CVE-2020-15990

CVE-2020-15990 affects Chromium/Google Chrome: a use-after-free in the autofill component prior to 86.0.4240.75 can allow a remote attacker, via a crafted HTML page loaded in a compromised renderer, to potentially escape the sandbox and execute arbitrary code. Public reports in Debian/Arch/Linux ...

CVE-2020-15995

CVE-2020-15995 is a vulnerability in Chromium/Google Chrome’s V8 engine, where an out-of-bounds write in V8 prior to 87.0.4280.141 could enable a remote attacker to potentially achieve heap corruption via a crafted HTML page. The issue was fixed by upgrading to Chromium version 87.0.4280.141 (or ...

CVE-2020-16000

CVE-2020-16000 refers to an Inappropriate implementation in Blink in Google Chrome before 86.0.4240.111, enabling remote exploitation via a crafted HTML page that could lead to heap corruption. Affected component: Blink in Chrome; root cause: inappropriate implementation in Blink; impact: potenti...

CVE-2020-16005

CVE-2020-16005 concerns the ANGLE component of Chromium (Chromium/Chrome) prior to the patch level 86.0.4240.183. The documented root cause is insufficient policy enforcement in ANGLE, which could allow a remote attacker to potentially trigger heap corruption via a crafted HTML page, leading to a...

CVE-2021-21106

The CVE-2021-21106 issue affects Chromium-based browsers (e.g., Google Chrome up to 87.0.4280.141 and related Chromium builds) and is caused by a use-after-free in the autofill component. This vulnerability could allow a remote attacker who has compromised the renderer process to escape the sandb...

CVE-2021-21116

CVE-2021-21116: Heap buffer overflow in the audio component of Chromium-based browsers (Chrome/Chromium) before 87.0.4280.141. A remote attacker could exploit heap corruption via a crafted HTML page. Remediation: update to 87.0.4280.141 or later.

CVE-2021-21210

Affected software: Google Chrome (before version 90.0.4430.72). The CVE describes an Inappropriate implementation in Network that could allow a remote attacker to potentially access local UDP ports via a crafted HTML page. Impact statements in the connected documents indicate a remote attacker co...

CVE-2021-30590

CVE-2021-30590 is a heap buffer overflow in the Bookmarks component of the Chromium-based browser engine before version 92.0.4515.131. The disclosed impact across connected records states potential remote code execution or heap corruption via crafted HTML pages, affecting Chrome/Chromium-derived ...

CVE-2022-2619

CVE-2022-2619 applies to Google Chrome/Chromium, where insufficient input validation in Settings allows injection of scripts/HTML into a privileged page when a user installs a malicious extension. Affected version baseline is before 104.0.5112.79. Public writeups in connected docs confirm the iss...

CVE-2026-12444

Chromoting in Google Chrome on Windows is affected by an out-of-bounds read vulnerability tracked as CVE-2026-12444. The issue allows a local attacker to obtain potentially sensitive information from process memory via a malicious file. The root cause is an out-of-bounds memory read in Chromoting...

CVE-2020-6435

CVE-2020-6435 describes a policy enforcement error in extensions that affects Google Chrome/Chromium prior to 81.0.4044.92. The issue, rooted in insufficient policy enforcement within the extensions component, could allow a remote attacker who has achieved renderer access to bypass navigation res...

CVE-2020-6576

CVE-2020-6576 is a vulnerability in the Chromium browser involving a use-after-free in the offscreen canvas component. The issue could allow a remote attacker to corrupt the heap via a crafted HTML page, potentially enabling arbitrary code execution. The most concrete remediation in the provided ...

CVE-2021-30559

CVE-2021-30559 is an out-of-bounds write in ANGLE within Chromium/Google Chrome prior to 91.0.4472.164. The issue could allow a remote attacker to trigger heap corruption via a crafted HTML page, enabling arbitrary code execution or crash. Affected component: ANGLE in the Chromium browser engine;...

CVE-2021-30603

CVE-2021-30603 concerns a data race in WebAudio for Google Chrome. The vulnerability is triggered in Chrome versions prior to 92.0.4515.159 via a crafted HTML page, potentially enabling heap corruption on a remote attacker. Affected component is WebAudio within Chrome’s rendering stack; root caus...

CVE-2023-0705

Google Chrome/Chromium Core has an integer overflow vulnerability tracked as CVE-2023-0705, fixed in Chrome 110.0.5481.77 and later. A remote attacker could trigger the overflow to cause heap corruption via a crafted HTML page, requiring user interaction. Affected line items include Chrome/Chromi...

CVE-2023-1213

CVE-2023-1213 describes a use-after-free in SwiftShader within Google Chrome/Chromium before 111.0.5563.64, allowing a remote attacker to potentially cause heap corruption via a crafted HTML page. The issue has high severity (CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Affected component is C...

CVE-2026-12027

The CVE-2026-12027 entry corresponds to an insecure/incorrect implementation in Google Chrome’s Headless mode prior to 149.0.7827.115, where a renderer-compromised page could trigger a sandbox escape through a crafted HTML page. Affected software is Chrome/Chromium Headless; root cause is an inap...

