CVE-2013-2859

CVE-2013-2859 affects Chromium/Google Chrome prior to 27.0.1453.110. The issue allows remote attackers to bypass the Same Origin Policy and trigger namespace pollution via unspecified vectors. Debian and Gentoo advisories document this CVE along with other related Chromium/V8 flaws and indicate r...

CVE-2013-0885

CVE-2013-0885 corresponds to a Chrome vulnerability affecting Windows, Linux, and macOS where API privileges granted during interaction with the Chrome Web Store were not properly restricted. The CVE entry notes an unspecified impact and attack vectors, but connected records identify the issue as...

CVE-2013-0888

CVE-2013-0888 affects Google Chrome where Skia processing allowed an out-of-bounds read via a user-gesture related check for dangerous file downloads. Affected versions are Chrome on Windows and Linux prior to 25.0.1364.97, and on macOS prior to 25.0.1364.99. The vulnerability enables a denial of...

CVE-2013-0892

CVE-2013-0892 involves multiple unspecified vulnerabilities in Google Chrome’s IPC layer affecting Windows, Linux, and Mac OS X. The CVE entry notes a denial-of-service or possibly other impact via unknown vectors, with vulnerable versions listed as before 25.0.1364.97 on Windows/Linux and before...

CVE-2013-2632

CVE-2013-2632 affects Google V8 up to version 3.17.12 (in Chrome prior to 27.0.1444.3). The vulnerability, triggered by crafted JavaScript (Bejeweled example), can cause an application crash and potentially other impact. Affected software: V8 JavaScript engine as used in Google Chrome. Root cause...

CVE-2013-2858

The CVE-2013-2858 entry concerns a use-after-free in the HTML5 Audio implementation of Chromium/Open Chrome before 27.0.1453.110. This vulnerability could allow a remote attacker to cause a denial of service or potentially other unspecified impact via unknown vectors. Affected products include Ch...

CVE-2013-2904

CVE-2013-2904 refers to a use-after-free in XML document parsing within Chromium/Blink (Document::finishedParsing) that could enable a denial of service via an onload handler altering an IFRAME src. The vulnerability was disclosed in the Chrome/Chromium context and is listed among multiple CVEs a...

CVE-2013-2908

CVE-2013-2908 affects Google Chrome prior to 30.0.1599.66. The root cause is incorrect function calls when determining NavigationEntry values, allowing an attacker to spoof the address bar via a response with a 204 No Content status. Publicly documented patches exist across multiple distributions...

CVE-2013-6625

CVE-2013-6625 is a use-after-free in DOM ranges (Blink: core/dom/ContainerNode.cpp) used by Google Chrome prior to 31.0.1650.48. Exploitation could cause a denial of service or other impact by removing a child node after a mutation or blur event. Mitigation: apply Chromium updates that address th...

CVE-2013-6626

CVE-2013-6626 affects Chromium/Google Chrome prior to 31.0.1650.48. The issue is due to WebContentsImpl::AttachInterstitialPage not canceling JavaScript dialogs when showing an interstitial warning, enabling spoofing of the address bar on a crafted site. Multiple OS advisories (openSUSE openSUSE-...

CVE-2013-6654

The CVE-2013-6654 issue affects Chromium/Blink: The SVGAnimateElement::calculateAnimatedValue function in Blink’s core/svg/SVGAnimateElement.cpp fails to handle unexpected data types, allowing remote attackers to cause a denial of service via an incorrect cast and potentially other impact via unk...

CVE-2014-1716

CVE-2014-1716 is a cross-site scripting (UXSS) vulnerability in Google V8’s Runtime_SetPrototype function (runtime.cc) affecting Google Chrome/Chromium prior to 34.0.1847.116. Exploitation could allow remote attackers to inject script/HTML via unspecified vectors. Publicly documented fixes includ...

