4916 matches found
CVE-2020-6558
CVE-2020-6558 affects Google Chrome on iOS (iOS WebView) prior to 85.0.4183.83. The vulnerability is due to insufficient policy enforcement in iOSWeb that allowed a remote attacker to bypass navigation restrictions with a crafted HTML page. It was fixed in the Chrome 85 stable release (85.0.4183....
CVE-2020-6561
CVE-2020-6561 affects Google Chrome (Content Security Policy implementation). The vulnerability arises from an inappropriate CSP implementation that allowed a remote attacker to leak cross-origin data via a crafted HTML page, impacting Chrome versions prior to 85.0.4183.83. According to the conne...
CVE-2021-21184
CVE-2021-21184 relates to Google Chrome/Chromium where an inappropriate implementation in the Performance API allowed a remote attacker to leak cross-origin data via a crafted HTML page. Affected product: Chromium/Chrome browser (Performance API component). Root cause: improper implementation in ...
CVE-2021-21205
CVE-2021-21205 affects Google Chrome on iOS prior to 90.0.4430.72. The issue is an insufficient policy enforcement in navigation, allowing a remote attacker to bypass navigation restrictions via a crafted HTML page. According to the provided description, the vulnerability is severe (CVSSv3.1 scor...
CVE-2021-30541
CVE-2021-30541 is a use-after-free in V8 (Chromium engine) before version 91.0.4472.164, disclosed for Google Chrome. The vulnerability allows a remote attacker to potentially trigger heap corruption through a crafted HTML page, enabling a remote code execution scenario as described in the CVE en...
CVE-2021-30625
CVE-2021-30625 is a use-after-free in the Selection API of the Chromium-based Google Chrome engine (pre-93.0.4577.82). A remote attacker could entice a user to visit a malicious page to trigger heap corruption. Google Chrome/stable updates fixed to 93.0.4577.82; upgrade to that version or later t...
CVE-2021-37962
CVE-2021-37962 is a use-after-free in Chrome’s Performance Manager before version 94.0.4606.54, enabling a remote attacker who has compromised the renderer to potentially trigger heap corruption via a crafted HTML page. The vulnerability affects Google Chrome (renderer/Performance Manager compone...
CVE-2022-0794
The CVE-2022-0794 entry concerns Google Chrome WebShare: a use-after-free in WebShare prior to 99.0.4844.51 that could allow a remote attacker to exploit heap corruption via a crafted HTML page after convincing a user to engage in specific interaction. Affected product is Google Chrome (Chromium-...
CVE-2023-1235
CVE-2023-1235 describes a Type Confusion in Chrome DevTools (Chromium DevTools) affecting Chrome versions before 111.0.5563.64. The vulnerability allows a remote attacker who has compromised the renderer process to potentially trigger heap corruption via crafted UI interactions. Affected product/...
CVE-2023-2725
CVE-2023-2725 is a use-after-free in Chrome/Chromium's Guest View leading to potential heap corruption when a user is tricked into installing a malicious extension. Affected software: Google Chrome (Guest View) and Chromium components prior to version 113.0.5672.126. Root cause: use-after-free in...
CVE-2023-2936
CVE-2023-2936 is a Type Confusion in Google Chrome’s V8 engine affecting Chrome prior to 114.0.5735.90, enabling remote heap corruption via a crafted HTML page. Public docs confirm Chrome/Chromium fixes and patched versions (e.g., Chromium 114.0.5735.90 and Debian/FreeBSD advisories). Remediation...
CVE-2024-2886
The CVE-2024-2886 entry concerns a use-after-free in WebCodecs within Google Chrome, exploitable via a crafted HTML page to achieve arbitrary read/write. Affected software is Google Chrome (WebCodecs) with the vulnerable intake prior to version 123.0.6312.86. The impact is high (network attack ve...
CVE-2024-9964
CVE-2024-9964 : In Google Chrome/Chromium, an inappropriate implementation in Payments allows a remote attacker to trigger UI spoofing by tricking a user into certain UI gestures via a crafted Chrome Extension. Public details across connected documents confirm UI-spoofing impact for Chrome/Chromi...
CVE-2025-5068
CVE-2025-5068 is a use-after-free in Blink affecting Google Chrome prior to 137.0.7151.68. The underlying issue is a heap corruption risk in Blink triggered by crafted HTML pages, with the CVSS vector indicating NETWORK attack vector, low attack complexity, and user interaction required, yielding...
CVE-2026-9116
CVE-2026-9116: In Google Chrome, insufficient policy enforcement in ServiceWorker before version 148.0.7778.179 allows a remote attacker to leak cross-origin data via a crafted HTML page. Affects Chrome’s ServiceWorker component; impact stated as Confidentiality impact (partial) with a CVSS v3.1 ...
CVE-2019-13678
CVE-2019-13678 affects Chromium/Google Chrome download-dialog spoofing. Root cause relates to incorrect data validation in the download dialog, enabling domain spoofing via crafted HTML. Debian advisories indicate remediation by upgrading Chromium to 78.0.3904.97-1~deb10u1 (and newer), with other...
