CVE-2019-13729

CVE-2019-13729 : Use-after-free in Chrome’s WebSockets before 79.0.3945.79 allowing remote heap corruption via a crafted HTML page. Affected: Google Chrome (WebSockets) on legacy builds up to 79.0.3945.79. Root cause: use-after-free in the WebSockets implementation. Impact: heap corruption; remot...

CVE-2019-5758

CVE-2019-5758 is a use-after-free in Blink/WebKit reported for Chromium-based browsers (Zhe Jin). The connected Debian/Nessus entries enumerate it among Chromium CVEs, linked to Blink/WebKit handling of HTML, and remediation is to update Chromium/Chrome to a newer version as released in the 72.x+...

CVE-2021-30548

CVE-2021-30548: A use-after-free in the Loader component of Chromium/Chrome prior to 91.0.4472.101 allows remote code execution via a crafted HTML page. Affected software: Chromium/Chrome (Loader); root cause: use-after-free. Impact: remote attacker could run arbitrary code. Remediation: upgrade ...

CVE-2022-1309

CVE-2022-1309 affects Chromium/Google Chrome before version 100.0.4896.88 due to insufficient policy enforcement in developer tools , potentially enabling a sandbox escape via a crafted HTML page. The issue is rated high/critical (CVSS: 9.6). Remediation observed across distributions: updates to ...

CVE-2023-4361

CVE-2023-4361 concerns Google Chrome/Chromium Autofill on Android (pre-116.0.5845.96). The vulnerability is an inappropriate Autofill implementation that allows a remote attacker to bypass Autofill restrictions via a crafted HTML page, enabling potential unauthorized autofill actions. Affected so...

CVE-2019-13739

The CVE-2019-13739 entry describes an insufficent policy enforcement flaw in Google Chrome’s Omnibox, enabling domain spoofing via IDN homographs. A remote attacker could exploit a crafted domain name to spoof a site, with impact limited to the UI/identity surface. Affected software is Chrome (Om...

CVE-2019-13747

CVE-2019-13747 affects Google Chrome/Chromium rendering on Android versions prior to 79.0.3945.79, where uninitialized data in rendering could enable a remote attacker to trigger heap corruption via a crafted HTML page. The provided connected documents confirm this CVE is tied to Chromium/Chrome ...

CVE-2019-5802

CVE-2019-5802 is a UI spoofing vulnerability in Chromium/Google Chrome prior to 73.0.3683.75. The issue enables a remote attacker to spoof a domain via crafted HTML content, as documented by multiple sources (Chrome security notes and distribution advisories). The flaw is categorized under conten...

CVE-2021-21156

CVE-2021-21156 refers to a heap buffer overflow in V8 (Chromium/Google Chrome) prior to 88.0.4324.182. The vulnerability in the V8 component could allow a remote attacker to potentially corrupt heap memory via a crafted script, leading to arbitrary code execution on the affected host. Public docu...

CVE-2021-21231

CVE-2021-21231 affects the V8 JavaScript engine in Google Chrome/Chromium prior to 90.0.4430.93. The root cause is insufficient data validation in V8, which can enable a remote attacker to cause heap corruption via a crafted HTML page. The vulnerability is evidenced across multiple connected advi...

CVE-2022-0805

CVE-2022-0805 affects Google Chrome (Chromium-based) Browser Switcher. It is a use-after-free in the Browser Switcher that could enable heap corruption after specific user interaction. The vulnerability is addressed by Chrome/Chromium updates to version 99.0.4844.51 and later (e.g., Chromium upda...

CVE-2023-5849

CVE-2023-5849 affects Chromium/Google Chrome USB handling: an integer overflow can lead to heap corruption via a crafted HTML page. Impact is high (CVE described as High); exploitation details in the wild are not provided in the documents. Remediation observed in multiple distros includes upgradi...

CVE-2019-5867

CVE-2019-5867 affects Chromium/Google Chrome before 76.0.3809.100, with an out-of-bounds read in the V8 JavaScript engine that could lead to heap corruption. The CVE is described as a remote code execution risk via a crafted HTML page, with several advisories confirming that upgrading to 76.0.380...

CVE-2020-6420

CVE-2020-6420 affects Google Chrome (media component). The issue is insufficient policy enforcement that allows a remote attacker to bypass the same-origin policy via a crafted HTML page, enabling information disclosure and potential further actions. Affected versions are Chrome before 80.0.3987....

CVE-2022-1495

CVE-2022-1495 affects Google Chrome on Android (prior to 101.0.4951.41). Root cause: Incorrect security UI in the Downloads dialog could allow a remote attacker to spoof the APK downloads dialog via crafted HTML. Impact described as spoofing the downloads prompt; no exploitation details provided ...

CVE-2022-1857

CVE-2022-1857 : Affected: Google Chrome/Chromium (and derivatives) prior to version 102.0.5005.61. Root cause: Insufficient policy enforcement in the File System API, enabling a remote attacker to bypass file system restrictions via a crafted HTML page. Impact: High (remote code/restriction bypas...

