CVE-2020-6510

CVE-2020-6510 describes a heap buffer overflow in Chrome/Chromium’s background fetch path (prior to 84.0.4147.89). A remote attacker could exploit this via a crafted HTML page to achieve heap corruption. The issue is publicly acknowledged across multiple advisories; remediation is to upgrade to C...

CVE-2019-5770

CVE-2019-5770 affects Google Chrome WebGL: insufficient input validation leads to an out-of-bounds memory read via a crafted HTML page. Vulnerable in Chrome up to version 72.0.3626.81; fixes shipped in later Chrome updates (e.g., 72.0.3626.81+). Debian/Fedora advisories and vendor advisories refe...

CVE-2019-5800

CVE-2019-5800 affects Chromium/Google Chrome prior to 73.0.3683.75. The issue is an access restriction bypass: a CSP bypass via blob URLs in the Content Security Policy, enabling crafted pages to bypass CSP protections. Affected component areas are CSP enforcement mechanisms related to blob URLs ...

CVE-2020-6470

CVE-2020-6470 affects Chromium/Google Chrome clipboard handling. The root cause is insufficient validation of untrusted input in the clipboard, enabling a local attacker to inject arbitrary scripts or HTML (UXSS) via crafted clipboard content. Connected advisories confirm upstream fixes in the 83...

CVE-2022-2623

CVE-2022-2623 refers to a Use-After-Free in Offline in Google Chrome on Android before 104.0.5112.79, which could allow heap corruption when a user engages in specific UI interactions after a convincing prompt. The CVE is associated with Chrome/Chromium code paths affecting offline UI, with the N...

CVE-2023-1233

Summary: CVE-2023-1233 refers to an insufficient policy enforcement issue in Resource Timing in Google Chrome (Chromium-based) before version 111.0.5563.64. The vulnerability could allow a user-wanted attacker who persuades a user to install a malicious extension to potentially access sensitive i...

CVE-2020-6478

CVE-2020-6478 is an implementation error in Chrome/Chromium’s full screen mode that could allow a remote attacker to spoof the security UI via a crafted HTML page. Public advisories (e.g., Debian DSA-4714-1, Arch security, Gentoo GLSA) confirm the issue affects Chromium/Chrome before version 83.0...

CVE-2020-6487

CVE-2020-6487 corresponds to an access-restriction bypass in the downloads component of the Chromium/Google Chrome browser prior to version 83.0.4103.61. The issue is described as insufficient policy enforcement in downloads that allowed a remote attacker to bypass navigation restrictions via a c...

CVE-2020-6530

CVE-2020-6530 affects Google Chrome (Chromium-based) with an out-of-bounds memory access in Developer Tools prior to 84.0.4147.89. A user-assisted exploit via a crafted malicious extension could potentially cause heap corruption. The connected advisories indicate fixes in Chrome/Chromium branches...

CVE-2025-4096

CVE-2025-4096 describes a heap buffer overflow in HTML in Google Chrome prior to version 136.0.7103.59, enabling a remote attacker to potentially trigger heap corruption via a crafted HTML page. The issue affects Chrome/Chromium components handling HTML and is classified with a high severity. The...

CVE-2019-13694

CVE-2019-13694: Use-after-free in WebRTC of Chromium/Google Chrome prior to 77.0.3865.120. Description and multiple advisories confirm a WebRTC use-after-free leading to potential remote code execution via a crafted HTML page. The fix is in Chromium 77.0.3865.120 (and related package updates in D...

CVE-2019-5834

CVE-2019-5834 involves insufficient data validation in Blink used by Google Chrome, enabling domain spoofing via a crafted HTML page in Chrome versions older than 75.0.3770.80. The vulnerability is attributed to the Blink component and affects Chrome before the fixed release. Debian advisories li...

