CVE-2019-5848

CVE-2019-5848 in Google Chrome/Chromium: incorrect font handling in autofill allows an attacker to potentially read sensitive process-memory contents via a crafted HTML page. Affected: Chrome/Chromium before 75.0.3770.142. CVEs and advisories in the connected docs confirm this is an information-d...

CVE-2020-6401

CVE-2020-6401 affects Google Chrome/Chromium Omnibox. The root cause is insufficient validation of untrusted input, enabling domain spoofing via IDN homographs with crafted domain names. Public sources in connected documents describe a domain-spoofing vulnerability tied to Omnibox input validatio...

CVE-2020-6477

CVE-2020-6477 affects Google Chrome on macOS (OS X) before 83.0.4103.61. The issue is an inappropriate implementation in the installer that allows a local attacker to escalate privileges via a crafted file. Public references in the connected documents confirm the affected product and root cause, ...

CVE-2022-0792

CVE-2022-0792 is an out-of-bounds read in ANGLE used by Google Chrome prior to 99.0.4844.51. The vulnerability allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. Affected product: Chrome/Chromium frontend components relying on ANGLE. Root cause: out-of-bounds...

CVE-2022-0808

Technical details about CVE-2022-0808 are not publicly provided in the connected documents. Monitor for updates and new disclosures to confirm affected products, root cause, impact, and fixes.

CVE-2022-1501

CVE-2022-1501 refers to an issue in Google Chrome/Chromium where an inappropriate implementation in iframe could leak cross-origin data via a crafted HTML page. Affected product: Chromium/Chrome prior to version 101.0.4951.41. Root cause: iframe handling leading to cross-origin data exposure. Imp...

CVE-2024-1938

CVE-2024-1938 corresponds to a Chrome/Chromium V8 type-confusion vulnerability (prior to 122.0.6261.94). The issue enables remote attackers to potentially trigger object corruption via a crafted HTML page, with high impact across confidentiality, integrity, and availability per the source. The As...

CVE-2025-6191

CVE-2025-6191 is a Chrome/Chromium vulnerability: an integer overflow in V8 prior to 137.0.7151.119 can enable a remote attacker to trigger out-of-bounds memory access via a crafted HTML page, with a High severity. There are public advisories and a Chrome security update (Stable channel 137.0.715...

CVE-2019-13688

CVE-2019-13688 is a use-after-free in Blink affecting Chromium/Google Chrome prior to 77.0.3865.90, enabling heap corruption on crafted HTML pages. Connected sources confirm the issue as part of a set of Chromium vulnerabilities, with remediation in newer Chromium builds. The Mageia advisory spec...

CVE-2019-13740

CVE-2019-13740 affects Google Chrome prior to 79.0.3945.79, where an incorrect security UI in sharing could enable domain spoofing via a crafted HTML page. The issue is fixed in Chrome updates released after 79.0.3945.79; confirmed patches appear in Debian’s chromium security advisory (DSA-4606-1...

CVE-2019-5867

CVE-2019-5867 affects Chromium/Google Chrome before 76.0.3809.100, with an out-of-bounds read in the V8 JavaScript engine that could lead to heap corruption. The CVE is described as a remote code execution risk via a crafted HTML page, with several advisories confirming that upgrading to 76.0.380...

CVE-2020-6379

CVE-2020-6379 affects Google Chrome/Chromium up to version 79.0.3945.130, with a use-after-free in the V8 JavaScript engine. The issue could allow a remote attacker to potentially achieve heap corruption and arbitrary code execution via a crafted HTML page. Public advisories (e.g., Debian, Fedora...

CVE-2022-1500

CVE-2022-1500 affects Google Chrome/Chromium Dev Tools. The root cause is insufficient data validation in Dev Tools that allows a remote attacker to bypass the Content Security Policy through a crafted HTML page. Documented impact is CSP bypass with network-remote vector, supported by CVSS data: ...

CVE-2022-1859

CVE-2022-1859 corresponds to a use-after-free/memory misreference in Chrome’s Performance Manager prior to 102.0.5005.61. Exploitation via a crafted HTML page could cause heap corruption, potentially leading to a crash or arbitrary code execution. Affected software is Google Chrome (Performance M...

CVE-2022-2164

CVE-2022-2164 is an issue in Google Chrome’s Extensions API (pre-103.0.5060.53) where an attacker could bypass discretionary access control via a crafted HTML page if the user installs a malicious extension. Affected software: Chrome (Extensions API). Root cause: inappropriate implementation in t...

CVE-2019-13725

CVE-2019-13725 describes a use-after-free vulnerability in Bluetooth handling in Google Chrome before 79.0.3945.79 that could allow a remote attacker to execute arbitrary code via a crafted HTML page. The CVE is part of a broader Chrome/Chromium set of issues (CVE-2019-13725–...-6380) disclosed a...

CVE-2019-5759

CVE-2019-5759 is a use-after-free vulnerability in Chromium-based browsers related to handling HTML pages containing select elements. The Debian advisory attributes it to Almog Benin and confirms a use-after-free in that area, contributing to potential sandbox escape. Public details across connec...

