CVE-2020-15962

Chromium/Google Chrome before 85.0.4183.121 is affected by a serial policy validation insufficiency that could allow a remote attacker to cause out-of-bounds memory access via a crafted HTML page. The issue is documented as CVE-2020-15962 and is addressed by upgrading to Chromium 85.0.4183.121+ (...

CVE-2020-6555

CVE-2020-6555 affects Google Chrome/Chromium WebGL. The vulnerability is an out-of-bounds read in WebGL that could allow a remote attacker to read potentially sensitive data from a process memory via a crafted page, prior to Chrome version 84.0.4147.125. Affected products include Chrome/Chromium ...

CVE-2021-30532

CVE-2021-30532 is a CSP policy enforcement vulnerability in Chromium-based Chrome before 91.0.4472.77. The issue is described as insufficient validation/enforcement in the Content Security Policy component, enabling a remote attacker to bypass CSP with a crafted HTML page. Public advisories acros...

CVE-2021-30540

CVE-2021-30540 affects Chromium/Google Chrome components prior to version 91.0.4472.77, with an incorrect security UI in the payments flow that could allow a remote attacker to spoof the domain via a crafted HTML page. The vulnerability is documented across multiple sources (Chromium/Chrome relea...

CVE-2022-0979

CVE-2022-0979 affects Google Chrome on Android (before 99.0.4844.74). The issue is a use-after-free in Safe Browsing that can lead to heap corruption when a user is prompted to interact with a crafted HTML page. Affected product: Chrome for Android; root cause: use-after-free in Safe Browsing; po...

CVE-2022-1874

This CVE affects Google Chrome on macOS. It describes Insufficient policy enforcement in Safe Browsing, allowing a remote attacker to bypass downloads protection via a crafted HTML page in versions prior to 102.0.5005.61. The issue is documented across multiple sources (Chromium/Chrome release no...

CVE-2022-2165

CVE-2022-2165 — Summary : The connected sources confirm a vulnerability in Google Chrome (desktop) stemming from insufficient data validation in URL formatting, enabling domain spoofing via IDN homographs with a crafted domain name. The issue affects Chrome up to version 103.0.5060.53 and is addr...

CVE-2022-2604

CVE-2022-2604 affects Google Chrome prior to 104.0.5112.79, where a use-after-free in Safe Browsing could lead to heap corruption via a crafted HTML page. The connected sources corroborate the same description across multiple trackers (Chromium/Chrome context). Impact is described as remote code ...

CVE-2023-5474

CVE-2023-5474 corresponds to a heap buffer overflow in PDF handling in Google Chrome/Chromium before 118.0.5993.70. A remote attacker could exploit this by convincing a user to perform specific interactions with a crafted PDF, potentially causing heap corruption. Public advisories reference Chrom...

CVE-2026-12469

CVE-2026-12469 affects Google Chrome on Android, where an uninitialized use in the GPU could allow a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability lies in the GPU component, with the affected version range prior to 149.0.7827.155. Remediation is to update to...

CVE-2019-5849

CVE-2019-5849 is described in the connected sources as an out-of-bounds read in the Skia graphics library in Google Chrome prior to 75.0.3770.80, enabling a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Affected product: Google Chrome (Sk...

CVE-2020-15980

CVE-2020-15980: In Chromium/Chrome, insufficient policy enforcement in the Intents component allows a local attacker to bypass navigation restrictions via crafted Intents. Impact is described as local code execution/privilege by affected components; Debian/Arch/FreeBSD advisories indicate fixes i...

CVE-2020-16004

CVE-2020-16004 affects Google Chrome/Chromium before 86.0.4240.183. The issue is a use-after-free in the user interface, leading to potential heap corruption exploitable by a remote attacker via a crafted HTML page. Multiple connected advisories confirm the same CVE and the vulnerability’s impact...

CVE-2020-6551

CVE-2020-6551 is a use-after-free in WebXR for Google Chrome, before version 84.0.4147.125, enabling a remote attacker to potentially corrupt the heap via a crafted HTML page. Affected product: Google Chrome (WebXR component). Root cause: use-after-free condition in WebXR handling. Impact: remote...

CVE-2021-21137

CVE-2021-21137 concerns an incorrect calculation issue in the DevTools component of Chromium prior to 88.0.4324.96. The core vulnerability is an inappropriate implementation in DevTools that could allow a remote attacker to obtain potentially sensitive information from disk via a crafted HTML pag...

CVE-2021-30602

CVE-2021-30602 describes a use-after-free in WebRTC in Google Chrome prior to 92.0.4515.159, where a crafted HTML page on a malicious site could trigger heap corruption. Affected product: Google Chrome (WebRTC component). Root cause: use-after-free leading to heap corruption. Impact: potential he...

CVE-2023-4350

CVE-2023-4350 is an issue in Chromium-based Chrome on Android involving an inappropriate implementation in Fullscreen that could allow a remote attacker to spoof the Omnibox (URL bar) via a crafted HTML page. The vulnerability originates from the Fullscreen implementation and affects Android buil...

