CVE-2019-13739

The CVE-2019-13739 entry describes an insufficent policy enforcement flaw in Google Chrome’s Omnibox, enabling domain spoofing via IDN homographs. A remote attacker could exploit a crafted domain name to spoof a site, with impact limited to the UI/identity surface. Affected software is Chrome (Om...

CVE-2019-5868

CVE-2019-5868 is a use-after-free in PDFium within the Chromium/Google Chrome stack, before version 76.0.3809.100 . The underlying issue in PDFium could allow a remote attacker to cause heap corruption via a crafted PDF file. Multiple connected sources confirm the PCV as part of a broader set of ...

CVE-2022-0805

CVE-2022-0805 affects Google Chrome (Chromium-based) Browser Switcher. It is a use-after-free in the Browser Switcher that could enable heap corruption after specific user interaction. The vulnerability is addressed by Chrome/Chromium updates to version 99.0.4844.51 and later (e.g., Chromium upda...

CVE-2022-1309

CVE-2022-1309 affects Chromium/Google Chrome before version 100.0.4896.88 due to insufficient policy enforcement in developer tools , potentially enabling a sandbox escape via a crafted HTML page. The issue is rated high/critical (CVSS: 9.6). Remediation observed across distributions: updates to ...

CVE-2019-13732

CVE-2019-13732 describes a use-after-free in the WebAudio implementation of Chromium/Google Chrome, exploitable via a crafted HTML page to potentially trigger heap corruption. The CVE is referenced across multiple advisories, indicating impact on Chromium/Chrome before version 79.0.3945.79, with ...

CVE-2019-13736

CVE-2019-13736 is a vulnerability in Google Chrome/Chromium where an integer overflow in the PDFium library could enable a remote attacker to trigger heap corruption via a crafted PDF. Public advisories confirm the affected product (Chromium/Chrome), the vulnerable component (PDFium), and the roo...

CVE-2019-5877

CVE-2019-5877 is listed in multiple advisories as part of Chromium/Chrome vulnerabilities. Debians DSA-4562-1 fixes this issue in chromium with a security update to version 78.0.3904.97-1~deb10u1, indicating an out-of-bounds read vulnerability in the Chromium/Chrome stack (context from the Debian...

CVE-2021-21231

CVE-2021-21231 affects the V8 JavaScript engine in Google Chrome/Chromium prior to 90.0.4430.93. The root cause is insufficient data validation in V8, which can enable a remote attacker to cause heap corruption via a crafted HTML page. The vulnerability is evidenced across multiple connected advi...

CVE-2022-2163

CVE-2022-2163 affects Google Chrome (Cast UI and Toolbar) and was triggered by a use-after-free leading to potential heap corruption when a user is convinced to install a malicious extension. Affected software: Google Chrome prior to 103.0.5060.134; impact described as high risk with possible arb...

CVE-2023-1224

CVE-2023-1224 affects Google Chrome/Chromium Web Payments API prior to 111.0.5563.64, where insufficient policy enforcement allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. The issue originates from Chromium Web Payments policy enforcement and results in an abi...

CVE-2019-13662

CVE-2019-13662 affects Chromium/Google Chrome: insufficient policy enforcement in navigations allows bypassing Content Security Policy via a crafted HTML page. Root cause: CSP bypass in navigation handling. Impact: CSP bypass without explicit exploitation details; vulnerable components reported a...

CVE-2019-13669

CVE-2019-13669 affects Google Chrome versions before 77.0.3865.75. The issue is an incorrect data validation in navigation that allows a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. The provided sources identify the vulnerability and its impact as URL ba...

CVE-2019-13705

CVE-2019-13705 is a Chromium/Google Chrome extension permission bypass vulnerability. The assigned CVE refers to insufficient policy enforcement in extensions prior to 78.0.3904.70, allowing a user-lacative attacker who tricks a user into installing a malicious extension to leak cross-origin data...

CVE-2019-13721

CVE-2019-13721 involves a use-after-free in the PDFium component used by Google Chrome before 78.0.3904.87. The issue, in PDF rendering via crafted HTML, can enable remote code execution through heap corruption. Affected product: Chrome/Chromium with PDFium. Root cause: use-after-free in PDFium. ...

CVE-2019-13748

CVE-2019-13748 affects Google Chrome (and Chromium) prior to 79.0.3945.79. It arises from insufficient policy enforcement in developer tools, allowing a local attacker to extract potentially sensitive information from process memory through a crafted HTML page. The issue is documented across mult...

CVE-2020-6379

CVE-2020-6379 affects Google Chrome/Chromium up to version 79.0.3945.130, with a use-after-free in the V8 JavaScript engine. The issue could allow a remote attacker to potentially achieve heap corruption and arbitrary code execution via a crafted HTML page. Public advisories (e.g., Debian, Fedora...

CVE-2020-6411

CVE-2020-6411 : The Omnibox in Google Chrome before 80.0.3987.87 suffers from insufficient validation of untrusted input, enabling a remote attacker to perform domain spoofing via IDN homographs with a crafted domain name. Several connected advisories confirm the vulnerability as part of Chromium...

