CVE-2011-3895

CVE-2011-3895 is a heap-based buffer overflow in FFmpeg’s Vorbis decoder (libavcodec) that can be triggered by a crafted input stream, potentially causing a denial of service or other unspecified impact. The connected documents indicate FFmpeg vulnerabilities across multiple CVEs, including this ...

CVE-2011-3900

CVE-2011-3900 affects Google Chrome prior to 15.0.874.121, specifically a vulnerability in the V8 engine where an out-of-bounds write could lead to denial of service or potentially other impact. Public references in the connected documents confirm the Chrome/Chromium V8 context and the remediatio...

CVE-2011-3903

CVE-2011-3903 affects Chromium and V8 per Gentoo GLSA 201201-03 and related advisories. The issue is described as multiple vulnerabilities tied to regex handling in Chromium that could allow a context-dependent attacker to cause arbitrary code execution or a Denial of Service, with possible URL b...

CVE-2011-3928

Technical details about CVE-2011-3928 are not publicly available in the provided documents. Monitor for updates from vendors and security advisories.

CVE-2012-2824

Connected documents confirm CVE-2012-2824 affects Mac OS X Safari

CVE-2012-4906

Google Chrome for Android prior to version 18.0.1025308 is affected by CVE-2012-4906, where improper restriction of file: URLs allows remote attackers to obtain sensitive information via unspecified vectors (demonstrated by credential data access). The issue is distinct from CVE-2012-4903 and was...

CVE-2012-5109

CVE-2012-5109 affects Google Chrome’s ICU functionality. The available documents specify that ICU in Chrome before 22.0.1229.92 is vulnerable to a denial-of-service caused by an out-of-bounds read via regex-related vectors. The OpenVAS/Nessus entries in connected documents reference the same CVE ...

CVE-2012-5136

CVE-2012-5136 affects Chromium; the flaw is a bad cast in input element handling, enabling a remote attacker to cause a denial of service (or possibly other impact) via a crafted HTML document. Connected openSUSE/OpenVAS entries confirm Chromium updates to 25.0.1343 as the fix (openSUSE-SU-2012:1...

CVE-2013-2846

CVE-2013-2846 is a use-after-free vulnerability in the media loader of Chromium/Google Chrome prior to version 27.0.1453.93 that can lead to denial of service or possibly other impact via unknown vectors. The issue is listed among multiple security issues affecting Chromium/Chrome (alongside CVEs...

CVE-2013-2903

CVE-2013-2903 is a use-after-free in Blink’s HTMLMediaElement::didMoveToNewDocument. Affected software: Google Chrome (Blink) prior to 29.0.1547.57. Impact stated: remote attackers could cause a denial of service or other unspecified effects by moving audio/video elements between documents. Publi...

CVE-2013-2910

CVE-2013-2910 is a use-after-free in Web Audio (AudioScheduledSourceNode.cpp) within Blink’s Web Audio implementation used by Chrome pre-30.0.1599.66. The vulnerability could allow a remote attacker to cause a denial of service or other unspecified impact via unknown vectors. Public documents in ...

CVE-2013-6638

CVE-2013-6638 is a vulnerability in Google V8 up to 3.22.24.7 (used by Google Chrome up to 31.0.1650.63). It describes multiple buffer overflows in v8/runtime.cc, specifically in Runtime_TypedArrayInitialize and Runtime_TypedArrayInitializeFromArrayLike, that could lead to denial of service or ot...

CVE-2014-3162

Affected software: Chromium/Google Chrome (Chromium browser) as packaged in Debian open repositories and openSUSE updates, specifically around version 36.0.1985.125. Root cause / issue: Multiple vulnerabilities in Chromium with CVE-2014-3162 cited as part of security fixes; Debian notes “the Goog...

CVE-2014-3171

CVE-2014-3171 is a use-after-free in Chrome’s Blink V8 bindings (HashMap add vs set) that affects the rendering engine’s V8 integration. The issue resides in bindings/core/v8/DOMWrapperMap.h and bindings/core/v8/SerializedScriptValue.cpp and, if exploited, can lead to a denial of service; remedia...

CVE-2014-3172

The CVE-2014-3172 issue affects Google Chrome prior to 37.0.2062.94, where the Debugger extension API (Debugger API in chrome browser extensions) does not validate a tab URL before an attach operation, potentially allowing an extension using a restricted URL (e.g., chrome:// URL) to bypass access...

CVE-2014-3197

CVE-2014-3197 affects Google Chrome (Blink engine) prior to 38.0.2125.101. The issue is in NavigationScheduler::schedulePageBlock within core/loader/NavigationScheduler.cpp, where substitute data for pages blocked by the XSS auditor is not provided correctly. This can allow a remote attacker to o...

CVE-2014-7931

CVE-2014-7931 affects Google Chrome (V8) where factory.cc memory-corruption vulnerability can be triggered by crafted JavaScript, potentially causing a crash or memory corruption. The root cause is improper maintenance of backing-store pointers in V8. The issue is present in Chrome before 40.0.22...

