CVE-2021-30553

CVE-2021-30553 pertains to a Use-after-free in the Network service of the Chromium-based Google Chrome stack, prior to version 91.0.4472.101. The issue allows a remote attacker to potentially trigger heap corruption via a crafted HTML page. Affected product/engine: Chromium-based Network service ...

CVE-2019-13662

CVE-2019-13662 affects Chromium/Google Chrome: insufficient policy enforcement in navigations allows bypassing Content Security Policy via a crafted HTML page. Root cause: CSP bypass in navigation handling. Impact: CSP bypass without explicit exploitation details; vulnerable components reported a...

CVE-2020-6411

CVE-2020-6411 : The Omnibox in Google Chrome before 80.0.3987.87 suffers from insufficient validation of untrusted input, enabling a remote attacker to perform domain spoofing via IDN homographs with a crafted domain name. Several connected advisories confirm the vulnerability as part of Chromium...

CVE-2021-30512

CVE-2021-30512 affects Chromium-based browsers (e.g., Chromium) with a use-after-free vulnerability in the Notifications component prior to version 90.0.4430.212. The issue, described as a use-after-free in Notifications, could be exploited by a remote attacker who provides crafted HTML/pages to ...

CVE-2023-5852

Summary of CVE-2023-5852 : A use-after-free in the Printing component of Google Chrome/Chromium prior to version 119.0.6045.105 could allow a remote attacker to trigger heap corruption by convincing a user to perform specific UI gestures. Impact is high (CVE-2023-5852 is associated with high base...

CVE-2026-12457

CVE-2026-12457 affects Google Chrome extensions in the renderer prior to version 149.0.7827.155. The underlying issue is an inappropriate extension implementation that lets a remote attacker, who has already compromised the renderer process, bypass Chrome’s site isolation via a crafted HTML page....

CVE-2019-13709

CVE-2019-13709 refers to an access-restriction bypass in Chromium/Google Chrome prior to 78.0.3904.70, where policy enforcement for downloads could be bypassed via a crafted HTML page, enabling a remote attacker to download files that should be restricted. Affected: Chromium/Google Chrome up to v...

CVE-2019-13738

CVE-2019-13738 affects Google Chrome (navigation component) where insufficient policy enforcement allows a remote attacker to bypass site isolation via a crafted HTML page. The issue is in Chrome versions prior to 79.0.3945.79. Remediation per the provided records is to upgrade to the fixed versi...

CVE-2019-13741

CVE-2019-13741 affects Blink in Google Chrome before 79.0.3945.79, where untrusted clipboard input could be insufficiently validated, enabling a local attacker to bypass the same-origin policy via crafted clipboard data. Impact is local, with partial confidentiality/integrity/availability concern...

CVE-2019-5801

The CVE-2019-5801 entry corresponds to a vulnerability in Google Chrome’s Omnibox on iOS, where incorrect URL eliding allowed domain spoofing via a crafted HTML page. Connected documents confirm this CVE was fixed in Chromium/Chrome updates (e.g., openSUSE and Fedora advisories) by upgrading to v...

CVE-2020-6395

CVE-2020-6395 is an out-of-bounds read in the JavaScript component of Chromium/Google Chrome prior to version 80.0.3987.87 that could allow a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. The vulnerability is addressed in upstream Chromiu...

CVE-2021-21233

CVE-2021-21233 has concrete details in connected documents: a heap buffer overflow in ANGLE, part of the Chromium/Google Chrome browser stack, before version 90.0.4430.93 on Windows. The vulnerability is described as an arbitrary code execution/heap corruption risk exploitable via a crafted HTML ...

CVE-2021-30545

CVE-2021-30545 is a use-after-free in the Chromium browser’s Extensions component before 91.0.4472.101. A remote attacker who comprom ised the renderer could potentially cause heap corruption via a crafted HTML page, enabling arbitrary code execution. Public advisories/patches instruct upgrading ...

CVE-2022-1488

CVE-2022-1488 involves Google Chrome’s Extensions API. The issue is described as an Inappropriate implementation in Extensions API, allowing a user-assisted attacker to leak cross-origin data via a crafted Chrome Extension. Affected software is Chrome prior to version 101.0.4951.41 (the policy wa...

CVE-2022-1500

CVE-2022-1500 affects Google Chrome/Chromium Dev Tools. The root cause is insufficient data validation in Dev Tools that allows a remote attacker to bypass the Content Security Policy through a crafted HTML page. Documented impact is CSP bypass with network-remote vector, supported by CVSS data: ...

CVE-2022-2164

CVE-2022-2164 is an issue in Google Chrome’s Extensions API (pre-103.0.5060.53) where an attacker could bypass discretionary access control via a crafted HTML page if the user installs a malicious extension. Affected software: Chrome (Extensions API). Root cause: inappropriate implementation in t...

CVE-2025-5959

CVE-2025-5959 is a Type Confusion in V8 used by Google Chrome prior to 137.0.7151.103 that allowed a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page. Affected software is Google Chrome (Chromium/V8 engine); the issue is rated High severity with network...

