CVE-2022-1146

CVE-2022-1146 affects Google Chrome prior to 100.0.4896.60, due to an inappropriate implementation in Resource Timing. This flaw could allow a remote attacker to leak cross-origin data via a crafted HTML page. Multiple connected sources (Chrome release notes, Debian security advisory, Gentoo GLSA...

CVE-2022-1869

CVE-2022-1869 refers to a type confusion in the V8 JavaScript engine used by Google Chrome before version 102.0.5005.61. The vulnerability arises from a type-confusion error in V8 that could allow a remote attacker to trigger heap corruption via a crafted HTML page. Several connected advisories c...

CVE-2022-2157

CVE-2022-2157 describes a use-after-free in Chrome’s Interest groups, allowing a remote attacker who already compromised a renderer to trigger heap corruption via a crafted HTML page. The vulnerability affects Google Chrome (Chromium) before version 103.0.5060.53; impact is described as high for ...

CVE-2021-21118

CVE-2021-21118 is a data validation issue in the V8 JavaScript engine of Chromium-based browsers. The connected advisories and Debian/Arch Fedora entries confirm the vulnerability stems from insufficient data validation in V8 prior to version 88.0.4324.96, potentially enabling out-of-bounds memor...

CVE-2021-21147

CVE-2021-21147 affects Chromium/Chrome where Skia had an inappropriate implementation that could allow a local attacker to spoof the Omnibox (URL bar) via a crafted HTML page. The public records consistently cite version 88.0.4324.146 as the fix, with Debian notes stating the patch is in 88.0.432...

CVE-2021-21172

CVE-2021-21172 corresponds to a policy enforcement error in Chrome's File System API on Windows, allowing a remote attacker to bypass filesystem restrictions via a crafted HTML page. Affected: Google Chrome/Chromium prior to 89.0.4389.72 (File System API component). Root cause: insufficient polic...

CVE-2021-30523

Chromium/WebRTC use-after-free vulnerability CVE-2021-30523 existed in Chromium before 91.0.4472.77, reported via Arch Linux advisory ASA-202106-33 and mirrored in Fedora/Debian Alpine entries. The issue is a use-after-free in the WebRTC component that could allow arbitrary code execution on remo...

CVE-2022-0607

CVE-2022-0607 is a use-after-free vulnerability in Google Chrome’s GPU handling, prior to version 98.0.4758.102, susceptible to remote heap corruption via a crafted HTML page. The issue affects Chrome/Chromium GPU code paths and was elevated to high impact in Chrome’s February 2022 security relea...

CVE-2022-0806

CVE-2022-0806 concerns Google Chrome (and Chromium-derived) browsers. The vulnerability enables a remote attacker to potentially leak cross-origin data via a crafted HTML page when a user is convinced to engage in screen sharing. The issue affects Chrome versions prior to 99.0.4844.51, with an im...

CVE-2023-0471

CVE-2023-0471: Use-after-free in WebTransport in Google Chrome before 109.0.5414.119. A crafted HTML page could trigger heap corruption via WebTransport, enabling remote code execution or instability per Chromium advisory. The Chrome release notes confirm a security fix in the 109.0.5414.119 Stab...

CVE-2023-5186

CVE-2023-5186 is a use-after-free vulnerability in Chromium-based browsers (Google Chrome and Chromium) prior to 117.0.5938.132. The issue lies in Passwords handling, where a crafted UI interaction can lead to a heap corruption through a use-after-free condition, potentially enabling arbitrary co...

CVE-2023-5472

CVE-2023-5472 describes a use-after-free in Chrome/Chromium Profiles prior to 118.0.5993.117, enabling heap corruption via a crafted HTML page for a remote attacker. Impact is high (CVE has base score 8.8). Affected software includes Google Chrome/Chromium; Debian advisories confirm fixed version...

