CVE-2019-5796

CVE-2019-5796 affects Chromium-based browsers (Chrome/Chromium) via the Extensions component. A race condition in Extensions before 73.0.3683.75 could be triggered remotely, with official advisories stating the vulnerability exists in Chromium’s Extensions and that upgrading to 73.0.3683.75 or ne...

CVE-2019-5824

CVE-2019-5824 affects the Chromium/Chrome media path: a parameter-passing error in the media component could enable heap corruption via a crafted HTML page. Connected advisories corroborate that Chromium/Chrome updates across distributions (e.g., Debian DSA-4500-1, openSUSE/Fedora advisories) add...

CVE-2023-5479

CVE-2023-5479 corresponds to an insufficiently secure Extensions API in Google Chrome/Chromium before 118.0.5993.70, enabling a user-assisted bypass of enterprise policy via a crafted HTML page if a malicious extension is installed. Public details across connected documents confirm the affected c...

CVE-2024-11113

CVE-2024-11113 affects Google Chrome (Accessibility component). A use-after-free in the Accessibility path prior to Chrome 131.0.6778.69 allowed a remote attacker who had compromised the renderer process to potentially cause heap corruption via a crafted HTML page. The Chrome release notes confir...

CVE-2022-2162

CVE-2022-2162 concerns Google Chrome/Chromium on Windows with vulnerable File System API policy enforcement. The issue is described as insufficient policy enforcement that allowed a remote attacker to bypass file system access via a crafted HTML page. The practical impact is potential unauthorize...

CVE-2023-0131

The CVE-2023-0131 entry concerns Google Chrome before version 109.0.5414.74, where an inappropriate implementation in the iframe Sandbox could allow a remote attacker to bypass file download restrictions via a crafted HTML page. The vulnerability affects Chrome/Chromium sandbox behavior and is ra...

CVE-2019-5791

CVE-2019-5791 is a type confusion in the V8 engine of Chromium/Chrome prior to version 73.0.3683.75. The issue potentially allows remote code execution via crafted HTML pages. Debian/Arch notes indicate fixes in 73.0.3683.75 (Debian: 73.0.3683.75-1; Arch: “before 73.0.3683.75” fixed). Affected pr...

CVE-2019-5790

CVE-2019-5790 is a heap-based buffer overflow in the V8 JavaScript engine of Chromium/Google Chrome prior to 73.0.3683.75. This vulnerability could allow a remote attacker to execute arbitrary code inside the browser’s sandbox via a crafted HTML page. The Chrome security fix was delivered in the ...

CVE-2020-6377

CVE-2020-6377 is a use-after-free in Chrome/Chromium’s audio path that could allow remote heap corruption via a crafted HTML page. Affected products: Google Chrome/Chromium prior to version 79.0.3945.117. Public advisories indicate fixes in later builds (e.g., Debian/Chromium updates to 79.0.3945...

CVE-2022-1232

CVE-2022-1232 concerns a type confusion in Chrome/Chromium’s V8 engine prior to 100.0.4896.75, enabling a remote attacker to potentially trigger heap corruption via a crafted HTML page. Multiple sources (Chromium/Chrome advisories, Debian security tracker, Gentoo GLSA) confirm the issue and that ...

CVE-2025-0445

A use after free vulnerability exists in the V8 engine within Google Chrome versions prior to 133.0.6943.53 . A remote attacker can potentially exploit heap corruption by navigating to a crafted HTML page . This issue is also associated with Chromium , Microsoft Edge , and Opera as part of broade...

CVE-2017-5130

CVE-2017-5130 describes an integer overflow in libxml2’s xmlmemory.c that could enable a remote attacker to cause heap corruption via a crafted XML file. The vulnerability affects libxml2 up to version before 2.9.5 and has been observed in products such as Google Chrome (prior to 62.0.3202.62) an...

