CVE-2026-87551

CVE-2026-87551 addresses an improper certificate validation flaw in the CORS (Cross-Origin Resource Sharing) mechanism of Google Chrome prior to version 153.0.8010.36 . A remote attacker leveraging social engineering could craft network traffic to bypass the web origin policy , leading to a limit...

CVE-2023-5475

The CVE-2023-5475 issue is an Inappropriate implementation in DevTools of Google Chrome up to version 118.0.5993.70, allowing a user-assisted attacker who installs a crafted malicious extension to bypass discretionary access control. Impact: potential high integrity via extension-based bypass; ex...

CVE-2024-7536

CVE-2024-7536 affects Chromium-based browsers (Google Chrome/Chromium) via a use-after-free in the WebAudio module, enabling potential heap corruption from a crafted HTML page. Affected versions are Chrome/Chromium before 127.0.6533.99; impact is high (C/H, I/H, A/H) with network access and user ...

CVE-2019-5809

CVE-2019-5809 is a use-after-free in Blink/WebKit affecting Chromium-based browsers, specifically in the file chooser path. The vulnerability allows a remote attacker who has already compromised the renderer process to escalate privileges via a crafted HTML page. Technical details across connecte...

CVE-2019-5838

CVE-2019-5838 : Insufficient policy enforcement in Chrome extensions API allowed a user-went-through-a-malicious-extension attack to bypass file URI restrictions. Affected: Google Chrome/Chromium prior to 75.0.3770.80. Impact is that a crafted extension could enable access to file URIs that shoul...

CVE-2024-7973

CVE-2024-7973 is a reported heap buffer overflow in PDFium used by Google Chrome/Chromium, enabling a remote attacker to trigger an out-of-bounds memory read via a crafted PDF file. Affected software includes Chrome/Chromium prior to the 128.0.6613.84 fix (Linux, Windows, macOS). The underlying i...

CVE-2019-5792

CVE-2019-5792 : An integer overflow in the PDFium component of Chromium/Google Chrome before 73.0.3683.75 allows remote attackers to potentially cause out-of-bounds memory access via a crafted PDF file. Affected product: Chromium/Chrome (PDFium). Root cause: integer overflow in PDFium. Impact: re...

CVE-2022-0610

CVE-2022-0610 : Google Chrome before 98.0.4758.102 is affected by an Inappropriate implementation in the Gamepad API, enabling a remote attacker to potentially trigger heap corruption via a crafted HTML page. Technical details in connected documents confirm the vulnerability is tied to the Gamepa...

CVE-2022-0809

CVE-2022-0809: Out-of-bounds memory access in WebXR on Chromium-based browsers (Chrome/Chromium) before version 99.0.4844.51 can enable heap corruption via a crafted HTML page. The vulnerability affects WebXR-related code paths in Chromium/WebKit/Blink. Impact is remote code execution/compromise ...

CVE-2024-7534

Summary: CVE-2024-7534 describes a heap buffer overflow in the Layout component of Google Chrome/Chromium, exploitable through a crafted HTML page. The vulnerability affects Chromium-based Chrome before version 127.0.6533.99 and is listed with High severity (CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/...

CVE-2026-19162

An out-of-bounds write vulnerability in the V8 engine of Google Chrome (prior to version 151.0.7922.109) allows a remote attacker to execute arbitrary code within a sandbox by viewing a crafted HTML page . This flaw also affects the Media component in both Google Chrome and Microsoft Edge . Remed...

CVE-2019-13680

This CVE affects Chromium/Google Chrome where an improper TLS implementation in Chrome prior to 77.0.3865.75 allowed an attacker to spoof the client’s IP address to websites via crafted TLS connections. The issue’s public fixes are reflected in Chromium/Chrome updates; Debian lists a security upd...

