CVE-2026-7921

A use after free vulnerability in the Passwords component of Google Chrome (and Chromium ) prior to version 148.0.7778.96 allows a remote attacker to execute arbitrary code via a crafted HTML page. The issue stems from the reuse of passwords after they were released. Practical impacts include pot...

CVE-2026-7933

Google Chrome versions prior to 148.0.7778.96 are vulnerable to an out-of-bounds read in the WebCodecs component. A remote attacker can exploit this by providing a crafted video file , potentially leading to the disclosure of sensitive information or memory data. The vulnerability has been addres...

CVE-2026-7939

An inappropriate implementation in the SanitizerAPI in Google Chrome and Microsoft Edge browsers prior to version 148.0.7778.96 allows a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. This vulnerability is caused by a lack of measures to protect the structure ...

CVE-2026-7960

A race condition vulnerability exists in the Speech component of the Google Chrome and Microsoft Edge browsers (versions prior to 148.0.7778.96 ). This synchronization error, caused by improper handling of a common resource, allows a remote attacker who has already compromised the renderer proces...

CVE-2026-7967

Google Chrome and Microsoft Edge browsers are affected by a vulnerability in the Navigation function caused by insufficient validation of untrusted input. A remote attacker who has already compromised the renderer process can use a crafted HTML page to potentially perform a sandbox escape . Impac...

CVE-2026-7987

A use after free (UAF) vulnerability in the WebRTC component of Google Chrome (prior to version 148.0.7778.96 ) allows a remote attacker to execute arbitrary code inside a sandbox. The root cause is the reutilization of resources within WebRTC, which can be triggered via a crafted HTML page . Imp...

CVE-2026-7995

An out-of-bounds read in the AdFilter component of Google Chrome (and potentially Microsoft Edge ) prior to version 148.0.7778.96 allows a remote attacker to execute arbitrary code inside a sandbox. This vulnerability is triggered by processing a crafted HTML page from a remote location. Impact i...

CVE-2026-8007

Google Chrome and Microsoft Edge are affected by a privilege escalation vulnerability in the Cast component. The root cause is insufficient validation of untrusted input , which allows a remote attacker who has already compromised the renderer process to elevate privileges using a crafted HTML pa...

CVE-2026-8510

Google Chrome on Windows prior to version 148.0.7778.168 is vulnerable to an integer overflow in the Skia library. A remote attacker who has already compromised the renderer process can leverage this flaw to perform an out-of-bounds memory write by tricking the browser into loading a specially cr...

CVE-2026-8530

A use after free vulnerability in the Network component of Google Chrome on Windows (versions prior to 148.0.7778.168 ) allows a remote attacker who has already compromised the renderer process to potentially perform a sandbox escape using a crafted HTML page. This is categorized as a High severi...

CVE-2026-8532

Google Chrome and the Chromium browser are affected by an integer overflow in the XML component . This vulnerability exists in versions prior to 148.0.7778.168 and can be exploited by a remote attacker to execute arbitrary code inside a sandbox using a crafted HTML page. Impacting systems include...

CVE-2026-9985

Google Chrome and Microsoft Edge are affected by CVE-2026-9985 , a vulnerability in the Media component caused by insufficient validation of untrusted input. A remote attacker who has already compromised the renderer process can exploit this via a crafted HTML page to obtain potentially sensitive...

CVE-2010-2106

Google Chrome before 5.0.375.55 is reported to be vulnerable to spoofing the URL bar via vectors involving unload event handlers. The CVE-2010-2106 entry is supported by multiple sources (NVD, OpenVAS/Nessus aggregations) indicating a URL-spoofing flaw tied to unload handlers; the OpenVAS/Nessus ...

CVE-2010-3254

Technical details for CVE-2010-3254 are not publicly detailed in the provided connected documents. The set includes references and mappings to the CVE across OpenVAS, Ubuntu advisories, and NVD, but no concrete exploit vectors, affected versions beyond Chrome before 6.0.472.53, or remediation spe...

CVE-2010-3258

The CVE-2010-3258 issue affects Google Chrome prior to version 6.0.472.53, where the sandbox implementation fails to deserialize certain parameters, with the impact described as unspecified and remote attack vectors. The vulnerability is tied to the browser’s sandbox deserialization logic (Chrome...

CVE-2010-3412

CVE-2010-3412 refers to Google Chrome’s console implementation race condition in versions prior to 6.0.472.59. The description from the CVE entry states an unspecified impact/attack vector. Connected documents corroborate multiple vulnerability listings for Google Chrome around Sep 2010 (includin...

CVE-2010-3415

CVE-2010-3415 affects Google Chrome versions before 6.0.472.59; the flaw is in Geolocation handling that could cause memory corruption and a denial of service (or other unspecified impact) via unknown vectors. The connected documents also reference overlapping use-after-free Geolocation issues in...

