CVE-2024-2626

CVE-2024-2626 affects Google Chrome/Chromium where an out-of-bounds read in SwiftShader could allow a remote attacker to cause memory access issues via a crafted HTML page. Affected component: SwiftShader within Chrome/Chromium before version 123.0.6312.58. Impact: information disclosure through ...

CVE-2019-13678

CVE-2019-13678 affects Chromium/Google Chrome download-dialog spoofing. Root cause relates to incorrect data validation in the download dialog, enabling domain spoofing via crafted HTML. Debian advisories indicate remediation by upgrading Chromium to 78.0.3904.97-1~deb10u1 (and newer), with other...

CVE-2020-15967

CVE-2020-15967 affects Chromium/Google Chrome prior to 86.0.4240.75, with a use-after-free in the payments component that could potentially lead to remote code execution and sandbox escape. Debian/FreeBSD/Arch Fedora advisories confirm the issue and provide a fixed version: 86.0.4240.75 (or newer...

CVE-2020-15979

CVE-2020-15979 affects Chromium/Google Chrome’s V8 engine prior to 86.0.4240.75. The Arch Linux ASA-202010-1 describes it as an appropriate implementation security issue in V8, labeled as an access restriction bypass. The Debian/DSA and Debian tracker entries also reference the CVE in the Chromi...

CVE-2020-16006

Chromium vulnerability CVE-2020-16006 concerns an inappropriate implementation in V8 prior to version 86.0.4240.183, enabling a remote attacker to potentially trigger heap corruption via a crafted HTML page. Affected software is the Chromium browser (V8 engine component). Impact is remote code ex...

CVE-2020-6428

CVE-2020-6428 involves a use-after-free in the audio component of Google Chrome prior to 80.0.3987.149, potentially enabling a remote attacker to trigger heap corruption via a crafted HTML page. Affected software includes Google Chrome and Chromium-based builds; Debian, Fedora, Gentoo, and Alpine...

CVE-2020-6546

CVE-2020-6546 affects Google Chrome on Windows/macOS/Linux via an Inappropriate implementation in the installer. The root cause is an flawed installer flow that can be abused by a local attacker to escalate privileges through a crafted filesystem, as detailed in multiple advisories. The impact is...

CVE-2020-6559

CVE-2020-6559 is a Use-After-Free in Chrome/Chromium’s Presentation API (heap corruption) that could be exploited remotely via a crafted HTML page. Affected products are Google Chrome/Chromium prior to version 85.0.4183.83. Mitigation from the connected documents shows upgrading to 85.0.4183.83 o...

CVE-2020-6573

CVE-2020-6573 affects Chromium before 85.0.4183.102. A use-after-free in the video component could allow a remote attacker, with renderer access, to escape the sandbox via a crafted HTML page, potentially leading to arbitrary code execution. Remediation: upgrade to 85.0.4183.102 or newer as indic...

CVE-2021-21130

CVE-2021-21130 refers to a policy enforcement issue in Chromium’s File System API prior to 88.0.4324.96, allowing a crafted HTML page to bypass filesystem restrictions. Affected software: Chromium browser (before 88.0.4324.96). Root cause: insufficient policy enforcement in the File System API co...

CVE-2021-21146

CVE-2021-21146 affects Chromium’s Navigation component prior to 88.0.4324.146, with a use-after-free in Navigation that could allow a remote attacker who has compromised the renderer to escape the sandbox via a crafted HTML page. The issue is reported across multiple advisories and Debian/Arch se...

CVE-2021-21168

CVE-2021-21168 describes a policy-enforcement vulnerability in Chrome’s appcache: a remote attacker could exfiltrate potentially sensitive memory from a crafted HTML page. Affected: Chrome before 89.0.4389.72. Remediation: update to a version containing the fix (Debian notes 89.0.4389.114-1 for t...

CVE-2021-21176

CVE-2021-21176 is an issue in Chromium/Google Chrome’s full screen mode where an inadequate implementation allowed a remote attacker to spoof the Omnibox (URL bar) via a crafted HTML page. Affected products include Chrome/Chromium prior to version 89.0.4389.72 across multiple advisories; the root...

CVE-2021-21213

CVE-2021-21213 affects Google Chrome’s WebMIDI implementation. A use-after-free in WebMIDI prior to 90.0.4430.72 can allow a remote attacker to trigger heap corruption via a crafted HTML page, potentially leading to arbitrary code execution. Remediation: upgrade Chrome to 90.0.4430.72 or newer (a...

CVE-2021-30599

Affected software: Google Chrome (V8 engine). The CVE-2021-30599 entry describes a type confusion in V8 that allowed remote code execution inside the sandbox via a crafted HTML page, for Chrome versions prior to 92.0.4515.159. The issue originates from the V8 type confusion and impacts the sandbo...

CVE-2026-12469

CVE-2026-12469 affects Google Chrome on Android, where an uninitialized use in the GPU could allow a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability lies in the GPU component, with the affected version range prior to 149.0.7827.155. Remediation is to update to...

