CVE-2018-6156

CVE-2018-6156 affects Google Chrome/WebRTC: an incorrect derivation of a packet length in WebRTC can cause a heap-based buffer overflow, enabling potential remote arbitrary code execution via a crafted video file. The security notes in connected docs indicate the fix was applied in chrome-related...

CVE-2019-13668

CVE-2019-13668 affects Google Chrome prior to 77.0.3865.75, where insufficient policy enforcement in developer tools could allow a crafted HTML page to leak cross-origin data (information disclosure). The issue is documented across multiple sources (CVE entry and Debian/ Gentoo advisories) and ha...

CVE-2019-5814

CVE-2019-5814 affects Google Chrome/Chromium Blink: an insufficient policy enforcement in Blink allowed a remote attacker to leak cross-origin data via a crafted HTML page (CORS bypass). Impact: cross-origin data disclosure. Affected versions are before 74.0.3729.108. Remediation: upgrade to 74.0...

CVE-2020-6399

CVE-2020-6399 is a policy-enforcement error in the AppCache component of the Chromium browser that allows a remote attacker to leak cross-origin data via a crafted HTML page. Affected product: Chromium prior to version 80.0.3987.87 (Chrome-based). Root cause per the public records is insufficient...

CVE-2021-30565

The CVE-2021-30565 entry corresponds to an out-of-bounds write in Chrome/Chromium’s Tab Groups feature, exploitable on Linux/ChromeOS before 92.0.4515.107 when a user is coaxed into loading a crafted page or extension. Connected sources (Astra Linux bulletin and ASA-202108-5) confirm the flaw is ...

CVE-2022-0796

CVE-2022-0796 affects Google Chrome/Chromium via a Use-after-free in Media vulnerability present before version 99.0.4844.51 . The issue could allow a remote attacker to exploit a heap corruption condition through a crafted HTML page. Affected platforms include Chromium-based packages across dist...

CVE-2022-1125

CVE-2022-1125 affects Portals in Google Chrome prior to 100.0.4896.60, with the vulnerability described as a Use-after-Free that could allow a remote attacker to trigger heap corruption via specific user interaction. The Chrome security update (Chrome 100) fixes this and other issues; Debian secu...

CVE-2023-1221

The CVE-2023-1221 entry describes a Chromium-based issue in Google Chrome’s Extensions API: insufficient policy enforcement allowed a user-assisted attacker to bypass navigation restrictions via a crafted extension in Chrome prior to 111.0.5563.64. Affected software is Google Chrome/Chromium with...

CVE-2023-5484

The CVE-2023-5484 entry concerns Chrome/Chromium where an inappropriate implementation in the Navigation UI allows a remote attacker to spoof security UI via a crafted HTML page. Affected product: Google Chrome/Chromium browser. Root cause: navigation handling in Chromium before 118.0.5993.70 per...

CVE-2024-4558

CVE-2024-4558: Use-after-free in ANGLE within Google Chrome/Chromium's WebKit/ANGLE path allows a remote attacker to potentially trigger heap corruption via a crafted HTML page. Affects Chrome/Chromium builds prior to version 124.0.6367.155. The issue is addressed in the referenced Chrome update;...

CVE-2026-3925

CVE-2026-3925 affects Google Chrome on Android (prior to 146.0.7680.71) due to an incorrect security UI in LookalikeChecks that enables UI spoofing via a crafted HTML page. The issue is tied to Chromium’s Lookalike UI handling; multiple advisories and Debian/Fedora updates reference Chromium/Chro...

CVE-2019-13666

CVE-2019-13666 : Google Chrome information leak in storage prior to 77.0.3865.75. Root cause: an information leak in storage that allowed cross-origin data to be exposed via a crafted HTML page. Impact: partial confidentiality loss with HIGH impact per CVSS3.1 (base score 7.4); attack vector NETW...