CVE-2011-1194

Summary (CVE-2011-1194): Google Chrome before 10.0.648.127 contains multiple vulnerabilities that allow remote attackers to bypass the pop-up blocker via unknown vectors. The impact is bypass of the browser’s pop-up protections, with no detailed exploit information provided in the sources. Affect...

CVE-2011-1294

The CVE-2011-1294 entry corresponds to Google Chrome before version 10.0.648.204, where improper handling of CSS token sequences could cause a denial of service and possibly other impact via a stale pointer. Public records (NVD/OpenVAS entries) corroborate Chrome-related vulnerabilities in Mar 20...

CVE-2011-1303

Google Chrome prior to version 11.0.696.57 is affected by CVE-2011-1303 due to a stale pointer in the handling of floating objects, which can allow remote attackers to cause a denial of service or unspecified impact. The issue is addressed in Chrome 11.0.696.57, per vendor updates and vulnerabili...

CVE-2011-1439

CVE-2011-1439 affects Google Chrome on Linux prior to 11.0.696.57. The vulnerability arises from improper isolation of renderer processes, with unspecified impact and remote attack vectors described in the entry. The issue was fixed in Chrome 11.0.696.57 (stable update), per Google's Chrome relea...

CVE-2011-1801

CVE-2011-1801 affects Google Chrome prior to version 11.0.696.71. The vulnerability is described as unspecified and allows remote attackers to bypass the browser’s pop-up blocker via unknown vectors. Several connected sources confirm Chrome versions before 11.0.696.71 are impacted; some entries r...

CVE-2011-1812

Google Chrome CVE-2011-1812 affects Chrome pre-12.0.742.91. The vulnerability is an extensions-permission bypass that lets remote attackers bypass access restrictions via extensions. Public details in NVD state the issue; ThreatPost confirms Chrome 12.0.742.91 fixes multiple chrome vulnerabilitie...

CVE-2011-1813

Google Chrome vulnerability CVE-2011-1813 affects Chrome prior to 12.0.742.91, due to a flaw in the extension framework that can cause a stale pointer. This can lead to denial of service and possibly other impact via unspecified vectors. The issue is tied to multiple Chrome vulnerabilities fixed ...

CVE-2011-2784

CVE-2011-2784 concerns Google Chrome prior to 13.0.782.107, where a request for the GL program log could disclose a local file path in an unspecified log entry. The connected OpenVAS/Nessus entries group this with multiple Chrome vulnerabilities around the same era, but no explicit remediation ve...

CVE-2011-2789

CVE-2011-2789 : Use-after-free in Google Chrome prior to 13.0.782.107 allows remote attackers to cause a denial of service or other unspecified impact via vectors related to Pepper plug-in instantiation. A remediation exists: upgrade to Chrome 13.0.782.107 or later.

CVE-2011-2839

CVE-2011-2839 affects Google Chrome’s Linux PDF handling: the PDF implementation does not properly use memset, enabling remote DoS and possibly other impact via unknown vectors. A fix is available in Chrome 13.0.782.215 and later.

CVE-2011-2849

CVE-2011-2849 affects Google Chrome before 14.0.835.163. The WebSockets implementation can trigger a NULL pointer dereference, causing a denial of service (application crash) via unspecified vectors. Connected sources confirm Chrome/Chromium vulnerability tracking and a remediation pathway via up...

CVE-2011-3906

CVE-2011-3906 affects Google Chrome/Chromium prior to 16.0.912.63, arising from the PDF parser causing an out-of-bounds read that can lead to remote denial of service. The Gentoo GLSA and related OpenVAS entries reference Chromium vulnerabilities and list a fix by upgrading to Chromium 16.0.912.7...

CVE-2011-3914

CVE-2011-3914 affects the i18n functionality in Google V8 used by Chrome/Chromium prior to version 16.0.912.63, enabling a remote attacker to trigger an out-of-bounds write that can cause a denial of service and possibly other impact. The connected Gentoo GLSA notes multiple Chromium/V8 vulnerabi...

CVE-2011-3921

CVE-2011-3921: A use-after-free in Google Chrome prior to 16.0.912.75 affects the browser’s handling of animation frames, allowing remote-triggered denial of service and potentially other impact. Affected software: Google Chrome (pre-16.0.912.75). Root cause: use-after-free in animation-frame pro...

CVE-2011-3925

CVE-2011-3925 is a use-after-free vulnerability in the Safe Browsing feature of Chromium-based browsers, with exploitation possible via a navigation entry and an interstitial page, potentially causing denial of service through heap memory corruption (impact listed as partial confidentiality, inte...

CVE-2013-0889

CVE-2013-0889 concerns Google Chrome where the browser did not properly enforce a user gesture requirement before proceeding with a file download, potentially enabling remote code execution via a crafted file. The description specifies affected builds: Windows and Linux: before 25.0.1364.97 Mac O...

