CVE-2011-3880

CVE-2011-3880 affects Google Chrome (and Chromium in related advisories) by not preventing use of an unspecified special character as a delimiter in HTTP headers. The initial entry notes unknown impact and remote attack vectors. OpenVAS/Gentoo GLSA entries corroborate the vulnerability family acr...

CVE-2012-5112

CVE-2012-5112 is a use-after-free vulnerability in WebKit’s SVG implementation used by Google Chrome up to version 22.0.1229.94. The Nessus and related advisories confirm that the vulnerability arises in WebKit and could allow remote code execution via unspecified vectors when processing SVG in a...

CVE-2013-0880

CVE-2013-0880 affects Google Chrome on Windows, Linux, and macOS with a use-after-free in database handling that can lead to remote DoS or other unspecified impact. The initial description lists affected versions as Chrome before 25.0.1364.97/99 (Mac), 25.0.1364.97 (Windows/Linux). Connected docu...

CVE-2013-2842

CVE-2013-2842 is referenced in multiple OpenVAS/Nessus entries tied to Apple iTunes and Safari components. Public details in the connected docs show it as part of a set of vulnerabilities affecting WebKit/libxml/libxslt in iTunes on Windows with memory corruption that could enable arbitrary code ...

CVE-2013-2854

Affected software and issue: Google Chrome on Windows, prior to version 27.0.1453.110, is vulnerable due to an incorrect handle passed to a renderer process in unspecified circumstances. Root cause: an incorrect handle to a renderer process is exposed in certain conditions. Impact: remote attacke...

CVE-2014-3168

CVE-2014-3168 is a use-after-free in Blink's SVG image handling for Chrome/Chromium prior to 37.0.2062.94, caused by improper caching of animated SVG content. Exploitation could lead to denial of service and possibly other impacts. Patches are present in Chrome/Chromium 37.0.2062.94 and newer (e....

CVE-2014-3178

CVE-2014-3178 is a use-after-free in Blink/WebKit’s DOM handling (core/dom/Node.cpp) affecting Chromium-based browsers. The vulnerability was disclosed in conjunction with Chrome/Chromium fixes for version set around 37.x. Debian/Ubuntu/OpenVAS entries indicate resolution by upgrading to Chromium...

CVE-2014-3194

CVE-2014-3194 refers to a use-after-free in the Web Workers implementation of Google Chrome prior to version 38.0.2125.101 . The vulnerability could allow a remote attacker to cause a denial of service or potentially other impacts, as noted in multiple advisories and vendor updates. The OpenVAS/O...

CVE-2014-7937

CVE-2014-7937 affects FFmpeg’s libavcodec/vorbisdec.c; multiple off-by-one errors can lead to a denial of service (use-after-free) or other impact via crafted Vorbis I data. The issue is present in FFmpeg versions before 2.4.2 as used by Google Chrome before 40.0.2214.91. Remediation is to upgrad...

CVE-2015-1228

CVE-2015-1228 affects Google Chrome (Blink) before 41.0.2272.76. The vulnerability is caused by RenderCounter::updateCounter not forcing a relayout and not initializing memory for a data structure, which can be triggered by a crafted CSS token sequence. The result is a denial of service (applicat...

CVE-2015-6769

CVE-2015-6769 affects Google Chrome/Chromium before 47.0.2526.73. The issue is a Same Origin Policy bypass in the core by exploiting a delay in window proxy clearing in WebKit’s WindowProxy.cpp, as reported in multiple sources (including Debian’s DSA-3415-1 and Chrome’s 47 stable release). Impact...

CVE-2016-1687

CVE-2016-1687 affects Google Chrome/Chromium. The vulnerability is an information disclosure in the renderer related to extensions, allowing a remote attacker to obtain sensitive information. The issue is documented as fixed in Chrome 51.0.2704.63 (and corresponding Chromium/debian security updat...

