CVE-2016-5191

Google Chrome UXSS in CVE-2016-5191 due to insufficient validation of crafted HTML data in bookmark handling. Desktop Chrome before 54.0.2840.59 (Windows/Mac/Linux) and Android before 54.0.2840.85 could be tricked via a crafted http://javascript:[email protected] URL to inject scripts/HTML. Imp...

CVE-2016-5223

CVE-2016-5223 is an integer overflow in the PDFium component of Chromium/Blink used by Chrome. The issue can potentially lead to heap corruption or DoS via a crafted PDF file. Public details in connected sources identify the affected component (PDFium) and the root cause (integer overflow) and no...

CVE-2017-5034

CVE-2017-5034 is a use-after-free in the PDFium component of Chromium/Chrome. The Arch Linux advisory documents this as enabling arbitrary code execution via remote exploitation, triggered by processing a crafted PDF. Public Debian/Chromium notes corroborate PDFium exposure and the upstream fix i...

CVE-2020-15994

CVE-2020-15994 affects Google Chrome’s V8 engine, with heap corruption possible through a remote attacker via a crafted HTML page in versions prior to 86.0.4240.99. The vulnerability is described as a use-after-free in V8. The Chrome 86.0.4240.99 Android update notes this release includes multipl...

CVE-2021-30558

Google Chrome prior to 91.0.4472.77 had an insufficient Content Security Policy enforcement vulnerability allowing a remote attacker to bypass CSP via a crafted HTML page. The issue affects Chrome desktop (client-side CSP handling) with a high impact per CVSS metrics, and was addressed in the Chr...

CVE-2023-7011

CVE-2023-7011 describes an improper implementation in Google Chrome’s Picture in Picture (PiP) feature that allowed a remote attacker to spoof the Omnibox contents via a crafted HTML page. Affected software is Google Chrome (PiP module) prior to version 119.0.6045.105. The underlying issue is an ...

CVE-2025-10890

CVE-2025-10890 is a Chromium/Chrome vulnerability where a side-channel in the V8 engine allowed a remote attacker to disclose cross-origin data via a crafted HTML page. Affected software includes Google Chrome/Chromium with V8 before version 140.0.7339.207. The root cause is a side-channel inform...

CVE-2025-13640

CVE-2025-13640 affects Chromium-based components (Chromium/Chromebooks/Chromium in Chromium-derived builds). The issue is an inappropriate implementation in Passwords that could allow a local attacker to bypass authentication via physical access. Publicly visible details describe the vulnerabilit...

CVE-2026-12017

Google Chrome extension component (Extensions) is affected by CVE-2026-12017. An insufficient input validation in the Extensions path allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Affected product: Google Chrome (Extensions). ...

CVE-2026-12443

CVE-2026-12443 is a use-after-free in Chrome’s Web Authentication implementation that could allow a remote attacker to execute arbitrary code via a crafted HTML page. Affected software: Google Chrome (Chromium). Underlying issue is in Web Authentication handling that leads to memory misuse. Impac...

CVE-2026-12449

CVE-2026-12449 relates to a use-after-free in Chromoting for Google Chrome on Windows cases prior to version 149.0.7827.155, enabling a local attacker to achieve OS‑level privilege escalation via a malicious file. The cross‑reference entries confirm the affected component as Chromoting within Chr...

CVE-2026-12468

CVE-2026-12468: A race in Chrome Mac updater allows a remote attacker (with renderer access) to potentially escape the sandbox via a crafted HTML page. Affected: Google Chrome on macOS prior to 149.0.7827.155. Impact: High. Mitigation: update to 149.0.7827.155 or later (per linked Chrome security...

CVE-2026-13037

CVE-2026-13037 is a use-after-free vulnerability in WebView for Android within Google Chrome, before version 149.0.7827.197. The flaw allows a local attacker to run arbitrary code inside the sandbox via a crafted HTML page. Affected component: WebView in Chrome on Android; root cause: use-after-f...