CVE-2021-21140

CVE-2021-21140 affects Chromium/Google Chrome USB stack: uninitialized memory use in the USB implementation could allow a local attacker to cause out-of-bounds access. The vulnerability is associated with Chrome/Chromium builds before 88.0.4324.96. In affected advisories, remediation is to upgrad...

CVE-2021-30553

CVE-2021-30553 pertains to a Use-after-free in the Network service of the Chromium-based Google Chrome stack, prior to version 91.0.4472.101. The issue allows a remote attacker to potentially trigger heap corruption via a crafted HTML page. Affected product/engine: Chromium-based Network service ...

CVE-2022-0800

CVE-2022-0800 is a heap buffer overflow in Google Chrome’s Cast UI prior to 99.0.4844.51. A remote attacker could exploit this by convincing a user to engage in specific interaction with a crafted HTML page, potentially causing heap corruption. Public reports indicate the vulnerability affects Ch...

CVE-2022-0802

CVE-2022-0802 affects Google Chrome on Android before 99.0.4844.51, where an improper implementation in full-screen mode could allow a remote attacker to hide the Omnibox contents via a crafted HTML page. The issue stems from a UI/fullscreen handling flaw that can misrepresent the URL bar visibil...

CVE-2023-5859

CVE-2023-5859 affects Chromium-based browsers (notably Google Chrome) with a security UI flaw in Picture-in-Picture that allowed a remote attacker to spoof the domain via a crafted local HTML page. The issue’s impact is domain spoofing (low severity per NVD, CVSS 3.1: 4.3) and is fixed by updatin...

CVE-2019-13736

CVE-2019-13736 is a vulnerability in Google Chrome/Chromium where an integer overflow in the PDFium library could enable a remote attacker to trigger heap corruption via a crafted PDF. Public advisories confirm the affected product (Chromium/Chrome), the vulnerable component (PDFium), and the roo...

CVE-2021-21194

CVE-2021-21194 affects Google Chrome’s screen sharing functionality, where a use-after-free in screen capture could lead to heap corruption via a crafted HTML page. Concrete details across connected sources show the issue within Chrome prior to version 89.0.4389.114. The Debian security advisorie...

CVE-2021-30550

The CVE-2021-30550 entry corresponds to a use-after-free vulnerability in the Accessibility component of the Chromium-based Chrome browser prior to version 91.0.4472.101 . The issue may allow a remote attacker to execute arbitrary code by tricking a user into loading a crafted HTML page or malici...

CVE-2022-1494

CVE-2022-1494 affects Google Chrome/Chromium with insufficient data validation in Trusted Types, enabling a remote attacker to bypass the trusted types policy via a crafted HTML page. The issue is tied to Chrome/Chromium components and was addressed in the 101.0.4951.41 stable release for Windows...

CVE-2025-5065

The CVE-2025-5065 entry corresponds to an insecure implementation in Chrome’s FileSystemAccess API that could enable UI spoofing via a crafted HTML page. Affected software is Google Chrome (Chromium-based); vulnerability arises from an inappropriate implementation in FileSystemAccess API prior to...

CVE-2019-13662

CVE-2019-13662 affects Chromium/Google Chrome: insufficient policy enforcement in navigations allows bypassing Content Security Policy via a crafted HTML page. Root cause: CSP bypass in navigation handling. Impact: CSP bypass without explicit exploitation details; vulnerable components reported a...

CVE-2019-13700

CVE-2019-13700 is a buffer overrun in the Blink component of Google Chrome prior to 78.0.3904.70. A remote attacker who can lure a user to a crafted page could trigger arbitrary code execution on the target system. The vulnerability is associated with the Chromium/Blink stack and was addressed in...

CVE-2019-13732

CVE-2019-13732 describes a use-after-free in the WebAudio implementation of Chromium/Google Chrome, exploitable via a crafted HTML page to potentially trigger heap corruption. The CVE is referenced across multiple advisories, indicating impact on Chromium/Chrome before version 79.0.3945.79, with ...

CVE-2019-13748

CVE-2019-13748 affects Google Chrome (and Chromium) prior to 79.0.3945.79. It arises from insufficient policy enforcement in developer tools, allowing a local attacker to extract potentially sensitive information from process memory through a crafted HTML page. The issue is documented across mult...

CVE-2020-16040

CVE-2020-16040 affects Google Chrome/Chromium before 87.0.4280.88 due to insufficient data validation in V8 , which could allow a remote attacker to trigger heap corruption and potentially execute arbitrary code. The vulnerability is mitigated by upgrading to 87.0.4280.88 (fixed upstream; Debian/...

CVE-2020-6411

CVE-2020-6411 : The Omnibox in Google Chrome before 80.0.3987.87 suffers from insufficient validation of untrusted input, enabling a remote attacker to perform domain spoofing via IDN homographs with a crafted domain name. Several connected advisories confirm the vulnerability as part of Chromium...

CVE-2021-21228

CVE-2021-21228 relates to Chromium/Google Chrome’s extensions policy enforcement. The vulnerability is a policy enforcement bypass in the extensions component of the Chromium-based browser, prior to version 90.0.4430.93, where a user convinced to install a crafted malicious extension could bypass...

