CVE-2024-10826

Concretely affected: Chromium-based Chrome/Chromium on Android and various Linux distributions (Chromium) with version strings up to 130.0.6723.116. The root cause is a use-after-free in the Family Experiences component that can lead to heap corruption via a crafted HTML page. Impact is high (C/H...

CVE-2024-5836

CVE-2024-5836 affects Google Chrome DevTools by Inappropriate Implementation in DevTools, allowing code execution when a user is convinced to install a crafted Chrome Extension. Impact is High with attacker-controlled arbitrary code execution possible via a malicious extension, prior to Chrome 12...

CVE-2024-8639

CVE-2024-8639 corresponds to a use-after-free in Autofill in Google Chrome/Chromium. The issue arises when processing Autofill data in Chromium-based browsers, potentially allowing a remote attacker to cause heap corruption via a crafted HTML page. Affected software is Chrome/Chromium prior to ve...

CVE-2019-5796

CVE-2019-5796 affects Chromium-based browsers (Chrome/Chromium) via the Extensions component. A race condition in Extensions before 73.0.3683.75 could be triggered remotely, with official advisories stating the vulnerability exists in Chromium’s Extensions and that upgrading to 73.0.3683.75 or ne...

CVE-2016-5131

CVE-2016-5131 is a use-after-free in libxml2 up to version 2.9.4 (as used in Chrome before 52.0.2743.82) triggered by XPointer range-to, leading to possible denial of service and potentially other impact. Connected advisories reaffirms libxml2 as the vulnerable component and references several ve...

CVE-2023-4072

Summary: CVE-2023-4072 is a WebGL-related out-of-bounds read/write vulnerability in Google Chrome/Chromium. The issue can enable a remote attacker to cause heap corruption via a crafted HTML page, with high impact as indicated by the CVSS vector (base score 8.8, Confidentiality/Integrity/Availabi...

CVE-2024-5832

CVE-2024-5832 is a Use after free in Dawn in Google Chrome prior to 126.0.6478.54 that could allow remote attackers to trigger heap corruption via a crafted HTML page. The issue is listed among Chrome security fixes for the 126 release line, with 126.0.6478.54 (and subsequent patch versions) addr...

CVE-2024-8194

CVE-2024-8194 is a Type Confusion in V8 affecting Google Chrome (Chromium) prior to 128.0.6613.113. The vulnerability could allow a remote attacker to trigger heap corruption via a crafted HTML page. Affected component: Chrome/Chromium’s V8 engine; impact described as high. Public documentation i...

CVE-2025-6558

CVE-2025-6558 involves insufficient validation of untrusted input in ANGLE and GPU within Google Chrome, enabling a remote attacker to potentially escape the sandbox via a crafted HTML page. Connected sources specify Chrome components ANGLE and GPU as affected, with the patch previously shipped i...

CVE-2019-5791

CVE-2019-5791 is a type confusion in the V8 engine of Chromium/Chrome prior to version 73.0.3683.75. The issue potentially allows remote code execution via crafted HTML pages. Debian/Arch notes indicate fixes in 73.0.3683.75 (Debian: 73.0.3683.75-1; Arch: “before 73.0.3683.75” fixed). Affected pr...

CVE-2024-11110

Affected product: Google Chrome/Chromium. Vulnerability: Inappropriate implementation in Extensions allowed a remote attacker to bypass site isolation via a crafted Chrome Extension (CVE-2024-11110). Root cause: extension handling issue enabling isolation bypass. Impact: potential high-risk bypas...

CVE-2024-7256

CVE-2024-7256 concerns Google Chrome/Chromium—Dawn component on Android pre-127.6533.88. The root cause is insufficient data validation in Dawn , enabling a remote attacker to execute arbitrary code via a crafted HTML page. Public references confirm the vulnerability exists in Chrome/Chromium wit...

