CVE-2019-5835

CVE-2019-5835 describes an object lifecycle issue in the SwiftShader component of Google Chrome/Chromium prior to 75.0.3770.80 that could allow a remote attacker to perform out-of-bounds memory access via a crafted HTML page. Public advisories and trackers consistently tie this CVE to Chrome/Chro...

CVE-2020-6410

CVE-2020-6410 affects Chromium/Chrome: insufficient policy enforcement in the navigation component prior to 80.0.3987.87 could confuse users via a crafted domain name. Affected products include Chromium/Chrome; root cause: navigation policy enforcement issue. Impact per sources: user confusion po...

CVE-2020-6486

CVE-2020-6486 is an access restriction bypass in the navigations component of the Chromium/Google Chrome browser, prior to version 83.0.4103.61. The vulnerability stems from insufficient policy enforcement in navigations, enabling a remote attacker to bypass navigation restrictions via a crafted ...

CVE-2021-21191

CVE-2021-21191 is a use-after-free vulnerability in the WebRTC component of Chromium-based browsers (Google Chrome) prior to 89.0.4389.90. The issue allows a remote attacker to potentially exploit heap corruption via a crafted HTML page, as described in the CVE entry. Connected documents confirm ...

CVE-2023-1229

The CVE-2023-1229 entry concerns Google Chrome (Chromium-based) prior to version 111.0.5563.64. Affected component: Permission prompts implementation. Root cause: Inappropriate implementation in Permission prompts allowed a remote attacker to bypass navigation restrictions via a crafted HTML page...

CVE-2019-13701

CVE-2019-13701 : A URL spoofing issue in Google Chrome/Chromium was caused by an incorrect implementation in navigation that allowed a remote attacker to spoof the Omnibox (URL bar) via a crafted page, prior to version 78.0.3904.70. Public records indicate the vulnerability affects Chromium/Chrom...

CVE-2019-5865

CVE-2019-5865 describes a site isolation bypass in Chromium/ Google Chrome prior to 76.0.3809.87 due to insufficient policy enforcement in navigations when a renderer is compromised. The vulnerability allowed a remote attacker to bypass site isolation via a crafted HTML page, enabling potential a...

CVE-2019-5881

CVE-2019-5881 : Out-of-bounds read in SwiftShader used by Google Chrome allowed remote attackers to obtain potentially sensitive information from process memory via a crafted HTML page. Affected product: Google Chrome (SwiftShader component). Root cause: memory read beyond bounds. Impact: informa...

CVE-2020-6387

CVE-2020-6387 is an out-of-bounds write in WebRTC’s video timing extension within Chromium-based Chrome prior to 80.0.3987.87. The bug occurs during Forward Error Correction processing when clearing certain RTP extensions (video timing); the code clears six bytes at a fixed offset without verifyi...

CVE-2020-6468

CVE-2020-6468 is a type confusion vulnerability in the V8 JavaScript engine used by Google Chrome/Chromium, affecting versions prior to 83.0.4103.61. The issue, identified in the V8 component, can lead to heap corruption and potential remote code execution when a user visits a specially crafted H...

CVE-2020-6534

CVE-2020-6534: Heap buffer overflow in WebRTC of Google Chrome (Chromium) prior to 84.0.4147.89. A crafted HTML page could trigger heap corruption, potentially enabling arbitrary code execution. The connected FreeBSD/Vuxml entry confirms CVE-2020-6534 as part of Chrome/Chromium security fixes and...

CVE-2020-6536

CVE-2020-6536 affects Google Chrome/Chromium PWAs. Root cause: Incorrect security UI in PWAs allowed a crafted PWA to spoof the Omnibox (URL bar). Impact: potential for spoofing the address bar content via a remote PWA installation. Remediation: update to Chrome/Chromium 84.0.4147.89 (stable chan...

