CVE-2026-11670

CVE-2026-11670: Use-after-free in PDF handling in Google Chrome prior to 149.0.7827.103 enables remote code execution in the sandbox when parsing a crafted PDF. Affected component is Chrome's PDF rendering; impact is high. Remediation per the connected documents is to update to Chrome 149.0.7827....

CVE-2026-14054

The CVE-2026-14054 entry concerns Google Chrome (Chromium base) with an issue in policy enforcement that allowed navigation restriction bypass via a crafted HTML page, affecting versions prior to 150.0.7871.47. The vulnerability is described as low severity (CVSS 4.3, MEDIUM by some scales) with ...

CVE-2026-14432

The CVE-2026-14432 entry documents a use-after-free in V8 affecting Google Chrome’s JavaScript engine prior to version 150.0.7871.46 . This vulnerability could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page, as described in multiple sources. Affected co...

CVE-2026-17725

CVE-2026-17725 is a Type Confusion in V8 affecting Google Chrome prior to 151.0.7922.72. The flaw allows a remote attacker to execute arbitrary code inside the Chrome sandbox via a crafted HTML page. Affected software is Chrome/Chromium with V8 as the JavaScript engine; the NVD and Debian OSV ent...

CVE-2026-17742

CVE-2026-17742 affects Google Chrome’s Payments feature. The vulnerability arises from insufficient policy enforcement in Payments, allowing a remote attacker to leak cross-origin data via a crafted HTML page. Root cause: inadequate enforcement within the Chrome Payments code path. Impact: potent...

CVE-2026-18018

CVE-2026-18018 affects Google Chrome on Windows, where the Updater’s implementation allowed a local attacker to spoof UI via a malicious file. The issue is described as an inappropriate implementation in the Updater prior to Chrome version 151.0.7922.72, with a Low severity (CVSS: Local, Low impa...

CVE-2026-3923

CVE-2026-3923 describes a use-after-free in WebMIDI within Google Chrome/Chromium before 146.0.7680.71, potentially enabling heap corruption via a crafted HTML page. Affected: Chrome/Chromium WebMIDI. Impact: high (remote, heap corruption). Remediation: upgrade to Chrome/Chromium 146.0.7680.71 or...

CVE-2026-4445

CVE-2026-4445 is a use-after-free in WebRTC in Google Chrome prior to 146.0.7680.153, allowing a remote attacker to potentially cause heap corruption via a crafted HTML page. The issue is tied to Chromium/WebRTC components and is categorized as High severity. Google Chrome released a security upd...

CVE-2026-6314

CVE-2026-6314 affects Google Chrome’s GPU process. An out-of-bounds write in the GPU code prior to version 147.0.7727.101 could allow a remote attacker with GPU process access to potentially escape the sandbox via a crafted HTML page. Impact is a sandbox escape risk as described in the entry. Aff...

CVE-2026-78948

A buffer overflow in the WebGL component of Google Chrome (affecting versions prior to 152.0.7977.65 ) allows a remote attacker to execute arbitrary code outside the sandbox by enticing a user to visit a crafted HTML page. The Chromium security severity is High, with a CVSS 3.1 score of 9.6 (CRIT...

CVE-2026-79006

CVE-2026-79006 is a protection mechanism failure in the HttpsUpgrades component of Google Chrome prior to version 152.0.7977.65 . The flaw allows a remote attacker to bypass the web origin policy via crafted network traffic. The CVSS 3.1 score is 4.3 (Medium) with the vector AV:N/AC:L/PR:N/UI:R/S...

CVE-2026-79009

CVE-2026-79009 is a UI misrepresentation vulnerability in Google Chrome prior to 152.0.7977.65 , where a remote attacker leveraging social engineering can spoof UI elements via a crafted HTML page. The Chromium project rates it Low severity, with a CVSS v3.1 score of 4.3 (Medium) . The CISA SSVC ...

CVE-2009-0276

CVE-2009-0276 affects Google Chrome (V8 JavaScript engine) prior to 1.0.154.46. A cross-domain vulnerability lets a crafted script bypass the Same Origin Policy, enabling reading the full URL of another frame and potentially other sensitive data, or modifying the URL of the target frame. The vuln...

CVE-2009-2935

Google Chrome

CVE-2010-0656

WebKit before r51295 (as used in Google Chrome before 4.0.249.78) may respond to a local file:// XMLHttpRequest targeting a directory with a directory listing, potentially exposing sensitive information or causing other impact via a crafted local HTML document. The mitigation is to update to the ...

CVE-2011-0472

CVE-2011-0472 affects Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344. The issue is improper handling of printing PDF documents, allowing user‑assisted remote attackers to cause a denial of service (application crash) via a multi‑page document. The connected documents do not pro...