CVE-2024-8906

CVE-2024-8906 : Affected software: Google Chrome/Chromium (Chrome prior to 129.0.6668.58). Description: Incorrect security UI in Downloads allowed a remote attacker to spoof UI by convincing a user to perform specific UI gestures on a crafted HTML page. Root cause (as stated): flawed security UI ...

CVE-2019-5810

CVE-2019-5810 is a Chromium/Google Chrome information disclosure vulnerability in the Autofill component, reported as information leakage from process memory via a crafted HTML page in Chromium before version 74.0.3729.108. Public records in Debian security advisories and Arch Linux ASA-201904-12...

CVE-2020-6443

Chromium/Google Chrome before 81.0.4044.92 is affected by CVE-2020-6443 due to an insufficient data validation flaw in the DevTools component, enabling a remote attacker to execute arbitrary code via a crafted HTML page after convincing a user to use DevTools. Affected product: Chromium/Chrome; r...

CVE-2020-6455

CVE-2020-6455 is an out-of-bounds read in Chromium/Google Chrome’s WebSQL implementation. The issue could allow a remote attacker to potentially cause heap corruption via a crafted page. Affected software is Chrome/Chromium before version 81.0.4044.92. The Debian Arch Linux security advisory and ...

CVE-2024-12382

CVE-2024-12382 concerns Google Chrome/Chromium Translate use-after-free leading to potential heap corruption. Affected versions are Chrome/Chromium prior to 131.0.6778.139, with exploitation possible via a crafted HTML page over the network; user interaction is required (per CVSS: Network, Low at...

CVE-2017-5130

CVE-2017-5130 describes an integer overflow in libxml2’s xmlmemory.c that could enable a remote attacker to cause heap corruption via a crafted XML file. The vulnerability affects libxml2 up to version before 2.9.5 and has been observed in products such as Google Chrome (prior to 62.0.3202.62) an...

CVE-2020-6423

CVE-2020-6423 affects Chromium/Google Chrome’s audio component. The Arch Linux ASA-202004-9 describes a use-after-free in the audio implementation prior to 81.0.4044.92, enabling a remote attacker to potentially execute arbitrary code. The issue is addressed upstream with version 81.0.4044.92 (Ch...

CVE-2024-11115

CVE-2024-11115 targets Google Chrome on iOS with insufficient policy enforcement in Navigation, enabling privilege escalation via a sequence of UI gestures. Affected: Chrome/iOS versions prior to 131.0.6778.69. Connected documents corroborate wider Chromium updates and security fixes across distr...

CVE-2024-5842

CVE-2024-5842 is a memory‑safety bug in Google Chrome’s Browser UI (use-after-free) that, prior to Chrome 126.0.6478.54, could allow a remote attacker to cause an out-of-bounds read via a crafted HTML page after convincing a user to perform specific UI gestures. The issue affects the Browser UI c...

CVE-2024-7532

CVE-2024-7532 describes an out-of-bounds memory access in ANGLE within Google Chrome/Chromium, enabling potential heap corruption via a crafted HTML page. Affected software/versions: Chrome/Chromium prior to 127.0.6533.99. Impact per sources: critical severity with network attack vector and user ...

CVE-2024-8638

CVE-2024-8638 is a Chrome/Chromium vulnerability affecting Google Chrome/Chromium before 128.0.6613.137, caused by a type confusion in V8 that could allow an attacker to trigger object corruption via a crafted HTML page. The issue has a high impact across confidentiality, integrity, and availabil...

CVE-2024-8909

CVE-2024-8909 affects Google Chrome on iOS (Chromium-based) prior to 129.0.6668.58. Root cause: Inappropriate UI implementation, enabling a remote attacker to spoof the UI via a crafted HTML page. Impact is UI spoofing; no other impacts are stated in the documents. The vulnerability is addressed ...

CVE-2011-3026

CVE-2011-3026 describes a heap-based overflow in libpng caused by an integer overflow in png_decompress_chunk(), leading to potential remote code execution or crashes when handling crafted PNGs. Affected: libpng as used by Chrome (and various products); vulnerable versions precede fixed releases....

