CVE-2022-1635

CVE-2022-1635 affects Google Chrome prior to 101.0.4951.64, where a use-after-free in Permission Prompts could allow a remote attacker to potentially exploit heap corruption via specific UI interactions. The issue is documented across multiple advisories, with Debian/Linux and Alpine/Linux tracke...

CVE-2019-5779

CVE-2019-5779: In Google Chrome, the ServiceWorker implementation suffered from insufficient policy validation, allowing a remote attacker to bypass navigation restrictions via a crafted HTML page. Affected software is Chrome prior to 72.0.3626.81 and the issue is fixed in later builds. The descr...

CVE-2019-5805

CVE-2019-5805 involves a use-after-free in the PDFium component of the Chromium/Google Chrome stack, prior to version 74.0.3729.108. The vulnerability could permit a remote attacker to potentially execute heap corruption via a crafted PDF file. Affected products include Google Chrome/Chromium (de...

CVE-2019-5851

Chromium before 76.0.3809.87 is vulnerable to CVE-2019-5851 due to a use-after-poison in the offline audio context (WebAudio). Remote attackers could potentially execute arbitrary code on affected hosts. Arch Linux advisory ASA-201908-1 documents this as a high-severity, remote issue and fixes by...

CVE-2020-6390

CVE-2020-6390 is an out-of-bounds read in the streams component of Google Chrome/Chromium before version 80.0.3987.87, enabling a remote attacker to potentially cause heap corruption via a crafted HTML page. Mitigation in the provided docs centers on upgrading Chromium/Chrome to 80.0.3987.87 or n...

CVE-2020-6485

CVE-2020-6485 affects Chromium/ Google Chrome and its media router component. The issue is described as insufficient validation of data in the media router, allowing a remote attacker (via a crafted HTML page) to bypass navigation restrictions after compromising the renderer. Public advisories no...

CVE-2020-6523

CVE-2020-6523: Out-of-bounds write in Skia used by Google Chrome prior to 84.0.4147.89. This could allow remote execution via heap corruption triggered by a crafted HTML page. Affected software: Google Chrome (Skia component); underlying issue described as an out-of-bounds write in Skia. Impact p...

CVE-2022-0809

CVE-2022-0809: Out-of-bounds memory access in WebXR on Chromium-based browsers (Chrome/Chromium) before version 99.0.4844.51 can enable heap corruption via a crafted HTML page. The vulnerability affects WebXR-related code paths in Chromium/WebKit/Blink. Impact is remote code execution/compromise ...

CVE-2019-13663

CVE-2019-13663 : IDN spoofing in Chrome/Chromium Omnibox via IDN homographs. Root cause is spoofed domain rendering in Omnibox, enabling domain spoofing. Affected: Google Chrome/Chromium (Omnibox domain matching). Impact: potential user trust deception through a crafted domain name. Public detail...

CVE-2020-6382

CVE-2020-6382 affects Chromium/Chrome before version 80.0.3987.87, caused by a type confusion in the v8 JavaScript engine. This vulnerability can enable a remote attacker to potentially execute arbitrary code through a crafted HTML page, with heap corruption as a possible consequence. Publicly re...

CVE-2020-6388

CVE-2020-6388 is an out-of-bounds read in the WebAudio component of Chromium/Google Chrome, prior to version 80.0.3987.87. The issue could allow a remote attacker to trigger heap-related memory corruption via a crafted HTML page, potentially affecting memory safety and information exposure. Publi...

CVE-2020-6413

CVE-2020-6413 is a Chrome/Blink HTML validator bypass vulnerability. The issue arises from an inappropriate implementation in Blink that allowed a remote attacker to bypass HTML validators via a crafted HTML page. Affected product: Google Chrome/Chromium (Blink/WebKit). Impact per sources: bypass...

