CVE-2020-6564

CVE-2020-6564: In Google Chrome, an inappropriate implementation in permissions allowed a remote attacker to spoof the contents of a permission dialog via a crafted HTML page, before version 85.0.4183.83. This entry is supported by Debian/Fedora advisories and CVE listings stating that Chromium/C...

CVE-2021-21155

CVE-2021-21155 is a heap buffer overflow in the Tab Strip component of the Chromium-based Chrome/Chromium browser for Windows, before build 88.0.4324.182. The issue arises when a crafted HTML page is loaded, with a compromised renderer process potentially enabling a sandbox escape. The connected ...

CVE-2021-21181

CVE-2021-21181 is a side-channel information leakage vulnerability in Chrome Autofill. The connected Debian security advisories confirm this CVE among a chromium set and state that fixes are available in Chrome 89.x (mitigated in Debian packages as 89.0.4389.114 and later). The Astra Linux bullet...

CVE-2021-21190

CVE-2021-21190 affects the PDFium component in Google Chrome prior to 89.0.4389.72, where uninitialized data in PDFium could allow a remote attacker to glean potentially sensitive information from a process’s memory via a crafted PDF file. The connected advisories confirm the issue and note the v...

CVE-2021-21226

CVE-2021-21226: Use-after-free in navigation in Google Chrome prior to 90.0.4430.85 allows a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Affected software: Google Chrome (renderer/navigation path). Root cause: use-after...

CVE-2021-30568

CVE-2021-30568 corresponds to a heap buffer overflow in WebGL within the Chromium-based Chromium/Chrome engine, affecting versions prior to 92.0.4515.107. The vulnerability is triggered by processing a crafted HTML page and could enable remote code execution through heap corruption. The Astra Lin...

CVE-2021-30575

CVE-2021-30575 affects the Chromium-based Chrome Autofill component. The vulnerability is an out-of-bounds write in the Autofill module of the Chromium browser engine before version 92.0.4515.107 . The underlying issue enables a remote attacker who can render content to potentially trigger heap c...

CVE-2021-30602

CVE-2021-30602 describes a use-after-free in WebRTC in Google Chrome prior to 92.0.4515.159, where a crafted HTML page on a malicious site could trigger heap corruption. Affected product: Google Chrome (WebRTC component). Root cause: use-after-free leading to heap corruption. Impact: potential he...

CVE-2022-1307

CVE-2022-1307 affects Google Chrome/Chromium components implementing full screen in Chrome/Chromium (Android and desktop variants). The publicly available description states an inappropriate full-screen implementation allowed a remote attacker to spoof the Omnibox (URL bar) via a crafted HTML pag...

CVE-2023-0931

CVE-2023-0931 is a confirmed use-after-free in Video handling of Google Chrome/Chromium before 110.0.5481.177, exploitable via a crafted HTML page to potentially cause heap corruption. Affected component: Video (Chromium rendering/Media pipeline). Root cause: use-after-free in Video path, enablin...

CVE-2023-0941

CVE-2023-0941 is referenced in connected Astra Linux security notes as a Use-after-free in Prompts vulnerability affecting Google Chrome/Chromium before version 110.0.5481.177 . The issue could enable a remote attacker to potentially cause heap corruption via a crafted HTML page (Chromium securit...

CVE-2024-1284

CVE-2024-1284 concerns Chromium/Google Chrome Mojo use-after-free leading to potential heap corruption via a crafted HTML page, with the vulnerable state in Chrome/Chromium prior to version 121.0.6167.160. Multiple connected advisories confirm the affected product family (Chromium-based browsers)...

CVE-2026-6298

CVE-2026-6298 is a heap buffer overflow in Skia used by Google Chrome prior to 147.0.7727.101. The vulnerability could allow a remote attacker to read potentially sensitive information from process memory via a crafted HTML page. The connected sources confirm the issue and its CVSS context (Chrom...

CVE-2019-5780

The CVE-2019-5780 entry refers to Google Chrome on macOS with insufficient restrictions on Apple Events before Chrome 72.0.3626.81, allowing a local attacker to execute JavaScript via Apple Events. Affects Chrome versions prior to the 72.0.3626.81 update. Root cause: insufficient restriction of A...

CVE-2020-15970

CVE-2020-15970 is a Use-after-free in the NFC component of the Chromium/Google Chrome browser before 86.0.4240.75. Public sources in Debian/Arch/Fedora/FreeBSD describe it as a remote issue where an attacker who can cause renderer compromise could potentially escape the sandbox via a crafted HTML...

CVE-2021-21162

CVE-2021-21162: Use-after-free in Chromium’s WebRTC before 89.0.4389.72. Affects the WebRTC component; root cause is a use-after-free leading to potential heap corruption exploitable by a crafted HTML page. Exploitation status not detailed in the provided docs beyond the CVE entry. Remediation: u...

CVE-2022-1133

CVE-2022-1133 is a use-after-free in WebRTC Perf in Google Chrome prior to 100.0.4896.60, which could allow a remote attacker to cause heap corruption via a crafted HTML page. The Chrome 100.0.4896.60 update patches this issue; users and administrators should apply the Chrome update to mitigat e ...

