CVE-2023-0474

CVE-2023-0474 affects Google Chrome/Chromium GuestView prior to 109.0.5414.119. The vulnerability is a Use-after-free in GuestView that could allow a user-assisted attacker who convinces a user to install a malicious extension to trigger heap corruption via a Chrome web app. The Chrome release no...

CVE-2023-0696

CVE-2023-0696 describes a Type Confusion in V8 affecting Google Chrome/Chromium prior to 110.0.5481.77, enabling potential heap corruption via a crafted HTML page. The Chrome/Chromium release notes confirm security fixes for this and related CVEs, with Chrome 110.0.5481.77+ addressing the issue. ...

CVE-2023-5997

The CVE-2023-5997 entry corresponds to a Use-After-Free in the Garbage Collection of Google Chrome/Chromium prior to 119.0.6045.159, enabling a remote attacker to potentially corrupt the heap through a crafted HTML page. Affected software includes Chromium-based browsers (Chrome) with fixes shipp...

CVE-2019-13660

CVE-2019-13660 affects Chromium/Google Chrome prior to 77.0.3865.75. Root cause: a user interface issue in full screen mode enabling UI spoofing of notifications via a crafted HTML page. Published details in Debian security advisory (CVE-2019-13660) and similar vendor advisories indicate remediat...

CVE-2020-15988

CVE-2020-15988 affects Chromium/Google Chrome on Windows prior to 86.0.4240.75, where insufficient policy enforcement in the downloads component could allow a remote attacker to bypass download restrictions and execute arbitrary code via a crafted HTML page if the user is tricked into opening a d...

CVE-2020-6515

CVE-2020-6515 describes a use-after-free in the tab strip of Google Chrome/Chromium prior to version 84.0.4147.89, potentially enabling remote code execution via a crafted HTML page and heap corruption. The connected documents confirm (1) affected product line: Google Chrome/Chromium; (2) vulnera...

CVE-2020-6548

CVE-2020-6548: Heap buffer overflow in Skia within Google Chrome prior to 84.0.4147.125. A remote attacker who gains control of the renderer process could exploit heap corruption via a crafted HTML page. Affected product: Chrome/Chromium with Skia integration. Impact: potential arbitrary code exe...

CVE-2020-6567

CVE-2020-6567 involves Google Chrome (Windows) prior to 85.0.4183.83, where insufficient validation of untrusted input in command line handling allowed bypassing navigation restrictions via a crafted HTML page. Connected advisories confirm Chromium updates to 85.0.4183.83 or later as the fix (e.g...

CVE-2021-21170

CVE-2021-21170 is a content spoofing/UX UI issue in Chromium-based browsers (Chrome/Chromium) prior to 89.0.4389.72. The vulnerability affects the Loader/URL bar UI and could allow a renderer-compromised attacker to spoof the Omnibox via a crafted HTML page. A fix exists in Chrome/Chromium 89.0.4...

CVE-2021-21173

CVE-2021-21173 describes a side-channel information leakage in Google Chrome/Chromium’s Network Internals, allowing a remote attacker to leak cross-origin data via a crafted HTML page. Affected component: Network Internals in Chromium before version 89.0.4389.72. Root cause: side-channel informat...

CVE-2021-37979

CVE-2021-37979 is a Chrome/Chromium-related vulnerability describing a heap buffer overflow in the WebRTC component of the Chromium engine (before version 94.0.4606.81). The issue could allow a remote attacker to trigger heap corruption by convincing a user to visit a malicious page containing cr...

CVE-2022-1131

CVE-2022-1131 is a security issue in Google Chrome's Cast UI . It is a Use-after-Free vulnerability that could enable heap corruption and potentially arbitrary code execution when a crafted HTML page is loaded. This CVE was addressed in Chrome 100.0.4896.60 (and later) as part of the March 2022 s...

CVE-2023-0933

CVE-2023-0933 describes an integer overflow in PDF parsing in Google Chrome (Chromium) prior to 110.0.5481.177, which could allow a remote attacker to potentially cause heap corruption via a crafted PDF file. The CVSS metrics provided assign a base score of 8.8 (HIGH) with network attack vector, ...

CVE-2026-17650

CVE-2026-17650 affects Google Chrome (Chromium-based) prior to 151.0.7922.72. Description: Use-after-free in Compositing could allow a remote attacker who has compromised the renderer process to potentially escape the sandbox via a crafted HTML page. Affected component: Compositing in Chrome. Roo...

CVE-2020-15973

CVE-2020-15973: Insufficient policy enforcement in the extensions component of Google Chrome (Chromium) prior to 86.0.4240.75 allowed an attacker, by convincing a user to install a malicious extension, to bypass the same-origin policy. Public advisories (Debian, FreeBSD, Arch Linux) confirm the i...

CVE-2021-37980

CVE-2021-37980 affects Chromium’s Sandbox component. An inappropriate implementation allowed sandbox escapes in versions before 94.0.4606.81, enabling a remote attacker to potentially bypass site isolation. The Debian/Arch/Fedora advisories indicate the fix is in Chromium 94.0.4606.81 or later; u...

