CVE-2021-21142

CVE-2021-21142 : A use-after-free in the Payments component of the Chromium/Google Chrome stack before version 88.0.4324.146 (macOS context in the CVE) could allow a remote attacker to execute arbitrary code via a crafted HTML page. Affected product: Chromium/Chrome; root cause is use-after-free ...

CVE-2021-21144

CVE-2021-21144 is a vulnerability in Chromium’s Tab Groups feature, where a heap buffer overflow prior to 88.0.4324.146 could allow a malicious extension to trigger heap corruption and potentially execute arbitrary code. Affected software is the Chromium browser (before 88.0.4324.146). The root c...

CVE-2022-4183

CVE-2022-4183 affects Google Chrome/Chromium components related to the Popup Blocker. The issue is described as insufficient policy enforcement in the Popup Blocker, enabling a remote attacker to bypass navigation restrictions via a crafted HTML page. The public fix is Chrome/Chromium 108.0.5359....

CVE-2023-2459

CVE-2023-2459 affects Chromium-based browsers (Google Chrome/Chromium). The vulnerability is an inappropriate implementation in Prompts that allows a remote attacker to bypass permission restrictions through a crafted HTML page. Severity is described as Medium. Technical details across connected ...

CVE-2023-2930

The CVE-2023-2930 entry describes a use-after-free in Google Chrome Extensions (Extensions component) prior to version 114.0.5735.90, enabling heap corruption when a user is persuaded to install a malicious extension via a crafted HTML page. Affected software: Google Chrome (Extensions handling);...

CVE-2023-6508

CVE-2023-6508 describes a use-after-free in Media Stream of Chromium-based browsers (Google Chrome) that could allow remote heap corruption via a crafted HTML page. Public details in the connected sources confirm affected products are Google Chrome/Chromium, with the issue triggered by Media Stre...

CVE-2024-0518

The CVE-2024-0518 entry concerns a type confusion in V8 used by Google Chrome/Chromium prior to version 120.0.6099.224, which could allow a remote attacker to potentially trigger heap corruption via a crafted HTML page. Connected sources confirm Chromium/Chrome vulnerability details and indicate ...

CVE-2026-13950

CVE-2026-13950 affects Google Chrome (GPU component) with an uninitialized use in GPU that could allow a remote attacker who already compromised the renderer process to read potentially sensitive data from process memory via a crafted HTML page. Affected version range is Chrome before 150.0.7871....

CVE-2020-15978

CVE-2020-15978 affects Chromium/Google Chrome navigation in the renderer on Android before 86.0.4240.75. The issue is described as insufficient data validation in the navigation component, allowing a compromised renderer to bypass navigation restrictions via a crafted HTML page. Connected sources...

CVE-2020-15992

CVE-2020-15992 affects Chromium-based browsers (Chromium/Google Chrome) before 86.0.4240.75, specifically the networking component. A remote attacker who already gained renderer-process access could bypass the same-origin policy via a crafted HTML page, with impacts including potential informatio...

CVE-2020-16001

CVE-2020-16001 is a use-after-free vulnerability in Chrome’s media component (video/multimedia stack) that could allow remote code execution via a crafted HTML page. It was fixed in the Chromium/Chrome stable channel with version 86.0.4240.111. The associated advisory notes this as a high-severit...

CVE-2020-16028

CVE-2020-16028 is a heap-based buffer overflow in the WebRTC component of the Chromium browser before version 87.0.4280.66. A remote attacker could potentially exploit heap corruption via a crafted HTML page. Affected upstream is Chromium/Chrome; fixes were released in Chrome/Chromium 87.0.4280.6...

CVE-2020-16038

CVE-2020-16038 refers to a use-after-free in the media component of Chromium/Google Chrome (pre-87.0.4280.88). The vulnerability could allow a remote attacker to achieve arbitrary code execution via a crafted HTML page, potentially leading to heap corruption. Public advisories from Debian, Arch L...