CVE-2020-6441

CVE-2020-6441 affects Chromium/Google Chrome prior to version 81.0.4044.92 and is described as an insufficient policy enforcement issue in the omnibox component, allowing a remote, crafted HTML page to bypass the security UI. Public advisories confirm the vulnerability as a policy‑enforcement err...

CVE-2022-1483

CVE-2022-1483 concerns a heap buffer overflow in WebGPU within Google Chrome/Chromium prior to 101.0.4951.41. The issue could allow a remote attacker who gains renderer process access to trigger heap corruption via a crafted HTML page. Affected software includes Chrome/Chromium and related builds...

CVE-2022-2156

CVE-2022-2156 is a Google Chrome vulnerability: Use-after-free in Core leading to potential heap corruption via a crafted HTML page, affecting Chrome before 103.0.5060.53. Debian reports the fix in chromium 103.0.5060.53-1~deb11u1, and Fedora updates Chromium to 103.0.5060.114-1.fcXX, indicating ...

CVE-2024-2625

CVE-2024-2625 affects Google Chrome/V8 with an object lifecycle issue in V8 prior to 123.0.6312.58 that could allow remote exploitation via a crafted HTML page (high severity). The issue is fixed in Chrome 123.0.6312.58+; Debian reports a fix to 123.0.6312.86-1~deb12u1 for stable, and Fedora pack...

CVE-2019-5803

CVE-2019-5803 affects Google Chrome/Chromium prior to 73.0.3683.75. The issue is an insufficent Content Security Policy enforcement in Chrome’s CSP implementation, enabling a CSP bypass via crafted HTML content (including CSP bypass with Javascript URLs and related vectors cited in connected sour...

CVE-2022-0796

CVE-2022-0796 affects Google Chrome/Chromium via a Use-after-free in Media vulnerability present before version 99.0.4844.51 . The issue could allow a remote attacker to exploit a heap corruption condition through a crafted HTML page. Affected platforms include Chromium-based packages across dist...

CVE-2022-0807

CVE-2022-0807 refers to an inappropriate Autofill implementation in Google Chrome before 99.0.4844.51. A remote attacker could bypass navigation restrictions via a crafted HTML page. Public sources corroborate a Chrome/Chromium family impact and cite the fix in 99.0.4844.51 (Chromium-based browse...

CVE-2022-1634

CVE-2022-1634 affects Google Chrome (Browser UI component). The underlying issue is a Use-after-free in the Browser UI, exploitable via specific UI interactions after convincing a user to engage in those interactions. The vulnerability was addressed in Chrome stable channel update to version 101....

CVE-2026-84359

A high-severity information leak vulnerability exists in the Skia component of Google Chrome (versions prior to 152.0.7977.75). A remote attacker who has already compromised the renderer process can exploit this flaw by using a crafted HTML page to leak cross-origin data . Public exploits for thi...

CVE-2014-0497

CVE-2014-0497 is an Adobe Flash Player integer underflow vulnerability affecting multiple platforms (Windows/macOS/Linux) that enables remote code execution via unspecified vectors. The initial description confirms the affected version ranges (pre-11.7.700.261/11.8.x–12.x pre-12.0.0.44 on Windows...

CVE-2019-5818

CVE-2019-5818 affects Chromium/Google Chrome’s media reader component before version 74.0.3729.108. The root cause is an uninitialized value in media processing, which can allow a remote attacker to obtain potentially sensitive information from process memory via a crafted video file. Public advi...

CVE-2020-6407

CVE-2020-6407 : Affected chromium-based browsers (Chromium/Google Chrome) before 80.0.3987.122 suffer an out-of-bounds memory access in streams , enabling a remote attacker to potentially cause heap corruption via a crafted HTML page. The related CVE-2020-6418 is a separate issue in V8 (type conf...

CVE-2022-2623

CVE-2022-2623 refers to a Use-After-Free in Offline in Google Chrome on Android before 104.0.5112.79, which could allow heap corruption when a user engages in specific UI interactions after a convincing prompt. The CVE is associated with Chrome/Chromium code paths affecting offline UI, with the N...

