CVE-2021-21179

CVE-2021-21179 affects Google Chrome/Chromium, specifically a use-after-free in the Network Internals component on Linux prior to version 89.0.4389.72, enabling potential heap corruption via a crafted HTML page. A patch is available by upgrading to Chrome/Chromium 89.0.4389.72 or newer (see refer...

CVE-2021-21186

CVE-2021-21186 refers to a policy-enforcement error in the QR scanning component of the Chromium/Chrome stack on iOS, allowing a user who is coaxed into scanning a crafted QR code to bypass navigation restrictions. Affected product: Google Chrome (iOS) with Chromium QR scan integration prior to 8...

CVE-2021-21187

CVE-2021-21187 is a Chromium/Google Chrome URL formatting vulnerability caused by insufficient data validation in the URL formatting code. It allows a remote attacker to perform domain spoofing via IDN homographs when a crafted domain name is used, with impact described as spoofing and potential ...

CVE-2021-21211

CVE-2021-21211 refers to an insecure navigation implementation in Google Chrome on iOS before 90.0.4430.72, enabling a remote attacker to leak cross-origin data via a crafted HTML page. The connected sources confirm the same vulnerability description across multiple trackers (e.g., Debian securit...

CVE-2022-1129

CVE-2022-1129 : Google Chrome on Android before 100.0.4896.60 suffers from an inappropriate Full Screen Mode implementation that can allow a remote attacker to spoof the Omnibox (URL bar) via a crafted HTML page. The issue is listed with a CVSS v3.1 base score of 6.5 (Medium); impact is spoofing ...

CVE-2023-2724

CVE-2023-2724 is a Chromium/Google Chrome type-confusion vulnerability in V8 prior to 113.0.5672.126. The issue allows a remote attacker to potentially trigger heap corruption via a crafted HTML page, with impact described as high (confidentiality, integrity, and availability). Remediation provid...

CVE-2023-2936

CVE-2023-2936 is a Type Confusion in Google Chrome’s V8 engine affecting Chrome prior to 114.0.5735.90, enabling remote heap corruption via a crafted HTML page. Public docs confirm Chrome/Chromium fixes and patched versions (e.g., Chromium 114.0.5735.90 and Debian/FreeBSD advisories). Remediation...

CVE-2020-15987

CVE-2020-15987 is a use-after-free in the WebRTC component of Chromium/Google Chrome prior to 86.0.4240.75. This vulnerability could allow a remote attacker to potentially cause heap corruption via a crafted WebRTC stream, leading to arbitrary code execution as described in connected advisories. ...

CVE-2020-6435

CVE-2020-6435 describes a policy enforcement error in extensions that affects Google Chrome/Chromium prior to 81.0.4044.92. The issue, rooted in insufficient policy enforcement within the extensions component, could allow a remote attacker who has achieved renderer access to bypass navigation res...

CVE-2020-6552

CVE-2020-6552 is a use-after-free in Blink affecting Google Chrome prior to 84.0.4147.125. The vulnerability could allow remote heap corruption via a crafted HTML page, enabling arbitrary code execution or a crash. Debian/GLSA notes advise upgrading Chromium/Chrome to the fixed version (84.0.4147...

CVE-2021-21175

In Google Chrome, CVE-2021-21175 corresponds to an inappropriate implementation in the Site Isolation feature prior to 89.0.4389.72. The issue allows a remote attacker to leak cross-origin data through a crafted HTML page. Affected product: Google Chrome (Site Isolation). Root cause: improper imp...

CVE-2021-21182

CVE-2021-21182 affects Google Chrome/Chromium navigations: insufficient policy enforcement in navigations allows a renderer-compromised remote attacker to bypass navigation restrictions via a crafted HTML page, for Chrome/Chromium fixes before/at 89.0.4389.72. Connected advisories (Debian Arch/DS...

CVE-2021-30625

CVE-2021-30625 is a use-after-free in the Selection API of the Chromium-based Google Chrome engine (pre-93.0.4577.82). A remote attacker could entice a user to visit a malicious page to trigger heap corruption. Google Chrome/stable updates fixed to 93.0.4577.82; upgrade to that version or later t...

CVE-2022-1637

CVE-2022-1637 targets Google Chrome’s Web Contents component. The issue arises from an inappropriate implementation that allows a remote attacker to leak cross-origin data via a crafted HTML page. Affected product is Chrome (Chromium-based); the specific impact is data disclosure between origins....

CVE-2022-4184

CVE-2022-4184 affects Google Chrome Autofill. The issue is insufficient policy enforcement that allowed bypassing Autofill restrictions via a crafted HTML page. Affected products include Chrome/Chromium, prior to version 108.0.5359.71. The Chrome release notes confirm this CVE (CVE-2022-4184) as ...

CVE-2022-4908

CVE-2022-4908 refers to an inappropriate implementation in Chrome/Chromium’s iFrame Sandbox that could leak cross-origin data via a crafted HTML page. Affected product is Google Chrome (and Chromium-based components); vulnerable component/behavior is the iFrame Sandbox. The root cause is an incor...