CVE-2020-6415

CVE-2020-6415 is an implementation error in the JavaScript component of Chromium/Google Chrome prior to 80.0.3987.87 that could enable a remote attacker to trigger heap corruption via a crafted HTML page. The issue is documented across multiple connected advisories (Debian, Fedora, Gentoo, Arch L...

CVE-2020-6491

CVE-2020-6491 affects Chromium/Google Chrome prior to 83.0.4103.61. The issue is an insufficient data validation in the site information component, enabling a remote attacker to spoof the security UI via a crafted domain. Impact involves content spoofing; remediation is to upgrade Chromium/Chrome...

CVE-2021-21227

CVE-2021-21227 affects Google Chrome/Chromium, caused by insufficient data validation in the V8 JavaScript engine. A crafted HTML page can potentially trigger heap corruption, with impact described as remote code execution risk depending on context, and is tied to Chrome/Chromium versions before ...

CVE-2022-1484

CVE-2022-1484 refers to a heap buffer overflow in the Web UI Settings component of Google Chrome before 101.0.4951.41. The vulnerability could allow a remote attacker to potentially trigger heap corruption by presenting a crafted HTML page, with impact described as high for confidentiality, integ...

CVE-2022-2160

The CVE-2022-2160 entry concerns Insufficient policy enforcement in DevTools for Google Chrome on Windows before 103.0.5060.53. A malicious extension installed by a user could allow access to potentially sensitive data from local files via a crafted HTML page. Connected documents corroborate the ...

CVE-2019-13668

CVE-2019-13668 affects Google Chrome prior to 77.0.3865.75, where insufficient policy enforcement in developer tools could allow a crafted HTML page to leak cross-origin data (information disclosure). The issue is documented across multiple sources (CVE entry and Debian/ Gentoo advisories) and ha...

CVE-2020-6471

CVE-2020-6471 concerns Google Chrome prior to 83.0.4103.61, where insufficient policy enforcement in the Developer Tools could allow a user-initiated extension to escape the sandbox. The vulnerability is attributed to a policy enforcement error in the Chromium developer tools component, potential...

CVE-2020-6481

CVE-2020-6481 affects Google Chrome (and Chromium) prior to 83.0.4103.61, where insufficient policy enforcement in URL formatting can enable domain spoofing via crafted domain names. The issue is categorized as an access restriction bypass in the URL formatting path. Remediation per connected adv...

CVE-2022-1310

CVE-2022-1310 affects Google Chrome: use-after-free in the regular expressions engine prior to 100.0.4896.88, potentially enabling heap corruption via a crafted HTML page. Remediation: upgrade Chrome to 100.0.4896.88 or newer (as reflected in multiple security advisories).

CVE-2022-1481

CVE-2022-1481 is a Google Chrome vulnerability affecting the Mac Chrome browser prior to 101.0.4951.41, described as a use-after-free in the Sharing component that could lead to heap corruption when a user is enticed into specific interaction with a crafted HTML page. The connected Chrome release...

CVE-2023-1223

CVE-2023-1223 concerns insufficient policy enforcement in Autofill on Chromium-derived Chrome/Android builds prior to 111.0.5563.64, enabling a remote attacker to leak cross-origin data via a crafted HTML page. Connected feeds confirm the remediation: Chromium/Chrome update to 111.0.5563.64 (and ...

CVE-2023-1228

CVE-2023-1228 is a Chromium-based Chrome vulnerability: Insufficient policy enforcement in Intents. Affects Google Chrome on Android prior to 111.0.5563.64 and allows a remote attacker to bypass navigation restrictions via a crafted HTML page. Mitigation in public advisories points to updating Ch...

CVE-2019-13696

Chromium/Google Chrome prior to version 77.0.3865.120 is affected by CVE-2019-13696 due to a use-after-free in the V8 component. This vulnerability could allow a remote attacker to execute arbitrary code via a crafted HTML page, with the issue fixed in 77.0.3865.120 according to multiple advisori...