CVE-2019-13696

Chromium/Google Chrome prior to version 77.0.3865.120 is affected by CVE-2019-13696 due to a use-after-free in the V8 component. This vulnerability could allow a remote attacker to execute arbitrary code via a crafted HTML page, with the issue fixed in 77.0.3865.120 according to multiple advisori...

CVE-2020-6462

CVE-2020-6462 is a use-after-free in Chrome/Chromium task scheduling that could allow a renderer-compromised remote attacker to escape the sandbox via a crafted HTML page. Affected: Google Chrome/Chromium prior to 81.0.4044.129. Impact and remediation as stated in connected sources: patches exist...

CVE-2020-6512

CVE-2020-6512: A type confusion in Google Chrome’s V8 engine prior to 84.0.4147.89 could allow a remote attacker to exploit heap corruption via a crafted HTML page, potentially enabling arbitrary code execution. Affected product: Chrome (V8). Root cause: type confusion in V8. Impact: remote code ...

CVE-2021-21191

CVE-2021-21191 is a use-after-free vulnerability in the WebRTC component of Chromium-based browsers (Google Chrome) prior to 89.0.4389.90. The issue allows a remote attacker to potentially exploit heap corruption via a crafted HTML page, as described in the CVE entry. Connected documents confirm ...

CVE-2022-1479

CVE-2022-1479 is a Chrome/Chromium issue affecting the ANGLE component and was described as a use-after-free vulnerability that could allow a remote attacker to cause heap corruption via a crafted HTML page. The vulnerability is tied to Google Chrome prior to version 101.0.4951.41. Public bulleti...

CVE-2023-5486

The CVE-2023-5486 entry concerns Google Chrome/Chromium prior to 118.0.5993.70 where an inappropriate input handling implementation could let a remote attacker spoof the security UI via a crafted HTML page. The issue is classified with Low severity; the initial record notes a Chromium-based vulne...

CVE-2019-13701

CVE-2019-13701 : A URL spoofing issue in Google Chrome/Chromium was caused by an incorrect implementation in navigation that allowed a remote attacker to spoof the Omnibox (URL bar) via a crafted page, prior to version 78.0.3904.70. Public records indicate the vulnerability affects Chromium/Chrom...

CVE-2019-5773

CVE-2019-5773 : Insufficient origin validation in IndexedDB in Google Chrome before 72.0.3626.81 allows a remote attacker who compromised the renderer process to bypass the same-origin policy via a crafted HTML page. Affected product/version: Google Chrome (IndexedDB). Root cause: origin validati...

CVE-2019-5835

CVE-2019-5835 describes an object lifecycle issue in the SwiftShader component of Google Chrome/Chromium prior to 75.0.3770.80 that could allow a remote attacker to perform out-of-bounds memory access via a crafted HTML page. Public advisories and trackers consistently tie this CVE to Chrome/Chro...

CVE-2019-5872

CVE-2019-5872 describes a use-after-free in Chrome’s Mojo component that could be triggered by a crafted HTML page, potentially allowing heap corruption. Affected: Google Chrome (Mojo path), version before 77.0.3865.75. Exploitation details, specific impact, and exact remediation are not provided...

CVE-2019-5881

CVE-2019-5881 : Out-of-bounds read in SwiftShader used by Google Chrome allowed remote attackers to obtain potentially sensitive information from process memory via a crafted HTML page. Affected product: Google Chrome (SwiftShader component). Root cause: memory read beyond bounds. Impact: informa...

CVE-2020-6412

CVE-2020-6412 affects Chromium/Google Chrome Omnibox: insufficient validation of untrusted input allows domain spoofing via IDN homographs in crafted domain names. Root cause is input validation flaw in Omnibox prior to 80.0.3987.87. Documents confirm affected component and version range and prov...

CVE-2020-6468

CVE-2020-6468 is a type confusion vulnerability in the V8 JavaScript engine used by Google Chrome/Chromium, affecting versions prior to 83.0.4103.61. The issue, identified in the V8 component, can lead to heap corruption and potential remote code execution when a user visits a specially crafted H...

