CVE-2019-5862

Chromium/Google Chrome: CVE-2019-5862 is an AppCache validation flaw in Chromium before 76.0.3809.87 (renderer-compromised bypass). The issue allows a remote attacker to bypass site isolation via a crafted HTML page. Affected component: AppCache in Chromium; root cause: insufficient data validati...

CVE-2022-1857

CVE-2022-1857 : Affected: Google Chrome/Chromium (and derivatives) prior to version 102.0.5005.61. Root cause: Insufficient policy enforcement in the File System API, enabling a remote attacker to bypass file system restrictions via a crafted HTML page. Impact: High (remote code/restriction bypas...

CVE-2022-2615

CVE-2022-2615 targets Google Chrome/Chromium prior to 104.0.5112.79, where insufficient cookie policy enforcement allows a crafted HTML page to leak cross-origin data. The issue is confirmed across multiple sources (Chromium/Chrome updates cited by Debian security tracker and related advisories)....

CVE-2022-3890

CVE-2022-3890 refers to a heap buffer overflow in Crashpad used by Google Chrome on Android before 107.0.5304.106. The vulnerability could be exploited by a remote attacker who already compromised the renderer process to potentially escape the sandbox via a crafted HTML page. Affected software is...

CVE-2026-14142

Summary : CVE-2026-14142 describes an inappropriate implementation in Google Chrome’s Extensions prior to 150.0.7871.47, enabling a remote attacker (with renderer access) to spoof the UI via a crafted HTML page. The vulnerability affects Chrome extensions rendering logic and is rated Low severity...

CVE-2026-3927

The CVE-2026-3927 entry concerns Google Chrome’s PictureInPicture security UI. Affects Chrome/Chromium where an incorrect UI in PictureInPicture could allow a remote attacker to spoof the UI via a crafted HTML page. Public references point to Chrome/Chromium fix activity: Chrome stable releases u...

CVE-2019-13742

CVE-2019-13742 corresponds to an UI spoof vulnerability in Google Chrome’s Omnibox on iOS, where an incorrect security UI allowed a remote attacker to spoof the URL bar via a crafted domain name prior to version 79.0.3945.79. Connected security advisories reference Chrome/Chromium remediation pat...

CVE-2020-6490

CVE-2020-6490 affects Google Chrome/Chromium loaders prior to 83.0.4103.61, with insufficient data validation in the loader enabling a remote attacker who could write to disk to leak cross-origin data via a crafted HTML page. Upstream fixes are in Chrome/Chromium 83.0.4103.61 and newer; Debian an...

CVE-2023-4349

CVE-2023-4349 : Use after free in Device Trust Connectors in Google Chrome prior to 116.0.5845.96. A remote attacker could potentially exploit heap corruption via a crafted HTML page. Affected product is Chrome (Chromium-based). The issue is addressed by updating to the latest Chrome/Chromium bui...

CVE-2023-5854

CVE-2023-5854 describes a use-after-free in the Profiles component of Google Chrome (Chromium) before 119.0.6045.105, enabling a remote attacker who persuades a user to perform specific UI gestures to potentially trigger heap corruption. The issue is documented across multiple sources (Astra Linu...

CVE-2019-13659

Technical details for CVE-2019-13659 are not publicly available in the provided documents. Monitor for updates from product advisories and security trackers.

CVE-2019-13737

CVE-2019-13737 in Google Chrome describes insufficient policy enforcement in the autocomplete component. The vulnerability could allow a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Affected are Chrome versions prior to 79.0.3945.79. Mit...

CVE-2019-13759

Google Chrome vulnerable: CVE-2019-13759 stems from incorrect security UI in interstitials that enables domain spoofing via a crafted HTML page. Affected: Chrome versions prior to 79.0.3945.79. Impact: potential spoofing of the address bar/domain in interstitial UI. Mitigation: upgrade to Chrome ...

CVE-2020-6403

CVE-2020-6403 affects Google Chrome/Chromium Omnibox behavior. The issue is an incorrect Omnibox implementation on iOS prior to 80.0.3987.87, which could allow a remote attacker to spoof the Omnibox (URL bar) via a crafted HTML page. Impact described in connected advisories includes UI spoofing r...

CVE-2020-6483

CVE-2020-6483 is a Chromium/Chrome vulnerability where an insufficient policy enforcement in the payments component allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Connected advisories confirm this is a Chromium/Chrome issue affecting the payments module and d...

CVE-2019-13682

CVE-2019-13682 affects Google Chrome prior to 77.0.3865.75, where insufficient policy enforcement in external protocol handling allowed a remote attacker to bypass the same-origin policy via a crafted HTML page. Public report describes this in Chrome/Chromium context; Debian advisories note fixes...

CVE-2019-13729

CVE-2019-13729 : Use-after-free in Chrome’s WebSockets before 79.0.3945.79 allowing remote heap corruption via a crafted HTML page. Affected: Google Chrome (WebSockets) on legacy builds up to 79.0.3945.79. Root cause: use-after-free in the WebSockets implementation. Impact: heap corruption; remot...

