CVE-2017-5128

CVE-2017-5128 affects the Chromium/ Blink WebGL component: a heap overflow in WebGL prior to Chrome 62.0.3202.62. The flaw can be triggered by a crafted HTML page, enabling remote code execution with high impact if exploited. Affected product/version: Chromium browser/WebGL before 62.0.3202.62. R...

CVE-2022-3048

CVE-2022-3048 refers to an inappropriate implementation in the Chrome OS lockscreen within Google Chrome on Chrome OS, prior to version 105.0.5195.52. The issue allowed a local attacker with physical access to bypass lockscreen navigation restrictions. Public advisories indicate a fix shipped wit...

CVE-2024-7000

CVE-2024-7000 is a use-after-free vulnerability in Chrome/Chromium CSS handling, allowing heap corruption via a crafted HTML page when a user is tricked into specific UI gestures. Affected: Google Chrome prior to 127.0.6533.72 (and Chromium); root cause: use-after-free in CSS. Impact: potentially...

CVE-2024-7022

CVE-2024-7022 describes an uninitialized use in V8 of Google Chrome before 123.0.6312.58, permitting a remote attacker to trigger out-of-bounds memory access via a crafted HTML page. Affected component: V8 JavaScript engine within Chrome/Chromium. Root cause: uninitialized use leading to memory a...

CVE-2024-7023

CVE-2024-7023 : Google Chrome Updater has insufficient data validation in its Updater component, affecting Chrome versions prior to 128.0.6537.0. This enables a remote attacker to escalate privileges via a malicious file. Remediation: update Chrome to version 128.0.6537.0 or later. If additional ...

CVE-2026-10887

CVE-2026-10887 is a use-after-free in Chromoting within Google Chrome on macOS, leading to remote arbitrary code execution via malicious network traffic. The connected Chrome release note confirms a fix in Chrome 149.0.7827.53 (and related stability updates) for macOS, addressing the vulnerabilit...

CVE-2026-13283

Google Chrome on Android is affected by a Use-After-Free in the AdFilter component. The issue arises when a remote attacker convinces a user to perform specific UI gestures on a crafted HTML page, potentially enabling arbitrary code execution. Root cause: use-after-free in AdFilter. Affected vers...

CVE-2026-14150

CVE-2026-14150 affects Google Chrome’s Speech component and is due to insufficient validation of untrusted input in the renderer. Prior to version 150.0.7871.47, a remote attacker who had already compromised the renderer process could perform UI spoofing via a crafted HTML page. The security rati...

CVE-2026-14411

CVE-2026-14411 describes insufficient validation of untrusted input in ANGLE used by Google Chrome, prior to build 150.0.7871.46. The issue may allow a remote attacker to cause a sandbox escape via a crafted HTML page. Documented impact is a high-severity, likely remote threat affecting ANGLE int...

CVE-2026-15905

CVE-2026-15905 is a local-use-after-free vulnerability in the Aura component of Google Chrome (Chromium-based) prior to 150.0.7871.128, allowing a local attacker to potentially cause heap corruption via a malicious file. The issue is confirmed in multiple sources and is addressed by an update to ...

CVE-2026-17681

The CVE-2026-17681 entry is validated by the connected Chrome release data: Google Chrome on Android versions affected prior to 151.0.7922.72 had insufficient validation of untrusted input in Web Authentication, enabling a renderer-compromise–driven sandbox escape via a crafted HTML page. The vul...

CVE-2026-17718

CVE-2026-17718 affects Google Chrome/Chromium ANGLE. A use-after-free in ANGLE could allow a remote attacker to escape the browser sandbox via a crafted HTML page. Impact is described as high/critical; no exploitation details are provided in the sources. The issue is addressed in Chrome/Chromium ...

CVE-2026-17723

CVE-2026-17723 relates to a use-after-free in Media in Google Chrome on Windows prior to 151.0.7922.72. A remote attacker who had compromised the renderer process could potentially perform a sandbox escape via a crafted HTML page. The issue is described as high severity (CVSS 3.1/8.3) with networ...

CVE-2026-17747

CVE-2026-17747: An insufficient validation of untrusted input flaw was found in the Payments component of Google Chrome on Android. The issue stems from inadequate input validation in Payments, allowing a remote attacker who had already compromised the renderer process to perform UI spoofing via ...

CVE-2026-19147

CVE-2026-19147 affects Google Chrome on Linux. The issue is a use-after-free in the Aura component, allowing a remote attacker that has compromised the renderer to potentially escape the sandbox via a crafted HTML page. The vulnerability is tied to Chrome/Chromium’s Aura handling and is fixed in ...

CVE-2026-6306

CVE-2026-6306 is a heap buffer overflow in PDFium used by Google Chrome (pre-147.0.7727.101). A crafted PDF can cause arbitrary code execution inside the sandbox. Remediation: update to Chrome 147.0.7727.101 (or the Debian/Chromium packagings listed in vendor advisories). Exploitation details are...

CVE-2026-6920

CVE-2026-6920 describes an out-of-bounds read in the GPU component of Google Chrome on Android, allowing a remote attacker who compromises the renderer process to potentially escape the sandbox via a crafted HTML page. Affected: Chrome on Android; vulnerable component: GPU/renderer interaction; r...