CVE-2025-4096

A heap buffer overflow in the HTML component of Google Chrome (prior to version 136.0.7103.59 ) allows a remote attacker to potentially exploit heap corruption by visiting a crafted HTML page. This vulnerability is classified with High security severity. While specific exploitation details are no...

CVE-2026-87583

CVE-2026-87583 is a UI misrepresentation vulnerability in Passwords affecting Google Chrome on Android prior to version 153.0.8010.36 . A remote attacker can exploit this via a crafted HTML page to spoof UI elements. This vulnerability also impacts Microsoft Edge as it ingests Chromium. While pub...

CVE-2019-13686

CVE-2019-13686 affects Chromium/Google Chrome in offline page handling. The issue is a Use-after-Free in offline mode that can lead to heap corruption, exploitable via a crafted HTML page. Affected product family: Chromium/Chrome browsers; root cause: use-after-free in offline pages flow. Impact:...

CVE-2020-6479

CVE-2020-6479 affects Chromium/Google Chrome before 83.0.4103.61. Root cause: an inappropriate implementation in the sharing component could allow a remote attacker to spoof the security UI via a crafted HTML page. Impact: spoofed security UI and potential circumvention of security checks, as des...

CVE-2020-6510

CVE-2020-6510 describes a heap buffer overflow in Chrome/Chromium’s background fetch path (prior to 84.0.4147.89). A remote attacker could exploit this via a crafted HTML page to achieve heap corruption. The issue is publicly acknowledged across multiple advisories; remediation is to upgrade to C...

CVE-2023-1233

Summary: CVE-2023-1233 refers to an insufficient policy enforcement issue in Resource Timing in Google Chrome (Chromium-based) before version 111.0.5563.64. The vulnerability could allow a user-wanted attacker who persuades a user to install a malicious extension to potentially access sensitive i...

CVE-2023-5480

CVE-2023-5480 affects Chromium-based browsers (Google Chrome/Chromium) with versions prior to 119.0.6045.105. It describes an inappropriate implementation in Payments that could allow a remote attacker to bypass XSS protections via a malicious file. Public advisories in this set confirm remediati...

CVE-2026-87568

CVE-2026-87568 affects Chromium in Google Chrome prior to 153.0.8010.36 . An improper input validation flaw allowed a remote attacker who had already compromised the renderer process to spoof UI elements via crafted network traffic. Chromium rated the severity as Low ; NVD assigned CVSS 4.3 (Medi...

CVE-2019-5770

CVE-2019-5770 affects Google Chrome WebGL: insufficient input validation leads to an out-of-bounds memory read via a crafted HTML page. Vulnerable in Chrome up to version 72.0.3626.81; fixes shipped in later Chrome updates (e.g., 72.0.3626.81+). Debian/Fedora advisories and vendor advisories refe...

CVE-2020-6392

CVE-2020-6392 describes an insufficient policy enforcement in the Extensions component of Chromium/Google Chrome, allowing an attacker who lures a user to install a crafted malicious extension to bypass navigation restrictions. Public advisories in connected documents indicate the issue affects C...

CVE-2023-1232

CVE-2023-1232 affects Google Chrome (Chromium-based) Resource Timing: insufficient policy enforcement can allow a remote attacker to obtain potentially sensitive information from the API via a crafted HTML page. The issue is documented as Low severity and is mitigated by upgrading to Chrome 111.0...

CVE-2023-1236

CVE-2023-1236 affects Google Chrome (Chromium-based) prior to 111.0.5563.64 via an inappropriate implementation in Internals that allowed remote spoofing of an iframe origin through a crafted HTML page. The issue is logged as a Low severity in Chromium terms (CVSS 3.1 base 4.3, MEDIUM overall). R...

