CVE-2021-30540

CVE-2021-30540 affects Chromium/Google Chrome components prior to version 91.0.4472.77, with an incorrect security UI in the payments flow that could allow a remote attacker to spoof the domain via a crafted HTML page. The vulnerability is documented across multiple sources (Chromium/Chrome relea...

CVE-2021-30589

CVE-2021-30589 affects Chromium’s Sharing component in Google Chrome/Chromium prior to 92.0.4515.107, due to insufficient validation of untrusted input. This could allow a remote attacker to bypass navigation restrictions via a crafted click-to-call link. Affected: Chromium before 92.0.4515.107. ...

CVE-2022-0803

CVE-2022-0803 concerns Google Chrome prior to 99.0.4844.51. It describes an inappropriate implementation in Permissions that allows a remote attacker to tamper with the Omnibox (URL bar) contents via a crafted HTML page. The issue affects Chrome’s handling within the Permissions component and has...

CVE-2022-0979

CVE-2022-0979 affects Google Chrome on Android (before 99.0.4844.74). The issue is a use-after-free in Safe Browsing that can lead to heap corruption when a user is prompted to interact with a crafted HTML page. Affected product: Chrome for Android; root cause: use-after-free in Safe Browsing; po...

CVE-2022-1874

This CVE affects Google Chrome on macOS. It describes Insufficient policy enforcement in Safe Browsing, allowing a remote attacker to bypass downloads protection via a crafted HTML page in versions prior to 102.0.5005.61. The issue is documented across multiple sources (Chromium/Chrome release no...

CVE-2022-2165

CVE-2022-2165 — Summary : The connected sources confirm a vulnerability in Google Chrome (desktop) stemming from insufficient data validation in URL formatting, enabling domain spoofing via IDN homographs with a crafted domain name. The issue affects Chrome up to version 103.0.5060.53 and is addr...

CVE-2023-0134

CVE-2023-0134 describes a use-after-free in the Chrome/Chromium shopping cart (Cart) component prior to 109.0.5414.74. The vulnerability could enable heap corruption via database corruption and a crafted HTML page when a user is convinced to install a malicious extension. Affected product/version...

CVE-2023-1810

CVE-2023-1810 corresponds to a heap buffer overflow in Visuals of Google Chrome/Chromium before 112.0.5615.49. The issue allows a remote attacker who has compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. Severity is High (CVSS v3.1 base score 8.8). A...

CVE-2023-5474

CVE-2023-5474 corresponds to a heap buffer overflow in PDF handling in Google Chrome/Chromium before 118.0.5993.70. A remote attacker could exploit this by convincing a user to perform specific interactions with a crafted PDF, potentially causing heap corruption. Public advisories reference Chrom...

CVE-2024-9966

CVE-2024-9966 affects Google Chrome/Chromium (Navigations) and is caused by an inappropriate implementation that allows bypassing the Content Security Policy via a crafted HTML page. The issue has a documented low severity and is associated with Chrome/Chromium builds prior to 130.0.6723.58. Publ...

CVE-2020-15964

CVE-2020-15964 is a Chrome/Chromium vulnerability affecting the media component (V8) with a pre-85.0.4183.121 build. The issue is described as an out-of-bounds write in V8 that could enable remote arbitrary code execution, tied to heap corruption in crafted HTML pages. Multiple connected advisori...

CVE-2020-6383

CVE-2020-6383 is a type confusion in Google Chrome's V8 engine that could allow a remote attacker to cause heap corruption via a crafted HTML page. The initial entry notes Chrome versions prior to 80.0.3987.116 were affected. The connected Chrome update (Stable Channel Update for Desktop) confirm...

CVE-2020-6507

CVE-2020-6507 describes an out-of-bounds write in the V8 JavaScript engine used by Google Chrome, allowing remote exploitation to potentially cause heap corruption via a crafted HTML page. The vulnerability affects Chrome versions prior to 83.0.4103.106. Connected documents confirm an exploit exi...