CVE-2019-5821

CVE-2019-5821 is a concrete issue in PDFium used by Google Chrome/Chromium, caused by an integer overflow in PDFium before 74.0.3729.108, enabling a remote attacker to potentially trigger heap corruption with a crafted PDF. Evidence across multiple advisories confirms the affected component (PDFi...

CVE-2019-5830

CVE-2019-5830 concerns Google Chrome/Chromium: insufficient CORS policy enforcement allowed a remote attacker to leak cross-origin data via a crafted HTML page. The issue is tracked across multiple advisories and was addressed by updating Chromium/Chrome to a patched release. Affected components:...

CVE-2022-1482

CVE-2022-1482 : In Google Chrome, the WebGL implementation contained an inappropriate/unsafe handling that could allow a remote attacker to trigger heap corruption via a crafted HTML page. The vulnerability is associated with Chrome/WebGL prior to version 101.0.4951.41. Public advisories and rele...

CVE-2024-6776

CVE-2024-6776 : Use-after-free in the Audio component of Google Chrome/Chromium before 126.0.6478.182 can allow remote heap corruption via a crafted HTML page. Affected software includes Chromium-based Chrome; vulnerable versions are prior to 126.0.6478.182. Remediation is a patch to 126.0.6478.1...

CVE-2026-12457

The Extensions component in Google Chrome and Microsoft Edge is vulnerable to a site isolation bypass due to an inappropriate implementation. A remote attacker who has already compromised the renderer process can exploit this by using a crafted HTML page to bypass site isolation, potentially gain...

CVE-2019-5810

CVE-2019-5810 is a Chromium/Google Chrome information disclosure vulnerability in the Autofill component, reported as information leakage from process memory via a crafted HTML page in Chromium before version 74.0.3729.108. Public records in Debian security advisories and Arch Linux ASA-201904-12...

CVE-2023-1529

CVE-2023-1529 is an out-of-bounds memory access in WebHID for Google Chrome prior to 111.0.5563.110, enabling a remote attacker to potentially trigger heap corruption via a malicious HID device. Multiple connected sources corroborate the same vulnerability class and affected component: Chromium/W...

CVE-2024-7979

CVE-2024-7979 is a Chromium-derived issue: Insufficient data validation in the Windows Installer component of Google Chrome prior to version 128.0.6613.84 allows privilege escalation via a crafted symbolic link. Public sources in the connected documents tie this CVE to Chrome/Chromium, with Debia...

CVE-2026-3910

CVE-2026-3910 is an inappropriately implemented Google Chrome V8 vulnerability (pre-146.0.7680.75) that allows remote code execution via a crafted HTML page in a sandbox. Public fixes landed in Chrome 146.0.7680.75 (and related channels); exploitation has been observed in reports, including notes...

CVE-2026-3929

Google Chrome contains a side-channel information leakage vulnerability in the ResourceTiming API, affecting versions prior to 146.0.7680.71 . The root cause is the improper protection of physical external channels , which allows a remote attacker to leak cross-origin data by诱导ing a user to visit...

CVE-2020-6423

CVE-2020-6423 affects Chromium/Google Chrome’s audio component. The Arch Linux ASA-202004-9 describes a use-after-free in the audio implementation prior to 81.0.4044.92, enabling a remote attacker to potentially execute arbitrary code. The issue is addressed upstream with version 81.0.4044.92 (Ch...

CVE-2019-5828

CVE-2019-5828 is a use-after-free vulnerability in the ServiceWorker component of the Chromium/Google Chrome stack, reported to be exploitable remotely via a crafted HTML page. The issue affects Chromium/Chrome versions prior to 75.0.3770.80, with multiple sources listing an upgrade to 75.0.3770....

CVE-2020-6434

CVE-2020-6434 is a use-after-free vulnerability in the Chrome/Chromium DevTools component, reported to affect Chromium before version 81.0.4044.92. The connected advisories attribute an arbitrary code execution impact to this issue, with upstream fixes released in the 81.0.4044.92 timeframe. Reme...