CVE-2026-87641

A race condition in the Browser component of Google Chrome prior to version 153.0.8010.36 allowed a remote attacker to bypass system access restrictions by serving a crafted HTML page. The vulnerability is rated Medium severity by Chromium and scored 4.2 (CVSS 3.1) by NVD, reflecting high attack ...

CVE-2026-9882

CVE-2026-9882 affects Google Chrome’s ANGLE component, where an integer overflow allows a remote attacker to leak cross-origin data via a crafted HTML page. Public reports/entries consistently describe the flaw as an integer overflow in ANGLE prior to Chrome 148.0.7778.216. The Chromium/Chrome se...

CVE-2009-2071

CVE-2009-2071 affects Google Chrome versions before 1.0.154.53. The vulnerability arises when Chrome uses the HTTP Host header to interpret 4xx/5xx CONNECT responses from a proxy, which can enable a man-in-the-middle to spoof arbitrary HTTPS sites by letting the browser obtain a valid certificate...

CVE-2011-1449

Technical details for CVE-2011-1449 are not provided in the connected documents; no affected products, root cause, impact, or remediation are specified here. Monitor for updates.

CVE-2011-2788

Technical details for CVE-2011-2788 are not publicly available in the provided documents. No specifics on affected product versions, root cause, or remediation are present. Monitor for updates from official advisories and vulnerability feeds.

CVE-2011-3056

CVE-2011-3056 affects Google Chrome prior to 17.0.963.83, where a cross-origin policy bypass is possible via a vector involving a “magic iframe.” The underlying issue is a Same Origin Policy bypass in the browser’s handling of iframes, enabling partial confidentiality/integrity exposure. The publ...

CVE-2011-3069

Technical details for CVE-2011-3069 are not publicly available in the provided documents; monitor for updates.

CVE-2012-5120

CVE-2012-5120 is part of a Chromium/V8 set of vulnerabilities described in GLSA-201309-16. The CVE corresponds to Google V8 before 3.13.7.5 (as used in Chrome prior to 23.0.1271.64) and relates to an out-of-bounds access in JavaScript arrays that could lead to denial of service or other impact. T...

CVE-2013-2843

CVE-2013-2843 is a use-after-free in Chromium’s speech data handling, affecting Chromium before 27.0.1453.93. Debian (DSA-2695) and Gentoo GLSA-2013-09.16 enumerate this as part of a set of related Chromium/V8 vulnerabilities and note the remote-denial-of-service/unspecified impact. The Debian ad...

CVE-2013-2849

In Chromium/Google Chrome, CVE-2013-2849 corresponds to multiple cross-site scripting (XSS) vulnerabilities in Chromium before 27.0.1453.93, enabling user-assisted remote attackers to inject arbitrary scripts or HTML via drag-and-drop or copy-and-paste vectors. The affected component is the Chrom...

CVE-2013-2856

CVE-2013-2856 is a use-after-free vulnerability in Chromium/Google Chrome prior to version 27.0.1453.110, with impact described as denial of service or possibly other unspecified effects via vectors related to input handling. Connected documents confirm this CVE is among several Chromium/Chrome i...

CVE-2013-2900

The CVE-2013-2900 vulnerability affects Google Chrome prior to 29.0.1547.57 on Windows, caused by the FilePath::ReferencesParent function in files/file_path.cc misparsing directory components consisting only of dots and whitespace, enabling remote directory-traversal via crafted directory names. ...

CVE-2013-6628

CVE-2013-6628 affects Chromium’s TLS renegotiation handling. OpenSUSE/NASL entries show a fix path in Chromium updates (31.x series) addressing issues where a server’s X.509 certificate could be misinterpreted or not revalidated during TLS renegotiation, potentially impacting trust relationships....

CVE-2013-6636

CVE-2013-6636 affects Chromium/Chromium-browser up to version 31.0.1650.63. The issue arises from a faulty empty-document check in the Blink FrameLoader path during modal dialog presentation, enabling an address bar spoofing attack via document.write. Affected component: FrameLoader.cpp in Blink ...

CVE-2014-7928

CVE-2014-7928 affects Google Chrome before 40.0.2214.91 via Google V8’s hydrogen.cc handling of arrays with holes, enabling remote memory corruption and possible DoS or other impact through crafted JavaScript. Connected sources (Nessus/OS advisories) confirm this as a memory corruption vulnerabil...

CVE-2015-1224

CVE-2015-1224 affects Google Chrome (vpxdecoder) where VpxDecode in media/filters/vpx_video_decoder.cc fails to ensure alpha-plane dimensions match image dimensions, leading to an out-of-bounds read and potential remote denial of service. The vulnerability is tied to Chrome before 41.0.2272.76. C...

CVE-2015-1227

The CVE-2015-1227 issue affects Google Chrome’s Blink rendering engine (DragImage::create in platform/DragImage.cpp). The root cause is uninitialized memory used for image drawing, as reported for Chrome versions prior to 41.0.2272.76. This memory initialization flaw could allow a remote attacker...