CVE-2019-5769

CVE-2019-5769 is an input validation error in Blink/WebKit that affected Chromium-based browsers (per Debian/Fedora advisories). The issue could allow a remote attacker to trigger heap corruption via a crafted HTML page. The connected documents confirm the flaw and attribute it to Blink/WebKit in...

CVE-2019-5872

CVE-2019-5872 describes a use-after-free in Chrome’s Mojo component that could be triggered by a crafted HTML page, potentially allowing heap corruption. Affected: Google Chrome (Mojo path), version before 77.0.3865.75. Exploitation details, specific impact, and exact remediation are not provided...

CVE-2020-6393

CVE-2020-6393 affects Google Chrome/Chromium Blink up to version 80.0.3987.87, where insufficient policy enforcement in Blink allowed a remote attacker to leak cross-origin data via a crafted HTML page. The root cause is a policy enforcement flaw in Blink, leading to cross-origin data exposure. A...

CVE-2020-6484

CVE-2020-6484 refers to insufficient data validation in the ChromeDriver component of Google Chrome prior to 83.0.4103.61. Multiple connected sources confirm the flaw affects Chrome/Chromium and that exploitation could bypass navigation restrictions via a crafted request. The Debian security noti...

CVE-2020-6512

CVE-2020-6512: A type confusion in Google Chrome’s V8 engine prior to 84.0.4147.89 could allow a remote attacker to exploit heap corruption via a crafted HTML page, potentially enabling arbitrary code execution. Affected product: Chrome (V8). Root cause: type confusion in V8. Impact: remote code ...

CVE-2021-30544

CVE-2021-30544: Use-after-free in BFCache of Chromium prior to 91.0.4472.101. This enables a remote attacker to potentially trigger heap corruption via a crafted HTML page. Affected component is BFCache (and related browser parts cited in parallel advisories); impact is arbitrary code execution o...

CVE-2018-6156

CVE-2018-6156 affects Google Chrome/WebRTC: an incorrect derivation of a packet length in WebRTC can cause a heap-based buffer overflow, enabling potential remote arbitrary code execution via a crafted video file. The security notes in connected docs indicate the fix was applied in chrome-related...

CVE-2019-13666

CVE-2019-13666 : Google Chrome information leak in storage prior to 77.0.3865.75. Root cause: an information leak in storage that allowed cross-origin data to be exposed via a crafted HTML page. Impact: partial confidentiality loss with HIGH impact per CVSS3.1 (base score 7.4); attack vector NETW...

CVE-2019-5755

CVE-2019-5755 describes an issue in the V8 JavaScript engine used by Google Chrome. The vulnerability is caused by incorrect handling of negative zero in V8, and, when exploited via a crafted HTML page, could allow a remote attacker to perform arbitrary read/write. The description specifies the a...

CVE-2019-5814

CVE-2019-5814 affects Google Chrome/Chromium Blink: an insufficient policy enforcement in Blink allowed a remote attacker to leak cross-origin data via a crafted HTML page (CORS bypass). Impact: cross-origin data disclosure. Affected versions are before 74.0.3729.108. Remediation: upgrade to 74.0...

CVE-2019-5864

CVE-2019-5864 concerns Google Chrome/Chromium where insufficient port filtering in CORS for extensions allowed bypassing Content Security Policy. Affected: Chrome/Chromium versions prior to 76.0.3809.87. Impact noted across multiple advisories (Arch Linux ASA-201908-1, Debian DSA-4500-1, Debian D...

CVE-2020-6381

CVE-2020-6381 refers to an integer overflow in the JavaScript engine of Chromium/Google Chrome prior to 80.0.3987.87, enabling potential heap corruption via a crafted HTML page. Affected products include Chrome/Chromium on ChromeOS and Android. Root cause: integer overflow in the v8 JavaScript li...

