML page. Public references confirm the vulnerability exists in Chrome/Chromium wit...

CVE-2011-3026

CVE-2011-3026 describes a heap-based overflow in libpng caused by an integer overflow in png_decompress_chunk(), leading to potential remote code execution or crashes when handling crafted PNGs. Affected: libpng as used by Chrome (and various products); vulnerable versions precede fixed releases....

CVE-2020-16042

CVE-2020-16042: Uninitialized Use in V8 within Google Chrome prior to 87.0.4280.88. This allows a remote attacker to potentially read sensitive information from a process’s memory via a crafted HTML page. The issue is tied to the Chromium/WebKit stack (V8) in Chrome, with confirmed remediation av...

CVE-2023-4074

CVE-2023-4074 is a Chrome/Chromium-related vulnerability described as a use-after-free in Blink Task Scheduling. Affects Google Chrome’s Blink engine, with the root cause being a use-after-free condition that could allow a remote attacker to trigger heap corruption via a crafted HTML page. The vu...

CVE-2024-5833

CVE-2024-5833 : A type confusion in V8 within Google Chrome (Chromium) prior to 126.0.6478.54 can allow a remote attacker to trigger out-of-bounds memory access through a crafted HTML page. Affected software: Google Chrome/Chromium with V8. Impact is described as high (CVE-2024-5833). Remediation...

CVE-2024-7532

CVE-2024-7532 describes an out-of-bounds memory access in ANGLE within Google Chrome/Chromium, enabling potential heap corruption via a crafted HTML page. Affected software/versions: Chrome/Chromium prior to 127.0.6533.99. Impact per sources: critical severity with network attack vector and user ...

CVE-2005-4900

The CVE-2005-4900 entry notes that SHA-1 is not collision resistant, enabling context-dependent spoofing attacks, with examples related to TLS 1.2. The provided materials do not specify affected products, versions, root causes within a specific product, or remediations. The entry serves as a gene...

CVE-2016-5131

CVE-2016-5131 is a use-after-free in libxml2 up to version 2.9.4 (as used in Chrome before 52.0.2743.82) triggered by XPointer range-to, leading to possible denial of service and potentially other impact. Connected advisories reaffirms libxml2 as the vulnerable component and references several ve...

CVE-2024-12382

CVE-2024-12382 concerns Google Chrome/Chromium Translate use-after-free leading to potential heap corruption. Affected versions are Chrome/Chromium prior to 131.0.6778.139, with exploitation possible via a crafted HTML page over the network; user interaction is required (per CVSS: Network, Low at...