CVE-2019-5808

CVE-2019-5808 affects Chromium/Google Chrome Blink: a use-after-free in Blink/WebKit prior to 74.0.3729.108 could allow a crafted HTML page to trigger heap corruption. Affected products include Chromium/Chrome; remediation is to upgrade to 74.0.3729.108 or newer (as noted by Arch Debian advisorie...

CVE-2019-5846

CVE-2019-5846 : Out-of-bounds access in SwiftShader used by Google Chrome prior to 73.0.3683.75 could allow a remote attacker to trigger heap corruption via a crafted HTML page. This vulnerability affects Chrome’s rendering/graphics stack (SwiftShader) and is described as a potential remote explo...

CVE-2025-6557

The CVE-2025-6557 entry concerns Google Chrome on Windows with an insufficient DevTools data validation flaw that could allow arbitrary code execution via a crafted HTML page after user interaction with specific UI gestures. Affected component: DevTools in Chrome; root cause: inadequate input val...

CVE-2026-15771

CVE-2026-15771 affects Google Chrome on Windows prior to 150.0.7871.125. The vulnerability arises from insufficient validation of untrusted input in the Media component, allowing a remote attacker who has compromised the renderer process to potentially read sensitive information from process memo...

CVE-2019-5790

CVE-2019-5790 is a heap-based buffer overflow in the V8 JavaScript engine of Chromium/Google Chrome prior to 73.0.3683.75. This vulnerability could allow a remote attacker to execute arbitrary code inside the browser’s sandbox via a crafted HTML page. The Chrome security fix was delivered in the ...

CVE-2019-5793

CVE-2019-5793 affects Chromium/Google Chrome extensions prior to 73.0.3683.75. The vulnerability is described as an excessive permissions issue in the Extensions component, enabling a crafted HTML page to trigger the extension installation UI, effectively bypassing policy controls and potentially...

CVE-2019-5821

CVE-2019-5821 is a concrete issue in PDFium used by Google Chrome/Chromium, caused by an integer overflow in PDFium before 74.0.3729.108, enabling a remote attacker to potentially trigger heap corruption with a crafted PDF. Evidence across multiple advisories confirms the affected component (PDFi...

CVE-2020-6524

CVE-2020-6524 : Heap buffer overflow in WebAudio affecting Google Chrome before 84.0.4147.89. A remote attacker could potentially exploit heap corruption via a crafted HTML page, leading to arbitrary code execution or crashes as described in multiple advisories. The issue is tied to Chrome’s WebA...

CVE-2024-7977

CVE-2024-7977 affects Google Chrome on Windows (Installer component) and stems from insufficient data validation, enabling privilege escalation via a malicious file. The vulnerability is tied to Chrome/Chromium family behavior prior to version 128.0.6613.84. Mitigation is to upgrade to the patche...

CVE-2024-7550

This CVE-2024-7550 concerns a Type Confusion in V8 used by Google Chrome/Chromium, leading to potential heap corruption via a crafted HTML page. Affected software is Chrome/Chromium with version guidance shown as pre-127.6533.99 builds. The vulnerability’s root cause is a V8 type confusion that c...

CVE-2024-7981

CVE-2024-7981 : In Google Chrome/Chromium, an inappropriate implementation in the Views layer allowed a remote attacker to perform UI spoofing via a crafted HTML page in Chrome prior to version 128.0.6613.84. Public references across Debian, FreeBSD, Gentoo, and other advisories confirm Chromium/...

CVE-2005-4900

The CVE-2005-4900 entry notes that SHA-1 is not collision resistant, enabling context-dependent spoofing attacks, with examples related to TLS 1.2. The provided materials do not specify affected products, versions, root causes within a specific product, or remediations. The entry serves as a gene...

CVE-2019-5822

CVE-2019-5822 affects Google Chrome/Chromium Blink component; describes bypass of Cross‑Origin Resource Sharing (CORS) via a crafted HTML page, effectively bypassing same-origin policy. Affected scope includes Blink/CORS handling in Chrome prior to 74.0.3729.108. Public advisories (Debian DSA-450...