CVE-2021-30510

CVE-2021-30510 is a race condition vulnerability in the Aura component of Chromium (Chromium before 90.0.4430.212). Multiple connected advisories confirm this issue alongside other OOB/UAF problems in the Chromium stack; affected version range is before 90.0.4430.212. Impact notes in the sources ...

CVE-2023-1224

CVE-2023-1224 affects Google Chrome/Chromium Web Payments API prior to 111.0.5563.64, where insufficient policy enforcement allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. The issue originates from Chromium Web Payments policy enforcement and results in an abi...

CVE-2023-1231

CVE-2023-1231 describes an issue in Google Chrome on Android where the Autofill implementation allowed a crafted HTML page to spoof the omnibox contents. The vulnerability is tied to Chromium’s Autofill logic and is described as an inappropriate implementation, with a CVSS v3.1 base score of 4.3 ...

CVE-2019-13752

CVE-2019-13752: Affected software is Google Chrome/Chromium with SQLite in the WebKit/Blink stack. The issue is an out-of-bounds read in the SQLite library, allowing a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. It affects Chrome/Chromi...

CVE-2019-5758

CVE-2019-5758 is a use-after-free in Blink/WebKit reported for Chromium-based browsers (Zhe Jin). The connected Debian/Nessus entries enumerate it among Chromium CVEs, linked to Blink/WebKit handling of HTML, and remediation is to update Chromium/Chrome to a newer version as released in the 72.x+...

CVE-2019-5877

CVE-2019-5877 is listed in multiple advisories as part of Chromium/Chrome vulnerabilities. Debians DSA-4562-1 fixes this issue in chromium with a security update to version 78.0.3904.97-1~deb10u1, indicating an out-of-bounds read vulnerability in the Chromium/Chrome stack (context from the Debian...

CVE-2020-6414

CVE-2020-6414 affects Chromium/Google Chrome with insufficient policy enforcement in Safe Browsing, allowing a remote attacker to bypass navigation restrictions via crafted HTML. Connected advisories (e.g., Debian DSA-4638-1 and Arch Linux ASA-202002-3) confirm the issue is tied to Safe Browsing ...

CVE-2022-1309

CVE-2022-1309 affects Chromium/Google Chrome before version 100.0.4896.88 due to insufficient policy enforcement in developer tools , potentially enabling a sandbox escape via a crafted HTML page. The issue is rated high/critical (CVSS: 9.6). Remediation observed across distributions: updates to ...

CVE-2022-1495

CVE-2022-1495 affects Google Chrome on Android (prior to 101.0.4951.41). Root cause: Incorrect security UI in the Downloads dialog could allow a remote attacker to spoof the APK downloads dialog via crafted HTML. Impact described as spoofing the downloads prompt; no exploitation details provided ...

CVE-2023-4361

CVE-2023-4361 concerns Google Chrome/Chromium Autofill on Android (pre-116.0.5845.96). The vulnerability is an inappropriate Autofill implementation that allows a remote attacker to bypass Autofill restrictions via a crafted HTML page, enabling potential unauthorized autofill actions. Affected so...

CVE-2019-13669

CVE-2019-13669 affects Google Chrome versions before 77.0.3865.75. The issue is an incorrect data validation in navigation that allows a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. The provided sources identify the vulnerability and its impact as URL ba...

CVE-2019-13711

CVE-2019-13711 is an information-disclosure vulnerability affecting Chromium/Google Chrome prior to version 78.0.3904.70. The connected sources describe a cross-context information leak in Chromium/Chrome (before 78.0.3904.70), with Debian/Mageia/Arch advisories noting fixes in 78.0.3904.70-1 or ...

CVE-2019-13726

CVE-2019-13726: A buffer overflow in Google Chrome’s password manager allows remote code execution via a crafted HTML page. Affected product: Google Chrome (Chromium core). Root cause: buffer/overflow in the password management path. Impact: remote arbitrary code execution with high impact on con...

CVE-2019-13739

The CVE-2019-13739 entry describes an insufficent policy enforcement flaw in Google Chrome’s Omnibox, enabling domain spoofing via IDN homographs. A remote attacker could exploit a crafted domain name to spoof a site, with impact limited to the UI/identity surface. Affected software is Chrome (Om...

CVE-2019-13747

CVE-2019-13747 affects Google Chrome/Chromium rendering on Android versions prior to 79.0.3945.79, where uninitialized data in rendering could enable a remote attacker to trigger heap corruption via a crafted HTML page. The provided connected documents confirm this CVE is tied to Chromium/Chrome ...

CVE-2019-5868

CVE-2019-5868 is a use-after-free in PDFium within the Chromium/Google Chrome stack, before version 76.0.3809.100 . The underlying issue in PDFium could allow a remote attacker to cause heap corruption via a crafted PDF file. Multiple connected sources confirm the PCV as part of a broader set of ...

CVE-2021-21232

CVE-2021-21232 affects Google Chrome DevTools. Use-after-free in Dev Tools prior to version 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Debian and other advisories note the fix in Chrome 90.0.4430.93 (and Chrome/Chromium update channels),...