CVE-2023-1224

CVE-2023-1224 affects Google Chrome/Chromium Web Payments API prior to 111.0.5563.64, where insufficient policy enforcement allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. The issue originates from Chromium Web Payments policy enforcement and results in an abi...

CVE-2023-4349

CVE-2023-4349 : Use after free in Device Trust Connectors in Google Chrome prior to 116.0.5845.96. A remote attacker could potentially exploit heap corruption via a crafted HTML page. Affected product is Chrome (Chromium-based). The issue is addressed by updating to the latest Chrome/Chromium bui...

CVE-2019-5868

CVE-2019-5868 is a use-after-free in PDFium within the Chromium/Google Chrome stack, before version 76.0.3809.100 . The underlying issue in PDFium could allow a remote attacker to cause heap corruption via a crafted PDF file. Multiple connected sources confirm the PCV as part of a broader set of ...

CVE-2020-6477

CVE-2020-6477 affects Google Chrome on macOS (OS X) before 83.0.4103.61. The issue is an inappropriate implementation in the installer that allows a local attacker to escalate privileges via a crafted file. Public references in the connected documents confirm the affected product and root cause, ...

CVE-2021-21140

CVE-2021-21140 affects Chromium/Google Chrome USB stack: uninitialized memory use in the USB implementation could allow a local attacker to cause out-of-bounds access. The vulnerability is associated with Chrome/Chromium builds before 88.0.4324.96. In affected advisories, remediation is to upgrad...

CVE-2021-21149

CVE-2021-21149 is a stack buffer overflow in the Data Transfer component of Google Chrome on Linux prior to 88.0.4324.182, enabling remote out-of-bounds memory access via a crafted HTML page. Upstream and downstream advisories (Chromium/Chrome updates) fix this by upgrading to 88.0.4324.182 or ne...

CVE-2023-1230

CVE-2023-1230 concerns an Inappropriate implementation in WebApp Installs in Google Chrome on Android before version 111.0.5563.64. The issue allows an attacker who persuades a user to install a malicious WebApp to spoof the contents of the PWA installer via a crafted HTML page. Affected product ...

CVE-2019-13669

CVE-2019-13669 affects Google Chrome versions before 77.0.3865.75. The issue is an incorrect data validation in navigation that allows a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. The provided sources identify the vulnerability and its impact as URL ba...

CVE-2019-13725

CVE-2019-13725 describes a use-after-free vulnerability in Bluetooth handling in Google Chrome before 79.0.3945.79 that could allow a remote attacker to execute arbitrary code via a crafted HTML page. The CVE is part of a broader Chrome/Chromium set of issues (CVE-2019-13725–...-6380) disclosed a...

CVE-2019-13732

CVE-2019-13732 describes a use-after-free in the WebAudio implementation of Chromium/Google Chrome, exploitable via a crafted HTML page to potentially trigger heap corruption. The CVE is referenced across multiple advisories, indicating impact on Chromium/Chrome before version 79.0.3945.79, with ...

CVE-2019-5759

CVE-2019-5759 is a use-after-free vulnerability in Chromium-based browsers related to handling HTML pages containing select elements. The Debian advisory attributes it to Almog Benin and confirms a use-after-free in that area, contributing to potential sandbox escape. Public details across connec...

CVE-2019-5877

CVE-2019-5877 is listed in multiple advisories as part of Chromium/Chrome vulnerabilities. Debians DSA-4562-1 fixes this issue in chromium with a security update to version 78.0.3904.97-1~deb10u1, indicating an out-of-bounds read vulnerability in the Chromium/Chrome stack (context from the Debian...

CVE-2021-21194

CVE-2021-21194 affects Google Chrome’s screen sharing functionality, where a use-after-free in screen capture could lead to heap corruption via a crafted HTML page. Concrete details across connected sources show the issue within Chrome prior to version 89.0.4389.114. The Debian security advisorie...

CVE-2021-21232

CVE-2021-21232 affects Google Chrome DevTools. Use-after-free in Dev Tools prior to version 90.0.4430.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Debian and other advisories note the fix in Chrome 90.0.4430.93 (and Chrome/Chromium update channels),...

CVE-2021-30506

CVE-2021-30506 affects Chromium/ Chrome Web App Installs component on Android before 90.0.4430.212. The issue is an Incorrect security UI that lets an attacker convince a user to install a web application and inject scripts or HTML into a privileged page via a crafted HTML page. Impact is that re...

CVE-2019-13736

CVE-2019-13736 is a vulnerability in Google Chrome/Chromium where an integer overflow in the PDFium library could enable a remote attacker to trigger heap corruption via a crafted PDF. Public advisories confirm the affected product (Chromium/Chrome), the vulnerable component (PDFium), and the roo...

CVE-2020-6379

CVE-2020-6379 affects Google Chrome/Chromium up to version 79.0.3945.130, with a use-after-free in the V8 JavaScript engine. The issue could allow a remote attacker to potentially achieve heap corruption and arbitrary code execution via a crafted HTML page. Public advisories (e.g., Debian, Fedora...