CVE-2022-2606

CVE-2022-2606 describes a use-after-free in Chrome/Chromium’s Managed devices API, allowing a remote attacker to potentially trigger heap corruption when a user enables a specific Enterprise policy and loads a crafted HTML page. Affected products are Google Chrome/Chromium prior to version 104.0....

CVE-2023-1214

CVE-2023-1214 affects Chromium/Google Chrome prior to 111.0.5563.64, due to a V8 type confusion that could enable remote heap corruption via a crafted HTML page. The connected Astra Linux bulletin confirms the same description and identifies the vulnerable line of Chromium prior to the 111.0.5563...

CVE-2023-1220

The CVE-2023-1220 entry is confirmed to be a heap buffer overflow in UMA within Google Chrome (Chromium) prior to 111.0.5563.64. The vulnerability could be triggered by a remote attacker who has compromised the renderer process through a crafted HTML page, potentially causing heap corruption. Con...

CVE-2025-5066

CVE-2025-5066 affects Google Chrome/Chromium: In Android Messages, an inappropriate implementation allowed UI spoofing via a crafted HTML page when a user engaged in specific UI gestures. Root cause is an implementation flaw in the Messages component. Impact is UI spoofing risk; no data exfiltrat...

CVE-2020-15968

CVE-2020-15968 is a use-after-free in Blink (Chromium) prior to 86.0.4240.75, contributing to arbitrary code execution via a crafted page. The connected Arch Linux advisory (ASA-202010-1) specifies this as a remote issue in chromium before 86.0.4240.75-1 and notes the fix as upstream in 86.0.4240...

CVE-2020-15974

CVE-2020-15974 is an integer overflow in Blink affecting Chromium/Google Chrome prior to 86.0.4240.75, potentially enabling arbitrary code execution or site‑isolation bypass as described in the linked Debian advisory. Debian notes a broader patch set and fixes in 87.0.4280.88-0.4~deb10u1 for Chro...

CVE-2021-21113

CVE-2021-21113 refers to a heap buffer overflow in the Skia component of the Chromium-based Chromium/Google Chrome stack, reported as affecting versions before 87.0.4280.141. The vulnerability can allow a remote attacker to potentially cause heap corruption through a crafted HTML page. The connec...

CVE-2021-21164

CVE-2021-21164 (Chrome on iOS) affects Google Chrome on iOS prior to version 89.0.4389.72, due to insufficient data validation that allows a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability is tied to Chrome’s handling on iOS, with the impact described as cross...

CVE-2021-30577

CVE-2021-30577 affects Google Chrome’s Installer component; prior to 92.0.4515.107 there is insufficient policy enforcement, enabling a remote attacker to escalate to local privileges via a crafted file. Remediation: upgrade to 92.0.4515.107 or newer. Exploitation status is not provided in the do...

CVE-2022-2479

CVE-2022-2479 affects Google Chrome/Chromium, with insufficient validation of untrusted input in a file-context on Android before version 103.0.5060.134. An attacker could entice a user to install a malicious app and, via a crafted HTML page, read potentially sensitive information from internal f...

CVE-2022-2610

CVE-2022-2610 : Concrete details across connected docs show a Chrome/Chromium vulnerability in Background Fetch due to insufficient policy enforcement, allowing a remote attacker to leak cross-origin data via a crafted HTML page. Affected software is Google Chrome (Chromium-based), with the root ...

CVE-2022-3885

CVE-2022-3885 is a Use-after-free in V8 affecting Google Chrome prior to 107.0.5304.106 that could allow remote heap corruption via a crafted HTML page. The issue is confirmed in multiple trusted sources (Chromium/Chrome advisories and Astra Linux bulletin) and is tracked in Debian as fixed in Ch...

CVE-2023-0140

CVE-2023-0140 describes an incorrect File System API implementation in Google Chrome on Windows prior to 109.0.5414.74, which allowed a remote attacker to bypass file system restrictions via a crafted HTML page. The issue affects Chrome’s Chromium-based File System API behavior and is listed as L...

CVE-2023-1811

CVE-2023-1811 is a Chrome/Chromium use-after-free in the Frames component causing potential heap corruption when a user engages in specific UI interactions with a crafted HTML page. The issue affects Google Chrome before version 112.0.5615.49 (reported as a high-severity, network-exploitable vuln...

CVE-2023-6351

CVE-2023-6351 describes a use-after-free in libavif used by Google Chrome before 119.0.6045.199, allowing a remote attacker to cause heap corruption via a crafted AVIF file. Affected product/component: Google Chrome/Chromium with libavif. Root cause: use-after-free in libavif leading to possible ...

CVE-2024-9958

CVE-2024-9958 affects Google Chrome/Chromium Picture-in-Picture: an inappropriate implementation allows UI spoofing via a crafted HTML page. The issue is addressed in Chromium/Chrome with version 130.0.6723.58 (and related ChromeOS updates); Debian advisories confirm a fix in chromium 130.0.6723....