CVE-2015-1220

The CVE-2015-1220 entry relates to Google Chrome/Blink. Concrete details from connected sources show a Use-after-Free in GIFImageReader::parseData within GIFImageReader.cpp (Blink) used by Chrome prior to 41.0.2272.76. The underlying issue is a use-after-free in the GIF decoder that can be trigge...

CVE-2015-6790

CVE-2015-6790 affects Google Chrome up to version 47.0.2526.80, where WebPageSerializerImpl::openTagToString does not properly escape HTML entities, enabling injection of arbitrary script or HTML via crafted documents. Debian security advisory DSA-3418-1 confirms the fix in Chrome 47.0.2526.80-1~...

CVE-2016-1635

CVE-2016-1635 affects Google Chrome/Chromium up to 49.0.2623.75, caused by improper handling of object lifetimes and re-entrancy during OnDocumentElementCreated, leading to a use-after-free and potential DoS or other impact. The issue was fixed in Chrome 49.0.2623.75 (stable channel); upgrading t...

CVE-2016-5206

CVE-2016-5206 is a same-origin policy bypass in the PDFium component used by the Chromium browser. Multiple connected advisories confirm a PDFium-related bypass vulnerability that could allow bypass of origin restrictions via crafted content, enabling potential access to restricted data. Affected...

CVE-2017-5027

CVE-2017-5027: Blink in Google Chrome prior to 56.0.2924.76 (desktop) and 56.0.2924.87 (Android) could bypass unsafe-inline CSP due to improper enforcement, enabling a remote attacker to defeat Content Security Policy via a crafted HTML page. Affected Chrome versions include Linux, Windows, and M...

CVE-2017-5072

CVE-2017-5072 affects Google Chrome/Chromium Omnibox. Insecure implementation allowed a remote attacker to spoof the address bar using RTL characters via a crafted URL page, reported for Android and tied to Chrome/Chromium versions around 59.x. The vulnerability arises from the Omnibox component’...

CVE-2024-6997

CVE-2024-6997 is a use-after-free in Chrome/Chromium Tabs prior to 127.0.6533.72, enabling heap corruption via a crafted HTML page when a user engages specific UI gestures. Affected product: Google Chrome/Chromium; root cause: use-after-free in tab handling; impact: remote code execution/compromi...

CVE-2026-0900

CVE-2026-0900: In Chrome/Chromium, an inappropriate implementation in V8 prior to 144.0.7559.59 could allow a remote attacker to cause object corruption via a crafted HTML page. The issue is rated High (CVSS 8.8). References indicate fixes in Chromium/Chrome updates (e.g., Chromium 144.0.7559.59+...

CVE-2026-0904

CVE-2026-0904 concerns an incorrect security UI in Digital Credentials in Google Chrome, enabling potential domain spoofing via a crafted HTML page. The issue affects Chrome/Chromium prior to the referenced 144.0.7559.59 baseline. Fedora package updates show chromium/cef builds shipping Chromium ...

CVE-2026-11092

Summary of CVE-2026-11092 : Google Chrome’s DevTools policy enforcement is insufficient before version 149.0.7827.53. An attacker could persuade a user to install a crafted (malicious) Chrome Extension to execute privilege escalation. Affected software: Chrome with DevTools; trigger requires user...

CVE-2026-11258

This CVE (CVE-2026-11258) affects Google Chrome’s File System Access and is due to an inappropriate implementation that allows a remote attacker to bypass discretionary access control when a user is persuaded by a crafted HTML page to perform specific UI gestures. Affected software: Chrome prior ...

CVE-2026-11662

CVE-2026-11662 affects Google Chrome bindings: Type Confusion in Bindings could allow remote code execution in a sandbox via a crafted HTML page, before version 149.0.7827.103. The issue is rated High (CVSS 3.1 base 8.8), with network attack vector and user interaction required. Affected componen...

CVE-2026-14017

CVE-2026-14017 concerns Google Chrome’s Navigation logic. Affected component: Chrome prior to build 150.0.7871.47; root cause: inappropriate navigation implementation allowed a remote attacker who had already compromised the renderer process to potentially escape the Chrome sandbox via a crafted ...

CVE-2026-14143

Affected product: Google Chrome on iOS prior to 150.0.7871.47. Issue: Incorrect security UI in Passwords UI that enables UI spoofing via a crafted HTML page. Impact: allows a remote attacker to perform UI spoofing; user interaction is required. Root cause: described as a security UI flaw in the p...

CVE-2026-15904

Google Chrome on Linux with Ozone is vulnerable to a use-after-free in Ozone that can lead to heap corruption. A remote attacker would need user interaction (specific UI gestures) and a crafted HTML page to potentially exploit the issue, with affected versions prior to 150.0.7871.128. Remediation...

