CVE-2023-4904

CVE-2023-4904 affects Google Chrome and Chromium-based derivatives, due to insufficient policy enforcement in the Downloads module. The issue allowed a remote attacker to bypass enterprise policy restrictions via a crafted download, enabling policy circumvention without requiring local privileges...

CVE-2019-5780

The CVE-2019-5780 entry refers to Google Chrome on macOS with insufficient restrictions on Apple Events before Chrome 72.0.3626.81, allowing a local attacker to execute JavaScript via Apple Events. Affects Chrome versions prior to the 72.0.3626.81 update. Root cause: insufficient restriction of A...

CVE-2020-15968

CVE-2020-15968 is a use-after-free in Blink (Chromium) prior to 86.0.4240.75, contributing to arbitrary code execution via a crafted page. The connected Arch Linux advisory (ASA-202010-1) specifies this as a remote issue in chromium before 86.0.4240.75-1 and notes the fix as upstream in 86.0.4240...

CVE-2020-6442

CVE-2020-6442 affects Chromium/Google Chrome prior to 81.0.4044.92. The issue is an implementation error in the page cache that could allow a remote attacker to leak cross-origin data via a crafted HTML page. Impact: potential cross-origin data exposure without user interaction beyond visiting a ...

CVE-2020-6494

CVE-2020-6494 : Google Chrome on Android prior to 83.0.4103.97 is affected by an incorrect security UI in the payments component that allows a remote attacker to spoof the Omnibox (URL bar) via a crafted HTML page. Connected sources (Arch Linux ASA-202006-3, Debian DSA-4714, FreeBSD vuln note, CN...

CVE-2020-6559

CVE-2020-6559 is a Use-After-Free in Chrome/Chromium’s Presentation API (heap corruption) that could be exploited remotely via a crafted HTML page. Affected products are Google Chrome/Chromium prior to version 85.0.4183.83. Mitigation from the connected documents shows upgrading to 85.0.4183.83 o...

CVE-2021-21130

CVE-2021-21130 refers to a policy enforcement issue in Chromium’s File System API prior to 88.0.4324.96, allowing a crafted HTML page to bypass filesystem restrictions. Affected software: Chromium browser (before 88.0.4324.96). Root cause: insufficient policy enforcement in the File System API co...

CVE-2021-21168

CVE-2021-21168 describes a policy-enforcement vulnerability in Chrome’s appcache: a remote attacker could exfiltrate potentially sensitive memory from a crafted HTML page. Affected: Chrome before 89.0.4389.72. Remediation: update to a version containing the fix (Debian notes 89.0.4389.114-1 for t...

CVE-2021-30584

The CVE-2021-30584 entry concerns a Chromium-based Chromium/Chrome Download UI issue on Android where an incorrect security UI allowed domain spoofing via a crafted HTML page. The vulnerability arises in the Downloads component of the browser engine prior to version 92.0.4515.107, enabling a remo...

CVE-2021-30599

Affected software: Google Chrome (V8 engine). The CVE-2021-30599 entry describes a type confusion in V8 that allowed remote code execution inside the sandbox via a crafted HTML page, for Chrome versions prior to 92.0.4515.159. The issue originates from the V8 type confusion and impacts the sandbo...

CVE-2022-1307

CVE-2022-1307 affects Google Chrome/Chromium components implementing full screen in Chrome/Chromium (Android and desktop variants). The publicly available description states an inappropriate full-screen implementation allowed a remote attacker to spoof the Omnibox (URL bar) via a crafted HTML pag...

CVE-2023-2312

CVE-2023-2312 is a Use-after-free in Chrome/Chromium’s Offline component affecting Google Chrome (and Chromium-based browsers) on Android, prior to version 116.0.5845.96. The issue could allow a remote attacker who has already compromised the renderer process to trigger heap corruption via a craf...