CVE-2020-16016
CVE-2020-16016 affects Google Chrome (Chromium base) prior to 86.0.4240.193. An inappropriate implementation in base allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Documented consequences include arbitrary code e...
CVE-2020-16039
CVE-2020-16039 is a use-after-free vulnerability in Chromium’s extensions component, fixed in Chromium versions before 87.0.4280.88 and addressed by upgrading to 87.0.4280.88 or newer per Debian/Arch Linux advisories. Affected product: Chromium browser (extensions module). Root cause: use-after-f...
CVE-2020-6533
CVE-2020-6533 affects Google Chrome’s V8 engine. The Debian security advisory and Debian tracker describe a Type Confusion in V8 prior to Chrome 84.0.4147.89, which could allow a remote attacker to trigger heap corruption via a crafted HTML page. The issue was addressed in Chrome 84.0.4147.89 (or...
CVE-2020-6538
CVE-2020-6538 affects Google Chrome WebView on Android (inappropriate WebView implementation) allowing cross-origin data leakage via a crafted HTML page. Connected sources indicate the issue was fixed in Chrome/Chromium releases around 84.0.4147.105; Debian’s advisory lists CVE-2020-6538 among up...
CVE-2021-21186
CVE-2021-21186 refers to a policy-enforcement error in the QR scanning component of the Chromium/Chrome stack on iOS, allowing a user who is coaxed into scanning a crafted QR code to bypass navigation restrictions. Affected product: Google Chrome (iOS) with Chromium QR scan integration prior to 8...
CVE-2022-0289
The CVE-2022-0289 entry affects Google Chrome’s Safe Browsing component, with a Use-After-Free vulnerability that could lead to heap corruption via a crafted HTML page. Affected version prior to 97.0.4692.99 is fixed in Chrome’s January 2022 update; the Chrome release notes list this as a critica...
CVE-2022-1129
CVE-2022-1129 : Google Chrome on Android before 100.0.4896.60 suffers from an inappropriate Full Screen Mode implementation that can allow a remote attacker to spoof the Omnibox (URL bar) via a crafted HTML page. The issue is listed with a CVSS v3.1 base score of 6.5 (Medium); impact is spoofing ...
CVE-2022-1637
CVE-2022-1637 targets Google Chrome’s Web Contents component. The issue arises from an inappropriate implementation that allows a remote attacker to leak cross-origin data via a crafted HTML page. Affected product is Chrome (Chromium-based); the specific impact is data disclosure between origins....
CVE-2022-4175
CVE-2022-4175 affects Google Chrome/Chromium, describing a Use-After-Free vulnerability in Camera Capture that could allow a remote attacker to trigger heap corruption via a crafted HTML page. The issue is confirmed in Chrome/Chromium family and was addressed in the 108.0.5359.71 release. Public ...
CVE-2022-4184
CVE-2022-4184 affects Google Chrome Autofill. The issue is insufficient policy enforcement that allowed bypassing Autofill restrictions via a crafted HTML page. Affected products include Chrome/Chromium, prior to version 108.0.5359.71. The Chrome release notes confirm this CVE (CVE-2022-4184) as ...
CVE-2026-12032
CVE-2026-12032 affects Google Chrome on Android (pre‑149.0.7827.115) where an inappropriate implementation in Passwords allowed a remote attacker, who had renderer access, to bypass site isolation via a crafted HTML page. The connected sources confirm the issue exists in Passwords and is tied to ...
CVE-2020-15987
CVE-2020-15987 is a use-after-free in the WebRTC component of Chromium/Google Chrome prior to 86.0.4240.75. This vulnerability could allow a remote attacker to potentially cause heap corruption via a crafted WebRTC stream, leading to arbitrary code execution as described in connected advisories. ...
CVE-2020-16002
CVE-2020-16002 is a use-after-free in PDFium leveraged via crafted PDFs in Google Chrome (before 86.0.4240.111). The vulnerability affects Chrome’s PDF rendering path (PDFium) and could allow a remote attacker to trigger heap corruption, with the potential for arbitrary impact as described in the...
CVE-2020-6517
CVE-2020-6517 : The connected documents confirm a heap buffer overflow in Chrome’s history handling, exploited via a crafted HTML page, affecting Chrome prior to 84.0.4147.89. The issue is listed among Chrome’s 2020 security fixes and was addressed in the Chrome 84 stable update (84.0.4147.89) fo...
CVE-2021-21112
CVE-2021-21112 is a use-after-free in the Blink component of the Chromium-based Chrome stack (before 87.0.4280.141). The vulnerability allows a remote attacker to potentially trigger heap corruption via a crafted HTML page. Impact: partial confidentiality/integrity/availability degradation as des...
CVE-2021-21174
CVE-2021-21174 is an implementation error in the Referrer policy handling in Chromium/Google Chrome before 89.0.4389.72, allowing a remote attacker to bypass navigation restrictions via a crafted HTML page. Affected product: Chromium/Chrome (referrer policy component). Root cause: inappropriate/r...