CVE-2020-15965

CVE-2020-15965: Type confusion in V8 within Google Chrome prior to 85.0.4183.121 allows remote attackers to trigger out-of-bounds memory access via crafted HTML, potentially leading to arbitrary code execution or memory corruption. Affected component is Chrome’s V8 engine; impact described as rem...

CVE-2020-15980

CVE-2020-15980: In Chromium/Chrome, insufficient policy enforcement in the Intents component allows a local attacker to bypass navigation restrictions via crafted Intents. Impact is described as local code execution/privilege by affected components; Debian/Arch/FreeBSD advisories indicate fixes i...

CVE-2020-16039

CVE-2020-16039 is a use-after-free vulnerability in Chromium’s extensions component, fixed in Chromium versions before 87.0.4280.88 and addressed by upgrading to 87.0.4280.88 or newer per Debian/Arch Linux advisories. Affected product: Chromium browser (extensions module). Root cause: use-after-f...

CVE-2020-6538

CVE-2020-6538 affects Google Chrome WebView on Android (inappropriate WebView implementation) allowing cross-origin data leakage via a crafted HTML page. Connected sources indicate the issue was fixed in Chrome/Chromium releases around 84.0.4147.105; Debian’s advisory lists CVE-2020-6538 among up...

CVE-2020-6561

CVE-2020-6561 affects Google Chrome (Content Security Policy implementation). The vulnerability arises from an inappropriate CSP implementation that allowed a remote attacker to leak cross-origin data via a crafted HTML page, impacting Chrome versions prior to 85.0.4183.83. According to the conne...

CVE-2020-6570

Technical details for CVE-2020-6570 are not present in the provided connected documents. Information is limited to the initial description. Monitor for updates.

CVE-2021-21154

CVE-2021-21154 describes a heap buffer overflow in the Chromium/Chrome Tab Strip component before 88.0.4324.182. A remote attacker who already has renderer access could potentially trigger a sandbox escape via a crafted HTML page. Affected product/variant: Google Chrome/Chromium (Tab Strip codepa...

CVE-2021-21163

The CVE-2021-21163 issue affects Chromium/Google Chrome Reader Mode and is caused by insufficient data validation, allowing a remote attacker to leak cross-origin data via a crafted HTML page and a malicious server. Affected: Chromium/Chrome prior to version 89.0.4389.72. Impact (as stated): cros...

CVE-2021-21184

CVE-2021-21184 relates to Google Chrome/Chromium where an inappropriate implementation in the Performance API allowed a remote attacker to leak cross-origin data via a crafted HTML page. Affected product: Chromium/Chrome browser (Performance API component). Root cause: improper implementation in ...

CVE-2022-0976

CVE-2022-0976 describes a heap buffer overflow in the GPU component of Google Chrome up to version 99.0.4844.74 (prior to that build). A remote attacker could potentially exploit heap corruption via a crafted HTML page, with impact on confidentiality, integrity, and availability as indicated by t...

CVE-2023-0132

CVE-2023-0132 affects Google Chrome/Chromium. The issue is an inappropriate implementation in permission prompts that allowed a remote attacker to force acceptance of a permission prompt via a crafted HTML page. Affected versions include Chrome/Chromium on Windows prior to 109.0.5414.74. The requ...

CVE-2023-2312

CVE-2023-2312 is a Use-after-free in Chrome/Chromium’s Offline component affecting Google Chrome (and Chromium-based browsers) on Android, prior to version 116.0.5845.96. The issue could allow a remote attacker who has already compromised the renderer process to trigger heap corruption via a craf...

CVE-2020-16002

CVE-2020-16002 is a use-after-free in PDFium leveraged via crafted PDFs in Google Chrome (before 86.0.4240.111). The vulnerability affects Chrome’s PDF rendering path (PDFium) and could allow a remote attacker to trigger heap corruption, with the potential for arbitrary impact as described in the...

CVE-2020-6424

CVE-2020-6424 is a use-after-free in Chrome’s media handling that could allow heap corruption via a crafted HTML page on Chrome versions prior to 80.0.3987.149. Affected: Google Chrome (desktop). Root cause: use-after-free in media code paths. Impact: remote code execution likelihood noted as hig...

CVE-2020-6517

CVE-2020-6517 : The connected documents confirm a heap buffer overflow in Chrome’s history handling, exploited via a crafted HTML page, affecting Chrome prior to 84.0.4147.89. The issue is listed among Chrome’s 2020 security fixes and was addressed in the Chrome 84 stable update (84.0.4147.89) fo...

CVE-2020-6533

CVE-2020-6533 affects Google Chrome’s V8 engine. The Debian security advisory and Debian tracker describe a Type Confusion in V8 prior to Chrome 84.0.4147.89, which could allow a remote attacker to trigger heap corruption via a crafted HTML page. The issue was addressed in Chrome 84.0.4147.89 (or...

CVE-2020-6558

CVE-2020-6558 affects Google Chrome on iOS (iOS WebView) prior to 85.0.4183.83. The vulnerability is due to insufficient policy enforcement in iOSWeb that allowed a remote attacker to bypass navigation restrictions with a crafted HTML page. It was fixed in the Chrome 85 stable release (85.0.4183....

