CVE-2021-21191

CVE-2021-21191 is a use-after-free vulnerability in the WebRTC component of Chromium-based browsers (Google Chrome) prior to 89.0.4389.90. The issue allows a remote attacker to potentially exploit heap corruption via a crafted HTML page, as described in the CVE entry. Connected documents confirm ...

CVE-2021-21231

CVE-2021-21231 affects the V8 JavaScript engine in Google Chrome/Chromium prior to 90.0.4430.93. The root cause is insufficient data validation in V8, which can enable a remote attacker to cause heap corruption via a crafted HTML page. The vulnerability is evidenced across multiple connected advi...

CVE-2022-2163

CVE-2022-2163 affects Google Chrome (Cast UI and Toolbar) and was triggered by a use-after-free leading to potential heap corruption when a user is convinced to install a malicious extension. Affected software: Google Chrome prior to 103.0.5060.134; impact described as high risk with possible arb...

CVE-2023-1230

CVE-2023-1230 concerns an Inappropriate implementation in WebApp Installs in Google Chrome on Android before version 111.0.5563.64. The issue allows an attacker who persuades a user to install a malicious WebApp to spoof the contents of the PWA installer via a crafted HTML page. Affected product ...

CVE-2023-5849

CVE-2023-5849 affects Chromium/Google Chrome USB handling: an integer overflow can lead to heap corruption via a crafted HTML page. Impact is high (CVE described as High); exploitation details in the wild are not provided in the documents. Remediation observed in multiple distros includes upgradi...

CVE-2024-2883

CVE-2024-2883 is a use-after-free vulnerability in ANGLE within Google Chrome (and Chromium-based browsers) prior to version 123.0.6312.86. The flaw could enable a remote attacker to exploit heap corruption via a crafted HTML page, with high severity and potential for impact on confidentiality, i...

CVE-2026-14013

An inappropriate implementation flaw in the SVG component of the Chromium browser (including Google Chrome and Microsoft Edge ) allows a remote attacker to perform UI spoofing through a crafted HTML page. This vulnerability can lead to a compromise of data integrity by falsely representing critic...

CVE-2026-76020

A race condition in the V8 engine of Google Chrome (prior to version 151.0.7922.173) allows a remote attacker to execute arbitrary code inside the sandbox through a crafted HTML page. This vulnerability has been addressed in various distributions, including Debian 12 (version 151.0.7922.173-1~deb...

CVE-2026-79193

An information leak in Canvas within Google Chrome (prior to version 152.0.7977.65) allows a remote attacker to leak cross-origin data via a crafted HTML page. This vulnerability has been addressed in updated versions of the chromium package. For example, Debian 12 provides a fix in version 152.0...

CVE-2019-13663

CVE-2019-13663 : IDN spoofing in Chrome/Chromium Omnibox via IDN homographs. Root cause is spoofed domain rendering in Omnibox, enabling domain spoofing. Affected: Google Chrome/Chromium (Omnibox domain matching). Impact: potential user trust deception through a crafted domain name. Public detail...

CVE-2019-13671

CVE-2019-13671 affects Google Chrome (Blink) prior to 77.0.3865.75. Description from connected sources confirms a UI spoofing issue where a crafted HTML page could spoof security UI. Remediation consistent with Chrome updates: upgrade to a version containing 77.0.3865.75 or newer (per referenced ...

CVE-2020-6381

CVE-2020-6381 refers to an integer overflow in the JavaScript engine of Chromium/Google Chrome prior to 80.0.3987.87, enabling potential heap corruption via a crafted HTML page. Affected products include Chrome/Chromium on ChromeOS and Android. Root cause: integer overflow in the v8 JavaScript li...

CVE-2020-6399

CVE-2020-6399 is a policy-enforcement error in the AppCache component of the Chromium browser that allows a remote attacker to leak cross-origin data via a crafted HTML page. Affected product: Chromium prior to version 80.0.3987.87 (Chrome-based). Root cause per the public records is insufficient...

CVE-2020-6413

CVE-2020-6413 is a Chrome/Blink HTML validator bypass vulnerability. The issue arises from an inappropriate implementation in Blink that allowed a remote attacker to bypass HTML validators via a crafted HTML page. Affected product: Google Chrome/Chromium (Blink/WebKit). Impact per sources: bypass...

CVE-2020-6484

CVE-2020-6484 refers to insufficient data validation in the ChromeDriver component of Google Chrome prior to 83.0.4103.61. Multiple connected sources confirm the flaw affects Chrome/Chromium and that exploitation could bypass navigation restrictions via a crafted request. The Debian security noti...

CVE-2020-6512

CVE-2020-6512: A type confusion in Google Chrome’s V8 engine prior to 84.0.4147.89 could allow a remote attacker to exploit heap corruption via a crafted HTML page, potentially enabling arbitrary code execution. Affected product: Chrome (V8). Root cause: type confusion in V8. Impact: remote code ...

CVE-2020-6527

Google Chrome before 84.0.4147.89 has an Insufficient policy enforcement in CSP that could allow a remote attacker to bypass content security policy via a crafted HTML page. This CVE affects Chrome’s CSP handling and was fixed in the 84.0.4147.89 update (stable channel) and related Chromium secur...