CVE-2021-21233

CVE-2021-21233 has concrete details in connected documents: a heap buffer overflow in ANGLE, part of the Chromium/Google Chrome browser stack, before version 90.0.4430.93 on Windows. The vulnerability is described as an arbitrary code execution/heap corruption risk exploitable via a crafted HTML ...

CVE-2021-30512

CVE-2021-30512 affects Chromium-based browsers (e.g., Chromium) with a use-after-free vulnerability in the Notifications component prior to version 90.0.4430.212. The issue, described as a use-after-free in Notifications, could be exploited by a remote attacker who provides crafted HTML/pages to ...

CVE-2023-3217

CVE-2023-3217 is a Use-After-Free in WebXR present in Google Chrome/Chromium prior to 114.0.5735.133, capable of heap corruption via a crafted HTML page. Affected products include Google Chrome/Chromium with the WebXR component; root cause is a use-after-free in the WebXR path. Impact is rated Hi...

CVE-2019-13687

CVE-2019-13687 is a use-after-free in Blink affecting Google Chrome/Chromium prior to 77.0.3865.90, enabling a remote attacker to potentially cause heap corruption via a crafted HTML page. The issue appears in Blink components and was fixed in updates across vendors: Debian/DSA-4562 notes Chromiu...

CVE-2020-6550

CVE-2020-6550 is a Use-After-Free in IndexedDB in Google Chrome before 84.0.4147.125 that could allow a remote attacker to cause heap corruption via a crafted HTML page. The issue affects Chrome/Chromium’s IndexedDB component; root cause is a use-after-free memory error leading to potential arbit...

CVE-2021-21195

CVE-2021-21195 describes a use-after-free in the V8 JavaScript engine within Google Chrome/Chromium, leading to potential heap corruption via a crafted HTML page. Affected software is Chrome/Chromium (Chromium-derived engines) prior to version 89.0.4389.114. Reported under CVE-2021-21195, the iss...

CVE-2022-0608

CVE-2022-0608 is a Chrome Mojo integer overflow vulnerability (pre-98.0.4758.102) that could enable remote heap corruption via a crafted HTML page. Affected: Google Chrome (Mojo component). Impact per sources: potential arbitrary code execution or crash; CVSS values indicate high impact. Remediat...

CVE-2022-1488

CVE-2022-1488 involves Google Chrome’s Extensions API. The issue is described as an Inappropriate implementation in Extensions API, allowing a user-assisted attacker to leak cross-origin data via a crafted Chrome Extension. Affected software is Chrome prior to version 101.0.4951.41 (the policy wa...

CVE-2023-5856

CVE-2023-5856 affects Google Chrome/Chromium: Use-after-free in the Side Panel prior to 119.0.6045.105 can be triggered by a crafted HTML page when a user performs specific UI gestures, potentially causing heap corruption and remote code execution. Affected software: Google Chrome (Chromium-deriv...

CVE-2019-13709

CVE-2019-13709 refers to an access-restriction bypass in Chromium/Google Chrome prior to 78.0.3904.70, where policy enforcement for downloads could be bypassed via a crafted HTML page, enabling a remote attacker to download files that should be restricted. Affected: Chromium/Google Chrome up to v...

CVE-2019-13717

CVE-2019-13717 is a vulnerability in Google Chrome/Chromium prior to 78.0.3904.70 where the security UI could be obscured in full-screen mode via a crafted HTML page, enabling a remote attacker to hide security UI. The issue is categorized under a user-interface spoof/content-security context, wi...

CVE-2019-13738

CVE-2019-13738 affects Google Chrome (navigation component) where insufficient policy enforcement allows a remote attacker to bypass site isolation via a crafted HTML page. The issue is in Chrome versions prior to 79.0.3945.79. Remediation per the provided records is to upgrade to the fixed versi...

CVE-2019-5801

The CVE-2019-5801 entry corresponds to a vulnerability in Google Chrome’s Omnibox on iOS, where incorrect URL eliding allowed domain spoofing via a crafted HTML page. Connected documents confirm this CVE was fixed in Chromium/Chrome updates (e.g., openSUSE and Fedora advisories) by upgrading to v...

CVE-2023-5855

CVE-2023-5855 is a Use-After-Free in Chromium/Google Chrome Reading Mode. A remote attacker could entice a user to perform specific UI gestures, potentially causing heap corruption. Affected versions are Chrome/Chromium prior to 119.0.6045.105. Mitigation: upgrade to 119.0.6045.105 or later (as r...

CVE-2019-13741

CVE-2019-13741 affects Blink in Google Chrome before 79.0.3945.79, where untrusted clipboard input could be insufficiently validated, enabling a local attacker to bypass the same-origin policy via crafted clipboard data. Impact is local, with partial confidentiality/integrity/availability concern...

CVE-2019-5878

CVE-2019-5878 is a use-after-free vulnerability in the V8 JavaScript engine used by Google Chrome/Chromium prior to version 77.0.3865.75. The issue could allow a remote attacker to potentially trigger heap corruption via a crafted HTML page. Public documentation across multiple advisories (Debian...