CVE-2014-1735

CVE-2014-1735 refers to multiple vulnerabilities in the V8 JavaScript engine as used by Chromium/Google Chrome. Affected software includes Google V8 before 3.24.35.33 and Chrome/Chromium before 34.0.1847.131 (Windows/OS X) or 34.0.1847.132 (Linux). The stated impact is denial of service or possib...

CVE-2014-1741

CVE-2014-1741 refers to multiple integer overflow issues in Blink/Chromium, specifically in the CharacterData implementation (CharacterData.cpp) used by Chromium/Google Chrome prior to version 34.0.1847.137. The vulnerability arises from integer overflow in the DOM data handling (replace-data pat...

CVE-2014-1749

CVE-2014-1749 refers to multiple vulnerabilities in Google Chrome/ Chromium up to version 35.0.1916.114 that allow a denial of service or possibly other impact via unknown vectors. The connected documents confirm this CVE is addressed in security updates across several distributions, e.g., openSU...

CVE-2014-7948

CVE-2014-7948 affects Google Chrome’s AppCache: the AppCacheUpdateJob::URLFetcher proceeds with caching for SSL sessions even when there is an X.509 certificate error, enabling MITM attackers to spoof HTML5 app content. Documented in multiple advisories (e.g., Ubuntu USN-2476-1, Red Hat RHSA-2015...

CVE-2015-1222

CVE-2015-1222 refers to multiple use-after-free vulnerabilities in the ServiceWorkerScriptCacheMap in Google Chrome prior to 41.0.2272.76, enabling remote denial of service or other impacts via vectors involving ServiceWorkerContextWrapper::DeleteAndStartOver and related NotifyStartedCaching/Noti...

CVE-2015-1223

CVE-2015-1223 affects Google Chrome (Blink DOM) where use-after-free in core/html/HTMLInputElement.cpp can be triggered by extraneous change events (invalid input or read-only fields) due to issues in initializeTypeInParsing and updateType. The vulnerability is in the Blink DOM implementation use...

CVE-2015-6580

CVE-2015-6580 relates to multiple unspecified vulnerabilities in Google V8 before 4.5.103.29, as used in Google Chrome before 45.0.2454.85. The description indicates a denial of service or possibly other impact via unknown vectors. The connected documents consistently reference Google Chrome/V8 a...

CVE-2015-6583

CVE-2015-6583 affects Google Chrome prior to 45.0.2454.85. The vulnerability arises because a hosted app’s window does not display the location bar after navigation away from the installation site, which could allow remote attackers to spoof content via a crafted app. The issue is tied to interna...

CVE-2016-1641

CVE-2016-1641 is a use-after-free vulnerability in Chromium/Google Chrome affecting the favicon handling path (content/browser/web_contents/web_contents_impl.cc). The issue exists in Chrome before 49.0.2623.75 and could allow a remote attacker to cause a denial of service or potentially other imp...

CVE-2016-5197

The CVE-2016-5197 issue affects Google Chrome for Android (before 54.0.2840.85). The Content View client insufficiently validated intent URLs, allowing a renderer-compromised page to trigger an arbitrary activity via a crafted HTML page. Impact stated: remote attacker could start arbitrary activi...

CVE-2023-7010

CVE-2023-7010 is a use-after-free vulnerability in WebRTC in Google Chrome, with impact described as potential heap corruption. The affected software is Google Chrome (WebRTC component); the concrete detail provided indicates exploitation could be remote via a crafted HTML page, and the vulnerabi...

CVE-2025-10500

Concretely affected: Google Chrome Dawn component, with vulnerability CVE-2025-10500 in Chrome prior to 140.0.7339.185. Root cause is a Use After Free in Dawn that can lead to heap corruption when processing crafted HTML pages. Impact is high (remote code execution potential) per the CVE entry. R...

CVE-2026-10003

CVE-2026-10003: Use-after-free in Chrome’s Views (Chromium) prior to 148.0.7778.216 permits a remote attacker to run arbitrary code via a crafted HTML page after the user engages specific UI gestures. Root cause is a flaw in the Views component of Chromium/Blink; affected software is Google Chrom...

