CVE-2026-8008

The CVE-2026-8008 entry concerns Google Chrome DevTools: a UI spoofing vulnerability caused by an inappropriate DevTools implementation that can be exploited when a user is induced to install a malicious Chrome Extension. Multiple connected sources corroborate affected software and version bounds...

CVE-2026-87560

CVE-2026-87560 is a missing authorization vulnerability in the Browser component of Google Chrome prior to version 153.0.8010.36 . A remote attacker can exploit it by serving a crafted HTML page , enabling them to bypass system access restrictions . The NVD-assigned CVSS 3.1 score is 4.3 (Medium)...

CVE-2026-87657

A use-after-free flaw in the V8 engine of Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had already compromised the renderer process to read memory inside the sandbox by loading a crafted HTML page. The Chromium security team rated this Medium severity, and NVD assigned a CVS...

CVE-2009-1442

CVE-2009-1442 refers to a vulnerability in Google Chrome where multiple integer overflows in Skia could allow code execution in the renderer via crafted image or canvas data. Affected software includes Chrome 1.x (before 1.0.154.64) and 2.x, with potential impact on Android as well. The underlyin...

CVE-2010-2295

CVE-2010-2295 affects WebKit/WebCore’s EventHandler.cpp in WebKit used by Google Chrome before 5.0.375.70. A change of the focused frame during keydown dispatch could allow a user‑assisted attacker to redirect keystrokes via a crafted HTML document (rdar 7018610). Impact is user‑driven keystroke ...

CVE-2010-4487

CVE-2010-4487 describes an incomplete blacklist vulnerability in Google Chrome up to version 8.0.552.215 on Linux and macOS, allowing remote attackers to cause an unspecified impact via a "dangerous file" . The primary description provides no details on exploit vectors or specifics of the impact....

CVE-2010-4493

Summary: CVE-2010-4493 is a use-after-free in Google Chrome prior to 8.0.552.215, related to handling of mouse dragging events, causing a denial of service when exploited remotely. The connected sources confirm the issue in Chrome/WebKit contexts and document remediation via browser/webkit update...

CVE-2011-1110

CVE-2011-1110 affects Google Chrome pre-9.0.597.107, where improper handling of key frame rules can cause a remote denial of service or other unspecified impact via stale pointers. The vulnerability is documented across multiple sources (NVD/Nessus/OpenVAS) with a base CVSSv2 of 7.5 (HIGH). Affec...

CVE-2011-1800

CVE-2011-1800 affects Google Chrome’s WebKit/WebCore SVG Filters: multiple integer overflows in the SVG Filters implementation may allow remote denial of service and other impact. Affected component is WebCore/SVG Filters in WebKit used by Chrome prior to 11.0.696.68. Exploitation details are not...

CVE-2011-2800

Technical details for CVE-2011-2800 are not publicly provided in the supplied connected documents; no explicit product/version/impact/fix information beyond the initial description is available here. Monitor for updated disclosures or vendor advisories.

CVE-2012-4904

CVE-2012-4904 is a Cross-site scripting (UXSS) vulnerability in Google Chrome for Android, affecting versions before 18.0.1025308. The issue allows remote attackers to inject arbitrary web script via unspecified vectors, demonstrated as UXSS attacks on the current tab. Affected product: Google Ch...

CVE-2013-0831

CVE-2013-0831 is a directory traversal vulnerability in Google Chrome prior to 24.0.1312.52, allowing remote attackers to exploit via an extension process; connected documents (openSUSE/Nessus/OpenVAS) confirm the CVE, but no remediation details are provided in the supplied documents.

CVE-2013-0835

CVE-2013-0835 affects Google Chrome’s Geolocation implementation. The vulnerability, described as an unspecified issue in Geolocation, can cause an application crash (denial of service) via unknown vectors in Chrome prior to 24.0.1312.52. Public/documented references in openSUSE/Nessus/Gentoo adv...

CVE-2013-0918

CVE-2013-0918 affects Google Chrome pre-26.0.1410.43. The vulnerability arises from not preventing navigation to developer tools during a drag-and-drop operation, enabling user-assisted remote attackers to impact via a crafted site. Connected advisories (OpenVAS/Nessus) confirm the CVE across pla...

CVE-2013-2869

Chromium/Chrome vulnerability CVE-2013-2869: out-of-bounds read in JPEG2000 image handling can be exploited to cause a remote denial of service. Affected versions include Chrome/Chromium up to 28.0.1500.71. Debian, Gentoo, and other advisories document the issue and state the fix is in Chromium 2...

CVE-2013-2915

Summary: CVE-2013-2915 affects Chromium-based browsers (Google Chrome/Chromium) and is described as an address bar spoofing issue triggered by a malformed scheme. Connected advisories document multiple Chromium updates that patched this class of vulnerabilities. Affected products/versions (from c...

CVE-2013-6666

The CVE-2013-6666 entry affects Google Chrome prior to 33.0.1750.146, where PepperFlashRendererHost::OnNavigate did not verify that all headers were Cross-Origin Resource Sharing (CORS) simple headers before performing a PPB_Flash.Navigate. This could allow a remote attacker to bypass CORS restri...

