CVE-2021-30525

CVE-2021-30525 describes a use-after-free in the Chromium browser's TabGroups component prior to 91.0.4472.77. A remote attacker could trigger heap corruption by convincing a user to install a crafted HTML page via a malicious extension. The issue is part of a broader set of Chromium vulnerabilit...

CVE-2021-30578

CVE-2021-30578 concerns the Chromium-based Chrome/Chromium media component. The issue is an uninitialized use in the Media module prior to version 92.0.4515.107, enabling a remote attacker to trigger out-of-bounds memory access via a crafted HTML page. Exploitation would require delivering the pa...

CVE-2022-0604

CVE-2022-0604 is a heap buffer overflow in Chrome’s Tab Groups, affecting Chrome before 98.0.4758.102. Affected component is the Tab Groups feature; root cause is a heap overflow that could be triggered by a crafted HTML page after user interaction with a malicious extension. Practical impact per...

CVE-2022-1868

The CVE-2022-1868 case concerns Google Chrome’s Extensions API where an improper implementation allowed bypassing navigation restrictions when a user is convinced to install a crafted malicious extension. Affected software is Google Chrome prior to 102.0.5005.61; a fix is reflected in Chrome/chro...

CVE-2026-5911

CVE-2026-5911 corresponds to a policy bypass vulnerability in Chrome/Chromium ServiceWorkers. Multiple connected sources confirm the issue affects Chromium-based browsers and was fixed by updating to version 147.0.7727.55 in various distributions (e.g., Debian/Chromium 147.0.7727.55-1 for bookwor...

CVE-2019-13765

CVE-2019-13765 describes a use-after-free in Chrome’s Content Delivery Manager leading to potential heap corruption via a crafted HTML page. Affected software: Google Chrome (Content Delivery Manager component); vulnerable when running versions prior to 78.0.3904.70. The underlying impact is remo...

CVE-2020-6554

CVE-2020-6554 is a use-after-free in Chrome extensions that could enable a sandbox escape via a crafted extension in Chrome versions before 84.0.4147.125. Public connected documents confirm Chromium/Chrome advisories and Debian advisory references to this vulnerability and related fixes; one Debi...

CVE-2021-21159

CVE-2021-21159 describes a heap buffer overflow in Chrome’s TabStrip prior to 89.0.4389.72. A remote attacker could potentially exploit this heap corruption via a crafted HTML page, leading to arbitrary code execution or crash. Connected advisories confirm Chrom(e/ium) components affected and not...

CVE-2021-30528

CVE-2021-30528 is a use-after-free vulnerability in the Chromium WebAuthentication component (Chromium/Google Chrome) on Android, before version 91.0.4472.77. The issue can allow a remote attacker who has compromised the renderer process of a user who saved a credit card in their Google account t...

CVE-2021-30582

CVE-2021-30582 corresponds to an “Inappropriate implementation in Animation” in the Chromium-based browser engine, affecting Google Chrome/Chromium prior to 92.0.4515.107. The issue enables a remote attacker to leak cross-origin data via a crafted HTML page, as described across multiple connected...

CVE-2021-30585

CVE-2021-30585 is a use-after-free in the sensor handling of the Chromium browser engine used by Google Chrome on Windows, before version 92.0.4515.107. A crafted HTML page could trigger a heap corruption that a remote attacker could exploit. Public documents consistently describe the vulnerabili...

CVE-2022-1128

CVE-2022-1128 affects Google Chrome on Windows and is caused by an inappropriate implementation of the Web Share API. The issue allows a crafted HTML page on a local network segment to leak cross-origin data. The vulnerability is tied to Chrome versions prior to 100.0.4896.60. The CVSS v3.1 vecto...

CVE-2022-2007

CVE-2022-2007 affects Chromium/Google Chrome’s WebGPU component. Use-after-free in WebGPU on versions prior to 102.0.5005.115 enables potential heap corruption via a crafted HTML page. The issue is cited across multiple sources (Chrome/Chromium release notes, Debian security tracker advisories, G...

CVE-2022-2161

CVE-2022-2161 targets Google Chrome/Chromium WebApp Provider. Description and connected sources confirm a Use-after-free in the WebApp Provider module, enabling heap corruption via user interactions. Affected software is Chrome/Chromium prior to version 103.0.5060.53 (stable channel updates refer...

CVE-2023-2721

CVE-2023-2721 involves a use-after-free in Navigation in Google Chrome (Chromium) prior to version 113.0.5672.126, enabling potential heap corruption via a crafted HTML page. Affected software is Google Chrome/Chromium; root cause is a memory misreference in Navigation leading to use-after-free. ...

CVE-2025-5066

CVE-2025-5066 affects Google Chrome/Chromium: In Android Messages, an inappropriate implementation allowed UI spoofing via a crafted HTML page when a user engaged in specific UI gestures. Root cause is an implementation flaw in the Messages component. Impact is UI spoofing risk; no data exfiltrat...

CVE-2019-5767

CVE-2019-5767 affects Google Chrome on Android (WebAPKs). The issue is caused by insufficient protection of the permission UI in WebAPKs, allowing an attacker who persuades a user to install a malicious APK to access privacy/security sensitive web APIs. Affected: Chrome on Android with WebAPK per...