CVE-2020-6440

CVE-2020-6440 concerns an insecure extension handling in Chromium/Google Chrome prior to 81.0.4044.92, caused by an inappropriate implementation in extensions. An attacker could exploit this by convincing a user to install a malicious extension, potentially leading to disclosure of sensitive info...

CVE-2019-5808

CVE-2019-5808 affects Chromium/Google Chrome Blink: a use-after-free in Blink/WebKit prior to 74.0.3729.108 could allow a crafted HTML page to trigger heap corruption. Affected products include Chromium/Chrome; remediation is to upgrade to 74.0.3729.108 or newer (as noted by Arch Debian advisorie...

CVE-2019-5822

CVE-2019-5822 affects Google Chrome/Chromium Blink component; describes bypass of Cross‑Origin Resource Sharing (CORS) via a crafted HTML page, effectively bypassing same-origin policy. Affected scope includes Blink/CORS handling in Chrome prior to 74.0.3729.108. Public advisories (Debian DSA-450...

CVE-2024-9603

Summary: CVE-2024-9603 is a Type Confusion in V8 used by Google Chrome/Chromium, prior to version 129.0.6668.100. The vulnerability could allow a remote attacker to cause heap corruption via a crafted HTML page. Affected software is Chromium-based (Chrome/Chromium); root cause is type confusion i...

CVE-2017-15412

CVE-2017-15412 is a use-after-free in libxml2 (affected before 2.9.5) used by Chrome and other products, potentially enabling heap corruption via crafted HTML. Connected advisories also reference CVE-2018-14404 (NULL pointer dereference in xmlXPathCompOpEval) affecting libxml2 up to 2.9.8 during ...

CVE-2020-6425

The CVE-2020-6425 entry concerns Chromium/Google Chrome. The vulnerability is a policy enforcement error in extensions that could allow a user-assisted attacker to bypass site isolation via a crafted Chrome extension. Affected product family: Chromium/Chrome browser engines as distributed in Debi...

CVE-2019-5793

CVE-2019-5793 affects Chromium/Google Chrome extensions prior to 73.0.3683.75. The vulnerability is described as an excessive permissions issue in the Extensions component, enabling a crafted HTML page to trigger the extension installation UI, effectively bypassing policy controls and potentially...

CVE-2024-6774

CVE-2024-6774 refers to a use-after-free in Chrome/Chromium’s Screen Capture feature that could allow heap corruption via a crafted HTML page, triggered by the user through specific UI gestures. Affected software is Google Chrome/Chromium prior to version 126.0.6478.182; the issue is rated High i...

CVE-2024-7968

CVE-2024-7968: Affected software is Google Chrome/Chromium. The issue is a Use-after-Free in Autofill leading to potential heap corruption via a crafted HTML page, with High severity. The publicly documented impact states that versions prior to 128.0.6613.84 are vulnerable. Concrete details acros...

CVE-2019-13764

CVE-2019-13764 is a Chrome JIT/type-confusion vulnerability in TurboFan/V8 causing induction-variable type mis-evaluation (NaN handling) that could enable out-of-bounds/heap-unsafe behavior. Initial description notes a type confusion in Chrome before 79.0.3945.79, allowing remote heap corruption ...

CVE-2020-16027

CVE-2020-16027 affects Chromium/Google Chrome before 87.0.4280.66, specifically the developer tools component where insufficient policy enforcement allowed an attacker to cause information disclosure via a crafted extension. Affected product: Chromium/Chrome; root cause: access restriction bypass...

CVE-2020-6524

CVE-2020-6524 : Heap buffer overflow in WebAudio affecting Google Chrome before 84.0.4147.89. A remote attacker could potentially exploit heap corruption via a crafted HTML page, leading to arbitrary code execution or crashes as described in multiple advisories. The issue is tied to Chrome’s WebA...

CVE-2020-6444

CVE-2020-6444 affects Google Chrome/Chromium WebRTC: uninitialized variable in WebRTC implementation could enable heap corruption via a crafted HTML page. Connected advisories confirm the issue in Chrome prior to 81.0.4044.92 and list it alongside related CVEs in Chromium (CVE-2020-6423, CVE-2020...

