CVE-2022-0809

CVE-2022-0809: Out-of-bounds memory access in WebXR on Chromium-based browsers (Chrome/Chromium) before version 99.0.4844.51 can enable heap corruption via a crafted HTML page. The vulnerability affects WebXR-related code paths in Chromium/WebKit/Blink. Impact is remote code execution/compromise ...

CVE-2025-4096

CVE-2025-4096 describes a heap buffer overflow in HTML in Google Chrome prior to version 136.0.7103.59, enabling a remote attacker to potentially trigger heap corruption via a crafted HTML page. The issue affects Chrome/Chromium components handling HTML and is classified with a high severity. The...

CVE-2025-6554

CVE-2025-6554 is a Google Chromium V8 type-confusion vulnerability that could allow a remote attacker to perform arbitrary read/write via a crafted HTML page. Affected product scope is Google Chrome/Chromium-based engines; root cause is type confusion in V8. Chrome’s June 2025/Stable updates addr...

CVE-2019-5756

CVE-2019-5756 is a use-after-free in the pdfium library used by Chromium/Chrome, caused by inappropriate memory management when caching. It could allow a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. Affected products include Google Chrome/Chromium and the p...

CVE-2019-5763

CVE-2019-5763 is a vulnerability in Google's V8 engine used by Chrome/Chromium, arising from a failure to check error conditions. This could allow a remote attacker to trigger heap corruption via a crafted HTML page, with impact described as partial confidentiality/integrity/availability in the C...

CVE-2020-6396

CVE-2020-6396 corresponds to an Inappropriate implementation in Skia used by Google Chrome before 80.0.3987.87, enabling a remote attacker to spoof the Omnibox (URL bar) via a crafted HTML page. Connected sources (Debian DSA-4638-1 and related advisories) confirm the issue resides in Skia and was...

CVE-2022-1481

CVE-2022-1481 is a Google Chrome vulnerability affecting the Mac Chrome browser prior to 101.0.4951.41, described as a use-after-free in the Sharing component that could lead to heap corruption when a user is enticed into specific interaction with a crafted HTML page. The connected Chrome release...

CVE-2023-1228

CVE-2023-1228 is a Chromium-based Chrome vulnerability: Insufficient policy enforcement in Intents. Affects Google Chrome on Android prior to 111.0.5563.64 and allows a remote attacker to bypass navigation restrictions via a crafted HTML page. Mitigation in public advisories points to updating Ch...

CVE-2019-13661

CVE-2019-13661 describes a UI spoofing vulnerability in Chromium-based Google Chrome prior to 77.0.3865.75, enabling a remote attacker to spoof notifications via a crafted HTML page. The initial description confirms the affected software (Chromium/Chrome) and the impact (notification spoofing in ...

CVE-2019-13671

CVE-2019-13671 affects Google Chrome (Blink) prior to 77.0.3865.75. Description from connected sources confirms a UI spoofing issue where a crafted HTML page could spoof security UI. Remediation consistent with Chrome updates: upgrade to a version containing 77.0.3865.75 or newer (per referenced ...

CVE-2019-5777

The CVE-2019-5777 entry concerns Google Chrome’s Omnibox where an incorrect handling of a confusable character allowed a remote attacker to spoof the URL bar with a crafted domain name, affecting Chrome prior to version 72.0.3626.81. The underlying issue is in the Omnibox domain-name processing (...

CVE-2019-5880

CVE-2019-5880 affects Blink in Google Chrome where insufficient policy enforcement allowed a remote attacker to leak cross-origin data via a crafted HTML page. Affected software is Chrome/Chromium built on Blink prior to the cited fix version; the publicly documented remediation is to upgrade to ...

CVE-2020-6382

CVE-2020-6382 affects Chromium/Chrome before version 80.0.3987.87, caused by a type confusion in the v8 JavaScript engine. This vulnerability can enable a remote attacker to potentially execute arbitrary code through a crafted HTML page, with heap corruption as a possible consequence. Publicly re...