CVE-2019-13687

CVE-2019-13687 is a use-after-free in Blink affecting Google Chrome/Chromium prior to 77.0.3865.90, enabling a remote attacker to potentially cause heap corruption via a crafted HTML page. The issue appears in Blink components and was fixed in updates across vendors: Debian/DSA-4562 notes Chromiu...

CVE-2020-16040

CVE-2020-16040 affects Google Chrome/Chromium before 87.0.4280.88 due to insufficient data validation in V8 , which could allow a remote attacker to trigger heap corruption and potentially execute arbitrary code. The vulnerability is mitigated by upgrading to 87.0.4280.88 (fixed upstream; Debian/...

CVE-2021-21195

CVE-2021-21195 describes a use-after-free in the V8 JavaScript engine within Google Chrome/Chromium, leading to potential heap corruption via a crafted HTML page. Affected software is Chrome/Chromium (Chromium-derived engines) prior to version 89.0.4389.114. Reported under CVE-2021-21195, the iss...

CVE-2023-3217

CVE-2023-3217 is a Use-After-Free in WebXR present in Google Chrome/Chromium prior to 114.0.5735.133, capable of heap corruption via a crafted HTML page. Affected products include Google Chrome/Chromium with the WebXR component; root cause is a use-after-free in the WebXR path. Impact is rated Hi...

CVE-2023-5855

CVE-2023-5855 is a Use-After-Free in Chromium/Google Chrome Reading Mode. A remote attacker could entice a user to perform specific UI gestures, potentially causing heap corruption. Affected versions are Chrome/Chromium prior to 119.0.6045.105. Mitigation: upgrade to 119.0.6045.105 or later (as r...

CVE-2019-13717

CVE-2019-13717 is a vulnerability in Google Chrome/Chromium prior to 78.0.3904.70 where the security UI could be obscured in full-screen mode via a crafted HTML page, enabling a remote attacker to hide security UI. The issue is categorized under a user-interface spoof/content-security context, wi...

CVE-2019-13762

CVE-2019-13762 relates to Google Chrome/Chromium on Windows, where insufficient policy enforcement in downloads could allow a local attacker to spoof downloaded files via local code. This is a local, low-severity (CVSS 3.1: 3.3; CVSS 2.0: 2.1) issue with limited impact if exploited. The documente...

CVE-2021-21132

CVE-2021-21132 stems from an inappropriate implementation in the DevTools component of Google Chrome (Chromium) prior to 88.0.4324.96, which could allow a remote attacker to escape the sandbox via a crafted Chrome Extension. Affected product/area: Chrome/Chromium DevTools. Root cause: implementat...

CVE-2021-30518

CVE-2021-30518 is a heap buffer overflow in the Reader Mode component of Chromium-based browsers (e.g., Google Chrome and chromium) before version 90.0.4430.212. The vulnerability could allow a remote attacker to trigger heap corruption via a crafted HTML page, potentially enabling arbitrary code...

CVE-2022-0795

CVE-2022-0795 discusses a type confusion in Blink Layout in Google Chrome/Chromium up to version 99.0.4844.51 that could enable remote heap corruption via a crafted HTML page. The issue is rooted in the browser’s Blink component, exposing a vulnerability when processing HTML content. Public conne...

CVE-2022-1498

CVE-2022-1498 affects Google Chrome/Chromium: Inappropriate implementation in the HTML Parser allowed a remote attacker to leak cross-origin data via a crafted HTML page. The issue is tied to Chrome/Chromium versions prior to 101.0.4951.41. Public references reiter the same description across mul...

CVE-2023-5859

CVE-2023-5859 affects Chromium-based browsers (notably Google Chrome) with a security UI flaw in Picture-in-Picture that allowed a remote attacker to spoof the domain via a crafted local HTML page. The issue’s impact is domain spoofing (low severity per NVD, CVSS 3.1: 4.3) and is fixed by updatin...

CVE-2024-1938

CVE-2024-1938 corresponds to a Chrome/Chromium V8 type-confusion vulnerability (prior to 122.0.6261.94). The issue enables remote attackers to potentially trigger object corruption via a crafted HTML page, with high impact across confidentiality, integrity, and availability per the source. The As...

CVE-2019-13716

CVE-2019-13716 affects Google Chrome (and Chromium) prior to 78.0.3904.70, where insufficient policy enforcement in service workers could allow a remote attacker to bypass navigation restrictions via a crafted HTML page. Exploitation is via a page crafted to abuse the service worker state, leadin...

CVE-2019-13761

CVE-2019-13761 affects Google Chrome/Chromium Omnibox UI, where a security UI flaw allowed domain spoofing via IDN homographs in crafted domain names. Root cause: incorrect security UI in Omnibox. Impact: remote attacker could spoof domains; no exploit details provided in the sources. Remediation...

CVE-2019-5878

CVE-2019-5878 is a use-after-free vulnerability in the V8 JavaScript engine used by Google Chrome/Chromium prior to version 77.0.3865.75. The issue could allow a remote attacker to potentially trigger heap corruption via a crafted HTML page. Public documentation across multiple advisories (Debian...

