CVE-2019-5854

CVE-2019-5854 is an integer overflow in the PDFium component of Chromium/Google Chrome prior to 76.0.3809.87, leading to potential heap corruption when processing crafted PDFs. Multiple connected sources (Debian security advisories, Arch Linux ASA, CVE listings) confirm PDFium’s role and the affe...

CVE-2020-6506

CVE-2020-6506 affects Android WebView used by Google Chrome on Android, due to insufficient policy enforcement in WebView that allows bypassing site isolation via a crafted HTML page. The issue is categorized as a policy enforcement error in WebView, impacting the ability to enforce cross-origin/...

CVE-2021-30519

CVE-2021-30519 affects the Chromium-based Chrome/Chromium Payments component, where a use-after-free leads to heap corruption via a crafted HTML page. Versions prior to 90.0.4430.212 are vulnerable. A fix is shipped in 90.0.4430.212 (upstream) with distributors (e.g., Fedora/Arch Linux) updating ...

CVE-2021-30531

CVE-2021-30531: A CSP policy enforcement issue in the Chromium/Google Chrome component before 91.0.4472.77 allowed remote attackers to bypass content security policy via a crafted HTML page. Affected product: Chromium/Chrome browser; vulnerable component: Content Security Policy enforcement in th...

CVE-2021-30572

The CVE-2021-30572 entry corresponds to a use-after-free in the Chromium Autofill component before version 92.0.4515.107, allowing a remote attacker to potentially exploit heap corruption via a crafted HTML page. Connected sources corroborate the same description across multiple advisories (Astra...

CVE-2022-0604

CVE-2022-0604 is a heap buffer overflow in Chrome’s Tab Groups, affecting Chrome before 98.0.4758.102. Affected component is the Tab Groups feature; root cause is a heap overflow that could be triggered by a crafted HTML page after user interaction with a malicious extension. Practical impact per...

CVE-2022-1870

CVE-2022-1870 describes a use-after-free in Chrome’s App Service, exploitable via a crafted Chrome Extension, potentially yielding heap corruption. Affected product: Google Chrome (App Service) prior to version 102.0.5005.61. Reported impact in the sources is high severity with potential for arbi...

CVE-2023-2721

CVE-2023-2721 involves a use-after-free in Navigation in Google Chrome (Chromium) prior to version 113.0.5672.126, enabling potential heap corruption via a crafted HTML page. Affected software is Google Chrome/Chromium; root cause is a memory misreference in Navigation leading to use-after-free. ...

CVE-2023-4900

CVE-2023-4900 affects Google Chrome/Chromium family (Android Chrome prior to 117.0.5938.62) where an inappropriate implementation in Custom Tabs allows a remote attacker to obfuscate a permission prompt via a crafted HTML page. Connected advisories indicate this is one of multiple Chromium issues...

CVE-2026-12453

CVE-2026-12453 affects Google Chrome (Chromium-based) prior to 149.0.7827.155. The issue is insufficient validation of untrusted input in Input, allowing a renderer process account-compromised page to bypass the same-origin policy via a crafted HTML page. Practical impact stated is the bypass of ...

CVE-2020-15962

Chromium/Google Chrome before 85.0.4183.121 is affected by a serial policy validation insufficiency that could allow a remote attacker to cause out-of-bounds memory access via a crafted HTML page. The issue is documented as CVE-2020-15962 and is addressed by upgrading to Chromium 85.0.4183.121+ (...

CVE-2020-6551

CVE-2020-6551 is a use-after-free in WebXR for Google Chrome, before version 84.0.4147.125, enabling a remote attacker to potentially corrupt the heap via a crafted HTML page. Affected product: Google Chrome (WebXR component). Root cause: use-after-free condition in WebXR handling. Impact: remote...

CVE-2021-21204

CVE-2021-21204 is a use-after-free in Blink/WebKit reported for Google Chrome on macOS before 90.0.4430.72, allowing remote heap corruption via a crafted HTML page. The issue is confirmed across multiple vendor advisories (Debian, Fedora, Alpine, Astra Linux) and is addressed by updating to Chrom...

CVE-2021-30534

CVE-2021-30534 concerns Chromium’s iFrameSandbox, where insufficient policy enforcement prior to version 91.0.4472.77 could allow a remote attacker to bypass navigation restrictions via a crafted HTML page. The issue is part of a broader set of Chromium vulnerabilities fixed in the 91.0.4472.77 r...

CVE-2021-30571

Summary (CVE-2021-30571): An insufficient policy enforcement in DevTools of the Chromium-based Chrome before 92.0.4515.107 could allow a user- tricked into installing a malicious extension to potentially perform a sandbox escape via a crafted HTML page. The issue resides in Chromium’s DevTools co...

CVE-2022-0605

CVE-2022-0605 is a Chrome/Chromium vulnerability: a use-after-free in the Webstore API prior to 98.0.4758.102 could allow heap corruption when a user is convinced to install a malicious extension and to engage in specific interactions. The issue was addressed in the Chrome 98.0.4758.102 release. ...