CVE-2021-30548

CVE-2021-30548: A use-after-free in the Loader component of Chromium/Chrome prior to 91.0.4472.101 allows remote code execution via a crafted HTML page. Affected software: Chromium/Chrome (Loader); root cause: use-after-free. Impact: remote attacker could run arbitrary code. Remediation: upgrade ...

CVE-2021-30556

Chromium/WebAudio vulnerability CVE-2021-30556: Use-after-free in the WebAudio component before 91.0.4472.114 allows remote code execution via a crafted page. Affects Chromium-based products relying on this engine; upgrade to 91.0.4472.114 or newer to fix. Arch Linux advisories note that an explo...

CVE-2022-0607

CVE-2022-0607 is a use-after-free vulnerability in Google Chrome’s GPU handling, prior to version 98.0.4758.102, susceptible to remote heap corruption via a crafted HTML page. The issue affects Chrome/Chromium GPU code paths and was elevated to high impact in Chrome’s February 2022 security relea...

CVE-2022-0805

CVE-2022-0805 affects Google Chrome (Chromium-based) Browser Switcher. It is a use-after-free in the Browser Switcher that could enable heap corruption after specific user interaction. The vulnerability is addressed by Chrome/Chromium updates to version 99.0.4844.51 and later (e.g., Chromium upda...

CVE-2022-0806

CVE-2022-0806 concerns Google Chrome (and Chromium-derived) browsers. The vulnerability enables a remote attacker to potentially leak cross-origin data via a crafted HTML page when a user is convinced to engage in screen sharing. The issue affects Chrome versions prior to 99.0.4844.51, with an im...

CVE-2023-1230

CVE-2023-1230 concerns an Inappropriate implementation in WebApp Installs in Google Chrome on Android before version 111.0.5563.64. The issue allows an attacker who persuades a user to install a malicious WebApp to spoof the contents of the PWA installer via a crafted HTML page. Affected product ...

CVE-2025-4050

CVE-2025-4050: Out-of-bounds memory access in DevTools of Google Chrome before 136.0.7103.59 allows a remote attacker who entices a user to perform specific UI gestures to potentially exploit heap corruption via a crafted HTML page. Affected software is Google Chrome (DevTools component); root ca...

CVE-2019-5802

CVE-2019-5802 is a UI spoofing vulnerability in Chromium/Google Chrome prior to 73.0.3683.75. The issue enables a remote attacker to spoof a domain via crafted HTML content, as documented by multiple sources (Chrome security notes and distribution advisories). The flaw is categorized under conten...

CVE-2021-30506

CVE-2021-30506 affects Chromium/ Chrome Web App Installs component on Android before 90.0.4430.212. The issue is an Incorrect security UI that lets an attacker convince a user to install a web application and inject scripts or HTML into a privileged page via a crafted HTML page. Impact is that re...

CVE-2022-0973

CVE-2022-0973 is a Chrome use-after-free vulnerability in Safe Browsing that could enable a remote attacker to cause heap corruption via a crafted HTML page. The connected sources confirm the issue affects Google Chrome before version 99.0.4844.74 and were addressed in the Chrome Stable Channel u...

CVE-2023-4763

CVE-2023-4763 is a Use-After-Free in Chromium/Google Chrome’s networking code that could allow a remote attacker to cause heap corruption via a crafted HTML page. The initial entry lists Chrome versions prior to 116.0.5845.179 as affected. Connected documents confirm the same issue across Chromiu...

CVE-2024-1938

CVE-2024-1938 corresponds to a Chrome/Chromium V8 type-confusion vulnerability (prior to 122.0.6261.94). The issue enables remote attackers to potentially trigger object corruption via a crafted HTML page, with high impact across confidentiality, integrity, and availability per the source. The As...

CVE-2019-13714

The CVE-2019-13714 entry concerns Google Chrome before 78.0.3904.70, where insufficient validation of untrusted input in the Color Enhancer extension can allow CSS injection into an HTML page via a crafted URL. Affected product: Google Chrome (earlier than 78.0.3904.70). Root cause/impact: CSS in...

CVE-2020-6420

CVE-2020-6420 affects Google Chrome (media component). The issue is insufficient policy enforcement that allows a remote attacker to bypass the same-origin policy via a crafted HTML page, enabling information disclosure and potential further actions. Affected versions are Chrome before 80.0.3987....

CVE-2021-21149

CVE-2021-21149 is a stack buffer overflow in the Data Transfer component of Google Chrome on Linux prior to 88.0.4324.182, enabling remote out-of-bounds memory access via a crafted HTML page. Upstream and downstream advisories (Chromium/Chrome updates) fix this by upgrading to 88.0.4324.182 or ne...

CVE-2021-21156

CVE-2021-21156 refers to a heap buffer overflow in V8 (Chromium/Google Chrome) prior to 88.0.4324.182. The vulnerability in the V8 component could allow a remote attacker to potentially corrupt heap memory via a crafted script, leading to arbitrary code execution on the affected host. Public docu...