CVE-2022-1485

CVE-2022-1485 corresponds to a use-after-free in Chrome/Chromium’s File System API (heap corruption) prior to 101.0.4951.41. The issue is described consistently across sources (Chromium/Chrome release notes and security bulletins), affecting Google Chrome and Chromium-derived builds. The Chrome 1...

CVE-2025-5959

A Type Confusion vulnerability in the V8 engine of Google Chrome (prior to version 137.0.7151.103 ) allows a remote attacker to execute arbitrary code inside a sandbox. The flaw originates from accessing resources using incompatible types, which can be triggered via a crafted HTML page . Exploita...

CVE-2026-14117

A flaw in the DevTools component of the Chromium browser (used in Google Chrome on Windows) allows a remote attacker to obtain sensitive information from process memory. This is achieved by convincing a user to perform specific UI gestures on a crafted HTML page, due to insufficient validation of...

CVE-2026-15115

A high-severity vulnerability exists in the WebAppInstalls component of Google Chrome on Android (prior to version 150.0.7871.115) due to insufficient validation of untrusted input . This flaw allows a local attacker to bypass the same-origin policy by utilizing a crafted HTML page. The issue is ...

CVE-2026-87614

Google Chrome and Chromium-based browsers (including Microsoft Edge ) are vulnerable to an incorrect authorization flaw in the ServiceWorker component prior to version 153.0.8010.36 . A remote attacker who has already compromised the renderer process can bypass the web origin policy by using a cr...

CVE-2019-13702

CVE-2019-13702 affects Google Chrome on Windows with an insecure installer implementation that allowed privilege escalation via a crafted executable. The vulnerability originates from an inappropriate installer implementation, enabling local attackers to elevate privileges. Public advisories conf...

CVE-2020-6412

CVE-2020-6412 affects Chromium/Google Chrome Omnibox: insufficient validation of untrusted input allows domain spoofing via IDN homographs in crafted domain names. Root cause is input validation flaw in Omnibox prior to 80.0.3987.87. Documents confirm affected component and version range and prov...

CVE-2021-30557

CVE-2021-30557 is a use-after-free vulnerability in the Chromium-based TabGroups component prior to version 91.0.4472.114. The issue can allow a remote attacker to trigger heap corruption via a crafted HTML page after guiding a user to install a malicious extension, potentially leading to arbitra...

CVE-2023-1532

CVE-2023-1532 affects Google Chrome (Chromium-based) due to an out-of-bounds read in the GPU Video component, potentially enabling heap corruption via a crafted HTML page. The issue is exploitable remotely with user interaction required; patching to Chrome 111.0.5563.110 or newer is the documente...

CVE-2023-4357

CVE-2023-4357 affects Google Chrome (Chromium-based) and its Chromium derivatives. The vulnerability is caused by insufficient validation of untrusted input in XML, enabling a remote attacker to bypass file access restrictions via a crafted HTML page. Public records confirm impact on Chrome befor...

CVE-2026-12463

Google Chrome and Microsoft Edge browsers are affected by a vulnerability in the Views component on Linux. An inappropriate implementation allows a remote attacker who has already compromised the renderer process to inject arbitrary scripts or HTML (UXSS ) via a crafted HTML page. This flaw can l...

CVE-2019-13666

CVE-2019-13666 : Google Chrome information leak in storage prior to 77.0.3865.75. Root cause: an information leak in storage that allowed cross-origin data to be exposed via a crafted HTML page. Impact: partial confidentiality loss with HIGH impact per CVSS3.1 (base score 7.4); attack vector NETW...

CVE-2019-13677

CVE-2019-13677 concerns Google Chrome/Chromium: insufficient policy enforcement in site isolation allowed remote bypass via a crafted HTML page. Connected advisories confirm the vulnerability and provide remediation guidance: Chromium/Chrome fixed in the 78.0.3904.97 series (Debian DSA-4562-1 lis...

CVE-2019-13721

CVE-2019-13721 involves a use-after-free in the PDFium component used by Google Chrome before 78.0.3904.87. The issue, in PDF rendering via crafted HTML, can enable remote code execution through heap corruption. Affected product: Chrome/Chromium with PDFium. Root cause: use-after-free in PDFium. ...

CVE-2019-5766

CVE-2019-5766 describes an incorrect origin taint handling in Canvas within Chromium/Google Chrome, which could allow a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability is tied to the Canvas origin taint check and is listed against Chrome versions prior to 72.0...

CVE-2019-5775

CVE-2019-5775 corresponds to a vulnerability in Google Chrome’s Omnibox: an incorrect handling of a confusable character enables a remote attacker to spoof the URL bar via a crafted domain name. The issue affects Chrome versions prior to 72.0.3626.81. Exploitation could mislead users by displayin...

CVE-2019-5814

CVE-2019-5814 affects Google Chrome/Chromium Blink: an insufficient policy enforcement in Blink allowed a remote attacker to leak cross-origin data via a crafted HTML page (CORS bypass). Impact: cross-origin data disclosure. Affected versions are before 74.0.3729.108. Remediation: upgrade to 74.0...