CVE-2026-14405

CVE-2026-14405 describes an uninitialized use in the V8 engine of Google Chrome, prior to version 150.0.7871.46, which could allow a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page. The vulnerability affects the V8 component within Chrome and is associ...

CVE-2026-14414

CVE-2026-14414 — Insufficient validation of untrusted input in Skia within Google Chrome prior to 150.0.7871.46 allows a remote attacker who has already compromised the renderer process to exfiltrate potentially sensitive data from process memory via a crafted HTML page. The issue is tied to Skia...

CVE-2026-17952

CVE-2026-17952 affects Google Chrome’s V8 engine prior to 151.0.7922.72. The issue arises from an inappropriate implementation in V8 that allows an attacker, by convincing a user to install a crafted Chrome extension, to execute arbitrary code inside Chrome’s sandbox. Practical impact is arbitrar...

CVE-2008-5915

CVE-2008-5915 concerns Google Chrome’s JavaScript implementation where an unspecified function creates and exposes a 'temporary footprint' during an active login, enabling in-session phishing via spoofed pop-ups. The sources describe the issue but provide no actionable details (no disclosure of f...

CVE-2009-1514

CVE-2009-1514 affects Google Chrome 1.0.154.53 and is caused by a NULL pointer dereference in a throw statement with a long exception value, leading to a denial of service (application crash). The vulnerability is documented across multiple sources (NVD/NVD-linked entries and PRION/NVD mirrors). ...

CVE-2011-0779

CVE-2011-0779 affects Google Chrome/Chromium prior to 9.0.597.84: a missing key in an extension can be exploited remotely to cause a denial of service (application crash) via a crafted extension. Debian DSAs reference this CVE and fix it in chromium-browser; for squeeze, version 6.0.472.63~r59945...

CVE-2011-1186

CVE-2011-1186 affects Google Chrome on Linux prior to 10.0.648.127. The vulnerability stems from improper handling of parallel calls to the print method in JavaScript, which could allow an attacker to crash the browser via crafted script, resulting in a denial-of-service. Connected documents corr...

CVE-2011-3049

Chromium/Chrome CVE-2011-3049 is documented in openSUSE security advisory GLSA 201203-19 and related openSUSE updates. The concrete entry notes: CVE-2011-3049 — Extension web request API can interfere with system requests (low severity). The openSUSE patch set (openSUSE-SU-2012:0466-1) upgrades C...

CVE-2011-3054

The CVE-2011-3054 entry relates to Chromium/Chrome’s WebUI privilege isolation. OpenSUSE security update 0466-1 notes a Low impact fix: “Apply additional isolations to webui privileges,” indicating a refinement of WebUI isolation rather than a new exploit. The patch was part of an update path to ...

CVE-2011-3083

CVE-2011-3083 affects Google Chrome prior to 19.0.1084.46, with the vulnerability stemming from the handling of a malformed ftp URL in the SRC attribute of a VIDEO element in profile_impl_io_data.cc. This can trigger a NULL pointer dereference and cause the browser to crash via a crafted page, i....

CVE-2012-5128

CVE-2012-5128 affects Google V8 before 3.13.7.5 as used in Google Chrome before 23.0.1271.64. The flaw is improper write operations that can cause a denial of service or have other unspecified impact via unknown vectors. Affected product/component: V8 engine (and Chrome integration). Impact: part...

CVE-2012-5141

CVE-2012-5141 affects Google Chrome/Chromium. The root cause is an insufficient restriction on the instantiation of the Chromoting (Chrome remote desktop) client plug‑in. The provided sources do not detail the exact impact or exploit vectors beyond noting an issue with the plug‑in instantiation. ...

CVE-2013-2862

CVE-2013-2862: Skia in Chromium-based Chrome before 27.0.1453.110 mishandles GPU acceleration, enabling remote memory corruption DoS and potentially other impact via unknown vectors. Affected: Chromium/Chrome with Skia GPU code prior to 27.0.1453.110. Impact is memory corruption/DoS; no exploitab...

