CVE-2015-2239

Chrome before 41.0.2272.76 is affected by CVE-2015-2239, where the browser’s interaction between the 1993 search features and restore-from-disk RELOAD transitions can be abused to spoof the address bar on a search-results page via a compromised search engine or a search-engine XSS vulnerability. ...

CVE-2016-5164

Chromium/Chrome vulnerability CVE-2016-5164 is a cross-site scripting (UXSS) issue in Blink’s DevTools component (WebKit/Blink) via V8Debugger.cpp. A crafted web site can inject arbitrary script/HTML into DevTools, as described in the CVE entry. Affected versions include Chrome up to 53.0.2785.89...

CVE-2017-5051

CVE-2017-5051 describes an integer overflow in FFmpeg used by Google Chrome prior to 57.0.2987.98 (Mac/Win/Linux) and 57.0.2987.108 for Android, allowing remote execution via a crafted video file related to ChunkDemuxer. Affected component: FFmpeg within Chrome; root cause: integer overflow leadi...

CVE-2025-10501

CVE-2025-10501 is a use-after-free in WebRTC within Chromium-based Chrome before version 140.0.7339.185. The vulnerability stems from heap corruption risk via crafted HTML, enabling remote attackers to potentially exploit memory safety. Connected sources confirm this exact flaw across multiple di...

CVE-2025-12727

The CVE-2025-12727 entry concerns an improper implementation in V8 used by Google Chrome/Chromium, allowing heap corruption via a crafted HTML page. Affected component: V8 within Chromium/Chromium-based browsers; root cause: insecure/inconsistent handling in V8 leading to heap corruption. Impact ...

CVE-2025-13230

CVE-2025-13230: Type Confusion in V8 within Google Chrome before 142.0.7444.59 may allow a remote attacker to cause heap corruption via a crafted HTML page. Affected product: Google Chrome (V8 engine). Impact as described: high severity, potential code execution through heap corruption. Remediati...

CVE-2025-14766

CVE-2025-14766 refers to an out-of-bounds read/write in the V8 engine of Google Chrome/Chromium prior to version 143.0.7499.147, enabling a remote attacker to potentially trigger heap corruption via a crafted HTML page. Public reports and security advisories confirm broader impact on Chromium-bas...

CVE-2026-10882

CVE-2026-10882 affects Google Chrome (Chromium-derived) prior to version 149.0.7827.53. The issue is a use-after-free in the Network component, enabling a remote attacker to execute arbitrary code via a crafted HTML page (Chrome security severity: Critical). The most relevant public detail is tha...

CVE-2026-10885

Use after free in Chrome for iOS: Google Chrome on iOS prior to 149.0.7827.53 allows remote code execution via a crafted HTML page. The issue in Chrome for iOS is confirmed in multiple sources (CVE-2026-10885). The Chrome 149 stability release includes this fix (149.0.7827.53) across desktop and ...

CVE-2026-10985

The CVE-2026-10985 entry describes an out-of-bounds read in Skia used by Google Chrome, prior to version 149.0.7827.53, that could allow a remote attacker to leak cross-origin data via a crafted HTML page. Root cause: Skia vulnerability leading to data exposure. Impact: cross-origin data leakage;...

CVE-2026-11028

Google Chrome on Linux and ChromeOS is affected by CVE-2026-11028 due to a use-after-free in the Media component, allowing a remote attacker who compromises the renderer to run arbitrary code in the sandbox via a crafted HTML page. The issue is instead mitigated in versions newer than 149.0.7827....

CVE-2026-11305

CVE-2026-11305 describes a use-after-free in PDFium used by Google Chrome prior to 149.0.7827.53, allowing remote code execution inside the sandbox via a crafted PDF file. Affected component: PDFium within Chrome/Chromium; vulnerability type: use-after-free. Impact as documented: high for confide...

