CVE-2026-79290

A use after free vulnerability in the Aura component of Google Chrome prior to version 152.0.7977.65 allows a remote attacker to execute arbitrary code outside the sandbox by convincing a user to visit a crafted HTML page. The bug was internally reported by Google on 2026-05-25 (Chromium bug 5164...

CVE-2009-1441

CVE-2009-1441 details (from provided documents): Google Chrome prior to 1.0.154.64 is affected by a heap-based/buffer overflow in the ParamTraits::Read function, enabling an attacker who can reach the renderer via IPC to crash the browser and potentially execute arbitrary code. The condition invo...

CVE-2010-0651

WebKit vulnerability CVE-2010-0651: WebKit before r52784 (used in Google Chrome < 4.0.249.78 and Apple Safari

CVE-2010-2302

CVE-2010-2302 is a use-after-free in WebKit’s WebCore affecting Google Chrome prior to 5.0.375.70. The flaw involves remote fonts used with shadow DOM trees and can cause memory corruption, leading to a denial of service or potential arbitrary code execution. Affected component: WebKit/WebCore in...

CVE-2011-1293

The CVE-2011-1293 entry concerns a use-after-free vulnerability in Google Chrome’s HTMLCollection implementation, affecting Chrome versions prior to 10.0.648.204. The vulnerability allows remote attackers to cause a denial of service and potentially other impact via unknown vectors. The provided ...

CVE-2011-1296

Technical details for CVE-2011-1296 are not provided in the connected documents. The initial description notes a Chrome SVG text handling issue leading to DoS, but no concrete product/version/impact specifics are given beyond that.

CVE-2011-3640

CVE-2011-3640 describes an untrusted search path vulnerability in Mozilla Network Security Services (NSS) as used in Google Chrome

CVE-2012-1521

CVE-2012-1521: A use-after-free in the XML parser affected Google Chrome prior to 18.0.1025.168, enabling remote denial of service or other impact via unknown vectors. The vulnerability is addressed by the Chrome update to 18.0.1025.168 or newer.

CVE-2013-0836

CVE-2013-0836 affects Google V8 before 3.14.5.3 as used in Google Chrome before 24.0.1312.52, with a weakness in garbage collection that can cause a remote denial of service (application crash) via crafted JavaScript. The connected documents corroborate the issue across multiple vendors and distr...

CVE-2013-6646

CVE-2013-6646 is a use-after-free vulnerability in Google Chrome’s Web Workers implementation. The flaw affects Chrome on Windows (pre-32.0.1700.76) and macOS/Linux (pre-32.0.1700.77), enabling remote denial of service and potentially other unspecified impacts via worker shutdown-related vectors....

CVE-2015-1230

CVE-2015-1230 concerns Google Chrome/Blink. The getHiddenProperty function in bindings/core/v8/V8EventListenerList.h conflicts with the AudioContext class, enabling a remote attacker to trigger type confusion via JavaScript when an AudioContext listener is added, potentially causing a denial of s...

CVE-2015-1279

CVE-2015-1279 : Integer overflow in CJBig2_Image::expand within PDFium (fxcodec/jbig2/JBig2_Image.cpp) used by Google Chrome before 44.0.2403.89 leads to a heap-based buffer overflow when processing large height/stride values. Impact described as remote denial of service (and unspecified other im...

CVE-2015-3333

CVE-2015-3333 affects Google V8 before 4.2.77.14 as used by Google Chrome before 42.0.2311.90. The vulnerability family could cause a denial of service or other impact via unknown vectors. Public advisories (Debian/Ubuntu) indicate fixes in chromium-browser versions around 42.0.2311.90. No exploi...

CVE-2016-1664

CVE-2016-1664 affects Google Chrome/Chromium. The vulnerability is in HistoryController::UpdateForCommit (content/renderer/history_controller.cc), where mishandling the interaction between subframe forward navigations and other forward navigations allows a remote attacker to spoof the address bar...

CVE-2016-1709

CVE-2016-1709 describes a heap-buffer-overflow in the ByteArray::Get method of data/byte_array.cc in Google sfntly, affecting Google Chrome prior to 52.0.2743.82 (sfntly used by Chrome). The vulnerability could allow a remote attacker to cause a denial of service or other unspecified impact via a...

CVE-2016-5144

The CVE-2016-5144 issue affects Blink’s Developer Tools in Google Chrome prior to 52.0.2743.116, where mishandling of the script-path hostname, remoteBase, and remoteFrontendUrl parameters allowed bypassing of access restrictions via a crafted URL. Connected sources also note the related CVE-2016...

CVE-2016-5149

CVE-2016-5149 affects Google's Chrome extensions subsystem. The vulnerability arises because Chrome’s extension identification uses an IFRAME source URL, enabling a remote attacker to perform extension-binding injection by manipulating a resource that starts at about:blank. Affected are Chrome bu...

CVE-2016-5160

The CVE-2016-5160 entry concerns Google Chrome/Chromium where the AllowCrossRendererResourceLoad function in extensions/browser/url_request_util.cc does not properly enforce a manifest.json web_accessible_resources restriction on IFRAMEs, enabling clickjacking schemes and user setting changes via...