CVE-2011-1113

CVE-2011-1113 affects Google Chrome before 9.0.597.107 on 64-bit Linux. The vulnerability arises from improper pickle deserialization in the browser, enabling remote attackers to trigger a denial of service via an out-of-bounds read. The available connected documents confirm the affected platform...

CVE-2011-1115

Technical details about CVE-2011-1115 are not publicly provided in the connected documents. Please monitor for updates from vendor advisories and vulnerability databases.

CVE-2011-1438

CVE-2011-1438 affects Google Chrome prior to 11.0.696.57. The vulnerability allows remote attackers to bypass the Same Origin Policy via vectors involving blobs, enabling cross-origin access or leakage. The issue is tied to the browser’s handling of blob-related operations and was addressed in th...

CVE-2011-2346

CVE-2011-2346 is a use-after-free in Google Chrome’s SVG fonts handling present in Chrome prior to 12.0.742.112. The underlying issue is a memory management error in the SVG font processing path, which could allow a remote attacker to trigger a denial of service or potentially cause other unspeci...

CVE-2011-2351

Technical details for CVE-2011-2351 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2011-3038

CVE-2011-3038 is a use-after-free in multi-column handling affecting Chromium/Chrome as documented in connected advisories. OpenSUSE notes a patch in openSUSE-SU-2012:0374-1 for Chromium v8, addressing High CVE-2011-3038 among others, and lists updates to Chromium 19.0.1060–19.0.1066 with related...

CVE-2011-3042

CVE-2011-3042 is aUse-after-free in table section handling in Chrome/Chromium prior to 17.0.963.65. Connected updates (openSUSE-SU-2012:0374-1) patch Chromium, upgrading to around 19.x and addressing multiple CVEs including 2011-3042. Remediation: apply the openSUSE security update to obtain the ...

CVE-2011-3047

CVE-2011-3047 affects Google Chrome/Chromium’s GPU process via an errant plug-in load, causing memory corruption. This could enable remote code execution or a denial of service. Public advisories consistently associate the issue with the GPU process and provide vendor patches; for example, Gentoo...

CVE-2011-3053

CVE-2011-3053 is a use-after-free in block splitting affecting Google Chrome up to 17.0.963.83 and related Chromium/WebKit components. Connected advisories document a fix path via security updates: openSUSE’s openSUSE-SU-2012:0466-1 for Chromium (addressing CVE-2011-3053 among others) and Ubuntu ...

CVE-2011-3075

CVE-2011-3075 describes a use-after-free in Google Chrome prior to 18.0.1025.151, exploitable remotely via style-application commands to cause a denial of service or possibly other impact. The vulnerability affects the Chrome rendering/style handling and is mitigated by upgrading to version 18.0....

CVE-2012-0725

CVE-2012-0725 affects Adobe Flash Player prior to 11.2.202.229 in Google Chrome up to 18.0.1025.151. The description notes memory corruption that could lead to a denial of service or possibly other impact via unknown vectors; no concrete exploit details or remediation are provided in the document...

CVE-2012-2825

CVE-2012-2825 is tied to the libxslt XSLT library, where the transformation of certain XSL templates via namespaces could trigger a denial of service (and, in related advisories, crashes) due to faulty handling when processing embedded DTDs or specific XSLT structures. Public notices from 2012–20...

CVE-2012-2893

CVE-2012-2893 is a Double free vulnerability in libxslt, impacting Google Chrome (before 22.0.1229.79) via XSLT transforms. Exploitation could cause a denial of service and potentially other impacts; CVSS v2 base score 6.8 (Medium) from NVD. Related Nessus/Gentoo/Debian advisories enumerate libxs...

CVE-2012-5149

CVE-2012-5149 affects Google Chrome before 24.0.1312.52, where an integer overflow in the audio IPC layer can be exploited remotely to cause a denial of service or other unspecified impact. The vulnerable component is Chrome’s audio IPC handling; the root cause is an integer overflow. Impact is a...

CVE-2013-2845

CVE-2013-2845 affects Chromium/Google Chrome prior to 27.0.1453.93, where the Web Audio implementation could be exploited to cause memory corruption and a denial of service (or other unspecified impact) via unknown vectors. Mitigation documented across Debian and vendor advisories directs upgradi...

CVE-2013-2863

CVE-2013-2863 affects Chromium/Google Chrome up to version 27.0.1453.110, where SSL socket handling is faulty, enabling remote attackers to execute arbitrary code or cause a memory corruption DoS via unspecified vectors. The issue is documented across multiple sources (NVD entry for CVE-2013-2863...

CVE-2013-2866

CVE-2013-2866 affects Google Chrome and Chrome OS where the Flash plugin's handling of an embedded Flash element’s opacity allowed a clickjacking technique to trick users into granting camera or microphone access. Root cause: improper determination of user consent for Flash-permission requests, e...