CVE-2023-4903

CVE-2023-4903 concerns Google Chrome on Android before 117.0.5938.62, where Inappropriate implementation in Custom Mobile Tabs allowed a remote attacker to spoof security UI via a crafted HTML page. The linked sources confirm this is a Chromium-derived issue affecting Chrome/Chromium and related ...

CVE-2026-12458

The CVE-2026-12458 issue affects Google Chrome (Chromium-based) prior to 149.0.7827.155. Core problem: an inappropriate implementation in Passwords leads to cross-origin data leakage when a user is induced to perform specific UI gestures on a crafted HTML page. Documented impact: leakage of cross...

CVE-2026-6298

CVE-2026-6298 is a heap buffer overflow in Skia used by Google Chrome prior to 147.0.7727.101. The vulnerability could allow a remote attacker to read potentially sensitive information from process memory via a crafted HTML page. The connected sources confirm the issue and its CVSS context (Chrom...

CVE-2020-6545

CVE-2020-6545 describes a use-after-free in Chrome’s audio pipeline that could allow remote code execution via a crafted HTML page, due to heap corruption in affected builds up to 84.0.4147.125. Debian and Debian-tracker entries confirm the issue and fix version (84.0.4147.125) was released; mult...

CVE-2021-21160

CVE-2021-21160 is a heap buffer overflow in WebAudio within Chromium/Google Chrome prior to version 89.0.4389.72. A remote attacker could exploit this via a crafted HTML page to cause heap corruption. The connected sources confirm this issue across multiple advisories (Chromium/Chromebook updates...

CVE-2021-30514

The CVE-2021-30514 entry maps to a concrete Chromium flaw: a use-after-free in Autofill prior to version 90.0.4430.212, enabling a remote attacker who can render pages to potentially trigger heap corruption. Affected software is the Chromium browser (Chromium project; Chrome builds align with Chr...

CVE-2021-30589

CVE-2021-30589 affects Chromium’s Sharing component in Google Chrome/Chromium prior to 92.0.4515.107, due to insufficient validation of untrusted input. This could allow a remote attacker to bypass navigation restrictions via a crafted click-to-call link. Affected: Chromium before 92.0.4515.107. ...

CVE-2022-0803

CVE-2022-0803 concerns Google Chrome prior to 99.0.4844.51. It describes an inappropriate implementation in Permissions that allows a remote attacker to tamper with the Omnibox (URL bar) contents via a crafted HTML page. The issue affects Chrome’s handling within the Permissions component and has...

CVE-2023-4906

Chromium/Google Chrome Autofill vulnerability CVE-2023-4906: Insufficient policy enforcement in Autofill allows bypass via a crafted HTML page. Descriptions in connected docs confirm affected components (Chromium/Chrome/ChromeOS), root cause, and low severity. Public fixes exist: Debian/Debian se...

CVE-2024-2400

CVE-2024-2400 describes a use-after-free in Chrome/Chromium’s Performance Manager, allowing a remote attacker to potentially corrupt heap via a crafted HTML page. Affected software includes Google Chrome and Chromium, with vulnerable iterations prior to version 122.0.6261.128. The underlying issu...

CVE-2024-9963

CVE-2024-9963 concerns Google Chrome/Chromium where insufficient data validation in Downloads allows a remote attacker to spoof UI when a user, lured by a crafted HTML page and specific UI gestures, interacts with the page. Affected product/version: Chrome/Chromium prior to 130.0.6723.58. Root ca...

CVE-2011-3045

CVE-2011-3045 describes an integer signedness error in libpng’s png_inflate (pngrutil.c) affecting libpng before 1.4.10beta01. The vulnerability, cited as used in Google Chrome before 17.0.963.83 and other products, can cause a denial of service (application crash) or potentially allow arbitrary ...

CVE-2020-6427

CVE-2020-6427 is a use-after-free in Google Chrome’s audio subsystem that could allow a remote attacker to exploit heap corruption via a crafted HTML page. Affected: Google Chrome (audio path); vulnerability type: use-after-free. Impact: potential remote code execution is described in affected ad...

CVE-2021-21131

CVE-2021-21131 is a policy enforcement issue in Chromium’s File System API (before version 88.0.4324.96). The vulnerability allows a remote attacker to bypass filesystem restrictions via a crafted HTML page. Affected product: Chromium browser (File System API component). Root cause: insufficient ...

CVE-2021-30526

CVE-2021-30526 describes an out-of-bounds write in the Chromium project’s TabStrip component, affecting Google Chrome and Chromium builds prior to version 91.0.4472.77. An attacker could persuade a user to install a crafted malicious extension via a specially crafted HTML page, triggering an out-...

CVE-2021-30581

CVE-2021-30581 is a use-after-free in DevTools of the Chromium browser engine prior to version 92.0.4515.107 . The issue, observed in the Chromium DevTools component, can be triggered by a crafted HTML page and a user-provided malicious extension, with the potential for remote code execution or c...

CVE-2023-0130

CVE-2023-0130 refers to an Inappropriate implementation in the Fullscreen API in Google Chrome/Chromium. The vulnerability could allow a remote attacker to spoof the Omnibox (URL bar) via a crafted HTML page. The issue is documented as affecting Chrome/Chromium and was addressed in Chrome 109.0.5...

