CVE-2026-91749

A use after free vulnerability in Workers within Google Chrome prior to version 153.0.8010.47 allows a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. This issue is addressed in Chromium and Microsoft Edge (Chromium-based) through downstream upda...

CVE-2019-13683

CVE-2019-13683 affects Google Chrome prior to 77.0.3865.75, where insufficient policy enforcement in developer tools could allow a crafted HTML page to leak cross-origin data. The vulnerability is a cross-origin data disclosure via the browser’s developer tools surface, with network-vector exposu...

CVE-2019-13706

CVE-2019-13706 affects Chromium/Google Chrome PDFium: an out-of-bounds read in PDFium before 78.0.3904.70. This is reported as information disclosure in multiple sources. Impact is bounded to unauthorized data exposure via crafted PDFs. Remediation: upgrade to Chromium/Chrome 78.0.3904.70 or newe...

CVE-2019-13763

CVE-2019-13763 affects Google Chrome: Insufficient policy enforcement in payments in Chrome prior to 79.0.3945.79 allowed a renderer-compromised remote attacker to leak cross-origin data via a crafted HTML page. Affected software is Chrome (renderer process context) with the vulnerability tied to...

CVE-2020-6388

CVE-2020-6388 is an out-of-bounds read in the WebAudio component of Chromium/Google Chrome, prior to version 80.0.3987.87. The issue could allow a remote attacker to trigger heap-related memory corruption via a crafted HTML page, potentially affecting memory safety and information exposure. Publi...

CVE-2020-6389

CVE-2020-6389 is an out-of-bounds write in Chrome’s WebRTC implementation (frame marking extension) that can occur when processing RTP frames. The vulnerability arises because WebRTC accepts layer_info entries up to seven, but it only allocates storage for five elements, allowing a write beyond t...

CVE-2020-6395

CVE-2020-6395 is an out-of-bounds read in the JavaScript component of Chromium/Google Chrome prior to version 80.0.3987.87 that could allow a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. The vulnerability is addressed in upstream Chromiu...

CVE-2020-6396

CVE-2020-6396 corresponds to an Inappropriate implementation in Skia used by Google Chrome before 80.0.3987.87, enabling a remote attacker to spoof the Omnibox (URL bar) via a crafted HTML page. Connected sources (Debian DSA-4638-1 and related advisories) confirm the issue resides in Skia and was...

CVE-2020-6448

CVE-2020-6448 is a use-after-free in the V8 JavaScript engine used by Google Chrome (Chromium). The issue could allow a remote attacker to trigger heap corruption via a crafted HTML page. Public details identify the vulnerability as part of the Chrome/Chromium 81.x timeframe, with fixes shipped i...

CVE-2020-6513

CVE-2020-6513 is documented in multiple sources as a heap buffer overflow in PDFium affecting Chromium/Google Chrome. Connected documents confirm it was among a set of Chromium vulnerabilities addressed in updates, with Debian's DSA-4824-1 noting fixes in Chromium 87.0.4280.88 for the buster rele...

CVE-2020-6523

CVE-2020-6523: Out-of-bounds write in Skia used by Google Chrome prior to 84.0.4147.89. This could allow remote execution via heap corruption triggered by a crafted HTML page. Affected software: Google Chrome (Skia component); underlying issue described as an out-of-bounds write in Skia. Impact p...

CVE-2026-84358

Improper privilege management in Downloads within Google Chrome (prior to version 152.0.7977.75) allows a remote attacker who has compromised the renderer process to spoof the address bar using a crafted HTML page. This vulnerability also affects Microsoft Edge (Chromium-based) and Chromium brows...

CVE-2019-5872

CVE-2019-5872 describes a use-after-free in Chrome’s Mojo component that could be triggered by a crafted HTML page, potentially allowing heap corruption. Affected: Google Chrome (Mojo path), version before 77.0.3865.75. Exploitation details, specific impact, and exact remediation are not provided...

CVE-2020-6450

CVE-2020-6450: A use-after-free in Chromium/Google Chrome’s WebAudio before version 80.0.3987.162 could allow a remote attacker to potentially cause heap corruption via a crafted HTML page. The issue affects Chromium/Chrome prior to the fixed build and has been addressed upstream with version 80....

CVE-2022-1484

CVE-2022-1484 refers to a heap buffer overflow in the Web UI Settings component of Google Chrome before 101.0.4951.41. The vulnerability could allow a remote attacker to potentially trigger heap corruption by presenting a crafted HTML page, with impact described as high for confidentiality, integ...

CVE-2026-15131

A vulnerability exists in the Navigation component of the Google Chrome and Microsoft Edge web browsers (specifically Chromium ). The issue stems from insufficient validation of input data , which allows a remote attacker to bypass site isolation using a specially crafted HTML page. This bypass c...

CVE-2019-13715

CVE-2019-13715 affects Google Chrome/Chromium: insufficient validation in Omnibox enables domain spoofing via IDN homographs. Public advisories show fixes in Chromium 78.0.3904.70+ (Chrome/Chromium updates; Debian notes 78.0.3904.70-1, Mageia references 78.0.3904.87). Remediation: update to a ver...