CVE-2020-6553

CVE-2020-6553 is described as a use-after-free in offline mode in Google Chrome on iOS prior to 84.0.4147.125, potentially enabling heap corruption via a crafted HTML page. Connected sources tie this entry to Chromium security updates; Debian advisories reference updating Chromium to 84.0.4147.12...

CVE-2021-21133

CVE-2021-21133 is a policy-enforcement vulnerability in Chromium’s Downloads component. The issue, observed in Chromium before 88.0.4324.96, could allow an attacker who lures a user to download files to bypass navigation restrictions via a crafted HTML page. Public advisories (Arch Linux ASA-2021...

CVE-2021-30596

CVE-2021-30596 is a Chromium-based browser vulnerability affecting Google Chrome/Chromium before version 92.0.4515.131. The issue is an incorrect security UI in the Navigation component that allows a remote attacker to spoof the Omnibox (URL bar) from a crafted HTML page. Public advisories (Arch ...

CVE-2022-0804

CVE-2022-0804 affects Google Chrome on Android (pre-99.0.4844.51). Root cause: Inappropriate Full screen implementation can let a crafted HTML page hide the Omnibox contents. Public sources confirm a fixed version 99.0.4844.51 in Debian (security tracker DSA-5089-1) and related updates in Fedora/...

CVE-2022-1855

The CVE-2022-1855 entry corresponds to a memory misreference/use-after-free vulnerability in the Messaging component of Google Chrome, exploitable via a crafted HTML page to trigger heap corruption. Affected product: Google Chrome (Messaging component). Root cause: use-after-free causing memory m...

CVE-2022-2607

CVE-2022-2607 is a use-after-free in the Tab Strip of Google Chrome on Chrome OS, prior to 104.0.5112.79, permitting heap corruption via specific user interactions. The issue affects Chrome/Chromium components on ChromeOS according to the CVE entry; Debian advisory confirms a fix in 104.0.5112.79...

CVE-2022-3040

CVE-2022-3040 is a memory-safety issue in Google Chrome’s Layout component, described as a use-after-free leading to heap corruption on crafted HTML pages. Affected versions are Chrome prior to 105.0.5195.52. Connected sources confirm the issue and trace fixes in subsequent Chrome/Chromium update...

CVE-2023-0139

CVE-2023-0139 affects Google Chrome/Chromium on Windows prior to 109.0.5414.74. It stems from insufficient validation of untrusted input in the Downloads feature, enabling a remote attacker to bypass download restrictions via a crafted HTML page. The Chrome/Chromium 109.0.5414.74 update (and rela...

CVE-2023-3215

The CVE-2023-3215 vulnerability affects Google's Chromium-based WebRTC: a use-after-free in WebRTC can lead to heap corruption when processing crafted HTML pages. Exploitable in Chrome/Chromium prior to version 114.0.5735.133. Remediation is to upgrade to 114.0.5735.133 or newer (as reflected in ...

CVE-2025-0995

CVE-2025-0995 affects V8 in Google Chrome prior to 133.0.6943.98, with a use-after-free in heap handling on crafted HTML pages. The underlying issue is a heap corruption vulnerability in V8, allowing remote code execution potential as indicated by the high severity (CVSS 3.1: AV:N/AC:L/PR:N/UI:R/...

CVE-2026-13874

CVE-2026-13874 describes a race in DataTransfer in Google Chrome (Chromium) prior to version 150.0.7871.47 that could allow a remote attacker to read potentially sensitive information from a process’s memory via a crafted HTML page. The issue is a data race in the DataTransfer pathway, with a net...

CVE-2026-9113

CVE-2026-9113: Out-of-bounds memory read in the GPU of Google Chrome on macOS, prior to 148.0.7778.179. A remote attacker could exploit this via a crafted HTML page. The issue affects Chrome’s GPU path and is mitigated by updating to the patched version (148.0.7778.179). The vulnerability is desc...