CVE-2020-6536

CVE-2020-6536 affects Google Chrome/Chromium PWAs. Root cause: Incorrect security UI in PWAs allowed a crafted PWA to spoof the Omnibox (URL bar). Impact: potential for spoofing the address bar content via a remote PWA installation. Remediation: update to Chrome/Chromium 84.0.4147.89 (stable chan...

CVE-2022-1493

Summary: CVE-2022-1493 is a Use-after-Free in DevTools of Google Chrome/Chromium up to version 101.0.4951.41, enabling a remote attacker to potentially cause heap corruption via specific, direct user interaction. The vulnerability affects Chrome/Chromium’s DevTools components and is reflected in ...

CVE-2024-1938

CVE-2024-1938 corresponds to a Chrome/Chromium V8 type-confusion vulnerability (prior to 122.0.6261.94). The issue enables remote attackers to potentially trigger object corruption via a crafted HTML page, with high impact across confidentiality, integrity, and availability per the source. The As...

CVE-2026-13865

Google Chrome Enterprise (and potentially Microsoft Edge ) are vulnerable to UI spoofing due to insufficient validation of untrusted input. A remote attacker can exploit this by serving a crafted HTML page to a victim. This vulnerability affects Chrome versions prior to 150.0.7871.47 . For Debian...

CVE-2026-79290

A Use after free vulnerability exists in Aura within Google Chrome (prior to version 152.0.7977.65), allowing a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. This is a Critical severity issue. The vulnerability affects Chromium-based browsers , including M...

CVE-2020-6393

CVE-2020-6393 affects Google Chrome/Chromium Blink up to version 80.0.3987.87, where insufficient policy enforcement in Blink allowed a remote attacker to leak cross-origin data via a crafted HTML page. The root cause is a policy enforcement flaw in Blink, leading to cross-origin data exposure. A...

CVE-2020-6403

CVE-2020-6403 affects Google Chrome/Chromium Omnibox behavior. The issue is an incorrect Omnibox implementation on iOS prior to 80.0.3987.87, which could allow a remote attacker to spoof the Omnibox (URL bar) via a crafted HTML page. Impact described in connected advisories includes UI spoofing r...

CVE-2022-2624

CVE-2022-2624 describes a heap buffer overflow in PDF handling in Google Chrome prior to 104.0.5112.79, enabling a remote attacker to potentially trigger heap corruption via a crafted PDF file when a user interacts with it. Connected sources (Astra Linux security bulletin and Debian security advi...

CVE-2022-3890

CVE-2022-3890 refers to a heap buffer overflow in Crashpad used by Google Chrome on Android before 107.0.5304.106. The vulnerability could be exploited by a remote attacker who already compromised the renderer process to potentially escape the sandbox via a crafted HTML page. Affected software is...

CVE-2026-19176

A use after free vulnerability exists in Skia within Google Chrome (prior to version 151.0.7922.109 ). This flaw allows a remote attacker who has already compromised the renderer process to execute arbitrary code inside a sandbox by navigating to a crafted HTML page. This issue has been identifie...

CVE-2026-79090

Google Chrome versions prior to 152.0.7977.65 are vulnerable to a flaw in the Actor component involving improper privilege management . A remote attacker can bypass system access restrictions by leveraging social engineering techniques through a specially crafted HTML page . For Debian 12 bookwor...

CVE-2019-13749

CVE-2019-13749 is a UI spoof vulnerability in the Omnibox (URL bar) of Google Chrome/Chromium. The issue allowed spoofing via a crafted page. Mitigation observed in connected advisories: update to a patched Chrome/Chromium version (e.g., Debian/Ubuntu debs list fixes to 79.0.3945.130+; Fedora upd...

CVE-2019-13754

CVE-2019-13754 affects Google Chrome/Chromium where insufficient policy enforcement in extensions could let a remote attacker bypass navigation restrictions via a crafted HTML page. The vulnerability is scoped to Chrome versions before 79.0.3945.79. Public advisories and updates indicate remediat...

CVE-2019-13762

CVE-2019-13762 relates to Google Chrome/Chromium on Windows, where insufficient policy enforcement in downloads could allow a local attacker to spoof downloaded files via local code. This is a local, low-severity (CVSS 3.1: 3.3; CVSS 2.0: 2.1) issue with limited impact if exploited. The documente...

CVE-2019-5773

CVE-2019-5773 : Insufficient origin validation in IndexedDB in Google Chrome before 72.0.3626.81 allows a remote attacker who compromised the renderer process to bypass the same-origin policy via a crafted HTML page. Affected product/version: Google Chrome (IndexedDB). Root cause: origin validati...

CVE-2019-5807

CVE-2019-5807 is a memory corruption issue in the V8 JavaScript engine in Google Chrome/Chromium prior to 74.0.3729.108. The vulnerability exists in V8’s handling of crafted HTML pages, potentially enabling heap corruption and remote code execution through a page load. Remediation across affected...