CVE-2021-21111

CVE-2021-21111 concerns Chromium/WebUI: insufficient policy enforcement prior to 87.0.4280.141 allows a user who installs a crafted malicious extension to potentially perform a sandbox escape. Affected: Chromium-based Chrome/Chromium up to the 87.0.4280.141 release. Impact: remote code execution ...

CVE-2021-30529

CVE-2021-30529 is a use-after-free in the Bookmarks component of the Chromium browser (Google Chrome) prior to 91.0.4472.77. An attacker who persuades a user to install a malicious extension could trigger heap corruption via a crafted HTML page, potentially leading to arbitrary code execution. Th...

CVE-2021-37978

CVE-2021-37978 is a heap-buffer-overflow in Blink (Chromium/Chrome) before version 94.0.4606.81 that could allow remote code execution via crafted HTML. Multiple connected sources (Chrome security update notes and Arch/Debian security advisories) confirm the issue and reference 94.0.4606.81 as th...

CVE-2021-37980

CVE-2021-37980 affects Chromium’s Sandbox component. An inappropriate implementation allowed sandbox escapes in versions before 94.0.4606.81, enabling a remote attacker to potentially bypass site isolation. The Debian/Arch/Fedora advisories indicate the fix is in Chromium 94.0.4606.81 or later; u...

CVE-2022-4175

CVE-2022-4175 affects Google Chrome/Chromium, describing a Use-After-Free vulnerability in Camera Capture that could allow a remote attacker to trigger heap corruption via a crafted HTML page. The issue is confirmed in Chrome/Chromium family and was addressed in the 108.0.5359.71 release. Public ...

CVE-2023-4902

CVE-2023-4902 affects Google Chrome and Chromium. The issue is an inappropriate implementation in Input that lets a remote attacker spoof security UI via a crafted HTML page. Root cause: flawed handling in the Input module prior to version 117.0.5938.62. Impact: spoofed UI could mislead users; ex...

CVE-2026-12032

CVE-2026-12032 affects Google Chrome on Android (pre‑149.0.7827.115) where an inappropriate implementation in Passwords allowed a remote attacker, who had renderer access, to bypass site isolation via a crafted HTML page. The connected sources confirm the issue exists in Passwords and is tied to ...

CVE-2026-12444

Chromoting in Google Chrome on Windows is affected by an out-of-bounds read vulnerability tracked as CVE-2026-12444. The issue allows a local attacker to obtain potentially sensitive information from process memory via a malicious file. The root cause is an out-of-bounds memory read in Chromoting...

CVE-2026-14117

The CVE-2026-14117 entry concerns Google Chrome’s DevTools on Windows prior to version 150.0.7871.47. The vulnerability is described as insufficient validation of untrusted input in DevTools, which could enable a remote attacker to obtain potentially sensitive information from process memory when...

CVE-2020-15977

The CVE entry CVE-2020-15977 describes an insufficient data validation issue in the dialogs component of the Chromium browser prior to 86.0.4240.75, enabling a remote attacker to potentially disclose data from disk via a crafted HTML page. Connected advisories (e.g., Arch Linux ASA-202010-1) enum...

CVE-2020-15992

CVE-2020-15992 affects Chromium-based browsers (Chromium/Google Chrome) before 86.0.4240.75, specifically the networking component. A remote attacker who already gained renderer-process access could bypass the same-origin policy via a crafted HTML page, with impacts including potential informatio...

CVE-2020-16008

CVE-2020-16008 affects Chromium/WebRTC prior to 86.0.4240.183. The root cause is a stack-based buffer overflow in the WebRTC component that could allow a remote attacker to trigger stack corruption and arbitrary code execution. Remediation is to upgrade Chromium to version 86.0.4240.183 or newer ...

CVE-2020-16030

CVE-2020-16030 affects the Blink component in Chromium/Google Chrome prior to 87.0.4280.66. The issue is insufficient data validation in Blink, enabling a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. Publicly cited sources in the provided documents confirm C...

CVE-2020-16036

CVE-2020-16036 : In Google Chrome/Chromium, an inappropriate implementation in cookies allowed a remote attacker to bypass cookie restrictions via a crafted HTML page. The vulnerability is tied to the cookies component and is classified as an access restriction bypass . Public fixes were released...

CVE-2021-21136

CVE-2021-21136 affects Chromium WebView on Android (before 88.0.4324.96). Root cause: insufficient policy enforcement in WebView. Impact: remote attacker could leak cross-origin data via a crafted HTML page. Public fixes and references indicate upgrade to Chromium 88.0.4324.96+ (e.g., Chromium pa...

CVE-2021-21142

CVE-2021-21142 : A use-after-free in the Payments component of the Chromium/Google Chrome stack before version 88.0.4324.146 (macOS context in the CVE) could allow a remote attacker to execute arbitrary code via a crafted HTML page. Affected product: Chromium/Chrome; root cause is use-after-free ...

CVE-2021-21170

CVE-2021-21170 is a content spoofing/UX UI issue in Chromium-based browsers (Chrome/Chromium) prior to 89.0.4389.72. The vulnerability affects the Loader/URL bar UI and could allow a renderer-compromised attacker to spoof the Omnibox via a crafted HTML page. A fix exists in Chrome/Chromium 89.0.4...