CVE-2026-10020

Affected software: Skia component in Google Chrome on Android. Vulnerability: Insufficient validation of untrusted input in Skia allows a renderer process–level attacker to potentially escape the sandbox via a crafted HTML page. Impact: Sandbox escape risk as described; exploitation requires a co...

CVE-2026-10965

CVE-2026-10965 is an integer overflow in Google Chrome’s DevTools prior to 149.0.7827.53. The issue allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Affected software: Chrome (DevTools). Root cause: integer overflow in DevTools as described in multiple ...

CVE-2026-11288

The CVE-2026-11288 entry concerns Google Chrome’s CSS policy enforcement. Affects Chrome prior to build 149.0.7827.53, where insufficient policy enforcement in CSS could allow a remote attacker to leak cross-origin data via a crafted HTML page. From the connected sources, the vulnerability is tie...

CVE-2026-1220

Summary: CVE-2026-1220 is a race in V8 in Google Chrome prior to 144.0.7559.99 that could allow a remote attacker to trigger type confusion via a crafted HTML page. The vulnerability affects Chromium-based Chrome and stems from the V8 engine; exploitation could lead to arbitrary code execution or...

CVE-2026-12466

Summary (CVE-2026-12466) : A heap buffer overflow in WebRTC within Google Chrome on Windows before version 149.0.7827.155 allows remote code execution via a crafted HTML page. Multiple connected sources corroborate the Windows/WebRTC/chrome vector and fixed version, signaling a high-severity Chro...

CVE-2026-14098

CVE-2026-14098 affects Google Chrome and other Chromium-based browsers due to an inappropriate CSS implementation that allows a remote attacker to leak cross-origin data via a crafted HTML page. Affected version range is Chrome prior to 150.0.7871.47. Impact is cross-origin data leakage; exploita...

CVE-2026-14426

CVE-2026-14426 is a Use After Free in V8 within Google Chrome before 150.0.7871.46. A remote attacker could lure a user into specific UI gestures to run arbitrary code in Chrome’s sandbox via a crafted HTML page. Severity: High. Affected: V8 in Chrome (pre-150.7871.46). Mitigation: Chrome update ...

CVE-2026-17654

The CVE-2026-17654 entry concerns Google Chrome on macOS with a race in the Updater that could lead to OS-level privilege escalation via a malicious file. Root cause is a race condition in the Updater component; affected version is Chrome prior to 151.0.7922.72. The vulnerability could allow a lo...

CVE-2026-17665

CVE-2026-17665 : Use-after-free in V8 (Chrome) before 151.0.7922.72. A crafted HTML page can trigger the vulnerability, enabling remote code execution inside the sandbox. The issue is listed as High severity in Chromium/Chrome advisories, and is addressed in the 151.0.7922.71/72 desktop stable-ch...

CVE-2026-17756

The CVE-2026-17756 entry corresponds to Insufficient policy enforcement in Presentation in Chromium-based Chrome/Chromium. Connected advisories show OpenSUSE and Debian security updates fixing Chromium 151.0.7922.71 with CVE-2026-17756 among others, and note that updates fix these issues (e.g., O...

CVE-2026-17764

CVE-2026-17764 describes an Inappropriate implementation flaw in the FedCM component of Chromium/Google Chrome that allowed a remote attacker to bypass the same-origin policy via a crafted HTML page. The issue affects Chrome/Chromium builds prior to version 151.0.7922.72, with the underlying caus...

CVE-2026-17772

CVE-2026-17772: An out-of-bounds read in WebGL in Google Chrome was reported for Chrome versions prior to 151.0.7922.72, enabling a remote attacker to read memory via a crafted HTML page. Multiple feeds (NVD, Debian, Red Hat, CIRCL, EUVD, OSV mirrors) corroborate the flaw as a WebGL WebKit/Chromi...