CVE-2013-6631

CVE-2013-6631 is a use-after-free in libjingle (WebRTC) within Channel::SendRTCPPacket, exploited via Google Chrome binaries prior to 31.0.1650.48 and affecting other Chromium-based products; leveraged vectors can cause heap memory corruption and potential denial of service. The OpenSUSE/Nessus n...

CVE-2013-6660

CVE-2013-6660 affects Google Chrome/OpenChromium drag-and-drop: an information-leak in WebDropData allows remote sites to leak full pathnames. Root cause: inadequate restriction in drag-and-drop data structures prior to Chrome 33.0.1750.117. Reported across multiple advisories; openSUSE notes a s...

CVE-2014-1722

CVE-2014-1722 is a use-after-free in Blink (RenderBlock::addChildIgnoringAnonymousColumnBlocks) affecting Google Chrome up to version 34.0.1847.116. The vulnerability allows remote attackers to cause a denial of service or potentially other unspecified impacts via vectors involving the addition o...

CVE-2014-1742

CVE-2014-1742 is a use-after-free in Blink’s FrameSelection::updateAppearance affecting Chromium/Chrome. Exploitation could cause a renderer crash or other impact. Public advisories (Ubuntu, openSUSE, Gentoo, Mageia) confirm Chrome/Chromium vulnerabilities and recommend updating to latest Chromiu...

CVE-2014-3200

CVE-2014-3200 affects Google Chrome/Chromium prior to 38.0.2125.101. The connected documents describe multiple Chromium/Chrome flaws that could cause denial of service or potentially other impact, with CVE-2014-3200 included among fixes. Affected component: Chromium/Chrome rendering/processing pa...

CVE-2014-7932

CVE-2014-7932 is a use-after-free in Blink’s DOM implementation (Element::detach in core/dom/Element.cpp) used by Google Chrome before 40.0.2214.91. The vulnerability allows a remote attacker to cause a denial of service or potentially other impact via vectors involving pending updates of detache...

CVE-2014-7939

CVE-2014-7939 affects Google Chrome before 40.0.2214.91, where the Harmony proxy in V8 can bypass the Same Origin Policy via crafted JavaScript using Proxy.create and console.log, related to HTTP responses missing X-Content-Type-Options: nosniff. Affected component is Chrome’s V8/Chromium stack; ...

CVE-2014-7947

CVE-2014-7947 affects OpenJPEG before r2944 as used in PDFium within Google Chrome up to version 40.0.2214.90/91. Root cause: an out-of-bounds read in the JPEG 2000 decoding path (files j2k.c, jp2.c, pi.c, t1.c, t2.c, tcd.c). Impact: remote attacker can trigger denial of service via a crafted PDF...

CVE-2015-1210

CVE-2015-1210 is a cross-origin bypass vulnerability in the Chrome/Blink V8 bindings. The issue arises in V8ThrowException::createDOMException within bindings/core/v8/V8ThrowException.cpp, which does not properly enforce frame access restrictions when throwing exceptions. A remote attacker could ...

CVE-2015-1217

CVE-2015-1217 affects Google Chrome (before 41.0.2272.76) and is tied to the V8 bindings in Blink. The vulnerability arises from the V8LazyEventListener::prepareListenerObject function in bindings/core/v8/V8LazyEventListener.cpp, where listeners are not properly compiled, enabling a remote attack...

CVE-2015-1219

CVE-2015-1219 concerns an integer overflow in Skia’s SkMallocPixelRef::NewAllocate (core/SkMallocPixelRef.cpp) used by Google Chrome before 41.0.2272.76. The vulnerability could allow a remote attacker to cause a denial of service or other unspecified impact by triggering allocation of a large am...

CVE-2015-1234

CVE-2015-1234 is a vulnerability in Google Chrome/Chromium prior to 41.0.2272.118. It concerns a race condition in gpu/command_buffer/service/gles2_cmd_decoder.cc that could allow a remote attacker to cause a denial of service (buffer overflow) or other impact by manipulating OpenGL ES commands. ...