CVE-2021-30596

CVE-2021-30596 is a Chromium-based browser vulnerability affecting Google Chrome/Chromium before version 92.0.4515.131. The issue is an incorrect security UI in the Navigation component that allows a remote attacker to spoof the Omnibox (URL bar) from a crafted HTML page. Public advisories (Arch ...

CVE-2022-0804

CVE-2022-0804 affects Google Chrome on Android (pre-99.0.4844.51). Root cause: Inappropriate Full screen implementation can let a crafted HTML page hide the Omnibox contents. Public sources confirm a fixed version 99.0.4844.51 in Debian (security tracker DSA-5089-1) and related updates in Fedora/...

CVE-2022-1131

CVE-2022-1131 is a security issue in Google Chrome's Cast UI . It is a Use-after-Free vulnerability that could enable heap corruption and potentially arbitrary code execution when a crafted HTML page is loaded. This CVE was addressed in Chrome 100.0.4896.60 (and later) as part of the March 2022 s...

CVE-2023-0136

CVE-2023-0136 affects Google Chrome/Chromium’s Fullscreen API implementation. The issue is an inappropriate implementation in Fullscreen API that can allow a remote attacker to trigger an incorrect security UI via a crafted HTML page. Public source records consistently tie this CVE to Chrome/Chro...

CVE-2019-5760

CVE-2019-5760 affects Google Chrome’s WebRTC implementation. Insufficient pointer validation could lead to heap corruption via a crafted HTML page, enabling remote exploitation. The fix is available in Chrome updates from 72.0.3626.81 onward.

CVE-2020-16001

CVE-2020-16001 is a use-after-free vulnerability in Chrome’s media component (video/multimedia stack) that could allow remote code execution via a crafted HTML page. It was fixed in the Chromium/Chrome stable channel with version 86.0.4240.111. The associated advisory notes this as a high-severit...

CVE-2020-16031

CVE-2020-16031 is a vulnerability in Chromium/Chrome related to the tab-Preview UI. Multiple connected sources (e.g., Arch Linux security advisory ASA-202011-11) describe it as a content spoofing issue in the tab preview component caused by an incorrect security UI, allowing a remote attacker to ...

CVE-2020-6529

CVE-2020-6529 involves an inappropriate WebRTC implementation in Google Chrome versions prior to 84.0.4147.89. An attacker positioned on an privileged network could leak cross-origin data via a crafted HTML page. The CVE is tied to WebRTC data handling in Chrome, with a base impact characterized ...

CVE-2020-6553

CVE-2020-6553 is described as a use-after-free in offline mode in Google Chrome on iOS prior to 84.0.4147.125, potentially enabling heap corruption via a crafted HTML page. Connected sources tie this entry to Chromium security updates; Debian advisories reference updating Chromium to 84.0.4147.12...

CVE-2020-6569

CVE-2020-6569 is an integer overflow in WebUSB in Google Chrome/Chromium prior to 85.0.4183.83. The vulnerability could allow a remote attacker who has compromised the renderer process to potentially cause heap corruption via a crafted HTML page. Public advisories in the connected set (e.g., Debi...

CVE-2023-0474

CVE-2023-0474 affects Google Chrome/Chromium GuestView prior to 109.0.5414.119. The vulnerability is a Use-after-free in GuestView that could allow a user-assisted attacker who convinces a user to install a malicious extension to trigger heap corruption via a Chrome web app. The Chrome release no...

CVE-2023-2459

CVE-2023-2459 affects Chromium-based browsers (Google Chrome/Chromium). The vulnerability is an inappropriate implementation in Prompts that allows a remote attacker to bypass permission restrictions through a crafted HTML page. Severity is described as Medium. Technical details across connected ...

CVE-2023-2930

The CVE-2023-2930 entry describes a use-after-free in Google Chrome Extensions (Extensions component) prior to version 114.0.5735.90, enabling heap corruption when a user is persuaded to install a malicious extension via a crafted HTML page. Affected software: Google Chrome (Extensions handling);...

CVE-2020-16028

CVE-2020-16028 is a heap-based buffer overflow in the WebRTC component of the Chromium browser before version 87.0.4280.66. A remote attacker could potentially exploit heap corruption via a crafted HTML page. Affected upstream is Chromium/Chrome; fixes were released in Chrome/Chromium 87.0.4280.6...

CVE-2020-6473

CVE-2020-6473 is a Blink/WebKit policy-enforcement error in Google Chrome prior to 83.0.4103.61 that could allow a remote attacker to obtain potentially sensitive information from a process’s memory via a crafted HTML page. Documents from Debian and Arch Linux confirm the vulnerability in Chrome/...

CVE-2021-21110

CVE-2021-21110 concerns Chromium/Chrome: a use-after-free in the safe browsing component of the Chromium browser before version 87.0.4280.141 could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Connected advisories consistently tie this CVE to Chromium u...