CVE-2022-3201

CVE-2022-3201 affects Google Chrome/DevTools on ChromeOS with insufficient input validation in DevTools prior to 105.0.5195.125, enabling a crafted HTML page via a user-instigated malicious extension to bypass navigation restrictions. The issue is tied to Chrome/Chromium DevTools input handling a...

CVE-2023-4902

CVE-2023-4902 affects Google Chrome and Chromium. The issue is an inappropriate implementation in Input that lets a remote attacker spoof security UI via a crafted HTML page. Root cause: flawed handling in the Input module prior to version 117.0.5938.62. Impact: spoofed UI could mislead users; ex...

CVE-2020-15971

CVE-2020-15971 is a use-after-free in the printing component of Chromium/Google Chrome before 86.0.4240.75. A remote attacker who has compromised the renderer could potentially escape the sandbox via a crafted HTML page, as described in multiple sources (Debian/Arch/FreeBSD summaries). Public dis...

CVE-2020-16008

CVE-2020-16008 affects Chromium/WebRTC prior to 86.0.4240.183. The root cause is a stack-based buffer overflow in the WebRTC component that could allow a remote attacker to trigger stack corruption and arbitrary code execution. Remediation is to upgrade Chromium to version 86.0.4240.183 or newer ...

CVE-2020-6400

CVE-2020-6400 refers to an inappropriate CORS implementation in Google Chrome prior to 80.0.3987.87, enabling a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability affects Chrome’s cross-origin resource sharing handling and is addressed by updating to Chrome 80.0....

CVE-2020-6532

CVE-2020-6532 affects Google Chrome (SCTP use-after-free) prior to version 84.0.4147.105. The root cause is a use-after-free in SCTP handling, which could allow remote code execution via a crafted HTML page (heap corruption). Public advisories in connected docs confirm the issue and list affected...

CVE-2020-6541

The CVE-2020-6541 entry concerns a Use-after-free in WebUSB in Google Chrome prior to version 84.0.4147.105 . The underlying issue could allow a remote attacker to potentially exploit a heap corruption via a crafted HTML page. Affected software is Chrome’s WebUSB component; exploitability is desc...

CVE-2021-21125

CVE-2021-21125 is a policy-enforcement vulnerability in the Chromium-based File System API of Google Chrome (Windows) before version 88.0.4324.96. The issue allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. Connected sources confirm this CVE occurs within Chromi...

CVE-2021-21136

CVE-2021-21136 affects Chromium WebView on Android (before 88.0.4324.96). Root cause: insufficient policy enforcement in WebView. Impact: remote attacker could leak cross-origin data via a crafted HTML page. Public fixes and references indicate upgrade to Chromium 88.0.4324.96+ (e.g., Chromium pa...

CVE-2021-21142

CVE-2021-21142 : A use-after-free in the Payments component of the Chromium/Google Chrome stack before version 88.0.4324.146 (macOS context in the CVE) could allow a remote attacker to execute arbitrary code via a crafted HTML page. Affected product: Chromium/Chrome; root cause is use-after-free ...

CVE-2021-37978

CVE-2021-37978 is a heap-buffer-overflow in Blink (Chromium/Chrome) before version 94.0.4606.81 that could allow remote code execution via crafted HTML. Multiple connected sources (Chrome security update notes and Arch/Debian security advisories) confirm the issue and reference 94.0.4606.81 as th...

CVE-2023-0136

CVE-2023-0136 affects Google Chrome/Chromium’s Fullscreen API implementation. The issue is an inappropriate implementation in Fullscreen API that can allow a remote attacker to trigger an incorrect security UI via a crafted HTML page. Public source records consistently tie this CVE to Chrome/Chro...

CVE-2023-1217

CVE-2023-1217 describes a stack buffer overflow in Chrome’s crash reporting on Windows prior to 111.0.5563.64. A remote attacker who already compromised a renderer process could read potentially sensitive data from the process memory via a crafted HTML page. The available connected data confirms ...

CVE-2023-2722

CVE-2023-2722 describes a use-after-free in Google Chrome’s Autofill UI on Android, prior to 113.0.5672.126, enabling heap corruption via a crafted HTML page. The vulnerability is tied to the Chromium Autofill UI implementation and has been classified as High severity. Public sources indicate the...

CVE-2023-2934

CVE-2023-2934 affects Google Chrome/Chromium Mojo, with out-of-bounds memory access leading to potential heap corruption via a crafted HTML page. Affected versions include Chrome prior to 114.0.5735.90 (and corresponding Chromium builds). The root cause is a Mojo memory access flaw; impact is hig...

CVE-2023-4354

CVE-2023-4354 describes a heap buffer overflow in Skia used by Google Chrome prior to 116.0.5845.96. The vulnerability could allow a remote attacker who has already compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. Public references in the connected ...

CVE-2026-14063

The CVE-2026-14063 entry describes an out-of-bounds read in Chromecast within Google Chrome prior to 150.0.7871.47. The issue allows a local attacker to obtain potentially sensitive information from process memory via malicious network traffic. The documented impact is information disclosure with...