CVE-2021-21140

CVE-2021-21140 affects Chromium/Google Chrome USB stack: uninitialized memory use in the USB implementation could allow a local attacker to cause out-of-bounds access. The vulnerability is associated with Chrome/Chromium builds before 88.0.4324.96. In affected advisories, remediation is to upgrad...

CVE-2021-21156

CVE-2021-21156 refers to a heap buffer overflow in V8 (Chromium/Google Chrome) prior to 88.0.4324.182. The vulnerability in the V8 component could allow a remote attacker to potentially corrupt heap memory via a crafted script, leading to arbitrary code execution on the affected host. Public docu...

CVE-2021-30550

The CVE-2021-30550 entry corresponds to a use-after-free vulnerability in the Accessibility component of the Chromium-based Chrome browser prior to version 91.0.4472.101 . The issue may allow a remote attacker to execute arbitrary code by tricking a user into loading a crafted HTML page or malici...

CVE-2023-1230

CVE-2023-1230 concerns an Inappropriate implementation in WebApp Installs in Google Chrome on Android before version 111.0.5563.64. The issue allows an attacker who persuades a user to install a malicious WebApp to spoof the contents of the PWA installer via a crafted HTML page. Affected product ...

CVE-2026-3927

The CVE-2026-3927 entry concerns Google Chrome’s PictureInPicture security UI. Affects Chrome/Chromium where an incorrect UI in PictureInPicture could allow a remote attacker to spoof the UI via a crafted HTML page. Public references point to Chrome/Chromium fix activity: Chrome stable releases u...

CVE-2019-13687

CVE-2019-13687 is a use-after-free in Blink affecting Google Chrome/Chromium prior to 77.0.3865.90, enabling a remote attacker to potentially cause heap corruption via a crafted HTML page. The issue appears in Blink components and was fixed in updates across vendors: Debian/DSA-4562 notes Chromiu...

CVE-2019-13693

CVE-2019-13693 affects Google Chrome/Chromium before 77.0.3865.120, with a use-after-free in IndexedDB that can allow a remote attacker who has compromised the renderer process to execute arbitrary code via a crafted HTML page. Multiple connected advisories corroborate the component and version, ...

CVE-2019-13700

CVE-2019-13700 is a buffer overrun in the Blink component of Google Chrome prior to 78.0.3904.70. A remote attacker who can lure a user to a crafted page could trigger arbitrary code execution on the target system. The vulnerability is associated with the Chromium/Blink stack and was addressed in...

CVE-2019-5848

CVE-2019-5848 in Google Chrome/Chromium: incorrect font handling in autofill allows an attacker to potentially read sensitive process-memory contents via a crafted HTML page. Affected: Chrome/Chromium before 75.0.3770.142. CVEs and advisories in the connected docs confirm this is an information-d...

CVE-2021-21194

CVE-2021-21194 affects Google Chrome’s screen sharing functionality, where a use-after-free in screen capture could lead to heap corruption via a crafted HTML page. Concrete details across connected sources show the issue within Chrome prior to version 89.0.4389.114. The Debian security advisorie...

CVE-2022-1495

CVE-2022-1495 affects Google Chrome on Android (prior to 101.0.4951.41). Root cause: Incorrect security UI in the Downloads dialog could allow a remote attacker to spoof the APK downloads dialog via crafted HTML. Impact described as spoofing the downloads prompt; no exploitation details provided ...

CVE-2024-4558

CVE-2024-4558: Use-after-free in ANGLE within Google Chrome/Chromium's WebKit/ANGLE path allows a remote attacker to potentially trigger heap corruption via a crafted HTML page. Affects Chrome/Chromium builds prior to version 124.0.6367.155. The issue is addressed in the referenced Chrome update;...

CVE-2025-6554

CVE-2025-6554 is a Google Chromium V8 type-confusion vulnerability that could allow a remote attacker to perform arbitrary read/write via a crafted HTML page. Affected product scope is Google Chrome/Chromium-based engines; root cause is type confusion in V8. Chrome’s June 2025/Stable updates addr...

CVE-2019-13709

CVE-2019-13709 refers to an access-restriction bypass in Chromium/Google Chrome prior to 78.0.3904.70, where policy enforcement for downloads could be bypassed via a crafted HTML page, enabling a remote attacker to download files that should be restricted. Affected: Chromium/Google Chrome up to v...

CVE-2019-13738

CVE-2019-13738 affects Google Chrome (navigation component) where insufficient policy enforcement allows a remote attacker to bypass site isolation via a crafted HTML page. The issue is in Chrome versions prior to 79.0.3945.79. Remediation per the provided records is to upgrade to the fixed versi...

CVE-2019-13741

CVE-2019-13741 affects Blink in Google Chrome before 79.0.3945.79, where untrusted clipboard input could be insufficiently validated, enabling a local attacker to bypass the same-origin policy via crafted clipboard data. Impact is local, with partial confidentiality/integrity/availability concern...