CVE-2019-5760

CVE-2019-5760 affects Google Chrome’s WebRTC implementation. Insufficient pointer validation could lead to heap corruption via a crafted HTML page, enabling remote exploitation. The fix is available in Chrome updates from 72.0.3626.81 onward.

CVE-2020-16030

CVE-2020-16030 affects the Blink component in Chromium/Google Chrome prior to 87.0.4280.66. The issue is insufficient data validation in Blink, enabling a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. Publicly cited sources in the provided documents confirm C...

CVE-2020-16031

CVE-2020-16031 is a vulnerability in Chromium/Chrome related to the tab-Preview UI. Multiple connected sources (e.g., Arch Linux security advisory ASA-202011-11) describe it as a content spoofing issue in the tab preview component caused by an incorrect security UI, allowing a remote attacker to ...

CVE-2020-16036

CVE-2020-16036 : In Google Chrome/Chromium, an inappropriate implementation in cookies allowed a remote attacker to bypass cookie restrictions via a crafted HTML page. The vulnerability is tied to the cookies component and is classified as an access restriction bypass . Public fixes were released...

CVE-2020-6384

CVE-2020-6384 is a use-after-free in WebAudio of Google Chrome/Chromium prior to version 80.0.3987.116, potentially enabling heap corruption via a crafted HTML page. Connected advisories confirm this issue is fixed in later Chromium/Chrome updates (e.g., Chromium 80.0.3987.132 and newer, with Red...

CVE-2020-6473

CVE-2020-6473 is a Blink/WebKit policy-enforcement error in Google Chrome prior to 83.0.4103.61 that could allow a remote attacker to obtain potentially sensitive information from a process’s memory via a crafted HTML page. Documents from Debian and Arch Linux confirm the vulnerability in Chrome/...

CVE-2021-21114

CVE-2021-21114 affects the Chromium-based browser (Chromium/Google Chrome family) with an issue in the audio component prior to version 87.0.4280.141 . The root cause is described as a use-after-free leading to potential heap corruption when processing crafted HTML pages, enabling a remote attack...

CVE-2021-21169

CVE-2021-21169 is a real vulnerability: an out-of-bounds memory access in the V8 JavaScript engine used by Chromium/Chrome. Connected advisories confirm the issue affects Chromium before version 89.0.4389.72 and has been fixed in newer Chrome/Chromium releases. Debian Security Advisories and Arch...

CVE-2021-30562

CVE-2021-30562 describes a use-after-free in the WebSerial component of the Chromium browser engine before version 91.0.4472.164. The issue allows a remote attacker to potentially trigger heap corruption through a crafted HTML page, with the impact limited to the affected WebSerial path as docume...

CVE-2021-30597

CVE-2021-30597 is a use-after-free vulnerability in the Browser UI of the Chromium/Chrome stack prior to version 92.0.4515.131. The issue, located in the Browser UI component, enables a remote attacker to potentially trigger heap corruption and execute arbitrary code via crafted web content or in...

CVE-2022-0108

CVE-2022-0108 describes an iframe sandbox/navigation handling issue in WebKit-based components. Connected documents show concrete details across multiple products: Google Chrome before 97.0.4692.71: leakage of cross-origin data via crafted HTML navigation (Description: Inappropriate implementatio...

CVE-2022-1306

CVE-2022-1306 affects Chromium/Google Chrome via an inappropriate implementation in compositing prior to version 100.0.4896.88, enabling a remote attacker to spoof the Omnibox (URL bar) with a crafted HTML page. Public sources confirm the vulnerability in Chrome/Chromium and document that updates...

CVE-2022-2614

CVE-2022-2614 is a use-after-free in Google Chrome/Chromium’s Sign-In Flow that could allow heap corruption via a crafted HTML page, affecting Chrome versions before 104.0.5112.79. Multiple connected sources confirm the issue and reference a public fix in 104.0.5112.79 (and Debian’s DSA noting th...