CVE-2020-6458

CVE-2020-6458 is an out-of-bounds read/write in PDFium used by Google Chrome, allowing heap corruption via a crafted PDF file in Chrome before 81.0.4044.122. Remediation: upgrade Chrome to 81.0.4044.122 or newer (as reflected in Debian/Fedora advisories). Ensure affected systems are updated to ve...

CVE-2023-4572

CVE-2023-4572 is a use-after-free vulnerability in Chrome/Chromium's MediaStream that could allow remote code execution via a crafted HTML page, caused by heap corruption. The CVE affects Chrome/Chromium browsers before the referenced fix version 116.0.5845.140. Public updates released by Debian ...

CVE-2019-13679

CVE-2019-13679 is a PDFium-related issue in Google Chrome/Chromium where insufficient policy enforcement allowed a crafted PDF to trigger print dialogs without user activation. Connected advisories (Fedora/Debian/Nessus) confirm the vulnerability and show remediation through upgrading Chromium/Ch...

CVE-2019-13695

CVE-2019-13695 is a use-after-free in Google Chrome’s audio component (Chromium) prior to version 77.0.3865.120. The issue was reported as an audio-use-after-free vulnerability in Chromium/Chrome before the stated patch version; upstream Chrome release notes confirm the 77.0.3865.120 update addre...

CVE-2020-6429

CVE-2020-6429 refers to a use-after-free in Google Chrome’s audio path that could allow remote heap corruption via a crafted HTML page. Public references in Debian and Alpine security advisories confirm the flaw affects Chromium/Chrome up to version 80.0.3987.149, with fixed versions pushed in th...

CVE-2020-6482

CVE-2020-6482 describes an insufficient policy enforcement vulnerability in Chrome’s developer tools. The root cause is improper access control in the developer tools component, allowing a user who installs a crafted malicious extension to bypass navigation restrictions. This could enable a remot...

CVE-2022-2160

The CVE-2022-2160 entry concerns Insufficient policy enforcement in DevTools for Google Chrome on Windows before 103.0.5060.53. A malicious extension installed by a user could allow access to potentially sensitive data from local files via a crafted HTML page. Connected documents corroborate the ...

CVE-2023-1232

CVE-2023-1232 affects Google Chrome (Chromium-based) Resource Timing: insufficient policy enforcement can allow a remote attacker to obtain potentially sensitive information from the API via a crafted HTML page. The issue is documented as Low severity and is mitigated by upgrading to Chrome 111.0...

CVE-2023-5480

CVE-2023-5480 affects Chromium-based browsers (Google Chrome/Chromium) with versions prior to 119.0.6045.105. It describes an inappropriate implementation in Payments that could allow a remote attacker to bypass XSS protections via a malicious file. Public advisories in this set confirm remediati...

CVE-2019-5784

CVE-2019-5784 affects Chromium/Chrome’s V8 engine. Root cause: incorrect handling of deferred code in V8 leads to potential heap corruption via a crafted HTML page. Impact: remote attacker could exploit heap corruption. Affected versions: Chrome/Chromium before 72.0.3626.96. Remediation: upgrade ...

CVE-2020-6521

CVE-2020-6521 affects Google Chrome prior to 84.0.4147.89, describing a side-channel information leakage in autofill that could let a remote attacker read potentially sensitive data from process memory via a crafted HTML page. Public details consistently identify Chrome/Chromium as the affected s...

CVE-2024-2625

CVE-2024-2625 affects Google Chrome/V8 with an object lifecycle issue in V8 prior to 123.0.6312.58 that could allow remote exploitation via a crafted HTML page (high severity). The issue is fixed in Chrome 123.0.6312.58+; Debian reports a fix to 123.0.6312.86-1~deb12u1 for stable, and Fedora pack...

CVE-2024-7025

CVE-2024-7025 describes an integer overflow in the Layout component of Google Chrome, exploitable via a crafted HTML page to cause heap corruption. Multiple connected advisories confirm the issue affects Chrome builds prior to version 129.0.6668.89 and have been addressed in later releases. Publi...