CVE-2016-1636

CVE-2016-1636 affects Google Chrome/Chromium prior to 49.0.2623.75, where PendingScript::notifyFinished incorrectly uses memory-cache data about integrity-check occurrences rather than actual integrity-check successes. This enables bypassing Subresource Integrity (SRI) by triggering two loads of ...

CVE-2016-1656

CVE-2016-1656 relates to Google Chrome for Android prior to 50.0.2661.75, where the download implementation allowed a remote attacker to bypass intended Android file-path restrictions. The issue arises from the download path handling in Chrome’s Android component, enabling bypass of pathname rest...

CVE-2016-5167

CVE-2016-5167 applies to Google Chrome/Chromium on Windows, macOS, and Linux. The initial entry notes multiple vulnerabilities with possible denial of service and other impact via unknown vectors. Connected documents clarify it affected Chromium/Chrome and were addressed by Chrome/Chromium update...

CVE-2017-15430

CVE-2017-15430 affects the Chromecast plugin in Google Chrome prior to 63.0.3239.84. Root cause: insufficient data validation in the Chromecast plugin. Impact: remote attacker could inject arbitrary scripts/HTML (UXSS) via a crafted HTML page. Public references note the vulnerability in Chrome’s ...

CVE-2017-5032

CVE-2017-5032: In Chromium/Chrome, PDFium contains an out-of-bounds write vulnerability affecting the PDF rendering path. A crafted PDF file could trigger heap corruption and potentially remote code execution on affected systems. Affected: Chromium/Chrome prior to version 57.0.2987.98 (Windows no...

CVE-2024-13178

CVE-2024-13178 concerns Google Chrome’s fullscreen implementation. The vulnerability arises from an inappropriate fullscreen handling in Chrome/Chromium prior to version 128.0.6613.84, enabling a remote attacker to trigger UI spoofing via a crafted HTML page. Practical impact is UI spoofing with ...

CVE-2025-13042

CVE-2025-13042 affects Google Chrome (V8/Chromium) with an incomplete V8 implementation that allows a remote attacker to exploit heap corruption via a crafted HTML page. The issue is categorized as High severity; impact includes potential arbitrary code execution, denial of service, or informatio...

CVE-2026-10014

CVE-2026-10014 describes a use-after-free in WebMIDI within the Chromium-based Google Chrome browser on Android, prior to version 148.0.7778.216. The issue arises when a renderer process is compromised, potentially enabling a sandbox escape via a crafted HTML page. Affected component: WebMIDI (Ch...

CVE-2026-10016

CVE-2026-10016 is a use-after-free in the DOM of Google Chrome, fixed by the 148.0.7778.216 update. The vulnerability allows a remote attacker to execute arbitrary code inside Chrome’s sandbox via a crafted HTML page. Severity: High (CVSS v3.1 base score 8.8; Network attack vector, no privileges ...

CVE-2026-10931

Summary: CVE-2026-10931 is a use-after-free in Chrome’s FileSystem that could allow a remote sandbox escape via a crafted HTML page. Affected product/area: Google Chrome (Chromium-based) prior to version 149.0.7827.53. Impact: high severity with potential sandbox escape; attacker could trigger ne...

CVE-2026-11061

CVE-2026-11061 involves a Type Confusion in ANGLE used by Google Chrome/Chromium before version 149.0.7827.53, which could enable a remote attacker to perform a sandbox escape via a crafted HTML page. Affected software is Google Chrome/Chromium with ANGLE integration; the underlying issue is type...

CVE-2026-11272

CVE-2026-11272 affects Google Chrome on iOS, specifically the Reading List feature. The root cause is insufficient validation of untrusted input, enabling a remote attacker to escalate privileges via a crafted HTML page when a user is guided to perform certain UI gestures. Impact is described as ...