CVE-2026-85042

A use-after-free vulnerability in DevTools within Google Chrome prior to 152.0.7977.82 allows a remote attacker to execute arbitrary code outside the sandbox by serving a crafted HTML page. Chromium rates this as High severity; CVSS 3.1 scores it 9.6 (Critical) with a Changed Scope, reflecting sa...

CVE-2014-7899

CVE-2014-7899 affects Google Chrome/Chromium: address bar spoofing by prefixing the URL with a blob: substring at the start, then the original URI, enabling phishing-like tricks. The historic entry covers Chrome before 38.0.2125.101; mitigations are to upgrade to Chromium/Chrome 39.x (e.g., 39.0....

CVE-2014-7909

CVE-2014-7909 affects Skia’s effects/SkDashPathEffect.cpp used by Google Chrome prior to 39.0.2171.65. The issue is an uninitialized memory read that could enable a remote DoS via crafted data. Public advisories indicate Chrome/openSUSE/OpenSSL patches update to 39.0.2171.65 to fix this and relat...

CVE-2014-9648

CVE-2014-9648 concerns Google Chrome before 40.0.2214.91 (Android) where intercept_navigation_resource_throttle.cc improperly restricts the use of intent: URLs to launch external apps after in-site navigation. This design flaw can let remote attackers craft JavaScript to cause a denial of service...

CVE-2015-1221

CVE-2015-1221 is a use-after-free in Blink used by Google Chrome before 41.0.2272.76, caused by incorrect operation ordering between the Web SQL Database thread and Blink’s main thread, related to the shutdown function in web/WebKit.cpp. The vulnerability could allow remote denial of service or o...

CVE-2015-8664

CVE-2015-8664: Integer overflow in Chrome’s WebCursor::Deserialize (content/common/cursors/webcursor.cc) before 47.0.2526.106 allows remote DoS or unspecified impact via a crafted RGBA pixel array. It is a different vulnerability from CVE-2015-6792; no additional exploit details are provided in t...

CVE-2016-5196

The CVE-2016-5196 entry concerns Google Chrome for Android prior to version 54.0.2840.85. The content renderer client fails to enforce the Same Origin Policy among downloaded files, allowing a remote attacker to access downloaded files and interact with sites the user is logged into via a crafted...

CVE-2019-25154

The CVE-2019-25154 entry describes an Inappropriate implementation in iframe handling in Google Chrome prior to 77.0.3865.75, which could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Affected software is Google Chrome (Chromium-based); the underlying is...

CVE-2023-7281

CVE-2023-7281 – Google Chrome/ui spoofing via crafted HTML page . The issue arises from an inappropriate implementation in the Chrome browser’s Compositing feature, allowing a remote attacker to perform UI spoofing. Affected product: Google Chrome (Chromium base) prior to version 119.0.6045.105. ...

CVE-2025-8581

CVE-2025-8581 affects Google Chrome/Chromium where an inappropriate Extension implementation prior to 139.0.7258.66 can allow a remote attacker—who lures a user into specific UI gestures via a crafted HTML page—to leak cross-origin data. The CVSS 3.1 base score is 4.3 (Medium); impact is limited ...

CVE-2026-10013

CVE-2026-10013: A use-after-free flaw in WebCodecs within Google Chrome prior to 148.0.7778.216 allows remote execution of arbitrary code in the sandbox via a crafted HTML page. Affected software is Google Chrome (WebCodecs component); root cause is use-after-free. Impact is high (arbitrary code ...

CVE-2026-10021

The CVE-2026-10021 entry describes an issue in Chromium-based Chrome where insufficient validation of untrusted input in the USB component could allow a remote attacker to execute arbitrary code via a crafted HTML page. Affected software is Google Chrome (Chromium-based); the underlying cause is ...