CVE-2013-2867

This CVE (CVE-2013-2867) affects Google Chrome/Chromium prior to version 28.0.1500.71, where pop-under windows were not properly prevented, enabling a remote attacker to trigger an unspecified impact via a crafted web page. Publicly available connected sources (e.g., Debian DSA-2724-1, Gentoo GLS...

CVE-2013-2921

CVE-2013-2921 is a use-after-free in Blink’s resource loader (ResourceFetcher::didLoadResource), affecting Chromium/Blink prior to 30.0.1599.66. The flaw can allow remote denial of service or other unspecified impacts via resource callback handling. Public records in connected docs confirm this C...

CVE-2013-6658

CVE-2013-6658 affects Google Chrome Blink: layout implementation vulnerabilities (use-after-free) in updateWidgetPositions. The issues permit remote denial of service and possibly other impact via vectors in updateWidgetPositions, specifically when executing JavaScript during the function or when...

CVE-2014-1701

The CVE-2014-1701 issue affects Blink in Google Chrome prior to 33.0.1750.149. The root cause is a missing cross-origin restriction in GenerateFunction (bindings/scripts/code_generator_v8.pm) for EventTarget::dispatchEvent, enabling Universal XSS via events. Public references in Debian/openSUSE a...

CVE-2014-1724

Summary: CVE-2014-1724 is a use-after-free in Free(b)soft Speech Dispatcher 0.7.1 used by Google Chrome

CVE-2014-1732

CVE-2014-1732 describes a use-after-free in the Speech Recognition UI (speech_recognition_bubble_views.cc) of Google Chrome/Chromium. The vulnerability affects Chrome/Chromium built before 34.0.1847.132 on Windows/OS X and Linux, potentially enabling a denial of service or other impact via an INP...

CVE-2014-7903

CVE-2014-7903 involves a buffer overflow in OpenJPEG prior to r2911 within PDFium, used by Google Chrome up to version 39.0.2171.65. An attacker can cause a denial of service or potentially other impact via a crafted JPEG image. The issue is tied to PDFium/OpenJPEG handling in Chrome before the s...

CVE-2015-1286

CVE-2015-1286 is a cross-site scripting vulnerability in Google Chrome prior to 44.0.2403.89. It affects the V8ContextNativeHandler::GetModuleSystem function in extensions/renderer/v8_context_native_handler.cc, allowing remote attackers to inject arbitrary web script or HTML due to insufficient V...

CVE-2015-7834

CVE-2015-7834 affects Google V8 before 4.6.85.23 as used in Chrome before 46.0.2490.71. The vulnerability could lead to a denial of service and possibly other impact via unknown vectors. Connected advisories indicate fixes in the 46.0.2490.71 range (Chrome/Chromium updates and OS advisories such ...

CVE-2016-2051

CVE-2016-2051 concerns multiple unspecified vulnerabilities in Google V8 (before 4.8.271.17) as used by Google Chrome before 48.0.2564.82, enabling denial of service and possibly other impact via unknown vectors. Connected documents corroborate affected components (V8/Chromium) and describe updat...

CVE-2016-5146

CVE-2016-5146 refers to multiple unspecified vulnerabilities in Google Chrome before 52.0.2743.116. The connected documents confirm this CVE as part of a set of Chrome fixes and indicate the issue involved various fixes from internal auditing, with the notable impact described as denial of servic...

CVE-2020-36765

CVE-2020-36765 affects Google Chrome (

CVE-2024-11919

CVE-2024-11919 concerns Google Chrome for Android, where an inappropriate implementation in Intents could let a remote attacker perform UI spoofing via a crafted HTML page. The issue affects Chrome on Android prior to version 129.0.6668.58 . The connected Red Hat/Ubuntu/Debian and other CVE feeds...

CVE-2025-12726

CVE-2025-12726 affects Google Chrome/Chromium on Windows with an incorrect Views implementation that allows privilege escalation via a crafted HTML page when the renderer is compromised. Affected versions are Chrome on Windows prior to 142.0.7444.137 (Chromium base). Remediation is to update to C...

CVE-2026-10984

Summary: CVE-2026-10984 affects Google Chrome on Android due to an inappropriate Accessibility implementation, enabling UI spoofing via a crafted HTML page. The issue lies in older Android builds before 149.0.7827.53; upgrading to 149.0.7827.53 or later mitigates the vulnerability. The vulnerabil...

CVE-2026-11002

CVE-2026-11002 : Use-after-free in Chrome Autofill (Chromium) prior to 149.0.7827.53 when a renderer process is compromised, potentially enabling a sandbox escape via a crafted HTML page. Affected: Chromium-based Chrome. Impact: remote code execution with sandbox break. Remediation: upgrade to Ch...

CVE-2026-11697

CVE-2026-11697 affects Google Chrome’s UI layer built on Chromium, where insufficient validation of untrusted input could enable a remote attacker to escape the sandbox via a crafted HTML page. The issue is described as a High-severity vulnerability, with exploitation linked to messages that prev...