CVE-2021-21133

CVE-2021-21133 is a policy-enforcement vulnerability in Chromium’s Downloads component. The issue, observed in Chromium before 88.0.4324.96, could allow an attacker who lures a user to download files to bypass navigation restrictions via a crafted HTML page. Public advisories (Arch Linux ASA-2021...

CVE-2021-30562

CVE-2021-30562 describes a use-after-free in the WebSerial component of the Chromium browser engine before version 91.0.4472.164. The issue allows a remote attacker to potentially trigger heap corruption through a crafted HTML page, with the impact limited to the affected WebSerial path as docume...

CVE-2022-0108

CVE-2022-0108 describes an iframe sandbox/navigation handling issue in WebKit-based components. Connected documents show concrete details across multiple products: Google Chrome before 97.0.4692.71: leakage of cross-origin data via crafted HTML navigation (Description: Inappropriate implementatio...

CVE-2022-1855

The CVE-2022-1855 entry corresponds to a memory misreference/use-after-free vulnerability in the Messaging component of Google Chrome, exploitable via a crafted HTML page to trigger heap corruption. Affected product: Google Chrome (Messaging component). Root cause: use-after-free causing memory m...

CVE-2022-3201

CVE-2022-3201 affects Google Chrome/DevTools on ChromeOS with insufficient input validation in DevTools prior to 105.0.5195.125, enabling a crafted HTML page via a user-instigated malicious extension to bypass navigation restrictions. The issue is tied to Chrome/Chromium DevTools input handling a...

CVE-2022-4183

CVE-2022-4183 affects Google Chrome/Chromium components related to the Popup Blocker. The issue is described as insufficient policy enforcement in the Popup Blocker, enabling a remote attacker to bypass navigation restrictions via a crafted HTML page. The public fix is Chrome/Chromium 108.0.5359....

CVE-2023-2723

CVE-2023-2723 relates to a use-after-free in Chrome/Chromium DevTools prior to 113.0.5672.126. A remote attacker who already compromised the renderer could trigger heap corruption via a crafted HTML page. The vulnerability has a high security impact (C/H/I/A) and a network attack vector with user...

CVE-2023-4908

CVE-2023-4908: In Google Chrome/Chromium, an inappropriate implementation in Picture-in-Picture allowed a remote attacker to spoof the security UI via a crafted HTML page. Affected versions are prior to 117.0.5938.62 (Chrome/Chromium). The issue is rated Low severity by the Chromium/Chrome ecosys...

CVE-2023-6702

CVE-2023-6702 describes a Type Confusion in V8 used by Google Chrome/Chromium before version 120.0.6099.109, which could allow a remote attacker to potentially cause heap corruption via a crafted HTML page. The vulnerability is rated High (CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Public no...

CVE-2020-15978

CVE-2020-15978 affects Chromium/Google Chrome navigation in the renderer on Android before 86.0.4240.75. The issue is described as insufficient data validation in the navigation component, allowing a compromised renderer to bypass navigation restrictions via a crafted HTML page. Connected sources...

CVE-2020-15984

CVE-2020-15984 affects Google Chrome on iOS before 86.0.4240.75, where the Omnibox (URL bar) does not enforce policies correctly, enabling a remote attacker to spoof the Omnibox via a crafted URL. Several advisories (Debian, FreeBSD, Arch) indicate the fixed version is 86.0.4240.75 or later, impl...

CVE-2020-6384

CVE-2020-6384 is a use-after-free in WebAudio of Google Chrome/Chromium prior to version 80.0.3987.116, potentially enabling heap corruption via a crafted HTML page. Connected advisories confirm this issue is fixed in later Chromium/Chrome updates (e.g., Chromium 80.0.3987.132 and newer, with Red...

CVE-2020-6391

CVE-2020-6391 concerns Blink in Google Chrome. The vulnerability arises from insufficient validation of untrusted input in Blink, allowing a local attacker to bypass Content Security Policy via a specially crafted HTML page on Chrome versions prior to 80.0.3987.87. Affected product: Google Chrome...

CVE-2020-6480

CVE-2020-6480 is documented as an access restriction bypass in Chromium/Google Chrome’s enterprise component, caused by insufficient policy enforcement. The Arch Linux ASA-202005-12 details multiple issues with chromium before 83.0.4103.61-1, including the CVE-2020-6480 bypass of navigation restr...

CVE-2021-21144

CVE-2021-21144 is a vulnerability in Chromium’s Tab Groups feature, where a heap buffer overflow prior to 88.0.4324.146 could allow a malicious extension to trigger heap corruption and potentially execute arbitrary code. Affected software is the Chromium browser (before 88.0.4324.146). The root c...

CVE-2021-30597

CVE-2021-30597 is a use-after-free vulnerability in the Browser UI of the Chromium/Chrome stack prior to version 92.0.4515.131. The issue, located in the Browser UI component, enables a remote attacker to potentially trigger heap corruption and execute arbitrary code via crafted web content or in...

CVE-2021-37971

CVE-2021-37971 affects Google Chrome up to 94.0.4606.54 where the Web Browser UI could be spoofed in the Omnibox via a crafted HTML page due to an incorrect security UI. The vulnerability allows a remote attacker to mislead users by altering the URL bar contents. The initial and connected documen...