CVE-2026-10973

CVE-2026-10973 describes an uninitialized use in Dawn within Google Chrome, affecting Chrome builds prior to 149.0.7827.53. This vulnerability could allow a remote attacker to leak cross-origin data via a crafted HTML page. The description attributes impact to data leakage with network-exposed at...

CVE-2026-11000

Summary : CVE-2026-11000 affects Google Chrome on Linux. The vulnerable component is the Fonts code in Chromium, with the underlying issue described as a use-after-free. This leads to the possibility of remote code execution inside the browser sandbox via a crafted HTML page. Public references in...

CVE-2026-11007

CVE-2026-11007 describes a vulnerability in WebView for Google Chrome on Android, where insufficient validation of untrusted input in WebView prior to 149.0.7827.53 enabled a renderer-compromised attacker to leak cross-origin data via a crafted HTML page. The connected Debian/OpenSUSE advisories ...

CVE-2026-11088

The CVE-2026-11088 entry describes an integer overflow in ANGLE used by Google Chrome, allowing a remote attacker who has compromised the renderer process to potentially escape the sandbox via a crafted HTML page. Public details specify Chrome versions prior to 149.0.7827.53 as affected, with the...

CVE-2026-11185

CVE-2026-11185 is a use-after-free in Google Chrome’s V8 engine, affecting Chrome builds prior to 149.0.7827.53. An attacker could lure a user to install a crafted malicious extension and achieve arbitrary code execution inside the sandbox. Affected component: V8 in Chrome. Root cause: use-after-...

CVE-2026-11308

Summary : CVE-2026-11308 describes an insecure implementation in Google Chrome’s Extensions handling prior to version 149.0.7827.53. Affected software/area : Google Chrome — Extensions module. Root cause : Inappropriate implementation in Extensions, enabling privilege escalation. Impact : An atta...

CVE-2026-11643

CVE-2026-11643 : Use-after-free in Proxy handling of Google Chrome before version 149.0.7827.103 allows a remote attacker to execute arbitrary code via malicious network traffic. Impact is rated high/critical; exploit would require network access with no user interaction. The documented remediati...

CVE-2026-11695

CVE-2026-11695 affects Google Chrome Passwords with an inappropriate implementation that allows a remote attacker to leak cross-origin data via a crafted HTML page. Affected product: Google Chrome (password handling). Root cause: improper handling leading to cross-origin data exposure. Impact: cr...

CVE-2026-12465

CVE-2026-12465 affects Google Chrome Metrics: an Object lifecycle issue in Chrome prior to 149.0.7827.155 allows a renderer-compromised remote attacker to potentially escape the sandbox via a crafted HTML page. Patch: update to Chrome 149.0.7827.155 or newer. Exploitation details are not describe...

CVE-2026-13861

CVE-2026-13861 : Use-after-free in Chrome’s Core component prior to 150.0.7871.47 allows a remote attacker who has compromised the renderer process to potentially escape the sandbox via a crafted HTML page. Exploitation details in the connected records indicate an impact across confidentiality, i...

CVE-2026-13911

CVE-2026-13911 concerns Google Chrome’s Spellcheck: insufficient policy enforcement could allow a renderer-compromised attacker to read potentially sensitive data from process memory via a crafted HTML page. Affected are Chrome builds prior to 150.0.7871.47; exploitation is described as remote, r...

CVE-2026-14046

CVE-2026-14046 affects Google Chrome on Android through the CustomTabs implementation. An inappropriate implementation allows a remote attacker to bypass the same-origin policy via a crafted HTML page. The vulnerability is characterized by a Chromium-based Low severity, with a network attack vect...

CVE-2026-14422

CVE-2026-14422 : Out-of-bounds read/write in Tint component of Google Chrome before version 150.0.7871.46. The issue allowed a remote attacker to potentially trigger memory access errors via a crafted HTML page. The severity is listed as High. Affected product: Google Chrome (Tint within Chromium...