CVE-2022-2622

CVE-2022-2622 affects Google Chrome on Windows (Safe Browsing component). The issue is “insufficient validation of untrusted input,” allowing a remote attacker to bypass download restrictions with a crafted file. Public documents corroborate the vulnerability and reference Chrome versions around ...

CVE-2023-1222

CVE-2023-1222: Heap buffer overflow in the Web Audio API of Google Chrome/Chromium before 111.0.5563.64 allows remote exploitation via a crafted HTML page, risking heap corruption. Affected: Chromium-based browsers; root cause is a heap buffer overflow in Web Audio API handling. Remediation: upgr...

CVE-2023-3728

CVE-2023-3728 is a use-after-free vulnerability in WebRTC components of Google Chrome/Chromium before version 115.0.5790.98. The issue, tied to heap corruption via a crafted HTML page, affects Chrome/Chromium WebRTC handling and has a high severity with potential for remote exploitation. The conn...

CVE-2026-14072

CVE-2026-14072 relates to an Inappropriate implementation in SplitView in Google Chrome prior to 150.0.7871.47, enabling UI spoofing via a crafted HTML page. The underlying issue is a SplitView implementation flaw; impact is UI spoofing with Low severity per the CVSS 3.1 metrics (AV:N/AC:L/PR:N/U...

CVE-2020-16041

CVE-2020-16041 affects Chromium-based Google Chrome before 87.0.4280.88. The issue is an out-of-bounds read in the networking component, enabling a remote attacker who has compromised the renderer process to potentially read memory from the process via a crafted HTML page. The vulnerability is do...

CVE-2020-6529

CVE-2020-6529 involves an inappropriate WebRTC implementation in Google Chrome versions prior to 84.0.4147.89. An attacker positioned on an privileged network could leak cross-origin data via a crafted HTML page. The CVE is tied to WebRTC data handling in Chrome, with a base impact characterized ...

CVE-2021-21107

CVE-2021-21107 is a Use-After-Free in the Chromium drag-and-drop path affecting Google Chrome/Chromium on Linux prior to 87.0.4280.141. The vulnerability could allow a remote attacker who compromises the renderer process to escape the sandbox via a crafted HTML page. Public advisories (Arch Linux...

CVE-2021-37971

CVE-2021-37971 affects Google Chrome up to 94.0.4606.54 where the Web Browser UI could be spoofed in the Omnibox via a crafted HTML page due to an incorrect security UI. The vulnerability allows a remote attacker to mislead users by altering the URL bar contents. The initial and connected documen...

CVE-2021-37974

CVE-2021-37974 affects Google Chrome's Safebrowsing component and is a use-after-free vulnerability that could allow a remote attacker who compromises the renderer process to cause heap corruption via a crafted HTML page. The issue is rooted in Safe Browsing handling prior to version 94.0.4606.71...

CVE-2023-1216

CVE-2023-1216 corresponds to a Use-After-Free in Chrome/Chromium DevTools (prior to 111.0.5563.64) that can allow a remote attacker to potentially exploit heap corruption via a crafted HTML page after social-engineering a user into direct UI interaction. The connected Astra Linux bulletin and Fed...

CVE-2023-2726

CVE-2023-2726 affects Google Chrome/Chromium prior to 113.0.5672.126, where an attacker could bypass the install dialog by convincing a user to install a malicious web app via a crafted HTML page. This is described as an Inappropriate implementation in WebApp Installs, with Chromium security seve...

CVE-2023-4355

CVE-2023-4355 affects Chromium-derived browsers (Google Chrome/Chromium) due to an out-of-bounds memory access in V8 that can lead to heap corruption via a crafted HTML page. The vulnerability is rated High severity (CVSS 3.1 base score 8.8) with network attack vector and user interaction require...