CVE-2021-21175
In Google Chrome, CVE-2021-21175 corresponds to an inappropriate implementation in the Site Isolation feature prior to 89.0.4389.72. The issue allows a remote attacker to leak cross-origin data through a crafted HTML page. Affected product: Google Chrome (Site Isolation). Root cause: improper imp...
CVE-2021-21179
CVE-2021-21179 affects Google Chrome/Chromium, specifically a use-after-free in the Network Internals component on Linux prior to version 89.0.4389.72, enabling potential heap corruption via a crafted HTML page. A patch is available by upgrading to Chrome/Chromium 89.0.4389.72 or newer (see refer...
CVE-2021-21182
CVE-2021-21182 affects Google Chrome/Chromium navigations: insufficient policy enforcement in navigations allows a renderer-compromised remote attacker to bypass navigation restrictions via a crafted HTML page, for Chrome/Chromium fixes before/at 89.0.4389.72. Connected advisories (Debian Arch/DS...
CVE-2021-30594
CVE-2021-30594 affects Chromium-derived browsers (Page Info UI) with a use-after-free in the Page Info UI component before version 92.0.4515.131. The issue is described in connected advisories as a Chromium engine vulnerability that could allow heap-type corruption via crafted interactions, with ...
CVE-2022-1856
CVE-2022-1856: Use-after-free in Google Chrome's User Education component prior to 102.0.5005.61 allows heap corruption via a crafted Chrome Extension or specific user interaction after social engineering to install a malicious extension. Affected: Google Chrome (User Education). Root cause: use-...
CVE-2022-4186
CVE-2022-4186 affects Google Chrome/Chromium, describing insufficient validation of untrusted input in Downloads. Prior to 108.0.5359.71, an attacker who convinces a user to install a malicious extension could bypass Download restrictions via a crafted HTML page. The CVE is labeled Medium severit...
CVE-2023-3214
CVE-2023-3214 covers a use-after-free in Chrome/Chromium’s Autofill payments path prior to 114.0.5735.133. The vulnerability could enable heap corruption via a crafted HTML page, with high/critical impact (remote code execution possible, per the public advisories). Affected products include Googl...
CVE-2023-6112
CVE-2023-6112: Use-after-free in Navigation in Google Chrome/Chromium (
CVE-2023-6702
CVE-2023-6702 describes a Type Confusion in V8 used by Google Chrome/Chromium before version 120.0.6099.109, which could allow a remote attacker to potentially cause heap corruption via a crafted HTML page. The vulnerability is rated High (CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Public no...
CVE-2025-2135
CVE-2025-2135 corresponds to a Type Confusion in V8 used by Google Chrome, prior to 134.0.6998.88, that could lead to heap corruption via a crafted HTML page. Public materials in connected documents corroborate Chrome’s vulnerability class and Chrome version discussed in Chrome’s security updates...
CVE-2020-6540
CVE-2020-6540 is a buffer overflow in Skia used by Google Chrome, prior to 84.0.4147.105, allowing remote heap corruption via a crafted HTML page. The Debian security advisory DSA-4824-1 lists CVE-2020-6540 among fixed issues and recommends upgrading Chromium to at least 87.0.4280.88-0.4~deb10u1 ...
CVE-2020-6552
CVE-2020-6552 is a use-after-free in Blink affecting Google Chrome prior to 84.0.4147.125. The vulnerability could allow remote heap corruption via a crafted HTML page, enabling arbitrary code execution or a crash. Debian/GLSA notes advise upgrading Chromium/Chrome to the fixed version (84.0.4147...
CVE-2021-21165
CVE-2021-21165: Data indicates a heap/object lifecycle issue in Chrome/Chromium audio paths before 89.0.4389.72, enabling potential remote arbitrary code execution. The Astra/Audit/Debian entries confirm an audio component flaw in Chromium with the same version bound. Affected product: Chromium b...
CVE-2021-21211
CVE-2021-21211 refers to an insecure navigation implementation in Google Chrome on iOS before 90.0.4430.72, enabling a remote attacker to leak cross-origin data via a crafted HTML page. The connected sources confirm the same vulnerability description across multiple trackers (e.g., Debian securit...
CVE-2022-1143
CVE-2022-1143 is a heap buffer overflow in Chrome’s WebUI, affecting Chrome before 100.0.4896.60. The issue could allow heap corruption via specific input into DevTools after user interaction, potentially enabling arbitrary code execution or other impacts described in related advisories. Public d...
CVE-2022-4908
CVE-2022-4908 refers to an inappropriate implementation in Chrome/Chromium’s iFrame Sandbox that could leak cross-origin data via a crafted HTML page. Affected product is Google Chrome (and Chromium-based components); vulnerable component/behavior is the iFrame Sandbox. The root cause is an incor...
CVE-2026-15899
The CVE-2026-15899 entry relates to Google Chrome on macOS before version 150.0.7871.128, where a use-after-free in CameraCapture could allow a remote attacker to escape the Chromium sandbox via a crafted HTML page (CRITICAL impact). The connected EUVD entry confirms the same issue. No publicly d...