CVE-2026-17679

CVE-2026-17679 is a Chrome vulnerability arising from insufficient validation of untrusted input in Print Preview. The issue affects Google Chrome prior to 151.0.7922.72 and could allow a remote attacker who compromises the renderer process to leak cross-origin data via a crafted HTML page. The C...

CVE-2026-17721

CVE-2026-17721 : Out-of-bounds write in ANGLE within Google Chrome before 151.0.7922.72 could allow a remote attacker to attempt a sandbox escape via a crafted HTML page. The vulnerability is rooted in ANGLE, affecting Chrome's rendering/sandbox components, with a high severity (CRITICAL) per the...

CVE-2026-17748

CVE-2026-17748: In Chromium-based Chrome, the vulnerability is an Inappropriate implementation in Extensions that allowed a renderer-compromised remote attacker to bypass site isolation via a crafted HTML page. Affected product/version: Chrome/Chromium before 151.0.7922.72. Root cause: extension ...

CVE-2026-17768

CVE-2026-17768: Insufficient validation of untrusted input in Chrome/Chromium WebSockets (renderer process) could allow a remote attacker to escape the sandbox via a crafted HTML page. Affected product/component: Chromium-based Chrome WebSockets handling; root cause: insufficient input validation...

CVE-2026-17920

CVE-2026-17920 is a use-after-free in V8 (Chrome) reported to affect Google Chrome builds prior to 151.0.7922.72. The issue allows an attacker, who can persuade a user to install a crafted Chrome Extension, to execute arbitrary code within Chrome’s sandbox. The public description and connected so...

CVE-2026-4673

CVE-2026-4673 is a heap buffer overflow in WebAudio in Google Chrome. Before 146.0.7680.165, a crafted HTML page could trigger an out-of-bounds memory write, enabling a remote attacker to exploit the vulnerability. Affected component: WebAudio in Chrome (Chromium). Root cause: heap buffer overflo...

CVE-2026-76039

Google Chrome on Android prior to 151.0.7922.169 contains an incorrect reference resolution flaw in Core, allowing a remote attacker to use social engineering and a crafted HTML page to obtain sensitive information (CVSS 6.5, confidentiality-high). CISA SSVC reports no active exploitation. Fix: u...

CVE-2026-76044

A race condition in Chrome's USB component affects versions prior to 151.0.7922.169. A remote attacker with renderer-process compromise could execute arbitrary code outside the sandbox via a crafted HTML page. The fix is included in Chrome 151.0.7922.169; CISA SSVC marks exploitation as "none" an...

CVE-2026-7896

CVE-2026-7896 is a Chrome/Blink vulnerability due to an integer overflow that can lead to heap corruption on a crafted HTML page. The vulnerability affects Blink in Google Chrome versions before 148.0.7778.96. The Chrome 148 stable update lists “Critical CVE-2026-7896: Integer overflow in Blink” ...

CVE-2026-79194

CVE-2026-79194 is a use-after-free vulnerability in Chromoting , a component of Google Chrome on Windows prior to version 152.0.7977.65 . A remote attacker can execute arbitrary code outside the browser sandbox by sending crafted network traffic to a vulnerable system. The Chromium team rated thi...

CVE-2026-8570

The CVE-2026-8570 entry concerns Google Chrome’s V8 engine. A Type Confusion in V8, affecting Chrome versions prior to 148.0.7778.168, could allow a remote attacker to read potentially sensitive data from process memory via a crafted HTML page. The description does not specify exact vulnerable bu...

CVE-2026-8573

Google Chrome on Windows is affected by CVE-2026-8573 due to an integer overflow in Codecs, enabling a remote attacker to potentially escape the sandbox via a crafted video file. Affected versions are Windows builds prior to 148.0.7778.168; remediation is to update to 148.0.7778.168 or newer. Chr...

CVE-2026-9888

The CVE-2026-9888 entry affects Google Chrome WebView on Android and is caused by a use-after-free in the WebView component, allowing a remote attacker who compromised the renderer process to potentially escape the sandbox via a crafted HTML page. The connected sources confirm the impact as a san...