CVE-2021-21149

CVE-2021-21149 is a stack buffer overflow in the Data Transfer component of Google Chrome on Linux prior to 88.0.4324.182, enabling remote out-of-bounds memory access via a crafted HTML page. Upstream and downstream advisories (Chromium/Chrome updates) fix this by upgrading to 88.0.4324.182 or ne...

CVE-2021-21232

CVE-2021-21232 affects Google Chrome DevTools. Use-after-free in Dev Tools prior to version 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Debian and other advisories note the fix in Chrome 90.0.4430.93 (and Chrome/Chromium update channels),...

CVE-2021-30553

CVE-2021-30553 pertains to a Use-after-free in the Network service of the Chromium-based Google Chrome stack, prior to version 91.0.4472.101. The issue allows a remote attacker to potentially trigger heap corruption via a crafted HTML page. Affected product/engine: Chromium-based Network service ...

CVE-2022-1501

CVE-2022-1501 refers to an issue in Google Chrome/Chromium where an inappropriate implementation in iframe could leak cross-origin data via a crafted HTML page. Affected product: Chromium/Chrome prior to version 101.0.4951.41. Root cause: iframe handling leading to cross-origin data exposure. Imp...

CVE-2019-13717

CVE-2019-13717 is a vulnerability in Google Chrome/Chromium prior to 78.0.3904.70 where the security UI could be obscured in full-screen mode via a crafted HTML page, enabling a remote attacker to hide security UI. The issue is categorized under a user-interface spoof/content-security context, wi...

CVE-2019-13762

CVE-2019-13762 relates to Google Chrome/Chromium on Windows, where insufficient policy enforcement in downloads could allow a local attacker to spoof downloaded files via local code. This is a local, low-severity (CVSS 3.1: 3.3; CVSS 2.0: 2.1) issue with limited impact if exploited. The documente...

CVE-2019-5878

CVE-2019-5878 is a use-after-free vulnerability in the V8 JavaScript engine used by Google Chrome/Chromium prior to version 77.0.3865.75. The issue could allow a remote attacker to potentially trigger heap corruption via a crafted HTML page. Public documentation across multiple advisories (Debian...

CVE-2020-6395

CVE-2020-6395 is an out-of-bounds read in the JavaScript component of Chromium/Google Chrome prior to version 80.0.3987.87 that could allow a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. The vulnerability is addressed in upstream Chromiu...

CVE-2022-1486

CVE-2022-1486 affects Google Chrome/Chromium’s V8 engine via a Type Confusion in V8. Prior to 101.0.4951.41, a crafted HTML page could allow a remote attacker to read potentially sensitive information from process memory. The issue is documented in Chrome/Chromium advisories and trusted feeds, wi...

CVE-2022-1857

CVE-2022-1857 : Affected: Google Chrome/Chromium (and derivatives) prior to version 102.0.5005.61. Root cause: Insufficient policy enforcement in the File System API, enabling a remote attacker to bypass file system restrictions via a crafted HTML page. Impact: High (remote code/restriction bypas...

CVE-2023-4763

CVE-2023-4763 is a Use-After-Free in Chromium/Google Chrome’s networking code that could allow a remote attacker to cause heap corruption via a crafted HTML page. The initial entry lists Chrome versions prior to 116.0.5845.179 as affected. Connected documents confirm the same issue across Chromiu...

CVE-2023-5849

CVE-2023-5849 affects Chromium/Google Chrome USB handling: an integer overflow can lead to heap corruption via a crafted HTML page. Impact is high (CVE described as High); exploitation details in the wild are not provided in the documents. Remediation observed in multiple distros includes upgradi...

CVE-2019-13761

CVE-2019-13761 affects Google Chrome/Chromium Omnibox UI, where a security UI flaw allowed domain spoofing via IDN homographs in crafted domain names. Root cause: incorrect security UI in Omnibox. Impact: remote attacker could spoof domains; no exploit details provided in the sources. Remediation...

CVE-2022-1500

CVE-2022-1500 affects Google Chrome/Chromium Dev Tools. The root cause is insufficient data validation in Dev Tools that allows a remote attacker to bypass the Content Security Policy through a crafted HTML page. Documented impact is CSP bypass with network-remote vector, supported by CVSS data: ...

CVE-2022-1859

CVE-2022-1859 corresponds to a use-after-free/memory misreference in Chrome’s Performance Manager prior to 102.0.5005.61. Exploitation via a crafted HTML page could cause heap corruption, potentially leading to a crash or arbitrary code execution. Affected software is Google Chrome (Performance M...

CVE-2023-4349

CVE-2023-4349 : Use after free in Device Trust Connectors in Google Chrome prior to 116.0.5845.96. A remote attacker could potentially exploit heap corruption via a crafted HTML page. Affected product is Chrome (Chromium-based). The issue is addressed by updating to the latest Chrome/Chromium bui...

CVE-2019-13670

CVE-2019-13670 is a memory corruption issue in the v8 JavaScript engine of Chromium/Google Chrome. Affects Chrome/Chromium builds prior to 77.0.3865.75 with insufficient data validation that could enable heap corruption via a crafted HTML page. The Debian security advisory lists CVE-2019-13670 am...