CVE-2021-21209

CVE-2021-21209 concerns the Google Chrome storage API: an inappropriate implementation allowed a remote attacker to leak cross-origin data via a crafted HTML page in Chrome versions prior to 90.0.4430.72. The issue is documented across multiple advisories, noting it as an information-disclosure v...

CVE-2021-30521

CVE-2021-30521 is a documented heap buffer overflow in the Autofill component of Chromium/Google Chrome for Android (pre-91.0.4472.77). The root cause is a memory safety flaw allowing out-of-bounds access via a crafted HTML page, enabling a remote attacker to potentially execute arbitrary code. P...

CVE-2021-30531

CVE-2021-30531: A CSP policy enforcement issue in the Chromium/Google Chrome component before 91.0.4472.77 allowed remote attackers to bypass content security policy via a crafted HTML page. Affected product: Chromium/Chrome browser; vulnerable component: Content Security Policy enforcement in th...

CVE-2021-30571

Summary (CVE-2021-30571): An insufficient policy enforcement in DevTools of the Chromium-based Chrome before 92.0.4515.107 could allow a user- tricked into installing a malicious extension to potentially perform a sandbox escape via a crafted HTML page. The issue resides in Chromium’s DevTools co...

CVE-2024-2626

CVE-2024-2626 affects Google Chrome/Chromium where an out-of-bounds read in SwiftShader could allow a remote attacker to cause memory access issues via a crafted HTML page. Affected component: SwiftShader within Chrome/Chromium before version 123.0.6312.58. Impact: information disclosure through ...

CVE-2024-9966

CVE-2024-9966 affects Google Chrome/Chromium (Navigations) and is caused by an inappropriate implementation that allows bypassing the Content Security Policy via a crafted HTML page. The issue has a documented low severity and is associated with Chrome/Chromium builds prior to 130.0.6723.58. Publ...

CVE-2021-21161

CVE-2021-21161 is a reported heap buffer overflow in the Chromium browser’s TabStrip component, fixed in versions before 89.0.4389.72 (vulnerable prior to that update). The issue allows a remote attacker to potentially cause heap corruption via a crafted HTML page. In practice, updates to Chromiu...

CVE-2021-21185

CVE-2021-21185 affects the Chromium browser (Extensions component) with a policy enforcement issue that could allow a user-targeted attacker who lures a user into installing a malicious extension to exfiltrate sensitive information. The Debian advisories list this CVE among multiple Chromium fixe...

CVE-2021-30534

CVE-2021-30534 concerns Chromium’s iFrameSandbox, where insufficient policy enforcement prior to version 91.0.4472.77 could allow a remote attacker to bypass navigation restrictions via a crafted HTML page. The issue is part of a broader set of Chromium vulnerabilities fixed in the 91.0.4472.77 r...

CVE-2021-30572

The CVE-2021-30572 entry corresponds to a use-after-free in the Chromium Autofill component before version 92.0.4515.107, allowing a remote attacker to potentially exploit heap corruption via a crafted HTML page. Connected sources corroborate the same description across multiple advisories (Astra...

CVE-2022-0605

CVE-2022-0605 is a Chrome/Chromium vulnerability: a use-after-free in the Webstore API prior to 98.0.4758.102 could allow heap corruption when a user is convinced to install a malicious extension and to engage in specific interactions. The issue was addressed in the Chrome 98.0.4758.102 release. ...

CVE-2022-1136

CVE-2022-1136 affects Google Chrome/Chromium: Use-after-free in the Tab Strip can lead to heap corruption when a user is convinced to install a malicious extension. Affected versions are before 100.0.4896.60; the Chrome 100 stable release fixed 28 security issues including this CVE. Exploitation ...

CVE-2024-1283

The connected records corroborate CVE-2024-1283: a heap buffer overflow in Skia used by Google Chrome/Chromium prior to 121.0.6167.160. The vulnerability allows remote attackers to trigger heap corruption via a crafted HTML page, potentially enabling code execution. Affected software includes Chr...

CVE-2024-2627

CVE-2024-2627 : Use-after-free in Canvas of Google Chrome/Chromium (pre-123.0.6312.58) can allow a remote attacker to trigger heap corruption via a crafted HTML page. Impact: high. Remediation: upgrade Chromium/Chrome to a fixed build (e.g., Chromium 123.0.6312.86+ as per Debian/Chromium advisori...

CVE-2026-12463

The CVE-2026-12463 entry corresponds to an UXSS vulnerability in Google Chrome on Linux, caused by an inappropriate implementation in Views that allowed a compromised renderer to inject arbitrary scripts/HTML via a crafted HTML page. Affected product is Chrome on Linux, with the issue present pri...

CVE-2026-19556

CVE-2026-19556 is a use-after-free vulnerability in the V8 JavaScript engine within Google Chrome prior to 151.0.7922.137, allowing a remote attacker to execute arbitrary code inside the browser sandbox when a user visits a crafted HTML page. Multiple sources (NVD, Red Hat, Debian OSV, EUVD) desc...