CVE-2026-19137

Google Chrome WebGL use-after-free on Android prior to 151.0.7922.109 can allow a renderer-compromised attacker to escape the sandbox via a crafted HTML page. The CVE-2026-19137 entry is corroborated by ENISA EUVD-2026-54263 and NVD/CVE records. The vulnerability affects WebGL in Chrome; root cau...

CVE-2020-15986

CVE-2020-15986 affects Chromium's media component. An integer overflow in media before 86.0.4240.75 could enable a remote attacker to potentially cause heap corruption and arbitrary code execution. Public records in connected documents reference Chrome/Chromium updates fixing this in version 86.0...

CVE-2020-6445

CVE-2020-6445 discusses an insufficient policy enforcement vulnerability in the trusted types component of the Chromium/Chrome browser before version 81.0.4044.92, enabling a remote attacker to bypass Content Security Policy via a crafted HTML page. Public references in Debian/Arch/Fedora advisor...

CVE-2020-6496

CVE-2020-6496 : Use-after-free in the payments component of Google Chrome on macOS before 83.0.4103.97 allows a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Affected: Chrome/macOS; Root cause: use-after-free in payments. Impact: sandbox escape possible; Exploit...

CVE-2020-6520

CVE-2020-6520: A heap buffer overflow in Skia used by Google Chrome prior to version 84.0.4147.89 allowed remote exploitation via a crafted HTML page (heap corruption). Multiple connected sources confirm the issue resides in Skia used by Chrome/Chromium and the fix was delivered via Chrome/Chromi...

CVE-2020-6547

CVE-2020-6547 affects Google Chrome/Chromium with an incorrect security UI issue in media that could allow a remote attacker to glean sensitive information via a crafted HTML page. The Debian advisory for chromium lists CVE-2020-6547 among multiple fixes and states the fix version as chromium 84....

CVE-2020-6562

CVE-2020-6562 affects Blink in Google Chrome; root cause is insufficient policy enforcement. A crafted HTML page could leak cross-origin data. Affected: Chrome before 85.0.4183.83. Fix: update to 85.0.4183.83 or newer (as per connected advisories).

CVE-2020-6563

CVE-2020-6563 affects Google Chrome on Android and is caused by insufficient policy enforcement in the intent-handling component, enabling a remote attacker to read potentially sensitive data from disk via a crafted HTML page. Affected: Chrome on Android versions prior to 85.0.4183.83. Impact: in...

CVE-2021-21167

CVE-2021-21167 affects Google Chrome prior to 89.0.4389.72, with a use-after-free in the bookmarks component that can lead to heap corruption via a crafted HTML page. Affected software is the Chromium-based browser (Chrome); root cause is a use-after-free condition in bookmarks. Impact stated: re...

CVE-2022-0977

CVE-2022-0977 is a Use-After-Free in Chrome OS Browser UI affecting Google Chrome on Chrome OS before 99.0.4844.74, enabling heap corruption via a crafted HTML page when a user engages in specific interactions. The issue is part of a family of Chrome/Chromium UI and rendering vulnerabilities that...

CVE-2022-0980

CVE-2022-0980 describes a use-after-free vulnerability in Google Chrome’s New Tab Page, exploitable when a user is convinced to install a malicious extension, potentially enabling heap corruption through specific interactions. The issue affects Chrome prior to 99.0.4844.74; Google’s Stable Channe...

CVE-2022-1138

CVE-2022-1138 affects Google Chrome (Chromium-based) before 100.0.4896.60. The vulnerability is caused by an inappropriate implementation in the Web Cursor component, which could allow a remote attacker with renderer access to obscure the Omnibox (URL bar) via a crafted HTML page. Remediation per...

CVE-2022-2478

CVE-2022-2478 is a Google Chrome vulnerability (Use-after-free in PDF handling) that allows a remote attacker to potentially cause heap corruption via a crafted HTML page. The issue affects Chrome prior to 103.0.5060.134; exploitation aligns with a network attack vector and requires user interact...

CVE-2022-4188

CVE-2022-4188 affects Google Chrome on Android before 108.0.5359.71, due to insufficient validation of untrusted input in CORS. This allowed a remote attacker to bypass the same-origin policy via a crafted HTML page. The issue is categorized as Medium severity (CVSS 3.1: 4.3). A fix was released ...

CVE-2023-3420

CVE-2023-3420 describes a Type Confusion in V8 affecting Google Chrome/Chromium before 114.0.5735.198, allowing a remote attacker to trigger heap corruption via a crafted HTML page. Affected downstream advisories/coordination reference Chromium fixes prior to 114.0.5735.198 (e.g., Debian DSA-5440...

CVE-2019-5819

CVE-2019-5819 corresponds to a vulnerability in Chromium/Google Chrome's Developer Tools. The root cause is insufficient data validation in the Developer Tools before version 74.0.3729.108, allowing a local attacker to execute arbitrary code by processing a crafted string copied to the clipboard....