CVE-2023-5857

CVE-2023-5857 affects Google Chrome/Chromium: an inappropriate implementation in the Downloads component allowed a remote attacker to potentially execute arbitrary code via a malicious file. The issue is tied to Chromium’s handling in Downloads prior to 119.0.6045.105. Public disclosures in conne...

CVE-2020-15963

CVE-2020-15963 concerns Google Chrome where insufficient policy enforcement in extensions could allow a user-tempted installation of a malicious extension to sandbox-escape. Affected software: Google Chrome prior to 85.0.4183.121 (extensions component policy enforcement). Root cause: insufficient...

CVE-2021-21123

CVE-2021-21123 is a data validation vulnerability in Google Chrome’s File System API (Chromium) prior to 88.0.4324.96. The issue allows a remote attacker to bypass filesystem restrictions via a crafted HTML page due to insufficient data validation in the File System API/File System component. The...

CVE-2022-0800

CVE-2022-0800 is a heap buffer overflow in Google Chrome’s Cast UI prior to 99.0.4844.51. A remote attacker could exploit this by convincing a user to engage in specific interaction with a crafted HTML page, potentially causing heap corruption. Public reports indicate the vulnerability affects Ch...

CVE-2022-0975

CVE-2022-0975 is a use-after-free in ANGLE affecting Google Chrome prior to 99.0.4844.74, leading to potential remote heap corruption. The vulnerability is documented across multiple sources (Chrome stable channel update and Debian security advisory) with fixes implemented in version 99.0.4844.74...

CVE-2022-1305

CVE-2022-1305 is a Use-after-free in storage in Chromium/Google Chrome prior to 100.0.4896.88 that could allow a remote attacker to trigger heap corruption via a crafted HTML page. Advisories indicate fixes in version 100.0.4896.88+ across distributions (e.g., Debian DSA-5120-1, Fedora/chromium u...

CVE-2022-1313

CVE-2022-1313 describes a use-after-free in Chromium-based browsers (Chrome/Chromium) related to tab groups, leading to potential heap corruption via a crafted HTML page. The issue affects Chromium-derived browsers and was publicly disclosed with the impact of remote code execution/compromise via...

CVE-2022-1492

Summary: CVE-2022-1492 corresponds to a Chrome/Blink vulnerability described as insufficient data validation in Blink Editing that could allow a remote attacker to inject arbitrary scripts or HTML via a crafted HTML page. The issue affects Google Chrome’s Blink Editing path and is associated with...

CVE-2022-1636

CVE-2022-1636 affects Google Chrome up to version 101.0.4951.64, where a use-after-free in Performance APIs could allow a remote attacker to trigger heap corruption via a crafted HTML page. Impact is high (C/H/I/H; network attack vector, no privileges required, user interaction required). Remedia...

CVE-2022-1865

Consolidated details confirm CVE-2022-1865 affects Google Chrome prior to 102.0.5005.61, due to a use-after-free in the Bookmarks component that can be triggered by convincing a user to install a malicious extension and perform specific interactions, potentially enabling heap corruption. Public b...

CVE-2023-5482

CVE-2023-5482 affects Google Chrome/Chromium before 119.0.6045.105 due to insufficient data validation in USB handling, enabling a remote attacker to trigger out-of-bounds memory access via a crafted HTML page. Impact is described as high, with potential memory corruption or crash; exploitation s...

CVE-2021-30509

CVE-2021-30509 affects Chromium/Google Chrome before 90.0.4430.212. It describes an out-of-bounds write in the Tab Strip component that an attacker could trigger by convincing a user to install a malicious extension, enabling memory corruption via a crafted HTML page and crafted Chrome extension....

CVE-2021-30574

CVE-2021-30574 is a use-after-free in the protocol handling component of the Chromium-based Google Chrome browser prior to 92.0.4515.107. The description indicates an attacker could craft an HTML page to trigger a remote heap corruption, potentially enabling arbitrary code execution or similar im...