CVE-2019-5771

CVE-2019-5771 : An incorrect JIT of GLSL shaders in SwiftShader used by Google Chrome prior to 72.0.3626.81 allows a remote attacker to execute arbitrary code via a crafted HTML page. This is fixed in Chrome 72.0.3626.81 and later. The vulnerability affects SwiftShader’s GLSL JIT within Chrome; n...

CVE-2019-5854

CVE-2019-5854 is an integer overflow in the PDFium component of Chromium/Google Chrome prior to 76.0.3809.87, leading to potential heap corruption when processing crafted PDFs. Multiple connected sources (Debian security advisories, Arch Linux ASA, CVE listings) confirm PDFium’s role and the affe...

CVE-2021-21126

Chromium/Google Chrome is affected by CVE-2021-21126 due to an insufficient policy enforcement in extensions, enabling a remote attacker to bypass site isolation via a crafted extension. Affected components include the extensions subsystem of Chromium (prior to version 88.0.4324.96). The issue is...

CVE-2021-21207

CVE-2021-21207 is a use-after-free in IndexedDB in Google Chrome prior to 90.0.4430.72. The vulnerability could allow an attacker who convinces a user to install a malicious Chrome Extension to potentially perform a sandbox escape via a crafted extension. Affected component is the IndexedDB imple...

CVE-2021-30519

CVE-2021-30519 affects the Chromium-based Chrome/Chromium Payments component, where a use-after-free leads to heap corruption via a crafted HTML page. Versions prior to 90.0.4430.212 are vulnerable. A fix is shipped in 90.0.4430.212 (upstream) with distributors (e.g., Fedora/Arch Linux) updating ...

CVE-2021-30573

CVE-2021-30573 affects the GPU component of Chromium/Chrome before version 92.0.4515.107. It is described as a use-after-free issue that could allow a remote attacker to trigger heap corruption via a crafted HTML page, with remote code execution and content impact stated in several advisories. Ex...

CVE-2022-1145

CVE-2022-1145 is a Chrome use-after-free in Extensions affecting Chrome

CVE-2023-4900

CVE-2023-4900 affects Google Chrome/Chromium family (Android Chrome prior to 117.0.5938.62) where an inappropriate implementation in Custom Tabs allows a remote attacker to obfuscate a permission prompt via a crafted HTML page. Connected advisories indicate this is one of multiple Chromium issues...

CVE-2026-14131

CVE-2026-14131 affects Google Chrome WebAppInstalls with insufficient validation of untrusted input in the WebAppInstalls component prior to version 150.0.7871.47. The underlying issue allows a remote attacker who has compromised the renderer process to perform UI spoofing via a crafted HTML page...

CVE-2026-5918

CVE-2026-5918 affects Google Chrome (Chromium-based); it stems from an inappropriate navigation implementation that could allow a renderer-compromised remote attacker to leak cross-origin data via a crafted HTML page. The public bulletins confirm the vulnerability in Chrome prior to 147.0.7727.55...

CVE-2020-6506

CVE-2020-6506 affects Android WebView used by Google Chrome on Android, due to insufficient policy enforcement in WebView that allows bypassing site isolation via a crafted HTML page. The issue is categorized as a policy enforcement error in WebView, impacting the ability to enforce cross-origin/...

CVE-2021-21145

CVE-2021-21145: A use-after-free in the Fonts component of Chromium prior to version 88.0.4324.146. Several advisories (Debian DSA-4846-1, Arch ASA-202102-4, Alpine, Fedora, etc.) document this as a Chromium/Fonts issue that could allow a remote attacker to exploit heap corruption via a crafted H...

CVE-2021-21204

CVE-2021-21204 is a use-after-free in Blink/WebKit reported for Google Chrome on macOS before 90.0.4430.72, allowing remote heap corruption via a crafted HTML page. The issue is confirmed across multiple vendor advisories (Debian, Fedora, Alpine, Astra Linux) and is addressed by updating to Chrom...

CVE-2022-1137

CVE-2022-1137 affects Google Chrome extensions prior to 100.0.4896.60. The connected sources describe an "Inappropriate implementation in Extensions" in Chrome, enabling an attacker who persuades a user to install a malicious extension to leak potentially sensitive information via a crafted HTML ...

CVE-2024-1284

CVE-2024-1284 concerns Chromium/Google Chrome Mojo use-after-free leading to potential heap corruption via a crafted HTML page, with the vulnerable state in Chrome/Chromium prior to version 121.0.6167.160. Multiple connected advisories confirm the affected product family (Chromium-based browsers)...

CVE-2020-15961

CVE-2020-15961 describes insufficient policy validation in Chrome extensions, enabling a sandbox escape via a crafted extension. The issue affects Google Chrome/Chromium prior to 85.0.4183.121, where an attacker could persuade a user to install a malicious extension to bypass sandbox restrictions...

CVE-2020-15962

Chromium/Google Chrome before 85.0.4183.121 is affected by a serial policy validation insufficiency that could allow a remote attacker to cause out-of-bounds memory access via a crafted HTML page. The issue is documented as CVE-2020-15962 and is addressed by upgrading to Chromium 85.0.4183.121+ (...