CVE-2022-1136

CVE-2022-1136 affects Google Chrome/Chromium: Use-after-free in the Tab Strip can lead to heap corruption when a user is convinced to install a malicious extension. Affected versions are before 100.0.4896.60; the Chrome 100 stable release fixed 28 security issues including this CVE. Exploitation ...

CVE-2023-4909

CVE-2023-4909 describes an Inappropriate implementation in Interstitials in Google Chrome/Chromium prior to 117.0.5938.62 that allows a remote attacker to obfuscate the security UI via a crafted HTML page. The issue is documented across multiple sources (Chromium/Chrome advisories, Debian securit...

CVE-2019-13766

CVE-2019-13766_affects_Google_Chrome: Use-after-free in accessibility leads to potential heap corruption via a crafted HTML page. Affected software: Google Chrome prior to 77.0.3865.75. Root cause: use-after-free in accessibility code path. Impact: remote attacker could exploit heap corruption on...

CVE-2021-21159

CVE-2021-21159 describes a heap buffer overflow in Chrome’s TabStrip prior to 89.0.4389.72. A remote attacker could potentially exploit this heap corruption via a crafted HTML page, leading to arbitrary code execution or crash. Connected advisories confirm Chrom(e/ium) components affected and not...

CVE-2021-21185

CVE-2021-21185 affects the Chromium browser (Extensions component) with a policy enforcement issue that could allow a user-targeted attacker who lures a user into installing a malicious extension to exfiltrate sensitive information. The Debian advisories list this CVE among multiple Chromium fixe...

CVE-2021-21189

CVE-2021-21189 is a policy-enforcement vulnerability in the Chromium/Chromium-based browser payments component, allowing navigation/policy bypass via a crafted HTML page in versions prior to 89.0.4389.72. Public documents confirm the issue affects Chromium’s payments logic and that upstream fixes...

CVE-2021-21207

CVE-2021-21207 is a use-after-free in IndexedDB in Google Chrome prior to 90.0.4430.72. The vulnerability could allow an attacker who convinces a user to install a malicious Chrome Extension to potentially perform a sandbox escape via a crafted extension. Affected component is the IndexedDB imple...

CVE-2022-1145

CVE-2022-1145 is a Chrome use-after-free in Extensions affecting Chrome

CVE-2024-2887

CVE-2024-2887 is a Type Confusion in WebAssembly in Google Chrome prior to 123.0.6312.86 that allows remote code execution via a crafted HTML page. Connected sources confirm this affects Chromium/WebAssembly, with public disclosures tied to Pwn2Own 2024. The Chrome/Bugfix release 123.0.6312.86 (a...

CVE-2020-16004

CVE-2020-16004 affects Google Chrome/Chromium before 86.0.4240.183. The issue is a use-after-free in the user interface, leading to potential heap corruption exploitable by a remote attacker via a crafted HTML page. Multiple connected advisories confirm the same CVE and the vulnerability’s impact...

CVE-2020-6545

CVE-2020-6545 describes a use-after-free in Chrome’s audio pipeline that could allow remote code execution via a crafted HTML page, due to heap corruption in affected builds up to 84.0.4147.125. Debian and Debian-tracker entries confirm the issue and fix version (84.0.4147.125) was released; mult...

CVE-2020-6555

CVE-2020-6555 affects Google Chrome/Chromium WebGL. The vulnerability is an out-of-bounds read in WebGL that could allow a remote attacker to read potentially sensitive data from a process memory via a crafted page, prior to Chrome version 84.0.4147.125. Affected products include Chrome/Chromium ...

CVE-2021-21145

CVE-2021-21145: A use-after-free in the Fonts component of Chromium prior to version 88.0.4324.146. Several advisories (Debian DSA-4846-1, Arch ASA-202102-4, Alpine, Fedora, etc.) document this as a Chromium/Fonts issue that could allow a remote attacker to exploit heap corruption via a crafted H...

CVE-2021-30532

CVE-2021-30532 is a CSP policy enforcement vulnerability in Chromium-based Chrome before 91.0.4472.77. The issue is described as insufficient validation/enforcement in the Content Security Policy component, enabling a remote attacker to bypass CSP with a crafted HTML page. Public advisories acros...

CVE-2022-2007

CVE-2022-2007 affects Chromium/Google Chrome’s WebGPU component. Use-after-free in WebGPU on versions prior to 102.0.5005.115 enables potential heap corruption via a crafted HTML page. The issue is cited across multiple sources (Chrome/Chromium release notes, Debian security tracker advisories, G...

CVE-2026-14142

Summary : CVE-2026-14142 describes an inappropriate implementation in Google Chrome’s Extensions prior to 150.0.7871.47, enabling a remote attacker (with renderer access) to spoof the UI via a crafted HTML page. The vulnerability affects Chrome extensions rendering logic and is rated Low severity...

CVE-2011-3045

CVE-2011-3045 describes an integer signedness error in libpng’s png_inflate (pngrutil.c) affecting libpng before 1.4.10beta01. The vulnerability, cited as used in Google Chrome before 17.0.963.83 and other products, can cause a denial of service (application crash) or potentially allow arbitrary ...