CVE-2024-8908

Affected software: Google Chrome (Autofill component).Root cause: Inappropriate implementation in Autofill.Vulnerability: Enables a remote attacker to perform UI spoofing via a crafted HTML page.Impact: UI spoofing possible without explicit exploit details beyond the description; no additional ri...

CVE-2025-4372

A use-after-free vulnerability exists in the WebAudio component of Google Chrome and Microsoft Edge browsers. The flaw occurs because the software accesses memory after it has been freed, which can be exploited by a remote attacker to cause heap corruption , execute arbitrary code , or cause a se...

CVE-2019-13685

CVE-2019-13685 affects Chromium/Google Chrome browsers. Descriptions across sources indicate a use-after-free in the sharing view component of Chromium/Chrome before version 77.0.3865.90, enabling heap corruption via a crafted HTML page. Related advisories show multiple vendors/packagers addressi...

CVE-2019-5829

CVE-2019-5829 is a vulnerability in Google's Chromium/Chrome download manager. The issue is an integer overflow that can trigger an out-of-bounds memory access via a crafted HTML page, potentially enabling remote exploitation. Affected software is Chrome/Chromium released before 75.0.3770.80. Mit...

CVE-2019-5836

CVE-2019-5836 : A heap buffer overflow in ANGLE within Google Chrome prior to 75.0.3770.80 could allow a remote attacker to cause heap corruption via a crafted HTML page. Connected sources corroborate ANGLE/Chrome scope and advise upgrading to a fixed version; Debian advisories list numerous Chro...

CVE-2019-5839

CVE-2019-5839 affects Google Chrome (Chromium) prior to 75.0.3770.80. The issue is excessive data validation in the URL parser, enabling a remote attacker who lures a user to input a crafted URL to bypass website URL validation. Root cause: improper validation in the URL parsing logic. Impact, pe...

CVE-2020-6525

CVE-2020-6525 : Heap buffer overflow in Skia used by Google Chrome prior to 84.0.4147.89. The vulnerability could allow remote code execution via a crafted HTML page due to heap corruption in Skia. Affected product/version: Google Chrome (Skia component) before 84.0.4147.89. Mitigation: upgrade C...

CVE-2022-1853

CVE-2022-1853 involves a use-after-free in IndexedDB in Google Chrome, prior to version 102.0.5005.61. The underlying issue allowed a remote attacker to potentially escape the Chrome sandbox via a crafted HTML page. Connected sources confirm the flaw affects Chrome’s IndexedDB handling and was ad...

CVE-2022-2158

CVE-2022-2158 is a type confusion in V8 affecting Google Chrome/Chromium prior to 103.0.5060.53, enabling potential heap corruption via a crafted HTML page. The CVE entry is supported by multiple connected notices: Debian/DSA-5168-1 fixes Chromium up to 103.0.5060.53; Fedora package updates refer...

CVE-2023-5478

Chromium/Google Chrome Autofill vulnerability CVE-2023-5478: Inappropriate Autofill implementation allowed a remote attacker to leak cross-origin data via a crafted HTML page. Affects Chrome/Chromium prior to 118.0.5993.70. Impact per sources: data leakage with low severity; no exploitation detai...

CVE-2019-5811

CVE-2019-5811 : In Chromium-based browsers, a Cross‑Origin Resource Sharing (CORS) bypass was discovered in Blink, allowing a crafted HTML page to bypass the same-origin policy via Service Worker semantics. The issue is associated with Chrome/Chromium builds prior to 74.0.3729.108. Impact is tied...

CVE-2019-5844

CVE-2019-5844 involves an out-of-bounds access in SwiftShader within Google Chrome/Chromium before 73.0.3683.75, enabling a remote attacker to potentially trigger heap corruption via a crafted HTML page. The entry does not indicate exploitation status. Affected tier: Chrome/Chromium in prior vers...