CVE-2020-6461

CVE-2020-6461: A use-after-free in Chrome storage prior to 81.0.4044.129 could allow a renderer-compromised remote attacker to escape the sandbox via a crafted HTML page. Affected: Google Chrome (storage subsystem); root cause: use-after-free. Impact: sandbox escape; exploit status not detailed i...

CVE-2021-21227

CVE-2021-21227 affects Google Chrome/Chromium, caused by insufficient data validation in the V8 JavaScript engine. A crafted HTML page can potentially trigger heap corruption, with impact described as remote code execution risk depending on context, and is tied to Chrome/Chromium versions before ...

CVE-2021-30544

CVE-2021-30544: Use-after-free in BFCache of Chromium prior to 91.0.4472.101. This enables a remote attacker to potentially trigger heap corruption via a crafted HTML page. Affected component is BFCache (and related browser parts cited in parallel advisories); impact is arbitrary code execution o...

CVE-2024-2625

CVE-2024-2625 affects Google Chrome/V8 with an object lifecycle issue in V8 prior to 123.0.6312.58 that could allow remote exploitation via a crafted HTML page (high severity). The issue is fixed in Chrome 123.0.6312.58+; Debian reports a fix to 123.0.6312.86-1~deb12u1 for stable, and Fedora pack...

CVE-2019-13715

CVE-2019-13715 affects Google Chrome/Chromium: insufficient validation in Omnibox enables domain spoofing via IDN homographs. Public advisories show fixes in Chromium 78.0.3904.70+ (Chrome/Chromium updates; Debian notes 78.0.3904.70-1, Mageia references 78.0.3904.87). Remediation: update to a ver...

CVE-2020-6389

CVE-2020-6389 is an out-of-bounds write in Chrome’s WebRTC implementation (frame marking extension) that can occur when processing RTP frames. The vulnerability arises because WebRTC accepts layer_info entries up to seven, but it only allocates storage for five elements, allowing a write beyond t...

CVE-2020-6390

CVE-2020-6390 is an out-of-bounds read in the streams component of Google Chrome/Chromium before version 80.0.3987.87, enabling a remote attacker to potentially cause heap corruption via a crafted HTML page. Mitigation in the provided docs centers on upgrading Chromium/Chrome to 80.0.3987.87 or n...

CVE-2022-1310

CVE-2022-1310 affects Google Chrome: use-after-free in the regular expressions engine prior to 100.0.4896.88, potentially enabling heap corruption via a crafted HTML page. Remediation: upgrade Chrome to 100.0.4896.88 or newer (as reflected in multiple security advisories).

CVE-2019-13743

CVE-2019-13743 affects Google Chrome/Chromium prior to version 79.0.3945.79, where an incorrect security UI in external protocol handling could allow a remote attacker to spoof the security UI via a crafted HTML page. Impact is spoofing of security prompts; practical exploitation details are not ...

CVE-2019-5779

CVE-2019-5779: In Google Chrome, the ServiceWorker implementation suffered from insufficient policy validation, allowing a remote attacker to bypass navigation restrictions via a crafted HTML page. Affected software is Chrome prior to 72.0.3626.81 and the issue is fixed in later builds. The descr...

CVE-2019-5805

CVE-2019-5805 involves a use-after-free in the PDFium component of the Chromium/Google Chrome stack, prior to version 74.0.3729.108. The vulnerability could permit a remote attacker to potentially execute heap corruption via a crafted PDF file. Affected products include Google Chrome/Chromium (de...

CVE-2020-6415

CVE-2020-6415 is an implementation error in the JavaScript component of Chromium/Google Chrome prior to 80.0.3987.87 that could enable a remote attacker to trigger heap corruption via a crafted HTML page. The issue is documented across multiple connected advisories (Debian, Fedora, Gentoo, Arch L...