CVE-2026-17656

CVE-2026-17656 is a use-after-free vulnerability in the Ozone component of Google Chrome, affecting desktop Chrome prior to version 151.0.7922.72. The flaw could allow a remote attacker to escape the Chrome sandbox via a crafted HTML page, representing a critical risk per the advisory metrics. Th...

CVE-2026-17671

CVE-2026-17671 affects Google Chrome (ANGLE) prior to 151.0.7922.72, where insufficient validation of untrusted input in ANGLE could allow a renderer-compromised attacker to escape the sandbox via a crafted HTML page. Chromium/Chrome update notes indicate a fix in Stable Channel updates to 151.0....

CVE-2026-17696

CVE-2026-17696 affects Google Chrome (Media) with a side-channel information leakage that enables a cross-origin data leak via a crafted HTML page. The description in the sources notes this as a High-severity issue and lists the fixed version as Chrome 151.0.7922.72 (stable channel). Corroboratin...

CVE-2026-17730

Technical details for CVE-2026-17730 are not provided in the connected documents; the initial description contains limited information. Please monitor for updates.

CVE-2026-17737

CVE-2026-17737 describes a use-after-free flaw in Bluetooth handling within Google Chrome on Android, where a renderer-compromised remote attacker could potentially escape the sandbox via a crafted HTML page. Affected software is Google Chrome on Android, with the vulnerability existing in versio...

CVE-2026-17794

CVE-2026-17794 describes insufficient validation of untrusted input in the Mobile component of Google Chrome on Android, allowing a remote attacker who has compromised the renderer process to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. The issue affects Chrome on Android ...

CVE-2026-17802

Vulnerability summary (CVE-2026-17802) : Side-channel information leakage in the GPU of Google Chrome on Android, prior to 151.0.7922.72. A remote attacker could leak cross-origin data via a crafted HTML page, indicating a confidentiality impact. The issue is associated with Chrome/Chromium and i...

CVE-2026-17834

CVE-2026-17834 affects Google Chrome/Chromium prior to 151.0.7922.72, where insufficient validation of untrusted input in the Passwords component could allow a renderer-process–restricted attacker to escape the sandbox via a crafted HTML page. Upstream reference notes an inappropriate implementat...

CVE-2026-17844

CVE-2026-17844 affects Google Chrome (Cast component) with insufficient validation of untrusted input, allowing a local-network attacker to leak cross-origin data through malicious traffic. The public descriptions consistently cite the Cast feature as the vulnerable surface, with the issue existi...

CVE-2026-17886

CVE-2026-17886 : Use-after-free in Google Chrome (Enterprise builds) prior to 151.0.7922.72 can enable a remote attacker to potentially cause heap corruption via a crafted HTML page. Public sources reference Chrome stability updates addressing multiple related subsystems (Dawn, Compositing, Views...

CVE-2026-17933

CVE-2026-17933 affects Google Chrome prior to 151.0.7922.72 due to an Inappropriate implementation in DOMStorage, enabling a remote attacker to leak cross-origin data via a crafted HTML page. The issue has a CVSS v3.1 base score of 4.3 (Medium); impact on confidentiality only. Remediation: upgrad...

CVE-2026-18019

Technical details for CVE-2026-18019 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-5291

CVE-2026-5291 corresponds to an Inappropriate implementation in WebGL in Google Chrome (Chromium) prior to 146.0.7680.178, allowing remote attackers to obtain potentially sensitive data from process memory via a crafted HTML page. Connected documents confirm the affected product is Google Chrome/...

CVE-2026-78945

CVE-2026-78945 is a use-after-free vulnerability in the Views component of Google Chrome , affecting versions prior to 152.0.7977.65 . A remote attacker can exploit it by luring a user into visiting a crafted HTML page through social engineering, potentially enabling arbitrary code execution outs...

CVE-2026-87649

CVE-2026-87649 is a UI misrepresentation vulnerability in the Downloads component of Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker, leveraging social engineering , could use a crafted HTML page to bypass system access restrictions. User interaction is required (the...

CVE-2026-9881

CVE-2026-9881 describes a use-after-free in Bluetooth within the Chromium-based Google Chrome browser on macOS, prior to version 148.0.7778.216. An attacker could trick a user into installing a malicious extension, potentially enabling a sandbox escape via the crafted extension. The issue affects...

CVE-2010-1825

CVE-2010-1825 is a use-after-free vulnerability in WebKit, affecting Google Chrome prior to 6.0.472.59, with exploitation via vectors related to nested SVG elements. The connected advisories (SUSE/OpenSUSE, Ubuntu, Debian, etc.) corroborate the issue and describe potential remote denial of servic...

CVE-2011-0984

CVE-2011-0984 affects Google Chrome prior to 9.0.597.94, where the browser mishandles plug-ins, enabling a remote attacker to cause a denial of service via an out-of-bounds read. Public sources (including Debian DSA-2166-1 and OpenVAS entries) corroborate the family of Chrome/Chromium vulnerabili...