CVE-2019-13696

Chromium/Google Chrome prior to version 77.0.3865.120 is affected by CVE-2019-13696 due to a use-after-free in the V8 component. This vulnerability could allow a remote attacker to execute arbitrary code via a crafted HTML page, with the issue fixed in 77.0.3865.120 according to multiple advisori...

CVE-2020-6422

CVE-2020-6422 is a use-after-free vulnerability in WebGL of Google Chrome before 80.0.3987.149, enabling a remote attacker to potentially cause heap corruption via a crafted HTML page. Mitigation: upgrade Chromium/Chrome to 80.0.3987.149 or newer (reported in Debian/Fedora advisories and Gentoo/G...

CVE-2020-6464

CVE-2020-6464 describes a type confusion in Blink/WebKit used by Google Chrome before 81.0.4044.138, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. Public disclosures in multiple advisories confirm this Chromium vulnerability, with affected rel...

CVE-2020-6488

CVE-2020-6488 affects Google Chrome prior to 83.0.4103.61, with an insufficient policy enforcement in downloads that allows a remote attacker to bypass navigation restrictions via a crafted HTML page. Impact: navigation restriction bypass in downloads; attacker could potentially influence downloa...

CVE-2022-1634

CVE-2022-1634 affects Google Chrome (Browser UI component). The underlying issue is a Use-after-free in the Browser UI, exploitable via specific UI interactions after convincing a user to engage in those interactions. The vulnerability was addressed in Chrome stable channel update to version 101....

CVE-2022-2481

CVE-2022-2481 affects Google Chrome/Chromium, describing a use-after-free in Views that could allow heap corruption via UI interactions. The issue is tied to Chrome/Chromium builds prior to 103.0.5060.134. Exploitation requires user interaction, with remote threat actors potentially triggering th...

CVE-2023-1236

CVE-2023-1236 affects Google Chrome (Chromium-based) prior to 111.0.5563.64 via an inappropriate implementation in Internals that allowed remote spoofing of an iframe origin through a crafted HTML page. The issue is logged as a Low severity in Chromium terms (CVSS 3.1 base 4.3, MEDIUM overall). R...

CVE-2025-6554

CVE-2025-6554 is a Google Chromium V8 type-confusion vulnerability that could allow a remote attacker to perform arbitrary read/write via a crafted HTML page. Affected product scope is Google Chrome/Chromium-based engines; root cause is type confusion in V8. Chrome’s June 2025/Stable updates addr...

CVE-2019-13697

CVE-2019-13697 is a cross-origin size leak in Google Chrome/Chromium prior to 77.0.3865.120. Connected sources confirm a fix in the 77.0.3865.120 release (and security advisories from Debian, Mageia, Arch Linux) for Chromium/Chrome, addressing the cross-origin information disclosure. Affected com...

CVE-2019-5817

CVE-2019-5817 is a heap buffer overflow in ANGLE used by Google Chrome on Windows, prior to Chrome 74.0.3729.108. The issue could allow a remote attacker to cause heap corruption via a crafted HTML page. Affected component: ANGLE in Chrome (Windows). Root cause per the linked records is a heap bu...

CVE-2019-5870

CVE-2019-5870 is a use-after-free vulnerability in Chrome’s media handling, allowing a remote attacker to potentially escape the sandbox via a crafted HTML page. The issue affects Google Chrome prior to version 77.0.3865.75, where an object in the media path could be freed while still in use, ena...

CVE-2020-6426

CVE-2020-6426: In Google Chrome, an implementation error in V8 prior to 80.0.3987.149 could allow a remote attacker to cause heap corruption via a crafted HTML page. Affected software is Chrome before 80.0.3987.149 (and Chromium-based builds). Root cause: inappropriate V8 implementation. Impact d...