CVE-2016-1701

CVE-2016-1701 concerns Google Chrome’s Autofill implementation. The vulnerability arises from how field updates interact with JavaScript triggering a frame deletion, leading to a use-after-free and potential denial of service (and possibly other impact) via a crafted web site. Affected software i...

CVE-2016-1702

The CVE-2016-1702 issue concerns SkRegion::readFromMemory in Skia, used by Google Chrome prior to 51.0.2704.79. The function does not validate the interval count, enabling remote attackers to trigger an out-of-bounds read via crafted serialized data, potentially causing a denial of service. Publi...

CVE-2016-5163

The CVE-2016-5163 issue affects Google Chrome’s bidirectional-text handling in the address bar (omnibox). Specifically, before Chrome 53.0.2785.89 on Windows/OS X and before 53.0.2785.92 on Linux, RTL Unicode text could cause the address bar to render URLs incorrectly, enabling spoofing via craft...

CVE-2016-5189

The CVE-2016-5189 issue affects Google Chrome/Chromium browser components (Chrome on Windows/macOS/Linux and Android) where navigation to blob URLs with non-canonical origins could cause the Omnibox (URL bar) contents to be spoofed via crafted HTML pages. Affected versions include Chrome before 5...

CVE-2016-5192

CVE-2016-5192 concerns Blink in Chrome prior to 54.0.2840.59 for Windows, where a missing same-origin policy check on redirects in TextTrackLoader allowed a remote attacker to bypass cross-origin restrictions via crafted HTML pages. The issue is categorized as a cross-origin policy bypass (same-o...

CVE-2016-5218

This CVE (CVE-2016-5218) affects Chromium/Google Chrome's Omnibox handling of PDFs, where a crafted HTML page containing PDF data could temporarily spoof the URL bar. The connected Debian security advisories and Arch/Linux entries confirm a class of content spoofing in the Omnibox related to Blin...

CVE-2017-5017

CVE-2017-5017 affects Google Chrome on macOS prior to 56.0.2924.76, tied to an uninitialized memory access in WebM video support that could allow an attacker to extract image fragments via a crafted page on systems with GeForce 8600M GPUs. The issue is a concrete, vendor-reported memory vulnerabi...

CVE-2017-5022

CVE-2017-5022 is a vulnerability in Google Chrome's Blink security policy enforcement. The issue allowed bypass of unsafe-inline Content Security Policy via a crafted HTML page, enabling remote attackers to bypass CSP. Affected products included Chrome on Linux, Windows, and Mac up to version 56....

CVE-2017-5096

CVE-2017-5096 affects Google Chrome for Android. The issue is described as insufficient policy enforcement during navigation between schemes, enabling a remote attacker to cause a cross-origin content download via a crafted HTML page and is associated with Android intents. The Chrome 60 release (...

CVE-2017-5106

Chromium-based Omnibox domain spoofing vulnerability CVE-2017-5106 in Google Chrome pre-60.0.3112.78 (Mac/Windows/Linux/Android). Root cause: insufficient policy enforcement allowing IDN homograph-based domain spoofing. Impact: remote attacker could spoof domain names via crafted domain names; re...

CVE-2020-6492

CVE-2020-6492 affects Google Chrome via a Use-After-Free in ANGLE (before 83.0.4103.97). The underlying issue is a use-after-free in ANGLE that could allow a remote attacker to potentially escape the Chrome sandbox through a crafted HTML page. Affected component: ANGLE within Chrome; impact descr...

CVE-2024-7018

CVE-2024-7018 describes a heap buffer overflow in PDF handling within Google Chrome prior to 124.0.6367.78, potentially allowing a remote attacker to trigger heap corruption via a crafted PDF. The issue originates in the Chromium-based PDF processing path and is documented across multiple feeds (...

CVE-2026-11036

CVE-2026-11036 affects Google Chrome before 149.0.7827.53 due to an inappropriate implementation in the DOM, enabling a remote attacker to bypass the same-origin policy via a crafted HTML page. The vulnerability is described across multiple sources (NVD/EUVD/CIRCL sighting) with the same core det...