CVE-2021-21202

CVE-2021-21202: Use-after-free in Chrome extensions (extensions subsystem) prior to 90.0.4430.72 enables a crafted Chrome Extension to potentially escape the sandbox. Affected product: Google Chrome; root cause: use-after-free in extensions. Impact: sandbox escape risk. Remediation: update to Chr...

CVE-2022-1494

CVE-2022-1494 affects Google Chrome/Chromium with insufficient data validation in Trusted Types, enabling a remote attacker to bypass the trusted types policy via a crafted HTML page. The issue is tied to Chrome/Chromium components and was addressed in the 101.0.4951.41 stable release for Windows...

CVE-2022-3890

CVE-2022-3890 refers to a heap buffer overflow in Crashpad used by Google Chrome on Android before 107.0.5304.106. The vulnerability could be exploited by a remote attacker who already compromised the renderer process to potentially escape the sandbox via a crafted HTML page. Affected software is...

CVE-2023-5853

CVE-2023-5853: A security-UI obfuscation vulnerability in Chromium-based browsers (Chrome/Chromium) before 119.0.6045.105; a crafted HTML page could mislead users in the Downloads UI. Remediation: upgrade to 119.0.6045.105 or newer.

CVE-2026-76033

CVE-2026-76033 is an inappropriate implementation in CORS in Google Chrome prior to 151.0.7922.169 . A remote attacker who had already compromised the renderer process could bypass site isolation via a crafted HTML page. The vulnerability was reported by Google on 2026-05-26 (bug 516715010) and c...

CVE-2019-5871

CVE-2019-5871 is a heap-buffer overflow in Skia used by Google Chrome/Chromium. The issue arises from a vulnerability in the Skia library that could allow a remote attacker to exploit heap corruption via a crafted HTML page. Public advisories confirm this CVE is reported in Chrome/Chromium and no...

CVE-2021-30552

CVE-2021-30552 is a use-after-free in the Extensions component of the Chromium browser before version 91.0.4472.101. A remote attacker could exploit this via a crafted HTML page or a malicious extension to achieve arbitrary code execution through heap corruption. Several connected advisories conf...

CVE-2023-5856

CVE-2023-5856 affects Google Chrome/Chromium: Use-after-free in the Side Panel prior to 119.0.6045.105 can be triggered by a crafted HTML page when a user performs specific UI gestures, potentially causing heap corruption and remote code execution. Affected software: Google Chrome (Chromium-deriv...

CVE-2019-13670

CVE-2019-13670 is a memory corruption issue in the v8 JavaScript engine of Chromium/Google Chrome. Affects Chrome/Chromium builds prior to 77.0.3865.75 with insufficient data validation that could enable heap corruption via a crafted HTML page. The Debian security advisory lists CVE-2019-13670 am...

CVE-2021-21152

CVE-2021-21152 describes a heap buffer overflow in the Media component of Chromium-based browsers (Google Chrome/Chromium) on Linux prior to 88.0.4324.182. Root cause is a heap buffer overflow in media handling that could allow remote attackers to trigger heap corruption via a crafted HTML page. ...

CVE-2021-30515

CVE-2021-30515 affects the File API in Chromium-based browsers (Chromium/Chrome) prior to 90.0.4430.212. The vulnerability is a use-after-free in the File API component, enabling a remote attacker to craft a page that could trigger heap corruption. Exploitation status is not described in the prov...

CVE-2021-30516

The CVE-2021-30516 entry refers to a heap buffer overflow in the History component of Chromium prior to 90.0.4430.212. The accompanying connected advisories confirm exploitation potential via crafted HTML pages and note this affects Chromium-based browsers (Chrome/Chromium family). Root cause: a ...

CVE-2022-0973

CVE-2022-0973 is a Chrome use-after-free vulnerability in Safe Browsing that could enable a remote attacker to cause heap corruption via a crafted HTML page. The connected sources confirm the issue affects Google Chrome before version 99.0.4844.74 and were addressed in the Chrome Stable Channel u...

CVE-2019-13667

CVE-2019-13667 affects Google Chrome on iOS, where an inappropriate Omnibox implementation allows a remote attacker to spoof the URL bar via a crafted HTML page. The vulnerability is tied to the Omnibox component in Chrome for iOS, describing a URL spoofing issue. The description notes the issue ...

CVE-2019-13682

CVE-2019-13682 affects Google Chrome prior to 77.0.3865.75, where insufficient policy enforcement in external protocol handling allowed a remote attacker to bypass the same-origin policy via a crafted HTML page. Public report describes this in Chrome/Chromium context; Debian advisories note fixes...

CVE-2019-13727

CVE-2019-13727 is a policy-enforcement error in Chrome’s WebSockets implementation that could allow a remote attacker to bypass the same-origin policy via a crafted HTML page. The vulnerability affects Google Chrome versions prior to 79.0.3945.79, with the issue explicitly tied to insufficient po...

CVE-2019-5812

CVE-2019-5812: In Google Chrome for iOS, the security UI is inadequate, enabling domain spoofing via a crafted HTML page. The vulnerability affects the iOS UI path in Chrome prior to version 74.0.3729.108. Public sources in the connected documents confirm this CVE is tied to Chrome/Chromium updat...