CVE-2023-0473

CVE-2023-0473 is a Chrome vulnerability describing a Type Confusion in the ServiceWorker API that could enable heap corruption via a crafted HTML page. The incident affects Chromium-based Chrome browser prior to version 109.0.5414.119, with the Chrome team’s release notes and advisories indicatin...

CVE-2023-3214

CVE-2023-3214 covers a use-after-free in Chrome/Chromium’s Autofill payments path prior to 114.0.5735.133. The vulnerability could enable heap corruption via a crafted HTML page, with high/critical impact (remote code execution possible, per the public advisories). Affected products include Googl...

CVE-2024-1939

CVE-2024-1939 affects Google Chrome's V8 engine (prior to Chrome 122.0.6261.94). It describes a Type Confusion in V8 that can lead to heap corruption via a crafted HTML page, potentially enabling remote code execution. The connected exploit content attributes the root cause to wasmS128 handling a...

CVE-2026-4453

CVE-2026-4453 affects Google Chrome on macOS, due to an integer overflow in Dawn that could allow a remote attacker to leak cross-origin data via a crafted HTML page. Affected Chrome builds are prior to 146.0.7680.153 (per Chromium Chrome advisories and Debian/chromium security updates). Remediat...

CVE-2020-15990

CVE-2020-15990 affects Chromium/Google Chrome: a use-after-free in the autofill component prior to 86.0.4240.75 can allow a remote attacker, via a crafted HTML page loaded in a compromised renderer, to potentially escape the sandbox and execute arbitrary code. Public reports in Debian/Arch/Linux ...

CVE-2020-15995

CVE-2020-15995 is a vulnerability in Chromium/Google Chrome’s V8 engine, where an out-of-bounds write in V8 prior to 87.0.4280.141 could enable a remote attacker to potentially achieve heap corruption via a crafted HTML page. The issue was fixed by upgrading to Chromium version 87.0.4280.141 (or ...

CVE-2020-6445

CVE-2020-6445 discusses an insufficient policy enforcement vulnerability in the trusted types component of the Chromium/Chrome browser before version 81.0.4044.92, enabling a remote attacker to bypass Content Security Policy via a crafted HTML page. Public references in Debian/Arch/Fedora advisor...

CVE-2020-6520

CVE-2020-6520: A heap buffer overflow in Skia used by Google Chrome prior to version 84.0.4147.89 allowed remote exploitation via a crafted HTML page (heap corruption). Multiple connected sources confirm the issue resides in Skia used by Chrome/Chromium and the fix was delivered via Chrome/Chromi...

CVE-2020-6540

CVE-2020-6540 is a buffer overflow in Skia used by Google Chrome, prior to 84.0.4147.105, allowing remote heap corruption via a crafted HTML page. The Debian security advisory DSA-4824-1 lists CVE-2020-6540 among fixed issues and recommends upgrading Chromium to at least 87.0.4280.88-0.4~deb10u1 ...

CVE-2021-21165

CVE-2021-21165: Data indicates a heap/object lifecycle issue in Chrome/Chromium audio paths before 89.0.4389.72, enabling potential remote arbitrary code execution. The Astra/Audit/Debian entries confirm an audio component flaw in Chromium with the same version bound. Affected product: Chromium b...

CVE-2021-21210

Affected software: Google Chrome (before version 90.0.4430.72). The CVE describes an Inappropriate implementation in Network that could allow a remote attacker to potentially access local UDP ports via a crafted HTML page. Impact statements in the connected documents indicate a remote attacker co...

CVE-2021-30541

CVE-2021-30541 is a use-after-free in V8 (Chromium engine) before version 91.0.4472.164, disclosed for Google Chrome. The vulnerability allows a remote attacker to potentially trigger heap corruption through a crafted HTML page, enabling a remote code execution scenario as described in the CVE en...

CVE-2022-0289

The CVE-2022-0289 entry affects Google Chrome’s Safe Browsing component, with a Use-After-Free vulnerability that could lead to heap corruption via a crafted HTML page. Affected version prior to 97.0.4692.99 is fixed in Chrome’s January 2022 update; the Chrome release notes list this as a critica...

CVE-2022-1143

CVE-2022-1143 is a heap buffer overflow in Chrome’s WebUI, affecting Chrome before 100.0.4896.60. The issue could allow heap corruption via specific input into DevTools after user interaction, potentially enabling arbitrary code execution or other impacts described in related advisories. Public d...

CVE-2024-9964

CVE-2024-9964 : In Google Chrome/Chromium, an inappropriate implementation in Payments allows a remote attacker to trigger UI spoofing by tricking a user into certain UI gestures via a crafted Chrome Extension. Public details across connected documents confirm UI-spoofing impact for Chrome/Chromi...

CVE-2020-15985

Technical details about CVE-2020-15985 are not publicly provided in the supplied documents. Monitor for updates in connected advisories and CVE trackers as additional details may emerge.

CVE-2020-15986

CVE-2020-15986 affects Chromium's media component. An integer overflow in media before 86.0.4240.75 could enable a remote attacker to potentially cause heap corruption and arbitrary code execution. Public records in connected documents reference Chrome/Chromium updates fixing this in version 86.0...