CVE-2023-1528

The connected Astra Linux bulletin confirms CVE-2023-1528 affects Chromium-based browsers, notably Google Chrome/Chromium Passwords, with the issue being a use-after-free that could lead to heap corruption when an attacker who has compromised the renderer page crafts HTML. This allows a remote at...

CVE-2023-5473

CVE-2023-5473 affects Google Chrome/Chromium Cast: Use-after-free in Cast prior to 118.0.5993.70 allows a renderer-compromised remote attacker to potentially cause heap corruption via a crafted HTML page (Chromium severity: Low). Public disclosures and advisories in connected documents confirm th...

CVE-2024-9958

CVE-2024-9958 affects Google Chrome/Chromium Picture-in-Picture: an inappropriate implementation allows UI spoofing via a crafted HTML page. The issue is addressed in Chromium/Chrome with version 130.0.6723.58 (and related ChromeOS updates); Debian advisories confirm a fix in chromium 130.0.6723....

CVE-2026-9115

CVE-2026-9115 : In Google Chrome, the Service Worker policy enforcement is insufficient prior to 148.0.7778.179, permitting a remote attacker to bypass the same-origin policy via a crafted HTML page. Affected: Chrome/Chromium's Service Worker. Impact is a potential cross-origin bypass as describe...

CVE-2019-13766

CVE-2019-13766_affects_Google_Chrome: Use-after-free in accessibility leads to potential heap corruption via a crafted HTML page. Affected software: Google Chrome prior to 77.0.3865.75. Root cause: use-after-free in accessibility code path. Impact: remote attacker could exploit heap corruption on...

CVE-2020-6432

CVE-2020-6432 : Affected software is Chromium/Google Chrome prior to 81.0.4044.92. Description: an insufficient policy enforcement in navigations vulnerability could allow a remote attacker to bypass navigation restrictions via a crafted HTML page. Impact per documents: potential bypass of naviga...

CVE-2020-6509

CVE-2020-6509 affects Chromium/Google Chrome before 83.0.4103.116, with a use-after-free in the extensions component. The issue enables a remote attacker to potentially execute arbitrary code (sandbox escape) when a user is convinced to install a crafted malicious extension. Multiple connected ad...

CVE-2020-6560

CVE-2020-6560 concerns Google Chrome’s autofill: insufficient policy enforcement before version 85.0.4183.83 can allow a remote attacker to leak cross-origin data via a crafted HTML page. The affected component is autofill policy enforcement in Chrome; root cause is improper policy checks that ex...

CVE-2021-21141

CVE-2021-21141 affects Chromium-based browsers (Chrome/Chromium) up to version 88.0.4324.96, due to insufficient policy enforcement in the File System API. This allows a remote attacker to bypass the file-extension policy via a crafted HTML page. The issue is mitigated by upgrading to 88.0.4324.9...

CVE-2023-1810

CVE-2023-1810 corresponds to a heap buffer overflow in Visuals of Google Chrome/Chromium before 112.0.5615.49. The issue allows a remote attacker who has compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. Severity is High (CVSS v3.1 base score 8.8). A...

CVE-2023-2466

CVE-2023-2466 describes an Inappropriate implementation in Prompts in Google Chrome (Chromium) prior to 113.0.5672.63 that allows a remote attacker to spoof the contents of the security UI via a crafted HTML page. Connected sources confirm Chromium/Chrome prompt-related weaknesses with this CVE a...

CVE-2023-2929

CVE-2023-2929 describes an out-of-bounds write in Google Chrome’s SwiftShader component, enabling potential remote heap corruption via a crafted HTML page. Affected products are Google Chrome/Chromium with SwiftShader; vulnerable if using versions prior to 114.0.5735.90. The Debian advisory (DSA-...

CVE-2024-9122

Type Confusion in V8 of Google Chrome (Chromium) prior to 129.0.6668.70 allows remote attackers to cause out-of-bounds memory access via a crafted HTML page. Affected products include Chromium/Chrome; vulnerable component is V8. Public references in connected documents confirm the issue and indic...

CVE-2026-12456

CVE-2026-12456 describes an Inappropriate implementation in Extensions in Google Chrome before 149.0.7827.155, where convincing a user to install a malicious extension could bypass the same-origin policy via a crafted Chrome Extension. Affected software: Google Chrome (Extensions subsystem). Root...

CVE-2020-16011

CVE-2020-16011 is a heap buffer overflow in Google Chrome’s Windows UI, prior to version 86.0.4240.183, that could allow a remote attacker who has compromised the renderer to potentially escape the Chrome sandbox via a crafted HTML page. Public advisories (Debian, FreeBSD, Debian DSA, and Chrome ...

CVE-2020-16037

CVE-2020-16037 affects the Chromium/Chrome browser prior to version 87.0.4280.88, with a use-after-free in the clipboard component. The vulnerability, described in connected advisories, can allow a remote attacker to potentially execute arbitrary code via a crafted HTML page, due to heap corrupti...