CVE-2020-6399

CVE-2020-6399 is a policy-enforcement error in the AppCache component of the Chromium browser that allows a remote attacker to leak cross-origin data via a crafted HTML page. Affected product: Chromium prior to version 80.0.3987.87 (Chrome-based). Root cause per the public records is insufficient...

CVE-2020-6527

Google Chrome before 84.0.4147.89 has an Insufficient policy enforcement in CSP that could allow a remote attacker to bypass content security policy via a crafted HTML page. This CVE affects Chrome’s CSP handling and was fixed in the 84.0.4147.89 update (stable channel) and related Chromium secur...

CVE-2019-13665

CVE-2019-13665 affects Chromium/Google Chrome’s Blink component. Description: insufficient filtering in Blink allowed a crafted HTML page to bypass multiple file download protections. Impact: remote attacker could bypass download protections via a malicious page on affected Chrome/Chromium builds...

CVE-2020-6462

CVE-2020-6462 is a use-after-free in Chrome/Chromium task scheduling that could allow a renderer-compromised remote attacker to escape the sandbox via a crafted HTML page. Affected: Google Chrome/Chromium prior to 81.0.4044.129. Impact and remediation as stated in connected sources: patches exist...

CVE-2019-13677

CVE-2019-13677 concerns Google Chrome/Chromium: insufficient policy enforcement in site isolation allowed remote bypass via a crafted HTML page. Connected advisories confirm the vulnerability and provide remediation guidance: Chromium/Chrome fixed in the 78.0.3904.97 series (Debian DSA-4562-1 lis...

CVE-2019-5773

CVE-2019-5773 : Insufficient origin validation in IndexedDB in Google Chrome before 72.0.3626.81 allows a remote attacker who compromised the renderer process to bypass the same-origin policy via a crafted HTML page. Affected product/version: Google Chrome (IndexedDB). Root cause: origin validati...

CVE-2019-5835

CVE-2019-5835 describes an object lifecycle issue in the SwiftShader component of Google Chrome/Chromium prior to 75.0.3770.80 that could allow a remote attacker to perform out-of-bounds memory access via a crafted HTML page. Public advisories and trackers consistently tie this CVE to Chrome/Chro...

CVE-2019-5881

CVE-2019-5881 : Out-of-bounds read in SwiftShader used by Google Chrome allowed remote attackers to obtain potentially sensitive information from process memory via a crafted HTML page. Affected product: Google Chrome (SwiftShader component). Root cause: memory read beyond bounds. Impact: informa...

CVE-2020-6412

CVE-2020-6412 affects Chromium/Google Chrome Omnibox: insufficient validation of untrusted input allows domain spoofing via IDN homographs in crafted domain names. Root cause is input validation flaw in Omnibox prior to 80.0.3987.87. Documents confirm affected component and version range and prov...

CVE-2022-0796

CVE-2022-0796 affects Google Chrome/Chromium via a Use-after-free in Media vulnerability present before version 99.0.4844.51 . The issue could allow a remote attacker to exploit a heap corruption condition through a crafted HTML page. Affected platforms include Chromium-based packages across dist...

CVE-2022-1125

CVE-2022-1125 affects Portals in Google Chrome prior to 100.0.4896.60, with the vulnerability described as a Use-after-Free that could allow a remote attacker to trigger heap corruption via specific user interaction. The Chrome security update (Chrome 100) fixes this and other issues; Debian secu...

CVE-2023-1221

The CVE-2023-1221 entry describes a Chromium-based issue in Google Chrome’s Extensions API: insufficient policy enforcement allowed a user-assisted attacker to bypass navigation restrictions via a crafted extension in Chrome prior to 111.0.5563.64. Affected software is Google Chrome/Chromium with...

CVE-2023-1229

The CVE-2023-1229 entry concerns Google Chrome (Chromium-based) prior to version 111.0.5563.64. Affected component: Permission prompts implementation. Root cause: Inappropriate implementation in Permission prompts allowed a remote attacker to bypass navigation restrictions via a crafted HTML page...