CVE-2025-6191

CVE-2025-6191 is a Chrome/Chromium vulnerability: an integer overflow in V8 prior to 137.0.7151.119 can enable a remote attacker to trigger out-of-bounds memory access via a crafted HTML page, with a High severity. There are public advisories and a Chrome security update (Stable channel 137.0.715...

CVE-2025-8879

CVE-2025-8879 is a heap buffer overflow in libaom used by Google Chrome/Chromium prior to 139.0.7258.127. The vulnerability allows remote exploitation via a curated set of gestures, leading to heap corruption with high impact (execution of code, crash). Affected component: libaom integration in C...

CVE-2026-12456

CVE-2026-12456 describes an Inappropriate implementation in Extensions in Google Chrome before 149.0.7827.155, where convincing a user to install a malicious extension could bypass the same-origin policy via a crafted Chrome Extension. Affected software: Google Chrome (Extensions subsystem). Root...

CVE-2026-5911

CVE-2026-5911 corresponds to a policy bypass vulnerability in Chrome/Chromium ServiceWorkers. Multiple connected sources confirm the issue affects Chromium-based browsers and was fixed by updating to version 147.0.7727.55 in various distributions (e.g., Debian/Chromium 147.0.7727.55-1 for bookwor...

CVE-2026-9115

CVE-2026-9115 : In Google Chrome, the Service Worker policy enforcement is insufficient prior to 148.0.7778.179, permitting a remote attacker to bypass the same-origin policy via a crafted HTML page. Affected: Chrome/Chromium's Service Worker. Impact is a potential cross-origin bypass as describe...

CVE-2020-15981

CVE-2020-15981 is an information-disclosure/out-of-bounds-read issue in the audio component of Chromium/Google Chrome prior to 86.0.4240.75. The vulnerability affects Chromium-based browsers and could allow a remote attacker to read potentially sensitive memory content via a crafted HTML page. Pu...

CVE-2020-15982

CVE-2020-15982 affects Chromium/Google Chrome prior to 86.0.4240.75, describing a side-channel information leakage in the cache component that can disclose potentially sensitive data from process memory via a crafted page. Multiple advisories and changelogs confirm the issue and tag it as informa...

CVE-2020-16022

Chromium/Chromium-derived Chrome vulnerability CVE-2020-16022 is an insufficient policy enforcement issue in the networking component that could let an attacker bypass firewall controls via a crafted HTML page. Affected software: Chromium browser (networking policy enforcement). Root cause: insuf...

CVE-2020-6542

CVE-2020-6542 affects ANGLE within Google Chrome prior to 84.0.4147.125. A use-after-free in ANGLE could allow remote attackers to trigger heap corruption via a crafted HTML page, potentially enabling arbitrary code execution. Debian/GLSA and other advisories confirm the same issue and indicate r...

CVE-2021-30584

The CVE-2021-30584 entry concerns a Chromium-based Chromium/Chrome Download UI issue on Android where an incorrect security UI allowed domain spoofing via a crafted HTML page. The vulnerability arises in the Downloads component of the browser engine prior to version 92.0.4515.107, enabling a remo...

CVE-2021-30591

CVE-2021-30591 is a use-after-free vulnerability in Chromium’s File System API, affecting Chromium-based browsers prior to 92.0.4515.131. Multiple connected advisories (Astra Linux, Arch Linux security advisories) confirm this issue and describe the root cause as a use-after-free in the File Syst...

CVE-2021-30598

CVE-2021-30598 — normal mode Affected software: Google Chrome (V8 engine). The connected documents confirm a type confusion vulnerability in V8 prior to Chrome version 92.0.4515.159. What is vulnerable: the V8 JavaScript engine implementation in Chrome contains a type confusion flaw that can be t...

CVE-2023-0135

Summary of CVE-2023-0135 (Google Chrome/Chromium) : A use-after-free in the Cart component of Google Chrome prior to 109.0.5414.74 allowed an attacker—if a user was convinced to install a malicious extension—to potentially trigger heap corruption via database corruption and a crafted HTML page. T...

CVE-2023-0927

CVE-2023-0927 : Affected component is the Web Payments API in Google Chrome on Android. The issue is a use-after-free in this API that could allow a remote attacker who has compromised the renderer to potentially exploit heap corruption via a crafted HTML page. The vulnerability is reported for C...

CVE-2023-1533

CVE-2023-1533 corresponds to a use-after-free in WebProtect within Google Chrome before version 111.0.5563.110, leading to potential heap corruption via a crafted HTML page. Multiple sources (Chromium-derived advisories and Astra Linux bulletin) confirm the issue affects Chrome/Chromium component...

CVE-2026-14131

CVE-2026-14131 affects Google Chrome WebAppInstalls with insufficient validation of untrusted input in the WebAppInstalls component prior to version 150.0.7871.47. The underlying issue allows a remote attacker who has compromised the renderer process to perform UI spoofing via a crafted HTML page...

CVE-2019-13678

CVE-2019-13678 affects Chromium/Google Chrome download-dialog spoofing. Root cause relates to incorrect data validation in the download dialog, enabling domain spoofing via crafted HTML. Debian advisories indicate remediation by upgrading Chromium to 78.0.3904.97-1~deb10u1 (and newer), with other...