CVE-2026-11112

CVE-2026-11112 affects Chromoting in Google Chrome on Linux, with insufficient validation of untrusted input prior to 149.0.7827.53. A remote attacker who has compromised the renderer process could potentially perform a sandbox escape via a crafted Chrome Extension. The vulnerability is associate...

CVE-2026-19159

Google Chrome vulnerable component: Views in Chromium-based Chrome. CVE-2026-19159 is a use-after-free flaw that can lead to heap corruption when a user is coerced into specific UI gestures via a crafted HTML page, affecting Chrome versions prior to 151.0.7922.109. The issue is documented in the ...

CVE-2026-87567

A UI misrepresentation vulnerability in UrlFormatting in Google Chrome prior to 153.0.8010.36 allowed a remote attacker, leveraging social engineering, to spoof the address bar using a crafted domain name. The Chromium security team rated this Medium severity. NVD scored it 4.3 (CVSS 3.1) with lo...

CVE-2026-9975

CVE-2026-9975 describes an out-of-bounds read and write flaw in ANGLE used by Google Chrome, affecting Chrome builds prior to 148.0.7778.216. The vulnerability could allow a remote attacker who has already compromised the renderer process to potentially escape the Chrome sandbox via a crafted HTM...

CVE-2026-9998

CVE-2026-9998 affects the Skia component in Google Chrome/Chromium. An integer overflow in Skia prior to version 148.0.7778.216 could allow a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. The impact is a high-severity, lo...

CVE-2010-0661

The CVE-2010-0661 issue affects WebKit/WebCore: V8DOMWindowCustom.cpp in WebKit before r52401, which is used in Google Chrome up to version 4.0.249.78. The vulnerability allows remote attackers to bypass the Same Origin Policy via vectors involving window.open. Connected sources confirm the affec...

CVE-2010-1770

CVE-2010-1770 affects WebKit-based browsers (Safari up to v5 on macOS 10.5–10.6 and Windows; Safari up to v4.1 on macOS 10.4; Chrome up to 5.0.375.70). The issue is a transformation handling bug for a text node using IBM1147 charset, in HTML with a BR element, related to a type checking issue. Co...

CVE-2011-1189

CVE-2011-1189 affects Google Chrome prior to 10.0.648.127. The vulnerability arises from improper box layout in the browser’s rendering, allowing remote attackers to cause a denial of service or potentially other impact via unknown vectors that lead to a “stale node.” Exploitation details are not...

CVE-2011-1451

Technical details for CVE-2011-1451 are not publicly provided in the connected documents. Available information only references a Chrome issue with DOM id maps and potential dangling pointers. Monitor for updates.

CVE-2011-2823

CVE-2011-2823 affects Google Chrome before 13.0.782.215. The vulnerability is a use-after-free in the line box handling, enabling remote denial of service and possibly other impact. The provided connected sources confirm the Chrome-specific root cause and vulnerable component, but do not specify ...

CVE-2013-2926

CVE-2013-2926 is a use-after-free vulnerability in Blink’s IndentOutdentCommand.cpp (IndentOutdentCommand::tryIndentingAsListItem). It affects Google Chrome (and Chromium/Blink) prior to 30.0.1599.101, where mismanagement of list element editing can lead to a denial of service and potentially oth...

CVE-2013-6641

CVE-2013-6641 is a use-after-free in Blink’s FormAssociatedElement::formRemovedFromTree, affecting Chromium-derived browsers (Chromium/chromium-browser) prior to the patched 32.0.1700.76/77 builds. The vulnerability arises from improper handling of the past names map of a FORM element, enabling r...

CVE-2013-6662

CVE-2013-6662 affects Google Chrome. The connected documents describe a vulnerability where Chrome caches TLS sessions before certificate validation, which can compromise session integrity. The impact details in the sources indicate minimal confidentiality impact, and partial integrity impact, wi...