CVE-2021-30565

The CVE-2021-30565 entry corresponds to an out-of-bounds write in Chrome/Chromium’s Tab Groups feature, exploitable on Linux/ChromeOS before 92.0.4515.107 when a user is coaxed into loading a crafted page or extension. Connected sources (Astra Linux bulletin and ASA-202108-5) confirm the flaw is ...

CVE-2022-0807

CVE-2022-0807 refers to an inappropriate Autofill implementation in Google Chrome before 99.0.4844.51. A remote attacker could bypass navigation restrictions via a crafted HTML page. Public sources corroborate a Chrome/Chromium family impact and cite the fix in 99.0.4844.51 (Chromium-based browse...

CVE-2022-2477

The CVE-2022-2477 entry corresponds to a use-after-free in Chrome/Chromium’s Guest View prior to 103.0.5060.134, potentially permitting heap corruption when a user is coaxed to install a malicious extension and render a crafted HTML page. Affected component: Guest View in Chrome/Chromium. Root ca...

CVE-2023-5484

The CVE-2023-5484 entry concerns Chrome/Chromium where an inappropriate implementation in the Navigation UI allows a remote attacker to spoof security UI via a crafted HTML page. Affected product: Google Chrome/Chromium browser. Root cause: navigation handling in Chromium before 118.0.5993.70 per...

CVE-2024-7025

CVE-2024-7025 describes an integer overflow in the Layout component of Google Chrome, exploitable via a crafted HTML page to cause heap corruption. Multiple connected advisories confirm the issue affects Chrome builds prior to version 129.0.6668.89 and have been addressed in later releases. Publi...

CVE-2019-13730

CVE-2019-13730 is a type confusion in Google Chrome's V8 JavaScript engine (Chromium-derived) that could allow a remote attacker to trigger heap corruption via a crafted HTML page. The vulnerability is in the JavaScript engine (V8) and is one of multiple Chromium/Chrome issues disclosed for CVE-2...

CVE-2019-5807

CVE-2019-5807 is a memory corruption issue in the V8 JavaScript engine in Google Chrome/Chromium prior to 74.0.3729.108. The vulnerability exists in V8’s handling of crafted HTML pages, potentially enabling heap corruption and remote code execution through a page load. Remediation across affected...

CVE-2019-5840

CVE-2019-5840 is a vulnerability tied to Google Chrome/Chromium where an incorrect security UI in the iOS popup blocker allowed bypassing navigation restrictions via a crafted HTML page. Public sources in Debian/Gentoo advisories specify that fixes were delivered by updating Chromium/Chrome to ne...

CVE-2022-1638

CVE-2022-1638 is a Chromium/Google Chrome vulnerability: a heap buffer overflow in V8 Internationalization that can enable heap corruption via a crafted HTML page. The issue affects Chrome/Chromium builds prior to 101.0.4951.64 and is described as a remote-execution risk with high impact (C/H/I/A...

CVE-2022-2623

CVE-2022-2623 refers to a Use-After-Free in Offline in Google Chrome on Android before 104.0.5112.79, which could allow heap corruption when a user engages in specific UI interactions after a convincing prompt. The CVE is associated with Chrome/Chromium code paths affecting offline UI, with the N...

CVE-2018-20073

CVE-2018-20073 concerns Google Chrome prior to 72.0.3626.81, where use of extended attributes in downloads could allow a local attacker to read download URLs via the filesystem (information leakage). The CVE is evidenced in multiple sources, including the NVD entry and Debian/openSUSE/OSS advisor...

CVE-2019-13703

CVE-2019-13703 is a URL bar spoofing vulnerability in Chromium-based Chrome/Chromium prior to version 78.0.3904.70. Root cause: insufficient policy enforcement in the Omnibox (address bar) allowing a crafted HTML page to spoof its contents. Affects Google Chrome on Android and Chromium-derived br...

CVE-2019-13754

CVE-2019-13754 affects Google Chrome/Chromium where insufficient policy enforcement in extensions could let a remote attacker bypass navigation restrictions via a crafted HTML page. The vulnerability is scoped to Chrome versions before 79.0.3945.79. Public advisories and updates indicate remediat...