CVE-2020-6542

CVE-2020-6542 affects ANGLE within Google Chrome prior to 84.0.4147.125. A use-after-free in ANGLE could allow remote attackers to trigger heap corruption via a crafted HTML page, potentially enabling arbitrary code execution. Debian/GLSA and other advisories confirm the same issue and indicate r...

CVE-2020-6564

CVE-2020-6564: In Google Chrome, an inappropriate implementation in permissions allowed a remote attacker to spoof the contents of a permission dialog via a crafted HTML page, before version 85.0.4183.83. This entry is supported by Debian/Fedora advisories and CVE listings stating that Chromium/C...

CVE-2021-21146

CVE-2021-21146 affects Chromium’s Navigation component prior to 88.0.4324.146, with a use-after-free in Navigation that could allow a remote attacker who has compromised the renderer to escape the sandbox via a crafted HTML page. The issue is reported across multiple advisories and Debian/Arch se...

CVE-2021-21154

CVE-2021-21154 describes a heap buffer overflow in the Chromium/Chrome Tab Strip component before 88.0.4324.182. A remote attacker who already has renderer access could potentially trigger a sandbox escape via a crafted HTML page. Affected product/variant: Google Chrome/Chromium (Tab Strip codepa...

CVE-2021-21163

The CVE-2021-21163 issue affects Chromium/Google Chrome Reader Mode and is caused by insufficient data validation, allowing a remote attacker to leak cross-origin data via a crafted HTML page and a malicious server. Affected: Chromium/Chrome prior to version 89.0.4389.72. Impact (as stated): cros...

CVE-2021-21176

CVE-2021-21176 is an issue in Chromium/Google Chrome’s full screen mode where an inadequate implementation allowed a remote attacker to spoof the Omnibox (URL bar) via a crafted HTML page. Affected products include Chrome/Chromium prior to version 89.0.4389.72 across multiple advisories; the root...

CVE-2021-21177

CVE-2021-21177 is a policy enforcement error in Chrome/Chromium Autofill (prior to 89.0.4389.72). Insufficient policy enforcement could allow a remote attacker to exfiltrate potentially sensitive memory contents via a crafted HTML page. Affected component: Autofill in the Chromium browser; root c...

CVE-2021-21203

CVE-2021-21203: In Blink/WebKit of Google Chrome, use-after-free in Blink could allow a remote attacker to exploit heap corruption via a crafted HTML page. Affected: Chrome prior to 90.0.4430.72. Remediation: update to Chrome 90.0.4430.72 or newer. Notes: connected sources corroborate the same de...

CVE-2021-30577

CVE-2021-30577 affects Google Chrome’s Installer component; prior to 92.0.4515.107 there is insufficient policy enforcement, enabling a remote attacker to escalate to local privileges via a crafted file. Remediation: upgrade to 92.0.4515.107 or newer. Exploitation status is not provided in the do...

CVE-2021-30591

CVE-2021-30591 is a use-after-free vulnerability in Chromium’s File System API, affecting Chromium-based browsers prior to 92.0.4515.131. Multiple connected advisories (Astra Linux, Arch Linux security advisories) confirm this issue and describe the root cause as a use-after-free in the File Syst...

CVE-2021-30598

CVE-2021-30598 — normal mode Affected software: Google Chrome (V8 engine). The connected documents confirm a type confusion vulnerability in V8 prior to Chrome version 92.0.4515.159. What is vulnerable: the V8 JavaScript engine implementation in Chrome contains a type confusion flaw that can be t...

CVE-2022-3885

CVE-2022-3885 is a Use-after-free in V8 affecting Google Chrome prior to 107.0.5304.106 that could allow remote heap corruption via a crafted HTML page. The issue is confirmed in multiple trusted sources (Chromium/Chrome advisories and Astra Linux bulletin) and is tracked in Debian as fixed in Ch...