CVE-2014-1719

CVE-2014-1719 is a use-after-free in Chromium’s Web Workers implementation (WebSharedWorkerStub::OnTerminateWorkerContext). The vulnerability allows a remote attacker to trigger a SharedWorker termination during script loading, potentially causing a heap memory corruption and Denial of Service. A...

CVE-2014-1726

CVE-2014-1726 affects Google Chrome up to version 34.0.1847.116. The vulnerability arises in the drag implementation, enabling a user-assisted remote attacker to bypass the Same Origin Policy and forge local pathnames by exploiting renderer access. The issue is described across multiple public ad...

CVE-2014-1736

CVE-2014-1736 is an integer overflow in the V8 engine’s api.cc used by Google Chrome/Chromium prior to version 34.0.1847.132 on Linux (and earlier Windows/macOS builds per the CVE description). The vulnerability can allow remote denial of service or other impacts via a large length value. Publicl...

CVE-2014-3173

CVE-2014-3173 affects Google Chrome WebGL: uninitialized memory read when canvas/clear interacts with framebuffer state, enabling remote denial-of-service. Affected: Chrome prior to 37.0.2062.94. Remediation: upgrade to 37.0.2062.94+ (Debian/SUSE advisories indicate later fixed builds; upgrade pa...

CVE-2014-7908

CVE-2014-7908 affects Google Chrome prior to 39.0.2171.65. The vulnerability is due to multiple integer overflows in the CheckMov function (media/base/container_names.cc) triggered by processing large atoms in MPEG-4 or QuickTime .mov data, enabling a remote attacker to cause a denial of service ...

CVE-2014-7936

CVE-2014-7936 is a use-after-free in Chrome’s ZoomBubbleView::Close (browser/ui/views/location_bar/zoom_bubble_view.cc) that affects Google Chrome before 40.0.2214.91. A crafted document can trigger improper maintenance of the zoom bubble, enabling denial of service and possibly other impact. Pub...

CVE-2015-1218

CVE-2015-1218 affects Google Chrome up to version 41.0.2272.76 (Blink DOM) and is caused by use-after-free in the DOM when moving a SCRIPT element between documents, related to HTMLScriptElement::didMoveToNewDocument and SVGScriptElement::didMoveToNewDocument. The vulnerability can lead to denial...

CVE-2015-1232

CVE-2015-1232 : In Google Chrome prior to 41.0.2272.76, an array index error in MidiManagerUsb::DispatchSendMidiData (media/midi/midi_manager_usb.cc) allows a remote attacker with renderer access to provide an invalid port index, triggering an out-of-bounds write and resulting in a Denial of Serv...

CVE-2015-1346

CVE-2015-1346 covers multiple unspecified vulnerabilities in Google V8 before 3.30.33.15, used in Google Chrome before 40.0.2214.91. The NVD entry notes potential denial of service or other impact via unknown vectors. Connected sources corroborate Chrome/Chromium lineage and list affected version...

CVE-2015-2239

Chrome before 41.0.2272.76 is affected by CVE-2015-2239, where the browser’s interaction between the 1993 search features and restore-from-disk RELOAD transitions can be abused to spoof the address bar on a search-results page via a compromised search engine or a search-engine XSS vulnerability. ...

CVE-2016-5164

Chromium/Chrome vulnerability CVE-2016-5164 is a cross-site scripting (UXSS) issue in Blink’s DevTools component (WebKit/Blink) via V8Debugger.cpp. A crafted web site can inject arbitrary script/HTML into DevTools, as described in the CVE entry. Affected versions include Chrome up to 53.0.2785.89...

CVE-2017-5051

CVE-2017-5051 describes an integer overflow in FFmpeg used by Google Chrome prior to 57.0.2987.98 (Mac/Win/Linux) and 57.0.2987.108 for Android, allowing remote execution via a crafted video file related to ChunkDemuxer. Affected component: FFmpeg within Chrome; root cause: integer overflow leadi...

CVE-2019-13690

CVE-2019-13690 affects Google Chrome on ChromeOS via an inappropriate OS implementation . Before version 75.0.3770.80 , a remote attacker could achieve OS-level privilege escalation by tricking the user with a malicious file. The documented impact is high, but the connected sources do not provide...

CVE-2025-10501

CVE-2025-10501 is a use-after-free in WebRTC within Chromium-based Chrome before version 140.0.7339.185. The vulnerability stems from heap corruption risk via crafted HTML, enabling remote attackers to potentially exploit memory safety. Connected sources confirm this exact flaw across multiple di...

CVE-2026-10897

CVE-2026-10897 affects Google Chrome (GPU component) with the root cause described as an inappropriate implementation in the GPU. This could allow a remote attacker to escape the Chrome sandbox via a crafted HTML page. The vulnerability is addressed in the Chrome 149.0.7827.53 stable release (Lin...

CVE-2026-11029

CVE-2026-11029 affects Google Chrome for Android prior to 149.0.7827.53. The issue is caused by insufficient validation of untrusted input in the Drag and Drop path, which could allow a renderer process that’s already been compromised to potentially escape the browser sandbox via a crafted HTML p...