CVE-2026-11630

CVE-2026-11630 concerns a Use-after-free in Chrome's File Input handling, leading to potential heap corruption via a crafted HTML page. Affected software is Google Chrome (Chromium-based); the issue is described as a Use after free in File Input prior to 149.0.7827.103. The Connected and Initial ...

CVE-2026-14112

The CVE-2026-14112 entry describes an inappropriate implementation in Google Chrome (enterprise) prior to version 150.0.7871.47 that could allow a remote attacker to extract potentially sensitive data from process memory when a user is persuaded to perform specific UI gestures via a crafted HTML ...

CVE-2026-14154

Summary: CVE-2026-14154 relates to an insecure DevTools implementation in Google Chrome prior to 150.0.7871.47 that could enable UI spoofing when a user is persuaded to install a malicious Chrome extension. Affected software: Google Chrome (DevTools component) prior to version 150.0.7871.47. Root...

CVE-2026-14387

Summary (CVE-2026-14387) : An integer overflow in Skia used by Google Chrome prior to 150.0.7871.46 could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. The description appears consistently across NVD, CVE list, EUVD, and related feeds. The connected sour...

CVE-2026-14410

CVE-2026-14410 affects Google Chrome’s Skia rendering pipeline. The issue arises from an inappropriate implementation in Skia that, if a renderer process is compromised, enables UI spoofing via a crafted HTML page. Impact is limited to remote UI spoofing with no broader exploit chain described; b...

CVE-2026-15132

CVE-2026-15132 affects Google Chrome (V8) with an Uninitialized Use in V8 that could allow a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page. The vulnerability is rated High (CVSS 3.1 base score 8.8) with network attack vector, requiring user interacti...

CVE-2026-17687

CVE-2026-17687 is a Type Confusion in ANGLE, affecting Google Chrome prior to 151.0.7922.72. The vulnerability could allow a remote attacker who has compromised the renderer process to potentially escape the Chrome sandbox via a crafted HTML page. The vulnerability is tied to ANGLE in Chrome’s re...

CVE-2026-17710

CVE-2026-17710 is a concrete Chromium-based Chrome vulnerability affecting the MHTML component on macOS. The issue is an inappropriate implementation in MHTML that could allow a remote attacker who has compromised the renderer process to potentially escape the Chrome sandbox via a crafted HTML pa...

CVE-2026-17728

CVE-2026-17728 describes an insecure implementation in Google Chrome extensions prior to build 151.0.7922.72, where a crafted HTML page could lead to UXSS by remote code injection. The base description notes an inappropriate implementation in Extensions that enables an attacker to inject arbitrar...

CVE-2026-17760

CVE-2026-17760 affects Google Chrome with NoStatePrefetch; a side-channel information leakage vulnerability allowed a remote attacker to exfiltrate cross-origin data via a crafted HTML page. The description specifies impact as leakage of cross-origin data and identifies the root cause as NoStateP...

CVE-2026-17832

The CVE-2026-17832 entry describes a use-after-free flaw in ANGLE within the Chromium-based Google Chrome browser, specifically prior to version 151.0.7922.72. The vulnerability arises when a remote attacker who has already compromised the renderer process could potentially escape the Chrome sand...

CVE-2026-17847

The CVE-2026-17847 entry describes an insufficient validation of untrusted input in ANGLE within Chromium-based browsers, enabling a potential sandbox escape via a crafted HTML page. Public documents consistently identify ANGLE as the affected component and Chrome/Chromium versions prior to 151.0...

CVE-2026-17855

The CVE-2026-17855 issue is a race in Chrome’s DevTools (Chromium) on macOS that could allow a remote attacker who already compromised the renderer process to escape the sandbox via a crafted HTML page. Affected: Google Chrome with DevTools on macOS before 151.0.7922.72. Root cause: race conditio...

CVE-2026-17891

CVE-2026-17891 records a use-after-free in ANGLE within Google Chrome on Android, allowing a remote attacker with renderer access to potentially escape the sandbox via a crafted HTML page. The issue is tied to the ANGLE component in Chromium; upstream reference is chromium issue 524639223. The pu...