CVE-2023-0140

CVE-2023-0140 describes an incorrect File System API implementation in Google Chrome on Windows prior to 109.0.5414.74, which allowed a remote attacker to bypass file system restrictions via a crafted HTML page. The issue affects Chrome’s Chromium-based File System API behavior and is listed as L...

CVE-2023-0473

CVE-2023-0473 is a Chrome vulnerability describing a Type Confusion in the ServiceWorker API that could enable heap corruption via a crafted HTML page. The incident affects Chromium-based Chrome browser prior to version 109.0.5414.119, with the Chrome team’s release notes and advisories indicatin...

CVE-2023-0927

CVE-2023-0927 : Affected component is the Web Payments API in Google Chrome on Android. The issue is a use-after-free in this API that could allow a remote attacker who has compromised the renderer to potentially exploit heap corruption via a crafted HTML page. The vulnerability is reported for C...

CVE-2023-1811

CVE-2023-1811 is a Chrome/Chromium use-after-free in the Frames component causing potential heap corruption when a user engages in specific UI interactions with a crafted HTML page. The issue affects Google Chrome before version 112.0.5615.49 (reported as a high-severity, network-exploitable vuln...

CVE-2023-2932

CVE-2023-2932 is a use-after-free in the Chrome/Chromium PDF component, allowing heap corruption via a crafted PDF. Affected: Google Chrome (pre-114.0.5735.90) and Chromium-based builds. Root cause: use-after-free in PDF handling. Impact: high (as per CVE severity and CVSS). Remediation: upgrade ...

CVE-2020-15967

CVE-2020-15967 affects Chromium/Google Chrome prior to 86.0.4240.75, with a use-after-free in the payments component that could potentially lead to remote code execution and sandbox escape. Debian/FreeBSD/Arch Fedora advisories confirm the issue and provide a fixed version: 86.0.4240.75 (or newer...

CVE-2020-6428

CVE-2020-6428 involves a use-after-free in the audio component of Google Chrome prior to 80.0.3987.149, potentially enabling a remote attacker to trigger heap corruption via a crafted HTML page. Affected software includes Google Chrome and Chromium-based builds; Debian, Fedora, Gentoo, and Alpine...

CVE-2020-6571

CVE-2020-6571 affects Google Chrome Omnibox. Insufficient data validation enables a remote attacker to spoof a domain using IDN homographs in a crafted domain name. The issue is fixed in Chrome 85.0.4183.83 (and later); upgrading Chrome mitigates the vulnerability.

CVE-2020-6573

CVE-2020-6573 affects Chromium before 85.0.4183.102. A use-after-free in the video component could allow a remote attacker, with renderer access, to escape the sandbox via a crafted HTML page, potentially leading to arbitrary code execution. Remediation: upgrade to 85.0.4183.102 or newer as indic...

CVE-2021-21187

CVE-2021-21187 is a Chromium/Google Chrome URL formatting vulnerability caused by insufficient data validation in the URL formatting code. It allows a remote attacker to perform domain spoofing via IDN homographs when a crafted domain name is used, with impact described as spoofing and potential ...

CVE-2021-21213

CVE-2021-21213 affects Google Chrome’s WebMIDI implementation. A use-after-free in WebMIDI prior to 90.0.4430.72 can allow a remote attacker to trigger heap corruption via a crafted HTML page, potentially leading to arbitrary code execution. Remediation: upgrade Chrome to 90.0.4430.72 or newer (a...

CVE-2021-30564

CVE-2021-30564 is a heap buffer overflow in Chromium’s WebXR component prior to 91.0.4472.164. A remote attacker could potentially execute arbitrary code via a crafted page. Remediation: upgrade to Chromium 91.0.4472.164+; advisories note a related exploit may exist in the wild.

CVE-2023-0132

CVE-2023-0132 affects Google Chrome/Chromium. The issue is an inappropriate implementation in permission prompts that allowed a remote attacker to force acceptance of a permission prompt via a crafted HTML page. Affected versions include Chrome/Chromium on Windows prior to 109.0.5414.74. The requ...