CVE-2020-6518

CVE-2020-6518: Use-after-free in Google Chrome’s developer tools prior to 84.0.4147.89, enabling a remote attacker who entices a user to use devtools to potentially trigger heap corruption via a crafted HTML page. Affected product: Google Chrome (Developer Tools). Root cause: use-after-free in de...

CVE-2020-6549

CVE-2020-6549 : Use-after-free in Chrome’s media subsystem (pre-84.0.4147.125) can allow a remote attacker to exploit heap corruption via a crafted HTML page. Affected: Google Chrome (media component). Root cause: use-after-free. Impact per sources: arbitrary code execution, information disclosur...

CVE-2021-21131

CVE-2021-21131 is a policy enforcement issue in Chromium’s File System API (before version 88.0.4324.96). The vulnerability allows a remote attacker to bypass filesystem restrictions via a crafted HTML page. Affected product: Chromium browser (File System API component). Root cause: insufficient ...

CVE-2023-2466

CVE-2023-2466 describes an Inappropriate implementation in Prompts in Google Chrome (Chromium) prior to 113.0.5672.63 that allows a remote attacker to spoof the contents of the security UI via a crafted HTML page. Connected sources confirm Chromium/Chrome prompt-related weaknesses with this CVE a...

CVE-2023-4350

CVE-2023-4350 is an issue in Chromium-based Chrome on Android involving an inappropriate implementation in Fullscreen that could allow a remote attacker to spoof the Omnibox (URL bar) via a crafted HTML page. The vulnerability originates from the Fullscreen implementation and affects Android buil...

CVE-2023-4903

CVE-2023-4903 concerns Google Chrome on Android before 117.0.5938.62, where Inappropriate implementation in Custom Mobile Tabs allowed a remote attacker to spoof security UI via a crafted HTML page. The linked sources confirm this is a Chromium-derived issue affecting Chrome/Chromium and related ...

CVE-2024-2627

CVE-2024-2627 : Use-after-free in Canvas of Google Chrome/Chromium (pre-123.0.6312.58) can allow a remote attacker to trigger heap corruption via a crafted HTML page. Impact: high. Remediation: upgrade Chromium/Chrome to a fixed build (e.g., Chromium 123.0.6312.86+ as per Debian/Chromium advisori...

CVE-2026-12463

The CVE-2026-12463 entry corresponds to an UXSS vulnerability in Google Chrome on Linux, caused by an inappropriate implementation in Views that allowed a compromised renderer to inject arbitrary scripts/HTML via a crafted HTML page. Affected product is Chrome on Linux, with the issue present pri...

CVE-2020-15966

CVE-2020-15966 refers to Google Chrome where insufficient policy enforcement in extensions prior to 85.0.4183.121 could allow a user-driven attacker to obtain potentially sensitive information by convincing a user to install a malicious extension. Public disclosures in Debian/Arch/Fedora security...

CVE-2020-16037

CVE-2020-16037 affects the Chromium/Chrome browser prior to version 87.0.4280.88, with a use-after-free in the clipboard component. The vulnerability, described in connected advisories, can allow a remote attacker to potentially execute arbitrary code via a crafted HTML page, due to heap corrupti...

CVE-2021-21137

CVE-2021-21137 concerns an incorrect calculation issue in the DevTools component of Chromium prior to 88.0.4324.96. The core vulnerability is an inappropriate implementation in DevTools that could allow a remote attacker to obtain potentially sensitive information from disk via a crafted HTML pag...

CVE-2021-21141

CVE-2021-21141 affects Chromium-based browsers (Chrome/Chromium) up to version 88.0.4324.96, due to insufficient policy enforcement in the File System API. This allows a remote attacker to bypass the file-extension policy via a crafted HTML page. The issue is mitigated by upgrading to 88.0.4324.9...