CVE-2020-16043

CVE-2020-16043 affects Chromium-based browsers (e.g., Chrome) before version 87.0.4280.141 . The issue is an insufficient data validation in networking that could allow a remote attacker to bypass discretionary access control via malicious network traffic. Impact per sources: remote code/impact r...

CVE-2020-6386

CVE-2020-6386 is a use-after-free in Chrome’s speech processing leading to potential heap corruption when processing crafted HTML. Affected: Google Chrome prior to version 80.0.3987.116. Impact: remote code execution or instability as described in public advisories, with the issue fixed in the Ch...

CVE-2020-6522

CVE-2020-6522 affects Google Chrome (and Chromium) due to an inappropriate implementation in external protocol handlers, potentially allowing a sandbox escape via a crafted HTML page. The issue existed in Chrome prior to version 84.0.4147.89. Debian and FreeBSD advisories list this CVE among many...

CVE-2020-6544

CVE-2020-6544 affects Google Chrome (media component) with a use-after-free in media leading to potential heap corruption via a crafted HTML page. The vulnerability is exploitable remotely and, per the supplied documents, is addressed by upgrading to Chrome 84.0.4147.125 or newer. Connected advis...

CVE-2020-6565

CVE-2020-6565 affects Google Chrome on iOS (Omnibox/URL bar). Insecure/improper Omnibox handling allowed a remote attacker to spoof the URL bar contents using a crafted HTML page. Root cause: inappropriate Omnibox implementation. Impact: spoofed UI; potential user deception. Remediation: update t...

CVE-2021-21151

CVE-2021-21151 is a use-after-free vulnerability in the Payments component of Chromium/Google Chrome, exploitable before version 88.0.4324.182. The issue could enable a remote attacker to potentially escape the sandbox, enabling arbitrary code execution. Affected product: Chromium-based browser (...

CVE-2021-21180

CVE-2021-21180 is a use-after-free vulnerability in Google Chrome’s tab search component, allowing a remote attacker to potentially trigger heap corruption via a crafted HTML page. The publicly documented impact is a remote code execution/heap corruption risk, with the vulnerability existing in C...

CVE-2022-1640

CVE-2022-1640 is a Google Chrome/Chromium vulnerability: a Use-after-free in Sharing path in Chrome prior to version 101.0.4951.64 could enable heap corruption when a user interacted with a crafted HTML page. The issue is listed in Chrome’s May 2022 stable-channel update (and Debian/Gentoo/Fedora...

CVE-2022-4195

CVE-2022-4195 stems from insufficient policy enforcement in Safe Browsing within Google Chrome. The vulnerability allows a remote attacker to bypass Safe Browsing warnings via a malicious file, affecting Chrome versions prior to 108.0.5359.71. The Chrome 108 release notes acknowledge this and lis...

CVE-2023-2460

CVE-2023-2460 is a Chromium/Chrome family issue: insufficient validation of untrusted input in Extensions could let a user-installed malicious extension bypass file access checks via a crafted HTML page. The vulnerability affects Google Chrome (and Chromium-based builds) up to version 113.0.5672....

CVE-2023-3598

CVE-2023-3598 describes an out-of-bounds read/write flaw in ANGLE used by Google Chrome/Chromium prior to version 114.0.5735.90, potentially enabling heap corruption via a crafted HTML page and allowing remote code execution or crash. Connected sources (Astra Linux, Fedora advisories) confirm aff...

CVE-2026-14117

The CVE-2026-14117 entry concerns Google Chrome’s DevTools on Windows prior to version 150.0.7871.47. The vulnerability is described as insufficient validation of untrusted input in DevTools, which could enable a remote attacker to obtain potentially sensitive information from process memory when...

CVE-2020-15975

CVE-2020-15975 affects Chromium/Google Chrome before 86.0.4240.75, caused by an integer overflow in the SwiftShader component that could enable remote code execution via crafted HTML. Debian/Arch advisories confirm the vulnerability in SwiftShader with the fix to version 86.0.4240.75 (or later) a...

CVE-2020-16015

CVE-2020-16015 affects Google Chrome/Chromium, specifically the WASM component. The issue is described as insufficient data validation in WASM prior to 87.0.4280.66, which could allow a remote attacker to trigger heap corruption via a crafted HTML page. Multiple connected sources corroborate that...

CVE-2020-6575

The CVE-2020-6575 vulnerability affects Google Chrome’s Mojo component in the renderer path, described as a race condition that could allow a sandbox escape when a crafted HTML page is loaded. The issue requires the renderer process to be compromised to exploit the sandbox escape vector. Exploita...

CVE-2021-21111

CVE-2021-21111 concerns Chromium/WebUI: insufficient policy enforcement prior to 87.0.4280.141 allows a user who installs a crafted malicious extension to potentially perform a sandbox escape. Affected: Chromium-based Chrome/Chromium up to the 87.0.4280.141 release. Impact: remote code execution ...

CVE-2021-21138

CVE-2021-21138 is a use-after-free in the Chromium DevTools component (Chromium before 88.0.4324.96) that could allow a local attacker to escape the sandbox via a crafted file. Public sources in the connected documents confirm the issue and its association with DevTools, and note that a fix is in...