CVE-2020-6535

CVE-2020-6535 affects Google Chrome/WebUI where insufficient data validation in the WebUI allowed a renderer-compromised attacker to inject scripts/HTML into a privileged page via a crafted HTML page. The vulnerability targets Chrome versions prior to 84.0.4147.89. Public sources in connected doc...

CVE-2020-6553

CVE-2020-6553 is described as a use-after-free in offline mode in Google Chrome on iOS prior to 84.0.4147.125, potentially enabling heap corruption via a crafted HTML page. Connected sources tie this entry to Chromium security updates; Debian advisories reference updating Chromium to 84.0.4147.12...

CVE-2020-6574

CVE-2020-6574 affects Chromium-based Chrome on macOS before 85.0.4183.102, due to insufficient policy enforcement in the installer that could allow a local privilege-escalation via a crafted binary. Several connected advisories confirm the issue and cite upgrades to at least 85.0.4183.102 (or lat...

CVE-2021-21110

CVE-2021-21110 concerns Chromium/Chrome: a use-after-free in the safe browsing component of the Chromium browser before version 87.0.4280.141 could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Connected advisories consistently tie this CVE to Chromium u...

CVE-2021-21133

CVE-2021-21133 is a policy-enforcement vulnerability in Chromium’s Downloads component. The issue, observed in Chromium before 88.0.4324.96, could allow an attacker who lures a user to download files to bypass navigation restrictions via a crafted HTML page. Public advisories (Arch Linux ASA-2021...

CVE-2021-21144

CVE-2021-21144 is a vulnerability in Chromium’s Tab Groups feature, where a heap buffer overflow prior to 88.0.4324.146 could allow a malicious extension to trigger heap corruption and potentially execute arbitrary code. Affected software is the Chromium browser (before 88.0.4324.146). The root c...

CVE-2021-30529

CVE-2021-30529 is a use-after-free in the Bookmarks component of the Chromium browser (Google Chrome) prior to 91.0.4472.77. An attacker who persuades a user to install a malicious extension could trigger heap corruption via a crafted HTML page, potentially leading to arbitrary code execution. Th...

CVE-2022-1855

The CVE-2022-1855 entry corresponds to a memory misreference/use-after-free vulnerability in the Messaging component of Google Chrome, exploitable via a crafted HTML page to trigger heap corruption. Affected product: Google Chrome (Messaging component). Root cause: use-after-free causing memory m...

CVE-2022-4183

CVE-2022-4183 affects Google Chrome/Chromium components related to the Popup Blocker. The issue is described as insufficient policy enforcement in the Popup Blocker, enabling a remote attacker to bypass navigation restrictions via a crafted HTML page. The public fix is Chrome/Chromium 108.0.5359....

CVE-2023-0139

CVE-2023-0139 affects Google Chrome/Chromium on Windows prior to 109.0.5414.74. It stems from insufficient validation of untrusted input in the Downloads feature, enabling a remote attacker to bypass download restrictions via a crafted HTML page. The Chrome/Chromium 109.0.5414.74 update (and rela...

CVE-2023-2723

CVE-2023-2723 relates to a use-after-free in Chrome/Chromium DevTools prior to 113.0.5672.126. A remote attacker who already compromised the renderer could trigger heap corruption via a crafted HTML page. The vulnerability has a high security impact (C/H/I/A) and a network attack vector with user...

CVE-2023-2930

The CVE-2023-2930 entry describes a use-after-free in Google Chrome Extensions (Extensions component) prior to version 114.0.5735.90, enabling heap corruption when a user is persuaded to install a malicious extension via a crafted HTML page. Affected software: Google Chrome (Extensions handling);...

CVE-2023-3727

CVE-2023-3727 is a use-after-free in WebRTC of Google Chrome/Chromium, potentially enabling remote heap corruption in versions before 115.0.5790.98. Affected product: Google Chrome (Chromium-based). Impact: high severity; remote attacker could exploit to compromise memory. Remediation: update to ...

CVE-2023-4908

CVE-2023-4908: In Google Chrome/Chromium, an inappropriate implementation in Picture-in-Picture allowed a remote attacker to spoof the security UI via a crafted HTML page. Affected versions are prior to 117.0.5938.62 (Chrome/Chromium). The issue is rated Low severity by the Chromium/Chrome ecosys...

CVE-2024-0518

The CVE-2024-0518 entry concerns a type confusion in V8 used by Google Chrome/Chromium prior to version 120.0.6099.224, which could allow a remote attacker to potentially trigger heap corruption via a crafted HTML page. Connected sources confirm Chromium/Chrome vulnerability details and indicate ...

CVE-2026-15124

CVE-2026-15124 affects Google Chrome; vulnerability in the Passwords component due to insufficient policy enforcement allows a remote attacker to bypass the same-origin policy via a crafted HTML page. Impact is a cross-origin bypass as described in the public advisories. Remediation: update to Ch...

CVE-2020-15992

CVE-2020-15992 affects Chromium-based browsers (Chromium/Google Chrome) before 86.0.4240.75, specifically the networking component. A remote attacker who already gained renderer-process access could bypass the same-origin policy via a crafted HTML page, with impacts including potential informatio...