CVE-2021-30524

CVE-2021-30524 is a use-after-free vulnerability in the Chromium browser’s TabStrip component, reported before 91.0.4472.77. The issue, exploited via crafted HTML pages, could allow a remote attacker to potentially execute arbitrary code when a user is persuaded to install a malicious extension. ...

CVE-2021-30567

CVE-2021-30567 is a use-after-free in Chromium’s DevTools before 92.0.4515.107. It can allow heap corruption via a specific user gesture after convincing a user to open DevTools. Affected software is Chromium/Chrome (DevTools component). Impact: potential remote code execution or instability as d...

CVE-2023-1528

The connected Astra Linux bulletin confirms CVE-2023-1528 affects Chromium-based browsers, notably Google Chrome/Chromium Passwords, with the issue being a use-after-free that could lead to heap corruption when an attacker who has compromised the renderer page crafts HTML. This allows a remote at...

CVE-2023-5473

CVE-2023-5473 affects Google Chrome/Chromium Cast: Use-after-free in Cast prior to 118.0.5993.70 allows a renderer-compromised remote attacker to potentially cause heap corruption via a crafted HTML page (Chromium severity: Low). Public disclosures and advisories in connected documents confirm th...

CVE-2026-12458

The CVE-2026-12458 issue affects Google Chrome (Chromium-based) prior to 149.0.7827.155. Core problem: an inappropriate implementation in Passwords leads to cross-origin data leakage when a user is induced to perform specific UI gestures on a crafted HTML page. Documented impact: leakage of cross...

CVE-2020-15961

CVE-2020-15961 describes insufficient policy validation in Chrome extensions, enabling a sandbox escape via a crafted extension. The issue affects Google Chrome/Chromium prior to 85.0.4183.121, where an attacker could persuade a user to install a malicious extension to bypass sandbox restrictions...

CVE-2020-15976

CVE-2020-15976 is a use-after-free in the WebXR component of Chromium/Google Chrome (Android) prior to 86.0.4240.75, potentially enabling heap corruption and arbitrary code execution via a crafted HTML page. Remediation from connected sources includes upgrading to Chromium 86.0.4240.75 or newer (...

CVE-2020-6557

CVE-2020-6557 affects Chromium prior to 86.0.4240.75. The vulnerability arises from an inappropriate implementation in the networking component, enabling domain spoofing via a crafted HTML page. Public documents in connected sources confirm the issue and recommend upgrading Chromium to 86.0.4240....

CVE-2021-30579

CVE-2021-30579 is a use-after-free vulnerability in the Chromium-based UI framework of Google Chrome prior to 92.0.4515.107. The issue could allow a remote attacker to trigger heap corruption via a crafted HTML page, with the impact described as remote code execution and potential content spoofin...

CVE-2022-4189

CVE-2022-4189 relates to Google Chrome/Chromium: Insufficient policy enforcement in DevTools that could let a user who installs a malicious extension bypass navigation restrictions via a crafted Chrome Extension. The issue is documented with a Medium severity (CVSS v3.1 base score 4.3) and is add...

CVE-2023-0130

CVE-2023-0130 refers to an Inappropriate implementation in the Fullscreen API in Google Chrome/Chromium. The vulnerability could allow a remote attacker to spoof the Omnibox (URL bar) via a crafted HTML page. The issue is documented as affecting Chrome/Chromium and was addressed in Chrome 109.0.5...

CVE-2023-4906

Chromium/Google Chrome Autofill vulnerability CVE-2023-4906: Insufficient policy enforcement in Autofill allows bypass via a crafted HTML page. Descriptions in connected docs confirm affected components (Chromium/Chrome/ChromeOS), root cause, and low severity. Public fixes exist: Debian/Debian se...

CVE-2024-1283

The connected records corroborate CVE-2024-1283: a heap buffer overflow in Skia used by Google Chrome/Chromium prior to 121.0.6167.160. The vulnerability allows remote attackers to trigger heap corruption via a crafted HTML page, potentially enabling code execution. Affected software includes Chr...