CVE-2019-5830

CVE-2019-5830 concerns Google Chrome/Chromium: insufficient CORS policy enforcement allowed a remote attacker to leak cross-origin data via a crafted HTML page. The issue is tracked across multiple advisories and was addressed by updating Chromium/Chrome to a patched release. Affected components:...

CVE-2020-16027

CVE-2020-16027 affects Chromium/Google Chrome before 87.0.4280.66, specifically the developer tools component where insufficient policy enforcement allowed an attacker to cause information disclosure via a crafted extension. Affected product: Chromium/Chrome; root cause: access restriction bypass...

CVE-2020-6434

CVE-2020-6434 is a use-after-free vulnerability in the Chrome/Chromium DevTools component, reported to affect Chromium before version 81.0.4044.92. The connected advisories attribute an arbitrary code execution impact to this issue, with upstream fixes released in the 81.0.4044.92 timeframe. Reme...

CVE-2022-1232

CVE-2022-1232 concerns a type confusion in Chrome/Chromium’s V8 engine prior to 100.0.4896.75, enabling a remote attacker to potentially trigger heap corruption via a crafted HTML page. Multiple sources (Chromium/Chrome advisories, Debian security tracker, Gentoo GLSA) confirm the issue and that ...

CVE-2023-5996

CVE-2023-5996 affects Chromium/Google Chrome WebAudio, with a use-after-free in WebAudio prior to version 119.0.6045.123. An attacker could craft an HTML page to trigger heap corruption, potentially enabling remote code execution. The vulnerability is rated High severity (CVSS v3.1: 8.8, NETWORK/...

CVE-2024-11113

CVE-2024-11113 affects Google Chrome (Accessibility component). A use-after-free in the Accessibility path prior to Chrome 131.0.6778.69 allowed a remote attacker who had compromised the renderer process to potentially cause heap corruption via a crafted HTML page. The Chrome release notes confir...

CVE-2019-5811

CVE-2019-5811 : In Chromium-based browsers, a Cross‑Origin Resource Sharing (CORS) bypass was discovered in Blink, allowing a crafted HTML page to bypass the same-origin policy via Service Worker semantics. The issue is associated with Chrome/Chromium builds prior to 74.0.3729.108. Impact is tied...

CVE-2019-5828

CVE-2019-5828 is a use-after-free vulnerability in the ServiceWorker component of the Chromium/Google Chrome stack, reported to be exploitable remotely via a crafted HTML page. The issue affects Chromium/Chrome versions prior to 75.0.3770.80, with multiple sources listing an upgrade to 75.0.3770....

CVE-2020-6425

The CVE-2020-6425 entry concerns Chromium/Google Chrome. The vulnerability is a policy enforcement error in extensions that could allow a user-assisted attacker to bypass site isolation via a crafted Chrome extension. Affected product family: Chromium/Chrome browser engines as distributed in Debi...

CVE-2020-6444

CVE-2020-6444 affects Google Chrome/Chromium WebRTC: uninitialized variable in WebRTC implementation could enable heap corruption via a crafted HTML page. Connected advisories confirm the issue in Chrome prior to 81.0.4044.92 and list it alongside related CVEs in Chromium (CVE-2020-6423, CVE-2020...

CVE-2023-5479

CVE-2023-5479 corresponds to an insufficiently secure Extensions API in Google Chrome/Chromium before 118.0.5993.70, enabling a user-assisted bypass of enterprise policy via a crafted HTML page if a malicious extension is installed. Public details across connected documents confirm the affected c...

CVE-2024-5843

CVE-2024-5843 affects Google Chrome/Chromium: an Inappropriate implementation in Downloads allowed a remote attacker to obfuscate the security UI via a malicious file. The Chrome release notes for 126.x document this as one of 21 fixes, with CVE-2024-5843 listed among Medium/High-severity issues ...