CVE-2020-16005

CVE-2020-16005 concerns the ANGLE component of Chromium (Chromium/Chrome) prior to the patch level 86.0.4240.183. The documented root cause is insufficient policy enforcement in ANGLE, which could allow a remote attacker to potentially trigger heap corruption via a crafted HTML page, leading to a...

CVE-2020-6563

CVE-2020-6563 affects Google Chrome on Android and is caused by insufficient policy enforcement in the intent-handling component, enabling a remote attacker to read potentially sensitive data from disk via a crafted HTML page. Affected: Chrome on Android versions prior to 85.0.4183.83. Impact: in...

CVE-2020-6576

CVE-2020-6576 is a vulnerability in the Chromium browser involving a use-after-free in the offscreen canvas component. The issue could allow a remote attacker to corrupt the heap via a crafted HTML page, potentially enabling arbitrary code execution. The most concrete remediation in the provided ...

CVE-2021-21112

CVE-2021-21112 is a use-after-free in the Blink component of the Chromium-based Chrome stack (before 87.0.4280.141). The vulnerability allows a remote attacker to potentially trigger heap corruption via a crafted HTML page. Impact: partial confidentiality/integrity/availability degradation as des...

CVE-2021-21116

CVE-2021-21116: Heap buffer overflow in the audio component of Chromium-based browsers (Chrome/Chromium) before 87.0.4280.141. A remote attacker could exploit heap corruption via a crafted HTML page. Remediation: update to 87.0.4280.141 or later.

CVE-2021-30559

CVE-2021-30559 is an out-of-bounds write in ANGLE within Chromium/Google Chrome prior to 91.0.4472.164. The issue could allow a remote attacker to trigger heap corruption via a crafted HTML page, enabling arbitrary code execution or crash. Affected component: ANGLE in the Chromium browser engine;...

CVE-2021-37962

CVE-2021-37962 is a use-after-free in Chrome’s Performance Manager before version 94.0.4606.54, enabling a remote attacker who has compromised the renderer to potentially trigger heap corruption via a crafted HTML page. The vulnerability affects Google Chrome (renderer/Performance Manager compone...

CVE-2022-1856

CVE-2022-1856: Use-after-free in Google Chrome's User Education component prior to 102.0.5005.61 allows heap corruption via a crafted Chrome Extension or specific user interaction after social engineering to install a malicious extension. Affected: Google Chrome (User Education). Root cause: use-...

CVE-2022-2619

CVE-2022-2619 applies to Google Chrome/Chromium, where insufficient input validation in Settings allows injection of scripts/HTML into a privileged page when a user installs a malicious extension. Affected version baseline is before 104.0.5112.79. Public writeups in connected docs confirm the iss...

CVE-2023-0705

Google Chrome/Chromium Core has an integer overflow vulnerability tracked as CVE-2023-0705, fixed in Chrome 110.0.5481.77 and later. A remote attacker could trigger the overflow to cause heap corruption via a crafted HTML page, requiring user interaction. Affected line items include Chrome/Chromi...

CVE-2023-3420

CVE-2023-3420 describes a Type Confusion in V8 affecting Google Chrome/Chromium before 114.0.5735.198, allowing a remote attacker to trigger heap corruption via a crafted HTML page. Affected downstream advisories/coordination reference Chromium fixes prior to 114.0.5735.198 (e.g., Debian DSA-5440...

CVE-2026-14129

The CVE-2026-14129 entry concerns Google Chrome on Android. An inappropriate implementation in the PreviewTab component allows a remote attacker to perform UI spoofing through a crafted HTML page after convincing the user to perform specific UI gestures. The issue is fixed in Chrome/Chromium upda...

CVE-2020-16000

CVE-2020-16000 refers to an Inappropriate implementation in Blink in Google Chrome before 86.0.4240.111, enabling remote exploitation via a crafted HTML page that could lead to heap corruption. Affected component: Blink in Chrome; root cause: inappropriate implementation in Blink; impact: potenti...

CVE-2020-6386

CVE-2020-6386 is a use-after-free in Chrome’s speech processing leading to potential heap corruption when processing crafted HTML. Affected: Google Chrome prior to version 80.0.3987.116. Impact: remote code execution or instability as described in public advisories, with the issue fixed in the Ch...

CVE-2020-6522

CVE-2020-6522 affects Google Chrome (and Chromium) due to an inappropriate implementation in external protocol handlers, potentially allowing a sandbox escape via a crafted HTML page. The issue existed in Chrome prior to version 84.0.4147.89. Debian and FreeBSD advisories list this CVE among many...

CVE-2020-6547

CVE-2020-6547 affects Google Chrome/Chromium with an incorrect security UI issue in media that could allow a remote attacker to glean sensitive information via a crafted HTML page. The Debian advisory for chromium lists CVE-2020-6547 among multiple fixes and states the fix version as chromium 84....

CVE-2021-30590

CVE-2021-30590 is a heap buffer overflow in the Bookmarks component of the Chromium-based browser engine before version 92.0.4515.131. The disclosed impact across connected records states potential remote code execution or heap corruption via crafted HTML pages, affecting Chrome/Chromium-derived ...