CVE-2021-21178

CVE-2021-21178 refers to an inappropriate implementation in the Chromium/Google Chrome compositor on Linux and Windows, allowing a remote attacker to spoof the Omnibox via a crafted HTML page. Affected: Chromium/Chrome prior to version 89.0.4389.72. Impact: content spoofing of the URL bar. Root c...

CVE-2021-21203

CVE-2021-21203: In Blink/WebKit of Google Chrome, use-after-free in Blink could allow a remote attacker to exploit heap corruption via a crafted HTML page. Affected: Chrome prior to 90.0.4430.72. Remediation: update to Chrome 90.0.4430.72 or newer. Notes: connected sources corroborate the same de...

CVE-2021-21205

CVE-2021-21205 affects Google Chrome on iOS prior to 90.0.4430.72. The issue is an insufficient policy enforcement in navigation, allowing a remote attacker to bypass navigation restrictions via a crafted HTML page. According to the provided description, the vulnerability is severe (CVSSv3.1 scor...

CVE-2021-30564

CVE-2021-30564 is a heap buffer overflow in Chromium’s WebXR component prior to 91.0.4472.164. A remote attacker could potentially execute arbitrary code via a crafted page. Remediation: upgrade to Chromium 91.0.4472.164+; advisories note a related exploit may exist in the wild.

CVE-2022-0794

The CVE-2022-0794 entry concerns Google Chrome WebShare: a use-after-free in WebShare prior to 99.0.4844.51 that could allow a remote attacker to exploit heap corruption via a crafted HTML page after convincing a user to engage in specific interaction. Affected product is Google Chrome (Chromium-...

CVE-2023-1235

CVE-2023-1235 describes a Type Confusion in Chrome DevTools (Chromium DevTools) affecting Chrome versions before 111.0.5563.64. The vulnerability allows a remote attacker who has compromised the renderer process to potentially trigger heap corruption via crafted UI interactions. Affected product/...

CVE-2023-2725

CVE-2023-2725 is a use-after-free in Chrome/Chromium's Guest View leading to potential heap corruption when a user is tricked into installing a malicious extension. Affected software: Google Chrome (Guest View) and Chromium components prior to version 113.0.5672.126. Root cause: use-after-free in...

CVE-2023-2929

CVE-2023-2929 describes an out-of-bounds write in Google Chrome’s SwiftShader component, enabling potential remote heap corruption via a crafted HTML page. Affected products are Google Chrome/Chromium with SwiftShader; vulnerable if using versions prior to 114.0.5735.90. The Debian advisory (DSA-...

CVE-2023-2932

CVE-2023-2932 is a use-after-free in the Chrome/Chromium PDF component, allowing heap corruption via a crafted PDF. Affected: Google Chrome (pre-114.0.5735.90) and Chromium-based builds. Root cause: use-after-free in PDF handling. Impact: high (as per CVE severity and CVSS). Remediation: upgrade ...

CVE-2023-4904

CVE-2023-4904 affects Google Chrome and Chromium-based derivatives, due to insufficient policy enforcement in the Downloads module. The issue allowed a remote attacker to bypass enterprise policy restrictions via a crafted download, enabling policy circumvention without requiring local privileges...

CVE-2024-9122

Type Confusion in V8 of Google Chrome (Chromium) prior to 129.0.6668.70 allows remote attackers to cause out-of-bounds memory access via a crafted HTML page. Affected products include Chromium/Chrome; vulnerable component is V8. Public references in connected documents confirm the issue and indic...

CVE-2024-9962

CVE-2024-9962 concerns Google Chrome prior to version 130.0.6723.58, where an improper permissions implementation could allow a remote attacker to cause UI spoofing by convincing a user to perform specific UI gestures on a crafted HTML page. The vulnerability impacts Chrome/Chromium components an...

CVE-2020-16016

CVE-2020-16016 affects Google Chrome (Chromium base) prior to 86.0.4240.193. An inappropriate implementation in base allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Documented consequences include arbitrary code e...

CVE-2020-6496

CVE-2020-6496 : Use-after-free in the payments component of Google Chrome on macOS before 83.0.4103.97 allows a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Affected: Chrome/macOS; Root cause: use-after-free in payments. Impact: sandbox escape possible; Exploit...

CVE-2020-6571

CVE-2020-6571 affects Google Chrome Omnibox. Insufficient data validation enables a remote attacker to spoof a domain using IDN homographs in a crafted domain name. The issue is fixed in Chrome 85.0.4183.83 (and later); upgrading Chrome mitigates the vulnerability.

CVE-2021-21177

CVE-2021-21177 is a policy enforcement error in Chrome/Chromium Autofill (prior to 89.0.4389.72). Insufficient policy enforcement could allow a remote attacker to exfiltrate potentially sensitive memory contents via a crafted HTML page. Affected component: Autofill in the Chromium browser; root c...

CVE-2021-21186

CVE-2021-21186 refers to a policy-enforcement error in the QR scanning component of the Chromium/Chrome stack on iOS, allowing a user who is coaxed into scanning a crafted QR code to bypass navigation restrictions. Affected product: Google Chrome (iOS) with Chromium QR scan integration prior to 8...