CVE-2019-13756

CVE-2019-13756 concerns Google Chrome’s and Chromium’s printing UI. The vulnerability is due to an incorrect security UI in printing that can allow a remote attacker to spoof the domain via a crafted HTML page, leading to domain spoofing. Affected version in the original entry is before 79.0.3945...

CVE-2021-30555

CVE-2021-30555 is a use-after-free in the Chromium Sharing component up to version 91.0.4472.114. An attacker could exploit heap corruption by convincing a user to install a malicious extension and rendering a crafted HTML page with user gesture. Impact described as arbitrary code execution/remot...

CVE-2021-30557

CVE-2021-30557 is a use-after-free vulnerability in the Chromium-based TabGroups component prior to version 91.0.4472.114. The issue can allow a remote attacker to trigger heap corruption via a crafted HTML page after guiding a user to install a malicious extension, potentially leading to arbitra...

CVE-2023-1221

The CVE-2023-1221 entry describes a Chromium-based issue in Google Chrome’s Extensions API: insufficient policy enforcement allowed a user-assisted attacker to bypass navigation restrictions via a crafted extension in Chrome prior to 111.0.5563.64. Affected software is Google Chrome/Chromium with...

CVE-2019-13749

CVE-2019-13749 is a UI spoof vulnerability in the Omnibox (URL bar) of Google Chrome/Chromium. The issue allowed spoofing via a crafted page. Mitigation observed in connected advisories: update to a patched Chrome/Chromium version (e.g., Debian/Ubuntu debs list fixes to 79.0.3945.130+; Fedora upd...

CVE-2019-13767

CVE-2019-13767 describes a use-after-free in Chrome’s media picker. A remote attacker who has compromised the renderer could trigger heap corruption via a crafted HTML page in Google Chrome prior to version 79.0.3945.88. The available documents confirm the affected component (media picker/rendere...

CVE-2019-5766

CVE-2019-5766 describes an incorrect origin taint handling in Canvas within Chromium/Google Chrome, which could allow a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability is tied to the Canvas origin taint check and is listed against Chrome versions prior to 72.0...

CVE-2019-5853

CVE-2019-5853 concerns Google Chrome prior to 76.0.3809.87, where a memory corruption issue occurs in the regexp length checks. The CVE entry originates from Chrome’s security release for version 76 and is listed among multiple Chrome vulnerabilities resolved in the 76.0.3809.87 update. The vulne...

CVE-2021-21229

CVE-2021-21229: An incorrect security UI issue in the downloads component of Chromium/Chrome prior to 90.0.4430.93 allowed a remote attacker to spoof the domain via a crafted HTML page. Public bulletins confirm impact and patch availability; Debian notes fix in 90.0.4430.93-1, with other advisori...

CVE-2019-13683

CVE-2019-13683 affects Google Chrome prior to 77.0.3865.75, where insufficient policy enforcement in developer tools could allow a crafted HTML page to leak cross-origin data. The vulnerability is a cross-origin data disclosure via the browser’s developer tools surface, with network-vector exposu...

CVE-2019-13706

CVE-2019-13706 affects Chromium/Google Chrome PDFium: an out-of-bounds read in PDFium before 78.0.3904.70. This is reported as information disclosure in multiple sources. Impact is bounded to unauthorized data exposure via crafted PDFs. Remediation: upgrade to Chromium/Chrome 78.0.3904.70 or newe...

CVE-2019-5837

CVE-2019-5837 affects Blink in Google Chrome (Chromium-based) prior to 75.0.3770.80, allowing an remote attacker to leak cross-origin data via a crafted HTML page (information disclosure). Debian security advisories indicate fixes in Chromium packages to 76.0.3809.100+; upgrade to the latest Chro...