CVE-2020-6469

CVE-2020-6469 concerns Google Chrome/Chromium's developer tools. The connected sources explicitly describe an "insufficient policy enforcement" issue in the developer tools before Chrome 83.0.4103.61, which could allow an attacker to persuade a user to install a malicious extension and potentiall...

CVE-2019-5754

CVE-2019-5754 affects Google Chrome’s QUIC networking implementation. Root cause: an implementation error in QUIC networking prior to version 72.0.3626.81. Consequence: an attacker who can cause the use of a proxy server can obtain cleartext of the transport encryption via a malicious network pro...

CVE-2019-5776

CVE-2019-5776 affects Google Chrome’s Omnibox (URL bar): a correctness flaw in handling confusable characters in domain names allows a remote attacker to spoof the displayed URL. Affected software: Chrome before 72.0.3626.81. Impact: spoofed Omnibox content (phishing risk). Remediation: upgrade t...

CVE-2020-6454

CVE-2020-6454 affects Chromium/Google Chrome extensions: a use-after-free in the extensions component could allow heap corruption and arbitrary code execution. Public docs indicate this affects Chrome before 81.0.4044.92 (and Chromium up to 81.0.4044.92). Debian and Arch advisories list the issue...

CVE-2020-6505

CVE-2020-6505 affects Google Chrome/Chromium prior to 83.0.4103.106, with a use-after-free vulnerability in the speech component that could permit a remote sandbox escape via a crafted HTML page. Public fixes are reflected in Chrome/Chromium updates (e.g., 83.0.4103.116+), with Debian/Fedora advi...

CVE-2021-30555

CVE-2021-30555 is a use-after-free in the Chromium Sharing component up to version 91.0.4472.114. An attacker could exploit heap corruption by convincing a user to install a malicious extension and rendering a crafted HTML page with user gesture. Impact described as arbitrary code execution/remot...

CVE-2022-0789

CVE-2022-0789 is a heap buffer overflow in ANGLE used by Google Chrome (and Chromium components) prior to version 99.0.4844.51. The vulnerability allows a remote attacker to trigger heap corruption through a crafted HTML page, with potential for arbitrary code execution. Affected ecosystem includ...

CVE-2022-1491

The CVE-2022-1491 entry concerns Google Chrome/Chromium’s Bookmarks: a Use-after-Free in the Bookmarks component could allow a remote attacker to trigger heap corruption. The flaw requires specific user interaction and affects Chrome/Chromium builds prior to 101.0.4951.41. The issue was fixed in ...

CVE-2019-13665

CVE-2019-13665 affects Chromium/Google Chrome’s Blink component. Description: insufficient filtering in Blink allowed a crafted HTML page to bypass multiple file download protections. Impact: remote attacker could bypass download protections via a malicious page on affected Chrome/Chromium builds...

CVE-2019-13723

CVE-2019-13723 is a use-after-free vulnerability in Chromium/Google Chrome’s Web Bluetooth implementation. The issue affects Web Bluetooth handling in Chromium browser builds prior to version 78.0.3904.108, where a compromised renderer could trigger heap corruption via a crafted HTML page to pote...

CVE-2020-6397

CVE-2020-6397 is described as an insecure sharing implementation in Google Chrome/Chromium that allows a remote attacker to spoof the security UI via a crafted HTML page. Public records among connected sources confirm this as a content spoofing issue in the sharing component of Chromium/Chrome up...

CVE-2020-6416

CVE-2020-6416 affects Chromium-based Chromium/Google Chrome prior to 80.0.3987.87 in the streams component. The root cause is insufficient data validation in streams, enabling a remote attacker to potentially trigger heap corruption via a crafted HTML page. Public advisories (Debian, Arch Linux A...

CVE-2022-0790

The CVE-2022-0790 issue is a use-after-free in Chrome’s Cast UI affecting Google Chrome prior to 99.0.4844.51. The root cause is a memory management error that could be triggered when a user interacts with a crafted HTML page, potentially enabling a sandbox escape. Multiple connected sources (e.g...