CVE-2023-2137

The provided connected docs confirm CVE-2023-2137 affects Google Chrome/Chromium and its underlying SQLite component, with a heap buffer overflow in SQLite prior to Chrome 112.0.5615.137. The root cause is a heap corruption condition that could be triggered by a crafted HTML page, allowing remote...

CVE-2023-5851

CVE-2023-5851 describes an insecure/incorrect implementation in Downloads of Google Chrome (Chromium) prior to 119.0.6045.105, which allowed a remote attacker to obfuscate the security UI via a crafted HTML page. Public references in the connected documents confirm the issue affects Chromium-base...

CVE-2019-5764

CVE-2019-5764 is a use-after-free/incorrect pointer management in the WebRTC code path of Chromium/Google Chrome, prior to version 72.0.3626.81, allowing a remote attacker to potentially exploit heap corruption via a crafted HTML page. Public references in Debian advisories and Fedora/Nessus entr...

CVE-2022-1862

CVE-2022-1862 corresponds to an issue in Google Chrome extensions: an inappropriate implementation in Extensions allowed a user-assisted attacker to bypass profile restrictions via a crafted HTML page. The vulnerability affects Chrome prior to 102.0.5005.61 (and related Chromium builds). Impact d...

CVE-2023-0141

Conforms to CVE-2023-0141: Google Chrome/Chromium suffered from insufficient CORS policy enforcement, enabling a remote attacker to leak cross-origin data via a crafted HTML page. Affected versions were prior to 109.0.5414.74. The Chrome stable update 109.0.5414.74+ includes fixes; the release no...

CVE-2023-1530

CVE-2023-1530 affects Chromium-derived browsers (Google Chrome/Chromium) prior to version 111.0.5563.110. The flaw is a Use-After-Free in PDF handling that can enable heap corruption via a crafted HTML page, leading to remote code execution risk as described in multiple advisories. Remediation is...

CVE-2023-4905

CVE-2023-4905 affects Google Chrome/Chromium where an inappropriate implementation in Prompts allowed a remote attacker to spoof the security UI via a crafted HTML page. The vulnerability is associated with Chrome/Chromium versions prior to 117.0.5938.62. Publicly documented fixes include Chrome/...

CVE-2025-5065

The CVE-2025-5065 entry corresponds to an insecure implementation in Chrome’s FileSystemAccess API that could enable UI spoofing via a crafted HTML page. Affected software is Google Chrome (Chromium-based); vulnerability arises from an inappropriate implementation in FileSystemAccess API prior to...

CVE-2019-5816

CVE-2019-5816 : A process lifetime issue in Google Chrome on Android (pre-74.0.3729.108) could allow a remote attacker to persist an exploited process via a crafted HTML page. The vulnerability is addressed in Chromium/Chrome updates (e.g., Chrome for Android and related Chromium patches such as ...

CVE-2020-6417

CVE-2020-6417: In Google Chrome, an inappropriate implementation in the installer before version 80.0.3987.87 allows a local attacker to execute arbitrary code via a crafted registry entry. Connected advisories confirm this as a Chrome installer path issue (local impact) and indicate that remedia...

CVE-2020-6537

CVE-2020-6537 involves a type confusion in V8 used by Google Chrome/Chromium, allowing a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Affected: Chromium/Google Chrome browsers prior to version 84.0.4147.105. Root cause: V8 type confusion leading to code ex...

CVE-2021-21201

CVE-2021-21201: Use-after-free in permissions of Google Chrome prior to 90.0.4430.72 can allow a remote attacker with renderer access to escape the sandbox via a crafted HTML page. Connected advisories (e.g., ASA-202104-2/ASA-202104-5) reiterate sandbox-escape and related issues across Chromium c...

CVE-2021-30530

CVE-2021-30530 : The connected documents confirm a vulnerability in Chromium’s WebAudio component prior to 91.0.4472.77, described as an out-of-bounds memory access. Exploitation is possible through a crafted HTML page that could be remote, with impact including potential memory access violations...