CVE-2026-5918

CVE-2026-5918 affects Google Chrome (Chromium-based); it stems from an inappropriate navigation implementation that could allow a renderer-compromised remote attacker to leak cross-origin data via a crafted HTML page. The public bulletins confirm the vulnerability in Chrome prior to 147.0.7727.55...

CVE-2020-15960

CVE-2020-15960 refers to an information-disclosure vulnerability in Chromium/Google Chrome prior to 85.0.4183.121. The 15960 issue is an out-of-bounds read in the storage component, exploitable via a crafted HTML page. The Debian/Arch/Gentoo entries corroborate the fix was to upgrade to 85.0.4183...

CVE-2020-6442

CVE-2020-6442 affects Chromium/Google Chrome prior to 81.0.4044.92. The issue is an implementation error in the page cache that could allow a remote attacker to leak cross-origin data via a crafted HTML page. Impact: potential cross-origin data exposure without user interaction beyond visiting a ...

CVE-2020-6494

CVE-2020-6494 : Google Chrome on Android prior to 83.0.4103.97 is affected by an incorrect security UI in the payments component that allows a remote attacker to spoof the Omnibox (URL bar) via a crafted HTML page. Connected sources (Arch Linux ASA-202006-3, Debian DSA-4714, FreeBSD vuln note, CN...

CVE-2020-6560

CVE-2020-6560 concerns Google Chrome’s autofill: insufficient policy enforcement before version 85.0.4183.83 can allow a remote attacker to leak cross-origin data via a crafted HTML page. The affected component is autofill policy enforcement in Chrome; root cause is improper policy checks that ex...

CVE-2021-21129

CVE-2021-21129 describes a policy-enforcement vulnerability in Chromium’s File System API, prior to version 88.0.4324.96, enabling a remote attacker to bypass filesystem restrictions via a crafted HTML page. Root cause: insufficient policy enforcement in the File System API. Impact stated by sour...

CVE-2021-30601

CVE-2021-30601: A use-after-free in Chrome’s Extensions API affects Google Chrome versions prior to 92.0.4515.159. An attacker convincing a user to install a malicious extension could potentially exploited heap corruption via a crafted HTML page. Affected component: Chrome Extensions API; root ca...

CVE-2024-9963

CVE-2024-9963 concerns Google Chrome/Chromium where insufficient data validation in Downloads allows a remote attacker to spoof UI when a user, lured by a crafted HTML page and specific UI gestures, interacts with the page. Affected product/version: Chrome/Chromium prior to 130.0.6723.58. Root ca...

CVE-2020-15989

CVE-2020-15989 affects the PDFium component in Chromium/Google Chrome, where uninitialized data could allow a crafted PDF file to disclose potentially sensitive information from process memory. This vulnerability is tied to the Chromium baseline before 86.0.4240.75 (reported in multiple advisorie...

CVE-2020-15991

CVE-2020-15991: Use-after-free in the password manager of Chromium/Google Chrome before 86.0.4240.75 allows a remote attacker who can render HTML in the renderer to potentially escape the sandbox. The Debian/Fedora/Arch security advisories and FreeBSD/vuxml entries confirm this vulnerability and ...

CVE-2020-16003

CVE-2020-16003 is a Chrome vulnerability: Use after free in the printing component. The connected data confirms Chrome/Chromium fixed this issue in the Chrome update cycle (reported as a use-after-free in printing), but the specific exploit details or affected versions beyond the prior 86.0.4240....

CVE-2020-6556

CVE-2020-6556 describes a heap buffer overflow in the SwiftShader component of Google Chrome/Chromium prior to version 84.0.4147.135, enabling remote exploitation of heap corruption via a crafted HTML page. The issue affects the SwiftShader path in Chrome/Chromium and could lead to arbitrary code...