CVE-2020-6486

CVE-2020-6486 is an access restriction bypass in the navigations component of the Chromium/Google Chrome browser, prior to version 83.0.4103.61. The vulnerability stems from insufficient policy enforcement in navigations, enabling a remote attacker to bypass navigation restrictions via a crafted ...

CVE-2021-30557

CVE-2021-30557 is a use-after-free vulnerability in the Chromium-based TabGroups component prior to version 91.0.4472.114. The issue can allow a remote attacker to trigger heap corruption via a crafted HTML page after guiding a user to install a malicious extension, potentially leading to arbitra...

CVE-2022-2623

CVE-2022-2623 refers to a Use-After-Free in Offline in Google Chrome on Android before 104.0.5112.79, which could allow heap corruption when a user engages in specific UI interactions after a convincing prompt. The CVE is associated with Chrome/Chromium code paths affecting offline UI, with the N...

CVE-2019-13665

CVE-2019-13665 affects Chromium/Google Chrome’s Blink component. Description: insufficient filtering in Blink allowed a crafted HTML page to bypass multiple file download protections. Impact: remote attacker could bypass download protections via a malicious page on affected Chrome/Chromium builds...

CVE-2019-13677

CVE-2019-13677 concerns Google Chrome/Chromium: insufficient policy enforcement in site isolation allowed remote bypass via a crafted HTML page. Connected advisories confirm the vulnerability and provide remediation guidance: Chromium/Chrome fixed in the 78.0.3904.97 series (Debian DSA-4562-1 lis...

CVE-2020-6410

CVE-2020-6410 affects Chromium/Chrome: insufficient policy enforcement in the navigation component prior to 80.0.3987.87 could confuse users via a crafted domain name. Affected products include Chromium/Chrome; root cause: navigation policy enforcement issue. Impact per sources: user confusion po...

CVE-2020-6534

CVE-2020-6534: Heap buffer overflow in WebRTC of Google Chrome (Chromium) prior to 84.0.4147.89. A crafted HTML page could trigger heap corruption, potentially enabling arbitrary code execution. The connected FreeBSD/Vuxml entry confirms CVE-2020-6534 as part of Chrome/Chromium security fixes and...

CVE-2020-6536

CVE-2020-6536 affects Google Chrome/Chromium PWAs. Root cause: Incorrect security UI in PWAs allowed a crafted PWA to spoof the Omnibox (URL bar). Impact: potential for spoofing the address bar content via a remote PWA installation. Remediation: update to Chrome/Chromium 84.0.4147.89 (stable chan...

CVE-2022-2008

CVE-2022-2008 involves a double free in WebGL in Google Chrome, enabling potential heap corruption via a crafted HTML page. Affected software is Google Chrome (Chromium/WebGL stack); root cause is a WebGL double-free condition leading to memory corruption. Impact states remote code execution/comp...

CVE-2019-13754

CVE-2019-13754 affects Google Chrome/Chromium where insufficient policy enforcement in extensions could let a remote attacker bypass navigation restrictions via a crafted HTML page. The vulnerability is scoped to Chrome versions before 79.0.3945.79. Public advisories and updates indicate remediat...

CVE-2019-5768

CVE-2019-5768 affects Google Chrome prior to 72.0.3626.81. The vulnerability arises from DevTools API not correctly gating on extension capability in DevTools, enabling an attacker who persuades a user to install a malicious Chrome Extension to read local files. The issue is fixed by updating to ...

CVE-2020-6387

CVE-2020-6387 is an out-of-bounds write in WebRTC’s video timing extension within Chromium-based Chrome prior to 80.0.3987.87. The bug occurs during Forward Error Correction processing when clearing certain RTP extensions (video timing); the code clears six bytes at a fixed offset without verifyi...