CVE-2026-17926

CVE-2026-17926 affects Google Chrome/Chromium DevTools. Insufficient validation of untrusted input in DevTools could allow a remote attacker to bypass navigation restrictions when a user is enticed to perform specific UI gestures on a crafted HTML page. Impact: potential integrity risk with user ...

CVE-2026-8021

CVE-2026-8021 is a UI-based script injection (UXSS) in Google Chrome. Multiple connected sources (OSV/DEBIAN-CVE-2026-8021, PT-2026-38214, PTSecurity) confirm: affecting Google Chrome versions prior to 148.0.7778.96, caused by a vulnerability in the browser UI that could execute arbitrary scripts...

CVE-2026-8556

The CVE-2026-8556 issue concerns ANGLE in Google Chrome on Windows with an inappropriate implementation that allowed a remote attacker who compromised the renderer process to leak cross-origin data via a crafted HTML page. This is tied to Chrome/ANGLE upstream fix 148.0.7778.168 (and earlier/rela...

CVE-2026-87645

CVE-2026-87645 is an improper state validation flaw in the Safebrowsing component of Google Chrome prior to 153.0.8010.36 . A remote attacker could leverage a crafted HTML page to bypass system access restrictions. The Chromium project rates the severity as Medium , with NVD assigning a CVSS 3.1 ...

CVE-2026-87647

CVE-2026-87647 is an uninitialized resource vulnerability in the GPU component of Google Chrome prior to 153.0.8010.36 . A remote attacker who had already compromised the renderer process could read memory outside the sandbox by serving a crafted HTML page. Chromium assigned a security severity o...

CVE-2026-9878

CVE-2026-9878 is a use-after-free in ANGLE within Google Chrome prior to 148.0.7778.216, allowing a remote attacker to execute arbitrary code inside the browser sandbox. The vulnerability affects ANGLE components used by Chrome; the public details confirm a sandbox escape risk via a crafted HTML ...

CVE-2026-9890

CVE-2026-9890 is a use-after-free in Chrome’s XR component on Windows, prior to version 148.0.7778.216. A renderer process–compromised attacker could potentially escape the Chrome sandbox via a crafted HTML page, as described in multiple sources (EUVD-2026-33185, Red Hat, Debian, NVD). The Chrome...

CVE-2026-9958

CVE-2026-9958: Use-after-free in PDFium within Google Chrome (pre-148.0.7778.216) allows a remote attacker to potentially exploit heap corruption via a crafted PDF file. Affected: Google Chrome/Chromium PDFium component. Root cause: use-after-free. Impact: high (per CVSS), with potential for impa...

CVE-2008-6995

CVE-2008-6995 : The vulnerability is an integer underflow in Google Chrome 0.2.149.27 (component: net/base/escape.cc in chrome.dll) that allows a remote attacker to cause a denial of service (browser crash) by presenting a URI with an invalid handler followed by a “%” character, triggering a buff...

CVE-2008-6996

CVE-2008-6996 affects Google Chrome BETA 0.2.149.27. The vulnerability is that Chrome does not prompt the user before saving an executable file, potentially enabling a remote attacker or malware to cause disk-based DoS or exploit other vulnerabilities via a URL referencing an executable (possibly...

CVE-2009-0374

Google Chrome 1.0.154.43 is listed as vulnerable to a Clickjacking-related issue where an onclick action moves a crafted element to the current mouse position to trick users into visiting an arbitrary URL. Public sources describe the vulnerability and cite third-party disputes about its relevance...

CVE-2009-2352

CVE-2009-2352 : The description documents a vulnerability in Google Chrome 1.0.154.48 and earlier where JavaScript: URIs in HTTP Refresh headers are not blocked, enabling cross-site scripting (XSS). The issue can be exploited by (1) injecting a Refresh header or (2) specifying the Refresh header ...