CVE-2026-17808

CVE-2026-17880/17808 affects WebGL in Chromium-based Chrome on Android. The flaw is an uninitialized use in WebGL within Chromium’s rendering stack, enabling a remote attacker to leak cross-origin data via a crafted HTML page. Affected software: Google Chrome (Android) before version 151.0.7922.7...

CVE-2026-17843

Summary of CVE-2026-17843 : An inappropriate implementation flaw in the CSS component of Google Chrome/Chromium allowed a remote attacker to leak cross-origin data via a crafted HTML page. Affected software is Chrome/Chromium before version 151.0.7922.72. Impact is exposure of cross-origin data; ...

CVE-2026-17851

CVE-2026-17851 : Side-channel information leakage in Autofill for Google Chrome. A remote attacker who had compromised the renderer could leak cross-origin data via a crafted HTML page. Affected products are Chrome versions prior to 151.0.7922.72; impact is information disclosure (no exploitation...

CVE-2026-17880

CVE-2026-17880 involves an inappropriate Autofill implementation in Google Chrome, affecting Chrome versions prior to 151.0.7922.72. The flaw allows a remote attacker to leak cross-origin data via a crafted HTML page, due to a vulnerability in how Autofill processes page content. The CVSS base im...

CVE-2026-2648

CVE-2026-2648 describes a heap buffer overflow in PDFium used by Google Chrome before 145.0.7632.109 that allows remote code execution via a crafted PDF file, leading to out-of-bounds memory writes. The vulnerability affects Chromium/PDFium components and is rated High severity (CVSS v3.1: 8.8). ...

CVE-2026-3536

The CVE-2026-3536 issue is an integer overflow in ANGLE within Google Chrome prior to 145.0.7632.159, allowing a remote attacker to potentially perform out-of-bounds memory access via a crafted HTML page. The vulnerability is rated Critical (NVD/Chrome CVSS 3.1: 8.8) with network attack vector an...

CVE-2026-4447

Concerning CVE-2026-4447, an issue in V8 for Google Chrome prior to 146.0.7680.153 enables remote code execution in the sandbox via a crafted HTML page. Several connected documents confirm affected Software: Google Chrome (V8) prior to 146.0.7680.153; Chromium-based builds and Debian/Fedora advis...

CVE-2026-4679

CVE-2026-4679 describes an integer overflow in Chrome’s Fonts code, allowing a remote attacker to trigger an out-of-bounds memory write via a crafted HTML page. Affected software: Google Chrome (Chromium-based) prior to version 146.0.7680.165. Root cause: integer overflow in the Fonts component. ...

CVE-2026-76043

An incorrect calculation in the V8 JavaScript engine in Google Chrome prior to 151.0.7922.169 allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The vulnerability requires user interaction (visiting a malicious page) but no prior authentication. CVSS 3....

CVE-2026-78891

CVE-2026-78891 is a buffer overflow in the WebRTC component of Google Chrome prior to version 152.0.7977.65 . A remote attacker can exploit this by luring a user to a crafted HTML page , leading to arbitrary code execution inside the Chrome sandbox , potentially resulting in unauthorized control ...

CVE-2026-78939

CVE-2026-78939 is a use after free vulnerability in Chromecast within Google Chrome , affecting versions prior to 152.0.7977.65 . A remote attacker who has already compromised the renderer process can trigger the flaw via a crafted HTML page , leading to arbitrary code execution outside the sandb...

CVE-2026-79034

CVE-2026-79034 is an information leak in CORS (Cross-Origin Resource Sharing) in Google Chrome prior to 152.0.7977.65 (also affecting chromium-browser ). A remote attacker who has already compromised the renderer process can leak cross-origin data by tricking a user into visiting a crafted HTML p...

CVE-2026-79196

A race condition in the Editing feature of Google Chrome prior to 152.0.7977.65 allows a remote attacker, leveraging social engineering, to obtain sensitive information via a crafted HTML page. Chromium rates this as Low severity, with a CVSS 3.1 score of 5.3 (Medium) reflecting the high attack c...