CVE-2020-6485

CVE-2020-6485 affects Chromium/ Google Chrome and its media router component. The issue is described as insufficient validation of data in the media router, allowing a remote attacker (via a crafted HTML page) to bypass navigation restrictions after compromising the renderer. Public advisories no...

CVE-2020-6523

CVE-2020-6523: Out-of-bounds write in Skia used by Google Chrome prior to 84.0.4147.89. This could allow remote execution via heap corruption triggered by a crafted HTML page. Affected software: Google Chrome (Skia component); underlying issue described as an out-of-bounds write in Skia. Impact p...

CVE-2019-5755

CVE-2019-5755 describes an issue in the V8 JavaScript engine used by Google Chrome. The vulnerability is caused by incorrect handling of negative zero in V8, and, when exploited via a crafted HTML page, could allow a remote attacker to perform arbitrary read/write. The description specifies the a...

CVE-2020-6388

CVE-2020-6388 is an out-of-bounds read in the WebAudio component of Chromium/Google Chrome, prior to version 80.0.3987.87. The issue could allow a remote attacker to trigger heap-related memory corruption via a crafted HTML page, potentially affecting memory safety and information exposure. Publi...

CVE-2020-6471

CVE-2020-6471 concerns Google Chrome prior to 83.0.4103.61, where insufficient policy enforcement in the Developer Tools could allow a user-initiated extension to escape the sandbox. The vulnerability is attributed to a policy enforcement error in the Chromium developer tools component, potential...

CVE-2020-6527

Google Chrome before 84.0.4147.89 has an Insufficient policy enforcement in CSP that could allow a remote attacker to bypass content security policy via a crafted HTML page. This CVE affects Chrome’s CSP handling and was fixed in the 84.0.4147.89 update (stable channel) and related Chromium secur...

CVE-2022-1484

CVE-2022-1484 refers to a heap buffer overflow in the Web UI Settings component of Google Chrome before 101.0.4951.41. The vulnerability could allow a remote attacker to potentially trigger heap corruption by presenting a crafted HTML page, with impact described as high for confidentiality, integ...

CVE-2019-13695

CVE-2019-13695 is a use-after-free in Google Chrome’s audio component (Chromium) prior to version 77.0.3865.120. The issue was reported as an audio-use-after-free vulnerability in Chromium/Chrome before the stated patch version; upstream Chrome release notes confirm the 77.0.3865.120 update addre...

CVE-2019-5851

Chromium before 76.0.3809.87 is vulnerable to CVE-2019-5851 due to a use-after-poison in the offline audio context (WebAudio). Remote attackers could potentially execute arbitrary code on affected hosts. Arch Linux advisory ASA-201908-1 documents this as a high-severity, remote issue and fixes by...

CVE-2020-6381

CVE-2020-6381 refers to an integer overflow in the JavaScript engine of Chromium/Google Chrome prior to 80.0.3987.87, enabling potential heap corruption via a crafted HTML page. Affected products include Chrome/Chromium on ChromeOS and Android. Root cause: integer overflow in the v8 JavaScript li...

CVE-2020-6413

CVE-2020-6413 is a Chrome/Blink HTML validator bypass vulnerability. The issue arises from an inappropriate implementation in Blink that allowed a remote attacker to bypass HTML validators via a crafted HTML page. Affected product: Google Chrome/Chromium (Blink/WebKit). Impact per sources: bypass...

CVE-2020-6481

CVE-2020-6481 affects Google Chrome (and Chromium) prior to 83.0.4103.61, where insufficient policy enforcement in URL formatting can enable domain spoofing via crafted domain names. The issue is categorized as an access restriction bypass in the URL formatting path. Remediation per connected adv...

CVE-2020-6484

CVE-2020-6484 refers to insufficient data validation in the ChromeDriver component of Google Chrome prior to 83.0.4103.61. Multiple connected sources confirm the flaw affects Chrome/Chromium and that exploitation could bypass navigation restrictions via a crafted request. The Debian security noti...