CVE-2009-2555

Summary (CVE-2009-2555) : The OpenVAS/Nessus entries and the Chrome release notes confirm a heap-based buffer/memory corruption vulnerability in Google V8 (src/jsregexp.cc) before V8 1.1.10.14, leveraged by Chrome prior to 2.0.172.37. The issue allows remote attackers to execute arbitrary code vi...

CVE-2010-0644

Google Chrome prior to 4.0.249.89 is affected when a SOCKS5 proxy is configured: Chrome sends DNS queries directly, allowing remote DNS servers logging the requests to potentially reveal the user’s identity. This CVE (CVE-2010-0644) is documented across multiple sources (NVD entry and OpenVAS/Nes...

CVE-2010-0646

CVE-2010-0646 concerns Google Chrome/V8: multiple integer signedness errors in factory.cc of the V8 engine, exploitable in Chrome builds prior to 4.0.249.89. The issue allows remote attackers to execute arbitrary code in the Chrome sandbox via crafted use of JavaScript arrays. Affected software i...

CVE-2010-0649

CVE-2010-0649 affects Google Chrome prior to 4.0.249.89. The vulnerability lies in the sandbox’s CrossCallParamsEx::CreateFromBuffer (sandbox/src/crosscall_server.cc) where an integer overflow during deserialization of sandbox messages can lead to renderer-accessible heap memory corruption and a ...

CVE-2010-0655

CVE-2010-0655 describes a use-after-free vulnerability in Google Chrome prior to 4.0.249.78. The flaw allows user-assisted remote attackers to cause a crash (DoS) and, in some cases, may enable arbitrary code execution via vectors related to the display of a blocked popup window during navigation...

CVE-2010-2297

CVE-2010-2297 affects Google Chrome’s WebKit/WebCore (FixedTableLayout.cpp) where an HTML document with a large colspan inside a table can crash the browser or potentially execute arbitrary code. Affected version: Chrome prior to 5.0.375.70. Public references in NVD, SUSE/SUSE-verified advisories...

CVE-2010-3116

CVE-2010-3116 corresponds to multiple use-after-free vulnerabilities in WebKit related to MIME-type handling by plug-ins. The issue affects WebKit-based clients such as Apple Safari (before 4.1.3 and 5.0.x before 5.0.3), Google Chrome (before 5.0.375.127), and webkitgtk (before 1.2.6). Exploitati...

CVE-2010-3257

CVE-2010-3257 is a use-after-free vulnerability in WebKit/WebKitGTK+ that can allow remote code execution or a crash via element focus. It affects WebKit-based components used by Safari, Chrome, and webkitgtk prior to affected patch levels (e.g., webkitgtk before 1.2.6). The MiracleLinux AXSA adv...

CVE-2010-5073

CVE-2010-5073 is referenced in connected OpenVAS entries as part of Google Chrome information-disclosure vulnerabilities and Chrome/macOS/Windows listings, tied to the JavaScript getComputedStyle object. The provided documents confirm that the vulnerability involves information disclosure and cro...

CVE-2011-2350

CVE-2011-2350: Google Chrome's HTML parser is affected before version 12.0.742.112 due to lifetime and re-entrancy issues. This can allow a remote attacker to cause a denial of service or potentially other impact via unknown vectors. The description and linked references indicate a patch/update i...

CVE-2011-2818

CVE-2011-2818 is a use-after-free memory corruption in Chrome/Safari related to display box rendering, enabling remote code execution or DoS via a crafted web page. Affected: Google Chrome before 13.0.782.107; exploitation via elements with certain styles as siblings/children of floated elements....

CVE-2011-3015

CVE-2011-3015 involves multiple integer overflows in Google Chrome’s PDF codecs, affecting Chrome versions prior to 17.0.963.56. The issue can allow a remote attacker to trigger a denial of service or possibly cause other impact via unknown vectors. Affected product/version detail: Google Chrome ...