CVE-2017-15403

CVE-2017-15403 affects Chrome OS crosh networking (network_diag) due to insufficient data validation, enabling local command injection under chronos privileges via a crafted HTML page. Affected platforms include Chrome OS before 61.0.3163.113. Google Chrome OS update 61.0.3163.113 (stable channel...

CVE-2017-5090

CVE-2017-5090 affects Google Chrome on macOS, where the Omnibox failed to enforce domain policy, enabling a remote attacker to spoof domains using a crafted name containing U+0620. Impact is domain spoofing; attack details describe exploitation remotely via the Omnibox. The vulnerability is assoc...

CVE-2025-11215

An off-by-one error in the V8 engine allows a remote attacker to perform an out-of-bounds memory read via a crafted HTML page. This vulnerability affects Google Chrome prior to version 141.0.7390.54 , as well as other Chromium-based browsers. To remediate this issue, users should upgrade to the l...

CVE-2026-4440

Google Chrome and Microsoft Edge are affected by an out-of-bounds read and write vulnerability in the WebGL component. This flaw allows a remote attacker to perform arbitrary read/write operations by interacting with a specially crafted HTML page, potentially compromising the confidentiality, int...

CVE-2026-4459

Google Chrome versions prior to 146.0.7680.153 are vulnerable to an out-of-bounds read and write within the WebAudio component. A remote attacker can exploit this flaw via a crafted HTML page to trigger heap corruption , which may result in arbitrary code execution , denial of service , or inform...

CVE-2026-5869

A heap buffer overflow in the WebML component of Google Chrome (prior to version 147.0.7727.55 ) allows a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page . The vulnerability is classified with a High security severity by Chromium. Remediatio...

CVE-2026-5896

A policy bypass vulnerability exists in the Audio component of Google Chrome prior to version 147.0.7727.55 . The issue stems from deficiencies in access control , which could allow a remote attacker to bypass sandbox download restrictions by convincing a user to perform specific UI gestures on a...

CVE-2026-5903

A policy bypass in the IFrameSandbox component of Google Chrome (prior to version 147.0.7727.55) allows a remote attacker to bypass navigation restrictions. By convincing a user to engage in specific UI gestures , the attacker can use a crafted HTML page to circumvent these security policies. Thi...

CVE-2026-5910

Google Chrome versions prior to 147.0.7727.55 are vulnerable to an integer overflow in the Media component. A remote attacker can exploit this flaw via a crafted video file to potentially cause heap corruption , which may lead to service failure, arbitrary code execution, denial of service, or in...

CVE-2026-5913

Google Chrome versions prior to 147.0.7727.55 are vulnerable to an out-of-bounds read within the Blink rendering module. A remote attacker can exploit this flaw by delivering a crafted HTML page to cause an out-of-bounds memory read or a service failure . Remediation is available in version 147.0...

CVE-2026-7341

Google Chrome (and potentially Microsoft Edge) is vulnerable to a use-after-free flaw in the WebRTC component in versions prior to 147.0.7727.138 . This resource management issue allows a remote attacker to execute arbitrary code inside a sandbox by navigating the user to a crafted HTML page. Rem...

CVE-2026-7916

A high-severity vulnerability exists in the InterestGroups component of Google Chrome prior to version 148.0.7778.96 . The root cause is insufficient data validation , which allows a remote attacker who has already compromised the renderer process to perform a sandbox escape using a crafted HTML ...

CVE-2026-7927

CVE-2026-7927 is a Chrome sandbox Type Confusion in Runtime vulnerability affecting Google Chrome before version 148.0.7778.96. The issue, described in multiple connected sources, stems from a runtime type-handling confusion that could allow a remote attacker to execute arbitrary code within the ...

CVE-2026-7929

Google Chrome versions prior to 148.0.7778.96 are vulnerable to a Use after free vulnerability in the MediaRecording component. A remote attacker could exploit this by convincing a user to perform specific UI gestures while visiting a crafted HTML page, potentially leading to arbitrary code execu...

CVE-2026-7943

The ANGLE library in Google Chrome and Microsoft Edge is vulnerable to arbitrary read/write due to insufficient validation of untrusted input . A remote attacker who has already compromised the renderer process can exploit this by using a crafted HTML page. Impacted versions are those prior to 14...

CVE-2026-7950

Google Chrome and Microsoft Edge browsers are affected by an out-of-bounds read and write vulnerability in the GFX graphical subsystem. This flaw allows a remote attacker to perform arbitrary read/write operations via malicious network traffic, potentially leading to information disclosure or una...

CVE-2010-2296

Google Chrome before 5.0.375.70 is affected by CVE-2010-2296 due to the implementation of unspecified DOM methods that can bypass the Same Origin Policy via unknown vectors. The vulnerability enables remote attackers to circumvent SOP, with impact described as complete confidentiality/integrity/a...