CVE-2019-5865

CVE-2019-5865 describes a site isolation bypass in Chromium/ Google Chrome prior to 76.0.3809.87 due to insufficient policy enforcement in navigations when a renderer is compromised. The vulnerability allowed a remote attacker to bypass site isolation via a crafted HTML page, enabling potential a...

CVE-2020-6415

CVE-2020-6415 is an implementation error in the JavaScript component of Chromium/Google Chrome prior to 80.0.3987.87 that could enable a remote attacker to trigger heap corruption via a crafted HTML page. The issue is documented across multiple connected advisories (Debian, Fedora, Gentoo, Arch L...

CVE-2020-6471

CVE-2020-6471 concerns Google Chrome prior to 83.0.4103.61, where insufficient policy enforcement in the Developer Tools could allow a user-initiated extension to escape the sandbox. The vulnerability is attributed to a policy enforcement error in the Chromium developer tools component, potential...

CVE-2020-6491

CVE-2020-6491 affects Chromium/Google Chrome prior to 83.0.4103.61. The issue is an insufficient data validation in the site information component, enabling a remote attacker to spoof the security UI via a crafted domain. Impact involves content spoofing; remediation is to upgrade Chromium/Chrome...

CVE-2020-6511

CVE-2020-6511 is a side-channel information leakage in Chrome/Chromium’s content security policy that could disclose cross-origin data via a crafted HTML page. Affected products: Google Chrome/Chromium before 84.0.4147.89. Impact: cross-origin data disclosure. Root cause: CSP implementation leaka...

CVE-2021-30544

CVE-2021-30544: Use-after-free in BFCache of Chromium prior to 91.0.4472.101. This enables a remote attacker to potentially trigger heap corruption via a crafted HTML page. Affected component is BFCache (and related browser parts cited in parallel advisories); impact is arbitrary code execution o...

CVE-2022-1479

CVE-2022-1479 is a Chrome/Chromium issue affecting the ANGLE component and was described as a use-after-free vulnerability that could allow a remote attacker to cause heap corruption via a crafted HTML page. The vulnerability is tied to Google Chrome prior to version 101.0.4951.41. Public bulleti...

CVE-2024-2887

CVE-2024-2887 is a Type Confusion in WebAssembly in Google Chrome prior to 123.0.6312.86 that allows remote code execution via a crafted HTML page. Connected sources confirm this affects Chromium/WebAssembly, with public disclosures tied to Pwn2Own 2024. The Chrome/Bugfix release 123.0.6312.86 (a...

CVE-2026-19149

Google Chrome on Linux versions prior to 151.0.7922.109 is vulnerable to a use-after-free flaw in the Aura component. A remote attacker could exploit this by serving a crafted HTML page to potentially achieve a sandbox escape . This vulnerability is rated as Critical by Chromium security. Remedia...

CVE-2019-5779

CVE-2019-5779: In Google Chrome, the ServiceWorker implementation suffered from insufficient policy validation, allowing a remote attacker to bypass navigation restrictions via a crafted HTML page. Affected software is Chrome prior to 72.0.3626.81 and the issue is fixed in later builds. The descr...

CVE-2020-6390

CVE-2020-6390 is an out-of-bounds read in the streams component of Google Chrome/Chromium before version 80.0.3987.87, enabling a remote attacker to potentially cause heap corruption via a crafted HTML page. Mitigation in the provided docs centers on upgrading Chromium/Chrome to 80.0.3987.87 or n...

CVE-2020-6481

CVE-2020-6481 affects Google Chrome (and Chromium) prior to 83.0.4103.61, where insufficient policy enforcement in URL formatting can enable domain spoofing via crafted domain names. The issue is categorized as an access restriction bypass in the URL formatting path. Remediation per connected adv...

CVE-2021-30565

The CVE-2021-30565 entry corresponds to an out-of-bounds write in Chrome/Chromium’s Tab Groups feature, exploitable on Linux/ChromeOS before 92.0.4515.107 when a user is coaxed into loading a crafted page or extension. Connected sources (Astra Linux bulletin and ASA-202108-5) confirm the flaw is ...

CVE-2026-15108

An integer overflow in the Extensions API of Google Chrome (prior to version 150.0.7871.115 ) allows an attacker to perform an out-of-bounds memory read . This is achieved by convincing a user to install a malicious extension which then uses a crafted Chrome Extension to trigger the flaw. The vul...

CVE-2019-5768

CVE-2019-5768 affects Google Chrome prior to 72.0.3626.81. The vulnerability arises from DevTools API not correctly gating on extension capability in DevTools, enabling an attacker who persuades a user to install a malicious Chrome Extension to read local files. The issue is fixed by updating to ...

CVE-2021-21191

CVE-2021-21191 is a use-after-free vulnerability in the WebRTC component of Chromium-based browsers (Google Chrome) prior to 89.0.4389.90. The issue allows a remote attacker to potentially exploit heap corruption via a crafted HTML page, as described in the CVE entry. Connected documents confirm ...