CVE-2026-11282

CVE-2026-11282 affects Google Chrome on Linux. The issue is insufficient policy enforcement in the Sandbox, potentially allowing a sandbox escape via a crafted HTML page on versions prior to 149.0.7827.53. The reported impact is a high-risk security bypass leading to full exposure of the host, wi...

CVE-2026-11628

Use-after-free in Ozone component of Google Chrome (versions before 149.0.7827.103) can allow a local attacker to potentially cause heap corruption when physical access is available. Root cause: use-after-free. Affected software is Chrome with the Ozone stack; the vulnerability is mitigated by up...

CVE-2026-11663

CVE-2026-11663 concerns Google Chrome affected by a use-after-free in Skia prior to version 149.0.7827.103. If a renderer-process compromise occurs, a crafted HTML page could potentially enable a sandbox escape. The vulnerability is described with a high severity. The document set indicates the f...

CVE-2026-13993

The CVE-2026-13993 vulnerability affects Google Chrome WebAppInstalls via an Incorrect security UI flaw that allows domain spoofing when a user is induced to perform specific UI gestures on a crafted HTML page. Affected software is Chrome (Chromium-based) with versions prior to 150.0.7871.47. The...

CVE-2026-14413

Uninitialized use in ANGLE within Google Chrome up to version 150.0.7871.46 allows a renderer-compromised attacker to potentially escape the sandbox via a crafted HTML page. CVE-2026-14413 (Severity High) indicates a sandbox-escape risk; remediations require updating to 150.0.7871.46 or later. No...

CVE-2026-16421

CVE-2026-16421 relates to an Inappropriate implementation in WebAudio in Google Chrome (Chromium) before 150.0.7871.182 that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. The vulnerability is part of a set of Chromium/WebAudio issues associated ...

CVE-2026-16422

Google Chrome on Linux is affected by CVE-2026-16422 due to insufficient validation of untrusted input in the Certificate component. Prior to version 150.0.7871.182, this could allow an attacker with a privileged network position to perform domain spoofing via malicious network traffic. The issue...

CVE-2026-17736

CVE-2026-17736 affects Google Chrome on Android (WebView) with insufficient validation of untrusted input in WebView, allowing a renderer-compromised remote attacker to potentially escape the sandbox via a crafted HTML page. The issue is described as affecting Android builds prior to 151.0.7922.7...

CVE-2026-18000

CVE-2026-18000 affects Google Chrome on Android. The issue is described as insufficient policy enforcement in USB, allowing a remote attacker who had already compromised the renderer process to leak cross-origin data via a crafted HTML page. Affected version range is Chrome on Android prior to 15...

CVE-2026-3543

CVE-2026-3543 describes an out-of-bounds memory access in Google Chrome’s V8 engine caused by an inappropriate implementation prior to version 145.0.7632.159. The vulnerability is triggered by a crafted HTML page and is rated High severity (CVSS v3.1). Affected product/version: Google Chrome with...

CVE-2026-6300

Google Chrome (Chromium CSS engine) contains a use-after-free in CSS that allows remote code execution inside the sandbox via a crafted HTML page. Affected versions are prior to 147.0.7727.101; remediation is to upgrade to Chrome 147.0.7727.101 or newer as indicated by the referenced Chromium upd...

CVE-2026-7940

CVE-2026-7940 concerns a use-after-free in V8 within Google Chrome before 148.0.7778.96. The issue allows an attacker who persuades a user to install a crafted Chrome Extension to execute arbitrary code inside a sandbox. Affected software is Google Chrome (V8 component) prior to the fixed version...

CVE-2026-7955

CVE-2026-7955 refers to an uninitialized use in the GPU path of Google Chrome before Chrome 148.0.7778.96. The issue could allow a remote attacker who has already compromised the renderer process to read potentially sensitive information from process memory via a crafted HTML page. Affected produ...

CVE-2026-8011

Summary of CVE-2026-8011: Google Chrome before 148.0.7778.96 has an insufficient policy enforcement issue in the Search feature that allows a remote attacker to leak cross-origin data via a crafted HTML page. This is documented across multiple sources (NVD, Debian OSV, ENISA EUVD, CVE list, and r...

CVE-2026-84325

CVE-2026-84325 is an improper input validation vulnerability in the DataTransfer component of Google Chrome prior to 152.0.7977.75 . A remote attacker leveraging social engineering can bypass system access restrictions via a co-installed app. Chromium rates this as High severity; the CNA-assigned...

CVE-2026-8580

CVE-2026-8580 describes a use-after-free in Mojo of Google Chrome before 148.0.7778.168. The underlying flaw is a use-after-free in Mojo that could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. The issue is classified with a Chromium-based severity of Me...

CVE-2026-87559

A UI misrepresentation vulnerability in Google Chrome prior to 153.0.8010.36 allowed a remote attacker, leveraging social engineering , to spoof UI elements via a crafted HTML page. The flaw resides in Chrome's UI subsystem, where a crafted page could cause the browser to render misleading interf...