CVE-2026-4453

CVE-2026-4453 affects Google Chrome on macOS, due to an integer overflow in Dawn that could allow a remote attacker to leak cross-origin data via a crafted HTML page. Affected Chrome builds are prior to 146.0.7680.153 (per Chromium Chrome advisories and Debian/chromium security updates). Remediat...

CVE-2020-15979

CVE-2020-15979 affects Chromium/Google Chrome’s V8 engine prior to 86.0.4240.75. The Arch Linux ASA-202010-1 describes it as an appropriate implementation security issue in V8, labeled as an access restriction bypass. The Debian/DSA and Debian tracker entries also reference the CVE in the Chromi...

CVE-2020-15981

CVE-2020-15981 is an information-disclosure/out-of-bounds-read issue in the audio component of Chromium/Google Chrome prior to 86.0.4240.75. The vulnerability affects Chromium-based browsers and could allow a remote attacker to read potentially sensitive memory content via a crafted HTML page. Pu...

CVE-2020-15982

CVE-2020-15982 affects Chromium/Google Chrome prior to 86.0.4240.75, describing a side-channel information leakage in the cache component that can disclose potentially sensitive data from process memory via a crafted page. Multiple advisories and changelogs confirm the issue and tag it as informa...

CVE-2020-16006

Chromium vulnerability CVE-2020-16006 concerns an inappropriate implementation in V8 prior to version 86.0.4240.183, enabling a remote attacker to potentially trigger heap corruption via a crafted HTML page. Affected software is the Chromium browser (V8 engine component). Impact is remote code ex...

CVE-2020-16022

Chromium/Chromium-derived Chrome vulnerability CVE-2020-16022 is an insufficient policy enforcement issue in the networking component that could let an attacker bypass firewall controls via a crafted HTML page. Affected software: Chromium browser (networking policy enforcement). Root cause: insuf...

CVE-2020-6424

CVE-2020-6424 is a use-after-free in Chrome’s media handling that could allow heap corruption via a crafted HTML page on Chrome versions prior to 80.0.3987.149. Affected: Google Chrome (desktop). Root cause: use-after-free in media code paths. Impact: remote code execution likelihood noted as hig...

CVE-2020-6546

CVE-2020-6546 affects Google Chrome on Windows/macOS/Linux via an Inappropriate implementation in the installer. The root cause is an flawed installer flow that can be abused by a local attacker to escalate privileges through a crafted filesystem, as detailed in multiple advisories. The impact is...

CVE-2020-6570

Technical details for CVE-2020-6570 are not present in the provided connected documents. Information is limited to the initial description. Monitor for updates.

CVE-2021-21178

CVE-2021-21178 refers to an inappropriate implementation in the Chromium/Google Chrome compositor on Linux and Windows, allowing a remote attacker to spoof the Omnibox via a crafted HTML page. Affected: Chromium/Chrome prior to version 89.0.4389.72. Impact: content spoofing of the URL bar. Root c...

CVE-2021-21221

CVE-2021-21221 corresponds to an information-disclosure flaw in Chrome’s Mojo component. Description across sources states insufficient validation of untrusted input in Mojo before 90.0.4430.72, enabling a remote attacker with a compromised renderer to leak cross-origin data via a crafted HTML pa...

CVE-2022-0976

CVE-2022-0976 describes a heap buffer overflow in the GPU component of Google Chrome up to version 99.0.4844.74 (prior to that build). A remote attacker could potentially exploit heap corruption via a crafted HTML page, with impact on confidentiality, integrity, and availability as indicated by t...

CVE-2020-15965

CVE-2020-15965: Type confusion in V8 within Google Chrome prior to 85.0.4183.121 allows remote attackers to trigger out-of-bounds memory access via crafted HTML, potentially leading to arbitrary code execution or memory corruption. Affected component is Chrome’s V8 engine; impact described as rem...