CVE-2014-3193

CVE-2014-3193 : Affected software is Google Chrome prior to 38.0.2125.101. Root cause is a type confusion issue in SessionService::GetLastSession used during callback processing, which can lead to a use-after-free and potentially other impact. The vulnerability enables denial of service and parti...

CVE-2014-7907

CVE-2014-7907 affects Chromium/Blink: multiple use-after-free in ScreenOrientationController.cpp (Blink) used by Google Chrome prior to 39.0.2171.65. Impact includes potential DoS and unspecified outcomes via vectors that trigger improper handling of a detached frame (related to lock/unlock). Aff...

CVE-2014-7946

CVE-2014-7946 is a vulnerability in Google Chrome's Blink engine (RenderTable.cpp) where RenderTable::simplifiedNormalFlowLayout skips captions during certain table layouts, enabling an out-of-bounds read and potential denial of service. Affected component is Blink/Chromium prior to version 40.0....

CVE-2015-1205

Technical details about CVE-2015-1205 are not publicly provided in the supplied documents. No affected product/version or root cause is specified here. Monitor for updates in connected sources.

CVE-2015-1275

Google Chrome before 44.0.2403.89 on Android is vulnerable to UXSS via a crafted intent: URL, enabling remote attackers to inject arbitrary script or HTML (trailing alert(document.cookie);// substring) through UrlUtilities.java. This is CVE-2015-1275. OpenSUSE/GLSA and related advisories show the...

CVE-2015-1301

CVE-2015-1301 affects Google Chrome/Chromium before version 45.0.2454.85. Multiple vulnerabilities were fixed during internal auditing and fuzzing, with the Chrome 45 stable channel update delivering the fix (Chrome 45.0.2454.85). Public advisories note fixes across components (e.g., DOM, Service...

CVE-2015-6787

CVE-2015-6787 refers to multiple vulnerabilities fixed in Google Chrome/Chromium prior to 47.0.2526.73. Public advisories enumerate a large set of issues across components (AppCache, DOM, core, PDFium, Skia, Infobars, V8, CSP, Omnibox, etc.) with use-after-free, out-of-bounds, and various bypass/...

CVE-2016-1650

The CVE-2016-1650 issue affects Google Chrome prior to 49.0.2623.108, where PageCaptureSaveAsMHTMLFunction::ReturnFailure in browser/extensions/api/page_capture/page_capture_api.cc could trigger a denial of service by failing to create MHTML documents. Public reports (CNVD/ Debian security adviso...

CVE-2016-5142

The CVE-2016-5142 entry describes a vulnerability in the Web Cryptography API (WebCrypto) implementation in Blink used by Google Chrome prior to 52.0.2743.116. The issue is a data buffer copy error in Blink (NormalizeAlgorithm.cpp and SubtleCrypto.cpp) that can cause a use-after-free, leading to ...

CVE-2016-5151

CVE-2016-5151 refers to a use-after-free in PDFium used by Google Chrome. The flaw occurs when handling timers in PDFium (PDF rendering component) and can be triggered by a crafted PDF document, potentially causing a denial of service (use-after-free) and, per related sources, may allow broader i...

CVE-2016-5225

CVE-2016-5225 is a CSP bypass in Blink (Chromium) prior to version 55.0.2883.75 for desktop and 55.0.2883.84 on Android. A crafted HTML page could bypass Content Security Policy via Blink, enabling remote exploitation in Chromium-based browsers. Public advisories indicate the issue affected the C...

CVE-2017-5021

CVE-2017-5021 is a use-after-free in Google Chrome/Chromium extensions prior to 56.0.2924.76 (Linux/Windows/Mac) and 56.0.2924.87 on Android, enabling a remote attacker to trigger an out-of-bounds memory read via a crafted HTML page. Publicly referenced fixes are in Chromium/Chromium-browser upda...