CVE-2021-21231

CVE-2021-21231 affects the V8 JavaScript engine in Google Chrome/Chromium prior to 90.0.4430.93. The root cause is insufficient data validation in V8, which can enable a remote attacker to cause heap corruption via a crafted HTML page. The vulnerability is evidenced across multiple connected advi...

CVE-2022-1487

CVE-2022-1487 describes a use-after-free in Ozone within Google Chrome/Chromium, allowing potential remote heap corruption when running a Wayland test. Affected product/portion: Ozone in Chrome/Chromium prior to version 101.0.4951.41. Root cause: use-after-free vulnerability in Ozone components. ...

CVE-2026-84328

Google Chrome and Microsoft Edge (Chromium-based) are affected by a missing authorization vulnerability in the FileSystem component. Prior to version 152.0.7977.75, a remote attacker who has compromised the renderer process could bypass the web origin policy using a crafted HTML page. This vulner...

CVE-2018-6156

CVE-2018-6156 affects Google Chrome/WebRTC: an incorrect derivation of a packet length in WebRTC can cause a heap-based buffer overflow, enabling potential remote arbitrary code execution via a crafted video file. The security notes in connected docs indicate the fix was applied in chrome-related...

CVE-2019-13663

CVE-2019-13663 : IDN spoofing in Chrome/Chromium Omnibox via IDN homographs. Root cause is spoofed domain rendering in Omnibox, enabling domain spoofing. Affected: Google Chrome/Chromium (Omnibox domain matching). Impact: potential user trust deception through a crafted domain name. Public detail...

CVE-2019-13671

CVE-2019-13671 affects Google Chrome (Blink) prior to 77.0.3865.75. Description from connected sources confirms a UI spoofing issue where a crafted HTML page could spoof security UI. Remediation consistent with Chrome updates: upgrade to a version containing 77.0.3865.75 or newer (per referenced ...

CVE-2020-6399

CVE-2020-6399 is a policy-enforcement error in the AppCache component of the Chromium browser that allows a remote attacker to leak cross-origin data via a crafted HTML page. Affected product: Chromium prior to version 80.0.3987.87 (Chrome-based). Root cause per the public records is insufficient...

CVE-2020-6484

CVE-2020-6484 refers to insufficient data validation in the ChromeDriver component of Google Chrome prior to 83.0.4103.61. Multiple connected sources confirm the flaw affects Chrome/Chromium and that exploitation could bypass navigation restrictions via a crafted request. The Debian security noti...

CVE-2022-1485

CVE-2022-1485 corresponds to a use-after-free in Chrome/Chromium’s File System API (heap corruption) prior to 101.0.4951.41. The issue is described consistently across sources (Chromium/Chrome release notes and security bulletins), affecting Google Chrome and Chromium-derived builds. The Chrome 1...

CVE-2022-1486

CVE-2022-1486 affects Google Chrome/Chromium’s V8 engine via a Type Confusion in V8. Prior to 101.0.4951.41, a crafted HTML page could allow a remote attacker to read potentially sensitive information from process memory. The issue is documented in Chrome/Chromium advisories and trusted feeds, wi...

CVE-2022-2163

CVE-2022-2163 affects Google Chrome (Cast UI and Toolbar) and was triggered by a use-after-free leading to potential heap corruption when a user is convinced to install a malicious extension. Affected software: Google Chrome prior to 103.0.5060.134; impact described as high risk with possible arb...

CVE-2024-2883

CVE-2024-2883 is a use-after-free vulnerability in ANGLE within Google Chrome (and Chromium-based browsers) prior to version 123.0.6312.86. The flaw could enable a remote attacker to exploit heap corruption via a crafted HTML page, with high severity and potential for impact on confidentiality, i...

CVE-2025-5959

A Type Confusion vulnerability in the V8 engine of Google Chrome (prior to version 137.0.7151.103 ) allows a remote attacker to execute arbitrary code inside a sandbox. The flaw originates from accessing resources using incompatible types, which can be triggered via a crafted HTML page . Exploita...

CVE-2026-13874

A race condition in the DataTransfer component of the Google Chrome and Microsoft Edge browsers allows a remote attacker to obtain potentially sensitive information from process memory. The vulnerability stems from an inappropriate implementation involving simultaneous execution using a shared re...

CVE-2026-19172

Google Chrome versions prior to 151.0.7922.109 are vulnerable to a Use after free flaw in the Views component. A remote attacker who has already compromised the renderer process can leverage this vulnerability to potentially perform a sandbox escape using a crafted HTML page. This is classified a...

CVE-2019-13702

CVE-2019-13702 affects Google Chrome on Windows with an insecure installer implementation that allowed privilege escalation via a crafted executable. The vulnerability originates from an inappropriate installer implementation, enabling local attackers to elevate privileges. Public advisories conf...

CVE-2020-6381

CVE-2020-6381 refers to an integer overflow in the JavaScript engine of Chromium/Google Chrome prior to 80.0.3987.87, enabling potential heap corruption via a crafted HTML page. Affected products include Chrome/Chromium on ChromeOS and Android. Root cause: integer overflow in the v8 JavaScript li...