CVE-2023-0138

CVE-2023-0138 is a heap buffer overflow in libphonenumber affecting Google Chrome/Chromium prior to 109.0.5414.74, enabling potential heap corruption via a crafted HTML page. The issue is tied to Chrome/Chromium’s libphonenumber component; remediation is to upgrade to Chrome 109.0.5414.74 or late...

CVE-2021-21120

CVE-2021-21120 is a use-after-free in Chromium’s WebSQL implementation reported as affecting Chromium before version 88.0.4324.96 . The connected sources confirm a remote attacker could potentially exploit this to cause heap corruption via a crafted HTML page. The details consistently reference t...

CVE-2021-30536

CVE-2021-30536 is an information-disclosure/out-of-bounds-read issue in the V8 engine of the Chromium browser before 91.0.4472.77. Multiple sources (Arch Linux ASA-202106-2/ASA-202106-33, Debian, Alpine, Fedora) describe it as affecting Chromium/Chrome prior to that version, with remediation by u...

CVE-2022-0802

CVE-2022-0802 affects Google Chrome on Android before 99.0.4844.51, where an improper implementation in full-screen mode could allow a remote attacker to hide the Omnibox contents via a crafted HTML page. The issue stems from a UI/fullscreen handling flaw that can misrepresent the URL bar visibil...

CVE-2023-6346

CVE-2023-6346 is a use-after-free in WebAudio within Chromium-based browsers, enabling potential heap corruption. The vulnerability affects Chromium and derivatives (e.g., Google Chrome) prior to version 119.0.6045.199. Multiple connected advisories confirm the fix in version 119.0.6045.199 or ne...

CVE-2019-5823

CVE-2019-5823 corresponds to a forced navigation from a service worker vulnerability in Chromium/Google Chrome, allowing navigation restriction bypass via a crafted HTML page. Affected products include Chromium/Chrome before version 74.0.3729.108. The issue is described as an access restriction b...

CVE-2019-8075

CVE-2019-8075 affects Google Chrome/Chromium (Flash component). Root cause: insufficient data validation in Flash leading to Same Origin Policy bypass and potential information disclosure. In Chrome/Chromium, fixes appeared in the 87.x series: Chrome 87.0.4280.66+ (and later) to address the vulne...

CVE-2021-21198

CVE-2021-21198 is an out-of-bounds read in the Inter-Process Communication (IPC) path of Chrome/Chromium before 89.0.4389.114, reported as a renderer-initiated sandbox-escape risk via a crafted HTML page. Connected advisories confirm the issue in Chromium's IPC and note remediation via upgrade to...

CVE-2021-30507

CVE-2021-30507: In Chromium (Chrome/Chromium) Offline component, before 90.0.4430.212, an incorrect/ inappropriate implementation could allow a remote attacker who has compromised the renderer process to bypass site isolation via a crafted HTML page. Public advisories/state indicate the fixed ver...

CVE-2022-0978

The CVE-2022-0978 entry affects ANGLE in Google Chrome prior to version 99.0.4844.74, where a use-after-free could enable a remote attacker to trigger heap corruption via a crafted HTML page. Public sources detail the issue as part of multiple Chromium/Chrome security fixes, with advisories and c...

CVE-2023-0133

CVE-2023-0133 affects Google Chrome/Chromium: an Inappropriate implementation in Permission prompts allowed bypass of main origin permission delegation via a crafted HTML page on Android prior to 109.0.5414.74. The issue is fixed in Chrome 109 release line (109.0.5414.74 and newer). Affected prod...

CVE-2012-4930

The CVE-2012-4930 issue affects the SPDY protocol (v3 and earlier) as used by Firefox, Chrome, and other products. It allows a man-in-the-middle to observe length-based side channels of TLS-compressed data to potentially recover plaintext HTTP headers (CRIME attack). Root cause: TLS compression w...