CVE-2016-5182

CVE-2016-5182 is a Google Chrome/Chromium Blink vulnerability described as a heap overflow in the ImageBitmap/bitmap handling path that could be triggered by a crafted HTML page. The issue allows a remote attacker to potentially achieve remote code execution on the affected host. Affected version...

CVE-2016-5213

CVE-2016-5213 : A use-after-free in the V8 engine of Chromium-based browsers (Chrome/Chromium) prior to 55.0.2883.75 on desktop and 55.0.2883.84 on Android can potentially lead to heap corruption via a crafted HTML page. The issue is confirmed in multiple feeds (e.g., Debian security advisories a...

CVE-2016-5226

CVE-2016-5226 is a cross-site scripting vulnerability in Chromium/Blink. Connected Debian/Arch entries confirm it affects Chromium with Blink, and Debian fixes it in version 55.0.2883.75-1 (and related Debian security advisories). Affected products prior to that build should upgrade to 55.0.2883....

CVE-2017-5078

CVE-2017-5078 is listed in Arch Linux ASA-201707-4 as a vulnerability in qt5-webengine (Chromium-based) before 5.9.1-1, described as an arbitrary command execution via a possible command injection in the mailto handling component of the Chromium browser. The advisory indicates multiple issues in ...

CVE-2020-16046

CVE-2020-16046 (and related CVEs) refers to a script injection issue in iOSWeb within Google Chrome on iOS prior to 84.0.4147.105. The connected sources corroborate that multiple CVEs (including CVE-2020-16046, CVE-2020-6532, CVE-2020-6537, CVE-2020-6538, CVE-2020-6539, CVE-2020-6540, CVE-2020-65...

CVE-2025-13632

CVE-2025-13632 affects Google Chrome/Chromium DevTools, where an inappropriate DevTools implementation allowed sandbox escape when a user installed a crafted malicious extension. The vulnerable component is DevTools in Chrome, with exploitation tied to extension installation. The issue stems from...

CVE-2026-11037

CVE-2026-11037 describes an out-of-bounds write in Chrome’s Codecs component, affecting Google Chrome before version 149.0.7827.53. The issue could allow a remote attacker to potentially achieve a sandbox escape via a crafted video file. Chromium/Chrome lists the vulnerability with a Chromium sec...

CVE-2026-11155

CVE-2026-11155 describes an inappropriate implementation in CSS in Google Chrome that, before version 149.0.7827.53, allowed a remote attacker to leak cross-origin data via a crafted HTML page. The underlying issue is in Chrome’s CSS handling (Chromium-based), creating potential cross-origin data...

CVE-2026-11634

CVE-2026-11634 describes a use-after-free in Chrome’s Gamepad handling on Windows, exploitable via a crafted HTML page to potentially escape the Chromium sandbox. Affected: Google Chrome on Windows, prior to version 149.0.7827.103. Impact: remote attacker could achieve sandbox escape with a high ...

CVE-2026-12008

CVE-2026-12008 : In Google Chrome, a Use-after-free in DigitalCredentials (pre-149.0.7827.115) could allow a remote attacker who has compromised the renderer process to potentially escape the sandbox via a crafted HTML page. The Chrome Stable update (149.0.7827.114/115 for Windows/Mac; 149.0.7827...

CVE-2026-14053

CVE-2026-14053 affects Google Chrome where extensions enforcement is insufficient. A remote attacker who has already compromised the renderer process could leak cross-origin data via a crafted HTML page, due to policy enforcement gaps in Extensions before version 150.0.7871.47. The vulnerability ...

CVE-2026-17738

CVE-2026-17738 : In Chrome/Chromium, insufficient validation of untrusted input in Payments can allow a renderer-compromised page to trigger a sandbox escape. The vulnerability affects Chrome before 151.0.7922.72 (and corresponding Chromium builds referenced in OSV and Debian advisories). OpenSUS...

CVE-2026-17954

CVE-2026-17954 affects Google Chrome’s MHTML handling. A policy bypass in MHTML could leak cross-origin data via a crafted MHTML page, as described for Chrome versions prior to 151.0.7922.72. The vulnerability is rated low by Chromium, with network attack vector and user interaction required. Aff...

CVE-2026-78987

CVE-2026-78987 is an information leak in the Canvas component of Google Chrome prior to 152.0.7977.65 , allowing a remote attacker to bypass the web origin policy via a crafted HTML page. According to Red Hat, this can lead to unauthorized access to sensitive information . The CVSS v3.1 score is ...

CVE-2026-79141

CVE-2026-79141 is an incorrect authorization vulnerability in the Google Chrome browser, affecting versions prior to 152.0.7977.65 . A remote attacker can bypass the web origin policy by enticing a user to visit a specially crafted HTML page, potentially leading to unauthorized access to sensitiv...

CVE-2026-79238

An incorrect authorization flaw in the ServiceWorker component of Google Chrome prior to 152.0.7977.65 allows a remote attacker, leveraging social engineering and a crafted Chrome extension , to bypass the web origin policy. Per Red Hat, this bypass could lead to unauthorized access to sensitive ...