CVE-2021-30514

The CVE-2021-30514 entry maps to a concrete Chromium flaw: a use-after-free in Autofill prior to version 90.0.4430.212, enabling a remote attacker who can render pages to potentially trigger heap corruption. Affected software is the Chromium browser (Chromium project; Chrome builds align with Chr...

CVE-2021-30521

CVE-2021-30521 is a documented heap buffer overflow in the Autofill component of Chromium/Google Chrome for Android (pre-91.0.4472.77). The root cause is a memory safety flaw allowing out-of-bounds access via a crafted HTML page, enabling a remote attacker to potentially execute arbitrary code. P...

CVE-2021-30581

CVE-2021-30581 is a use-after-free in DevTools of the Chromium browser engine prior to version 92.0.4515.107 . The issue, observed in the Chromium DevTools component, can be triggered by a crafted HTML page and a user-provided malicious extension, with the potential for remote code execution or c...

CVE-2022-0973

CVE-2022-0973 is a Chrome use-after-free vulnerability in Safe Browsing that could enable a remote attacker to cause heap corruption via a crafted HTML page. The connected sources confirm the issue affects Google Chrome before version 99.0.4844.74 and were addressed in the Chrome Stable Channel u...

CVE-2020-16011

CVE-2020-16011 is a heap buffer overflow in Google Chrome’s Windows UI, prior to version 86.0.4240.183, that could allow a remote attacker who has compromised the renderer to potentially escape the Chrome sandbox via a crafted HTML page. Public advisories (Debian, FreeBSD, Debian DSA, and Chrome ...

CVE-2020-6432

CVE-2020-6432 : Affected software is Chromium/Google Chrome prior to 81.0.4044.92. Description: an insufficient policy enforcement in navigations vulnerability could allow a remote attacker to bypass navigation restrictions via a crafted HTML page. Impact per documents: potential bypass of naviga...

CVE-2021-21126

Chromium/Google Chrome is affected by CVE-2021-21126 due to an insufficient policy enforcement in extensions, enabling a remote attacker to bypass site isolation via a crafted extension. Affected components include the extensions subsystem of Chromium (prior to version 88.0.4324.96). The issue is...

CVE-2021-21127

CVE-2021-21127 affects Chromium/Chrome:Insufficient policy enforcement in extensions before 88.0.4324.96 allows bypassing Content Security Policy via a crafted extension. Affected product: Chromium/Chrome extensions subsystem; root cause is policy enforcement weakness in extensions. Impact: attac...

CVE-2022-1137

CVE-2022-1137 affects Google Chrome extensions prior to 100.0.4896.60. The connected sources describe an "Inappropriate implementation in Extensions" in Chrome, enabling an attacker who persuades a user to install a malicious extension to leak potentially sensitive information via a crafted HTML ...

CVE-2022-2604

CVE-2022-2604 affects Google Chrome prior to 104.0.5112.79, where a use-after-free in Safe Browsing could lead to heap corruption via a crafted HTML page. The connected sources corroborate the same description across multiple trackers (Chromium/Chrome context). Impact is described as remote code ...

CVE-2023-4907

CVE-2023-4907 affects Google Chrome on Android (pre-117.0.5938.62). The issue stems from an inappropriate implementation in the Intents module, enabling a remote attacker to obfuscate security UI via a crafted HTML page. The vulnerability is categorized with a low severity and was disclosed as pa...

CVE-2020-6427

CVE-2020-6427 is a use-after-free in Google Chrome’s audio subsystem that could allow a remote attacker to exploit heap corruption via a crafted HTML page. Affected: Google Chrome (audio path); vulnerability type: use-after-free. Impact: potential remote code execution is described in affected ad...

CVE-2020-6509

CVE-2020-6509 affects Chromium/Google Chrome before 83.0.4103.116, with a use-after-free in the extensions component. The issue enables a remote attacker to potentially execute arbitrary code (sandbox escape) when a user is convinced to install a crafted malicious extension. Multiple connected ad...

CVE-2020-6539

CVE-2020-6539 refers to a use-after-free in CSS handling in Google Chrome prior to 84.0.4147.105, enabling potential remote code execution via a crafted HTML page. The vulnerability affects Chrome’s CSS engine and could allow heap corruption leading to arbitrary code execution, with impact descri...

CVE-2020-6543

CVE-2020-6543 affects Google Chrome/Chromium and is a use-after-free in the task scheduling path that could allow a remote attacker to abuse heap corruption via a crafted HTML page. The vulnerability is described as potentially enabling remote code execution with network attack surface and requir...

CVE-2021-21160

CVE-2021-21160 is a heap buffer overflow in WebAudio within Chromium/Google Chrome prior to version 89.0.4389.72. A remote attacker could exploit this via a crafted HTML page to cause heap corruption. The connected sources confirm this issue across multiple advisories (Chromium/Chromebook updates...

CVE-2021-30526

CVE-2021-30526 describes an out-of-bounds write in the Chromium project’s TabStrip component, affecting Google Chrome and Chromium builds prior to version 91.0.4472.77. An attacker could persuade a user to install a crafted malicious extension via a specially crafted HTML page, triggering an out-...