CVE-2026-9904

CVE-2026-9904 affects Google Chrome via a Use-After-Free in ANGLE, with the root cause in ANGLE’s memory management. A crafted HTML page could potentially escape the Chrome sandbox, as described in multiple sources. A fix is available in Chrome 148.0.7778.216 (and surrounding 148.0.7778.215/217 f...

CVE-2026-9914

CVE-2026-9914 concerns an ANGLE input-validation flaw in Google Chrome prior to 148.0.7778.216. The renderer process, if compromised, could be forced to escape the sandbox via a crafted HTML page. The issue is described as a high-severity, remote threat with impact on confidentiality, integrity, ...

CVE-2026-9931

This CVE-2026-9931 entry describes a use-after-free in Chrome's GPU component prior to version 148.0.7778.216. A remote attacker who already compromised the renderer process could potentially escape the Chrome sandbox via a crafted HTML page. The impact is High (CVSS 3.1: AV:N/AC:H/PR:N/UI:R/S:C/...

CVE-2026-9962

CVE-2026-9962 describes a use-after-free flaw in WebRTC within the Chromium-based Google Chrome browser. The issue allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page, with impact reported as high. Affected software: Google Chrome (WebRTC component in Chrom...

CVE-2026-9974

CVE-2026-9974 concerns Google Chrome's GPU component in Chromium. The vulnerability is an out-of-bounds write in the GPU code that, if a renderer process is already compromised, could enable a sandbox escape via a crafted HTML page. Affected version range is Chrome prior to 148.0.7778.216. The do...

CVE-2026-9982

Affected software: Google Chrome (ANGLE component). Issue: insufficient validation of untrusted input in ANGLE allows a renderer process user to escalate to sandbox escape via a crafted HTML page. Severity: High (CVSS 3.1 base 8.3). Affected version window: prior to 148.0.7778.216; remediation: u...

CVE-2026-9984

CVE-2026-9984 affects Google Chrome on Windows with a use-after-free in the UI of the Chromium-based browser, allowing remote code execution via a crafted HTML page. Root cause: use-after-free in the UI component. Affected products/versions: Chrome prior to 148.0.7778.216. Impact: arbitrary code ...

CVE-2008-4724

CVE-2008-4724 affects Google Chrome 0.2.149.30 and involves multiple XSS vulnerabilities triggered by ftp:// URLs delivering HTML content (within a JPG, PDF, or TXT file). The OpenVAS/NVD entries confirm the XSS vector via FTP handling; Exploit-DB also documents a remote exploit for Windows. The ...

CVE-2009-3934

The CVE-2009-3934 issue affects Google Chrome’s WebFrameLoaderClient (WebFrameLoaderClient::dispatchDidChangeLocationWithinPage) in src/webkit/glue/webframeloaderclient_impl.cc, where the code fails to handle page-local redirects correctly. This allows user-assisted remote attackers to cause a de...

CVE-2010-0658

CVE-2010-0658 covers multiple integer overflows in Skia used by Google Chrome prior to version 4.0.249.78, enabling remote code execution in the Chrome sandbox or a denial of service via CANVAS-related vectors. Affected: Skia canvas handling within Chrome; root cause: integer overflows leading to...

CVE-2010-1229

CVE-2010-1229 affects Google Chrome prior to 4.1.249.1036. Connected sources show multiple vulnerabilities in Chrome’s sandbox and related components (e.g., race conditions and pointer handling issues; memory errors; other listed issues) that were present in the 4.1.249.1036 timeframe. The core d...

CVE-2010-2900

CVE-2010-2900 concerns Google Chrome prior to 5.0.375.125, which does not properly handle a large canvas. The connected records identify Chrome as the affected product and list CVE-2010-2900 among WebKit/Chrome vulnerabilities in 2010-2011 public advisories (e.g., USN-1195-1, OpenVAS entries). Th...