CVE-2026-87574

CVE-2026-87574 is an information leak in the ServiceWorker component of Google Chrome prior to 153.0.8010.36 . A remote attacker can exploit the flaw by delivering a crafted HTML page that causes the ServiceWorker to expose cross-origin data to the attacker, resulting in a low confidentiality imp...

CVE-2026-87655

CVE-2026-87655 is a clickjacking vulnerability in the Downloads component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker, leveraging social engineering , could spoof UI elements via a crafted HTML page. The Chromium security severity is rated Medium , with a CVSS...

CVE-2011-3073

Technical details for CVE-2011-3073 are not publicly provided in the supplied documents; no affected product/version or remediation is specified here. Monitor for updates.

CVE-2013-0843

CVE-2013-0843 affects Google Chrome on macOS, where the renderer code in webrtc_audio_renderer.cc mishandles the buffer size for a 96 kHz WebRTC audio stream. This can lead to memory corruption and a resulting crash (DoS) or potentially other unspecified impact when processing audio from a web si...

CVE-2013-2931

CVE-2013-2931 is part of the Chromium/Google Chrome 31.x fixes mentioned in openSUSE/Debian advisories. The description notes “Various fixes from internal audits, fuzzing and other initiatives” without detailing root cause or exploit. Remediation in the connected docs is to update to Chromium/Chr...

CVE-2013-6627

CVE-2013-6627 is an out-of-bounds read in Chromium/Google Chrome’s HTTP parsing (1xx handling). Affected: Chrome/Chromium around 31.x prior to 31.0.1650.48. Exploitation noted in public advisories/Exploits. Remediation: update to Chromium/Chrome 31.0.1650.48 or newer (as reflected in openSUSE Deb...

CVE-2014-1747

CVE-2014-1747 is a UXSS-type XSS in Blink's DocumentLoader::maybeCreateArchive used by Google Chrome prior to 35.0.1916.114. The vulnerability allows remote attackers to inject arbitrary script/HTML via crafted MHTML content. Affected component is Blink/WebKit's MHTML handling in Chrome versions ...

CVE-2014-3191

CVE-2014-3191 is a use-after-free vulnerability in Blink used by Google Chrome prior to 38.0.2125.101. It arises from widget-position update interactions with the render tree, specifically in FrameView.cpp (FrameView::updateLayoutAndStyleForPainting) and RenderLayerScrollableArea.cpp (RenderLayer...

CVE-2015-1265

CVE-2015-1265 affects Google Chrome/Chromium up to version 43.0.2357.65. The CVE entry represents multiple unspecified vulnerabilities that could cause a denial of service or other impact via unknown vectors. Publicly linked documents confirm Chrome/Chromium vulnerabilities across several compone...

CVE-2015-1297

CVE-2015-1297 affects Google Chrome’s WebRequest API (extensions/browser/api/web_request/web_request_api.cc) where the request source is not properly validated, allowing remote attackers to bypass access restrictions via a crafted app or extension. The vulnerability is fixed in Chrome 45.0.2454.8...

CVE-2015-3336

CVE-2015-3336 (Chromium/Google Chrome) : A vulnerability in Chrome/Chromium allowed user-assisted remote attackers to cause UI disruption by abusing CONTENT_SETTINGS_TYPE_FULLSCREEN and CONTENT_SETTINGS_TYPE_MOUSELOCK. A crafted HTML document loaded via a file: URL could trigger requestFullScreen...

CVE-2015-6788

CVE-2015-6788 affects Google Chrome prior to 47.0.2526.80. The issue is a type confusion in the extensions subsystem, specifically the ObjectBackedNativeHandler in extensions/renderer/object_backed_native_handler.cc, which can be triggered remotely to cause a denial of service and possibly unspec...

CVE-2016-1616

CVE-2016-1616 in Google Chrome/Chromium prior to 48.0.2564.82: The CustomButton::AcceleratorPressed function in ui/views/controls/button/custom_button.cc allows remote attackers to spoof URLs via vectors involving an unfocused custom button. Impact is remote URL spoofing; likelihood and severity ...

CVE-2016-1686

The CVE-2016-1686 entry concerns PDFium (as used by Google Chrome up to version 51.0.2704.63). The flaw is in CPDF_DIBSource::CreateDecoder in core/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp, where decoder-initialization failure is mishandled, enabling a remote attacker to trigger an out-of-bo...

CVE-2016-5147

CVE-2016-5147 is a Chrome/Blink UXSS issue where deferred page loads are mishandled, allowing remote injection of script/HTML via crafted sites. Affected: Blink in Google Chrome (versions prior to 53.0.2785.89 on Windows/OS X and prior to 53.0.2785.92 on Linux). Impact aligned with Cross-site Scr...

CVE-2016-5219

CVE-2016-5219 is a heap-use-after-free in the V8 engine of Chromium/Chrome, exploitable remotely via a crafted HTML page. Affects Chrome prior to 55.0.2883.75 on desktop and 55.0.2883.84 on Android. The vulnerability is due to heap corruption in V8; remote attackers could potentially exploit it. ...