CVE-2019-5852

CVE-2019-5852 is an information-disclosure vulnerability in Chromium/Google Chrome prior to 76.0.3809.87. The initial description notes an inappropriate JavaScript implementation that could leak memory contents via a crafted HTML page. Connected sources confirm Chromium before 76.0.3809.87 is aff...

CVE-2022-1479

CVE-2022-1479 is a Chrome/Chromium issue affecting the ANGLE component and was described as a use-after-free vulnerability that could allow a remote attacker to cause heap corruption via a crafted HTML page. The vulnerability is tied to Google Chrome prior to version 101.0.4951.41. Public bulleti...

CVE-2022-1487

CVE-2022-1487 describes a use-after-free in Ozone within Google Chrome/Chromium, allowing potential remote heap corruption when running a Wayland test. Affected product/portion: Ozone in Chrome/Chromium prior to version 101.0.4951.41. Root cause: use-after-free vulnerability in Ozone components. ...

CVE-2022-2008

CVE-2022-2008 involves a double free in WebGL in Google Chrome, enabling potential heap corruption via a crafted HTML page. Affected software is Google Chrome (Chromium/WebGL stack); root cause is a WebGL double-free condition leading to memory corruption. Impact states remote code execution/comp...

CVE-2023-4357

CVE-2023-4357 affects Google Chrome (Chromium-based) and its Chromium derivatives. The vulnerability is caused by insufficient validation of untrusted input in XML, enabling a remote attacker to bypass file access restrictions via a crafted HTML page. Public records confirm impact on Chrome befor...

CVE-2018-6126

CVE-2018-6126 is a Skia-related heap/buffer overflow in Google Chrome prior to 67.0.3396.62. A precision error in Skia could allow a remote attacker to perform an out-of-bounds memory write via a crafted HTML page, enabling potential arbitrary code execution. Publicly, this vulnerability is track...

CVE-2019-5778

CVE-2019-5778 affects Google Chrome/Chromium extensions. The available description states a missing case in handling special schemes during permission request checks in Extensions, allowing bypass of extension permission checks for privileged pages via a crafted Chrome Extension (pre 72.0.3626.81...

CVE-2019-5857

Chromium/Google Chrome vulnerable to CVE-2019-5857 prior to version 76.0.3809.87. A denial-of-service crash can occur due to a faulty comparison between -0 and null in Chromium before this patch. Affected packages include Chromium on Arch Linux (pre-76.0.3809.87) and Debian/SEC advisories note fi...

CVE-2019-5860

CVE-2019-5860 is a use-after-free in the PDFium component of Chromium/Google Chrome prior to 76.0.3809.87. The vulnerability can potentially lead to heap corruption and remote code execution via a crafted PDF file. Multiple connected advisories confirm the affected component (PDFium) and the vers...

CVE-2020-6394

Chromium vulnerability CVE-2020-6394 is a Blink policy enforcement bypass in Chrome/Chromium prior to 80.0.3987.87, allowing a remote attacker to bypass Content Security Policy via a crafted HTML page. Affected products: Chromium before 80.0.3987.87 (up to 80.0.3987.87-1 in some updates). Root ca...

CVE-2022-0789

CVE-2022-0789 is a heap buffer overflow in ANGLE used by Google Chrome (and Chromium components) prior to version 99.0.4844.51. The vulnerability allows a remote attacker to trigger heap corruption through a crafted HTML page, with potential for arbitrary code execution. Affected ecosystem includ...

CVE-2023-5486

The CVE-2023-5486 entry concerns Google Chrome/Chromium prior to 118.0.5993.70 where an inappropriate input handling implementation could let a remote attacker spoof the security UI via a crafted HTML page. The issue is classified with Low severity; the initial record notes a Chromium-based vulne...

CVE-2019-13745

CVE-2019-13745 affects Google Chrome (Chromium) prior to 79.0.3945.79. It is a policy enforcement error in the audio component that could allow a remote attacker to leak cross-origin data via a crafted HTML page. The entry lists the vulnerable condition and version range but does not provide expl...