CVE-2023-4572

CVE-2023-4572 is a use-after-free vulnerability in Chrome/Chromium's MediaStream that could allow remote code execution via a crafted HTML page, caused by heap corruption. The CVE affects Chrome/Chromium browsers before the referenced fix version 116.0.5845.140. Public updates released by Debian ...

CVE-2026-17651

Google Chrome on Android (prior to version 151.0.7922.72 ) is vulnerable to a sandbox escape due to insufficient validation of untrusted input in Dawn . A remote attacker could exploit this via a crafted HTML page . Impact includes high severity for confidentiality, integrity, and availability. A...

CVE-2020-6456

CVE-2020-6456 affects the chromium/chrome browser family. The vulnerability is caused by insufficient validation of untrusted input in the clipboard, enabling a local attacker to bypass site isolation via crafted clipboard contents in affected builds prior to 81.0.4044.92. Public records in multi...

CVE-2019-13661

CVE-2019-13661 describes a UI spoofing vulnerability in Chromium-based Google Chrome prior to 77.0.3865.75, enabling a remote attacker to spoof notifications via a crafted HTML page. The initial description confirms the affected software (Chromium/Chrome) and the impact (notification spoofing in ...

CVE-2024-4558

CVE-2024-4558: Use-after-free in ANGLE within Google Chrome/Chromium's WebKit/ANGLE path allows a remote attacker to potentially trigger heap corruption via a crafted HTML page. Affects Chrome/Chromium builds prior to version 124.0.6367.155. The issue is addressed in the referenced Chrome update;...

CVE-2026-12456

Google Chrome and Microsoft Edge are affected by a high-severity vulnerability in the Extensions component. The root cause is the insufficient validation of untrusted input , which allows an attacker who convinces a user to install a malicious extension to bypass the same-origin policy via a craf...

CVE-2026-14131

CVE-2026-14131 affects Google Chrome WebAppInstalls with insufficient validation of untrusted input in the WebAppInstalls component prior to version 150.0.7871.47. The underlying issue allows a remote attacker who has compromised the renderer process to perform UI spoofing via a crafted HTML page...

CVE-2026-15130

The Navigation component in Google Chrome and Microsoft Edge web browsers is vulnerable to a site isolation bypass due to insufficient policy enforcement. A remote attacker can exploit this by using a crafted HTML page to access confidential data . Affected versions of Google Chrome include those...

CVE-2026-19157

An out-of-bounds write vulnerability in the ANGLE library within Google Chrome on Android (versions prior to 151.0.7922.109 ) allows a remote attacker to potentially perform a sandbox escape . The flaw can be triggered by a specially crafted HTML page , potentially leading to arbitrary code execu...

CVE-2026-87564

CVE-2026-87564 is a type confusion vulnerability in the V8 JavaScript engine within Google Chrome , affecting versions prior to 153.0.8010.36 . A remote attacker can exploit it via a crafted HTML page to read memory inside the sandbox . Google classifies the Chromium security severity as High , w...

CVE-2019-5784

CVE-2019-5784 affects Chromium/Chrome’s V8 engine. Root cause: incorrect handling of deferred code in V8 leads to potential heap corruption via a crafted HTML page. Impact: remote attacker could exploit heap corruption. Affected versions: Chrome/Chromium before 72.0.3626.96. Remediation: upgrade ...

CVE-2019-5800

CVE-2019-5800 affects Chromium/Google Chrome prior to 73.0.3683.75. The issue is an access restriction bypass: a CSP bypass via blob URLs in the Content Security Policy, enabling crafted pages to bypass CSP protections. Affected component areas are CSP enforcement mechanisms related to blob URLs ...

CVE-2020-6408

CVE-2020-6408 : The connected sources confirm an insufficient policy enforcement in CORS within Google Chrome/Chromium before version 80.0.3987.87. A local attacker could obtain potentially sensitive information by presenting a crafted HTML page, as described in multiple advisories (Debian, Arch ...