CVE-2022-2295

The CVE-2022-2295 issue is a type confusion in V8 affecting Google Chrome/Chromium, prior to version 103.0.5060.114, enabling a remote attacker to potentially trigger heap corruption via a crafted HTML page. Public details across connected sources confirm the affected component as Chromium’s V8 e...

CVE-2022-4174

Summary: CVE-2022-4174 is a type confusion in V8 used by Google Chrome/Chromium prior to 108.0.5359.71 that could allow a remote attacker to trigger heap corruption via a crafted HTML page. The issue is listed with a Chromium security severity of High and is reflected in multiple advisories and t...

CVE-2023-4357

CVE-2023-4357 affects Google Chrome (Chromium-based) and its Chromium derivatives. The vulnerability is caused by insufficient validation of untrusted input in XML, enabling a remote attacker to bypass file access restrictions via a crafted HTML page. Public records confirm impact on Chrome befor...

CVE-2019-13699

CVE-2019-13699 pertains to the Chromium/Google Chrome media component prior to version 78.0.3904.70, where a use-after-free in media could be triggered by a crafted page and lead to heap corruption or arbitrary code execution. The vulnerability can be exploited by remote attackers who have compro...

CVE-2019-13749

CVE-2019-13749 is a UI spoof vulnerability in the Omnibox (URL bar) of Google Chrome/Chromium. The issue allowed spoofing via a crafted page. Mitigation observed in connected advisories: update to a patched Chrome/Chromium version (e.g., Debian/Ubuntu debs list fixes to 79.0.3945.130+; Fedora upd...

CVE-2019-13756

CVE-2019-13756 concerns Google Chrome’s and Chromium’s printing UI. The vulnerability is due to an incorrect security UI in printing that can allow a remote attacker to spoof the domain via a crafted HTML page, leading to domain spoofing. Affected version in the original entry is before 79.0.3945...

CVE-2019-5807

CVE-2019-5807 is a memory corruption issue in the V8 JavaScript engine in Google Chrome/Chromium prior to 74.0.3729.108. The vulnerability exists in V8’s handling of crafted HTML pages, potentially enabling heap corruption and remote code execution through a page load. Remediation across affected...

CVE-2019-5865

CVE-2019-5865 describes a site isolation bypass in Chromium/ Google Chrome prior to 76.0.3809.87 due to insufficient policy enforcement in navigations when a renderer is compromised. The vulnerability allowed a remote attacker to bypass site isolation via a crafted HTML page, enabling potential a...

CVE-2019-5766

CVE-2019-5766 describes an incorrect origin taint handling in Canvas within Chromium/Google Chrome, which could allow a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability is tied to the Canvas origin taint check and is listed against Chrome versions prior to 72.0...

CVE-2019-5840

CVE-2019-5840 is a vulnerability tied to Google Chrome/Chromium where an incorrect security UI in the iOS popup blocker allowed bypassing navigation restrictions via a crafted HTML page. Public sources in Debian/Gentoo advisories specify that fixes were delivered by updating Chromium/Chrome to ne...

CVE-2018-20073

CVE-2018-20073 concerns Google Chrome prior to 72.0.3626.81, where use of extended attributes in downloads could allow a local attacker to read download URLs via the filesystem (information leakage). The CVE is evidenced in multiple sources, including the NVD entry and Debian/openSUSE/OSS advisor...

CVE-2019-13703

CVE-2019-13703 is a URL bar spoofing vulnerability in Chromium-based Chrome/Chromium prior to version 78.0.3904.70. Root cause: insufficient policy enforcement in the Omnibox (address bar) allowing a crafted HTML page to spoof its contents. Affects Google Chrome on Android and Chromium-derived br...

CVE-2019-5852

CVE-2019-5852 is an information-disclosure vulnerability in Chromium/Google Chrome prior to 76.0.3809.87. The initial description notes an inappropriate JavaScript implementation that could leak memory contents via a crafted HTML page. Connected sources confirm Chromium before 76.0.3809.87 is aff...