CVE-2015-1268

CVE-2015-1268 refers to Blink via bindings/scripts/v8_types.py in Chrome before 43.0.2357.130, where the creation context for a return value’s DOM wrapper was not correctly selected, enabling a remote attacker to bypass the Same Origin Policy through crafted JavaScript (e.g., data: URLs). Connect...

CVE-2015-1269

CVE-2015-1269 affects Google Chrome and related Chromium-based packages. The DecodeHSTSPreloadRaw function in net/http/transport_security_state.cc failed to canonicalize DNS hostnames before comparing against HSTS/HPKP preload entries, enabling bypass of access restrictions via hostnames that end...

CVE-2015-1292

CVE-2015-1292 is a concrete Chrome/Blink vulnerability. The NavigatorServiceWorker::serviceWorker function in modules/serviceworkers/NavigatorServiceWorker.cpp allowed a remote attacker to bypass the Same Origin Policy by accessing a Service Worker, as part of Chrome before 45.0.2454.85. Public d...

CVE-2015-1294

CVE-2015-1294 is a use-after-free in the Skia graphics library (SkMatrix::invertNonIdentity in core/SkMatrix.cpp) used by Google Chrome. The vulnerability allows remote attackers to cause a denial of service or potentially other impact by triggering matrix elements that yield an infinite result d...

CVE-2015-1296

CVE-2015-1296 is a Chrome/Chromium vulnerability where the UnescapeURLWithAdjustmentsImpl in net/base/escape.cc could allow spoofing the SSL lock icon by displaying Unicode LOCK characters in the omnibox. Affected: Google Chrome prior to 45.0.2454.85. Root cause: improper handling in omnibox URL ...

CVE-2015-1300

CVE-2015-1300 affects Blink (Chrome’s rendering engine): FrameFetchContext::updateTimingInfoForIFrameNavigation does not properly restrict IFRAME Resource Timing API times, enabling a remote attacker to glean sensitive info via crafted JavaScript using history.back. Affects Chrome before 45.0.245...

CVE-2015-3910

CVE-2015-3910 is reported for Google V8 before 4.3.61.21, as used in Google Chrome before 43.0.2357.65. The connected documents confirm multiple unspecified vulnerabilities in V8 with possible denial of service or other impact via unknown vectors. They also show the issue referenced in Ubuntu/Deb...

CVE-2015-6781

CVE-2015-6781 describes an integer overflow in the sfntly library’s FontData::Bound function (data/font_data.cc), affecting Google Chrome prior to 47.0.2526.73. A crafted offset/length in SFNT font data could trigger a denial of service or potentially other unspecified impact. Connected sources c...

CVE-2016-5154

CVE-2016-5154 is a PDFium-related heap overflow in Chromium/Chrome affecting the PDF rendering path (via crafted JBig2 images). Public sources confirm the flaw exists in Chromium/Chrome around 53.x branches and was fixed in later releases. Debian advisories map CVE-2016-5154 to chromium-browser u...

CVE-2017-5018

CVE-2017-5018 affects Chromium/Google Chrome prior to 56.0.2924.76 (Linux/Windows/Mac) and 56.0.2924.87 (Android). The flaw is an insufficiently strict content security policy on the chrome://apps launcher page, enabling a remote attacker to inject scripts or HTML into a privileged page via a cra...

CVE-2023-2458

CVE-2023-2458 describes a use-after-free in ChromeOS Camera within Google Chrome on ChromeOS, prior to 113.0.5672.114, enabling a remote attacker who persuades UI interaction to trigger heap corruption. Connected sources corroborate the same description; no exploit code or live-attack data is pro...

CVE-2023-3731

CVE-2023-3731 affects Google Chrome on ChromeOS prior to 115.0.5790.131, where a use-after-free in Diagnostics could be triggered by a user-installed malicious extension, potentially enabling heap corruption. The vulnerability is tied to Diagnostics handling in ChromeOS, with high severity. Publi...

CVE-2023-4369

CVE-2023-4369 affects Google Chrome on ChromeOS prior to 116.0.5845.120. The issue is insufficient data validation in Systems Extensions, which could allow a user who is convinced to install a malicious extension to bypass file restrictions via a crafted HTML page. Connected sources corroborate t...

CVE-2026-10001

CVE-2026-10001 affects Google Chrome/Chromium’s PerformanceManager: a use-after-free in PerformanceManager can allow a remote attacker who has already compromised the renderer process to potentially escape the sandbox via a crafted HTML page. Impact is described as high (CVSS 3.1: AV:N/AC:H/PR:N/...

CVE-2026-11667

CVE-2026-11667 affects Google Chrome WebRTC. The vulnerability is an out-of-bounds read in WebRTC that, if the GPU process is compromised, could enable heap corruption via a crafted HTML page. Impacted software: Chrome prior to version 149.0.7827.103. The publicly documented remediation is to upg...

CVE-2026-11700

This CVE affects Google Chrome’s Tracing component in the renderer process. The root cause is a use-after-free in Tracing, which, if an attacker can compromise the renderer, could enable a sandbox escape via a crafted HTML page. The vulnerability is described for Chrome versions prior to 149.0.78...