CVE-2020-6401

CVE-2020-6401 affects Google Chrome/Chromium Omnibox. The root cause is insufficient validation of untrusted input, enabling domain spoofing via IDN homographs with crafted domain names. Public sources in connected documents describe a domain-spoofing vulnerability tied to Omnibox input validatio...

CVE-2021-30550

The CVE-2021-30550 entry corresponds to a use-after-free vulnerability in the Accessibility component of the Chromium-based Chrome browser prior to version 91.0.4472.101 . The issue may allow a remote attacker to execute arbitrary code by tricking a user into loading a crafted HTML page or malici...

CVE-2022-1859

CVE-2022-1859 corresponds to a use-after-free/memory misreference in Chrome’s Performance Manager prior to 102.0.5005.61. Exploitation via a crafted HTML page could cause heap corruption, potentially leading to a crash or arbitrary code execution. Affected software is Google Chrome (Performance M...

CVE-2019-13662

CVE-2019-13662 affects Chromium/Google Chrome: insufficient policy enforcement in navigations allows bypassing Content Security Policy via a crafted HTML page. Root cause: CSP bypass in navigation handling. Impact: CSP bypass without explicit exploitation details; vulnerable components reported a...

CVE-2019-13721

CVE-2019-13721 involves a use-after-free in the PDFium component used by Google Chrome before 78.0.3904.87. The issue, in PDF rendering via crafted HTML, can enable remote code execution through heap corruption. Affected product: Chrome/Chromium with PDFium. Root cause: use-after-free in PDFium. ...

CVE-2019-13748

CVE-2019-13748 affects Google Chrome (and Chromium) prior to 79.0.3945.79. It arises from insufficient policy enforcement in developer tools, allowing a local attacker to extract potentially sensitive information from process memory through a crafted HTML page. The issue is documented across mult...

CVE-2019-5848

CVE-2019-5848 in Google Chrome/Chromium: incorrect font handling in autofill allows an attacker to potentially read sensitive process-memory contents via a crafted HTML page. Affected: Chrome/Chromium before 75.0.3770.142. CVEs and advisories in the connected docs confirm this is an information-d...

CVE-2020-6411

CVE-2020-6411 : The Omnibox in Google Chrome before 80.0.3987.87 suffers from insufficient validation of untrusted input, enabling a remote attacker to perform domain spoofing via IDN homographs with a crafted domain name. Several connected advisories confirm the vulnerability as part of Chromium...

CVE-2021-21228

CVE-2021-21228 relates to Chromium/Google Chrome’s extensions policy enforcement. The vulnerability is a policy enforcement bypass in the extensions component of the Chromium-based browser, prior to version 90.0.4430.93, where a user convinced to install a crafted malicious extension could bypass...

CVE-2021-30539

CVE-2021-30539 affects Chromium browser (and Chromium-based Google Chrome) before 91.0.4472.77. The root cause is insufficient validation/enforcement of the Content Security Policy, allowing a remote attacker to bypass CSP via a crafted HTML page. Public advisories in connected documents confirm ...

CVE-2022-1486

CVE-2022-1486 affects Google Chrome/Chromium’s V8 engine via a Type Confusion in V8. Prior to 101.0.4951.41, a crafted HTML page could allow a remote attacker to read potentially sensitive information from process memory. The issue is documented in Chrome/Chromium advisories and trusted feeds, wi...

CVE-2022-1501

CVE-2022-1501 refers to an issue in Google Chrome/Chromium where an inappropriate implementation in iframe could leak cross-origin data via a crafted HTML page. Affected product: Chromium/Chrome prior to version 101.0.4951.41. Root cause: iframe handling leading to cross-origin data exposure. Imp...

CVE-2023-4763

CVE-2023-4763 is a Use-After-Free in Chromium/Google Chrome’s networking code that could allow a remote attacker to cause heap corruption via a crafted HTML page. The initial entry lists Chrome versions prior to 116.0.5845.179 as affected. Connected documents confirm the same issue across Chromiu...

CVE-2024-2883

CVE-2024-2883 is a use-after-free vulnerability in ANGLE within Google Chrome (and Chromium-based browsers) prior to version 123.0.6312.86. The flaw could enable a remote attacker to exploit heap corruption via a crafted HTML page, with high severity and potential for impact on confidentiality, i...

CVE-2019-13693

CVE-2019-13693 affects Google Chrome/Chromium before 77.0.3865.120, with a use-after-free in IndexedDB that can allow a remote attacker who has compromised the renderer process to execute arbitrary code via a crafted HTML page. Multiple connected advisories corroborate the component and version, ...

CVE-2019-13700

CVE-2019-13700 is a buffer overrun in the Blink component of Google Chrome prior to 78.0.3904.70. A remote attacker who can lure a user to a crafted page could trigger arbitrary code execution on the target system. The vulnerability is associated with the Chromium/Blink stack and was addressed in...

CVE-2019-13705

CVE-2019-13705 is a Chromium/Google Chrome extension permission bypass vulnerability. The assigned CVE refers to insufficient policy enforcement in extensions prior to 78.0.3904.70, allowing a user-lacative attacker who tricks a user into installing a malicious extension to leak cross-origin data...