CVE-2022-0796

CVE-2022-0796 affects Google Chrome/Chromium via a Use-after-free in Media vulnerability present before version 99.0.4844.51 . The issue could allow a remote attacker to exploit a heap corruption condition through a crafted HTML page. Affected platforms include Chromium-based packages across dist...

CVE-2022-1479

CVE-2022-1479 is a Chrome/Chromium issue affecting the ANGLE component and was described as a use-after-free vulnerability that could allow a remote attacker to cause heap corruption via a crafted HTML page. The vulnerability is tied to Google Chrome prior to version 101.0.4951.41. Public bulleti...

CVE-2023-4901

CVE-2023-4901 affects Google Chrome/Chromium: an improper Prompts implementation prior to Chrome 117.0.5938.62 allowed a remote attacker to potentially spoof security UI via a crafted HTML page. Impact is Medium (CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N; base score 4.3). Affected products in...

CVE-2019-13663

CVE-2019-13663 : IDN spoofing in Chrome/Chromium Omnibox via IDN homographs. Root cause is spoofed domain rendering in Omnibox, enabling domain spoofing. Affected: Google Chrome/Chromium (Omnibox domain matching). Impact: potential user trust deception through a crafted domain name. Public detail...

CVE-2019-13694

CVE-2019-13694: Use-after-free in WebRTC of Chromium/Google Chrome prior to 77.0.3865.120. Description and multiple advisories confirm a WebRTC use-after-free leading to potential remote code execution via a crafted HTML page. The fix is in Chromium 77.0.3865.120 (and related package updates in D...

CVE-2019-5769

CVE-2019-5769 is an input validation error in Blink/WebKit that affected Chromium-based browsers (per Debian/Fedora advisories). The issue could allow a remote attacker to trigger heap corruption via a crafted HTML page. The connected documents confirm the flaw and attribute it to Blink/WebKit in...

CVE-2020-6393

CVE-2020-6393 affects Google Chrome/Chromium Blink up to version 80.0.3987.87, where insufficient policy enforcement in Blink allowed a remote attacker to leak cross-origin data via a crafted HTML page. The root cause is a policy enforcement flaw in Blink, leading to cross-origin data exposure. A...

CVE-2020-6491

CVE-2020-6491 affects Chromium/Google Chrome prior to 83.0.4103.61. The issue is an insufficient data validation in the site information component, enabling a remote attacker to spoof the security UI via a crafted domain. Impact involves content spoofing; remediation is to upgrade Chromium/Chrome...

CVE-2022-0807

CVE-2022-0807 refers to an inappropriate Autofill implementation in Google Chrome before 99.0.4844.51. A remote attacker could bypass navigation restrictions via a crafted HTML page. Public sources corroborate a Chrome/Chromium family impact and cite the fix in 99.0.4844.51 (Chromium-based browse...

CVE-2022-1125

CVE-2022-1125 affects Portals in Google Chrome prior to 100.0.4896.60, with the vulnerability described as a Use-after-Free that could allow a remote attacker to trigger heap corruption via specific user interaction. The Chrome security update (Chrome 100) fixes this and other issues; Debian secu...

CVE-2022-1487

CVE-2022-1487 describes a use-after-free in Ozone within Google Chrome/Chromium, allowing potential remote heap corruption when running a Wayland test. Affected product/portion: Ozone in Chrome/Chromium prior to version 101.0.4951.41. Root cause: use-after-free vulnerability in Ozone components. ...

CVE-2022-2477

The CVE-2022-2477 entry corresponds to a use-after-free in Chrome/Chromium’s Guest View prior to 103.0.5060.134, potentially permitting heap corruption when a user is coaxed to install a malicious extension and render a crafted HTML page. Affected component: Guest View in Chrome/Chromium. Root ca...