CVE-2020-16019

CVE-2020-16019 is an issue in the Chromium filesystem component described as an inappropriate implementation that allowed a remote attacker, who had already compromised the browser process, to bypass noexec restrictions via a malicious file. Connected sources confirm the vulnerability affects Chr...

CVE-2020-16028

CVE-2020-16028 is a heap-based buffer overflow in the WebRTC component of the Chromium browser before version 87.0.4280.66. A remote attacker could potentially exploit heap corruption via a crafted HTML page. Affected upstream is Chromium/Chrome; fixes were released in Chrome/Chromium 87.0.4280.6...

CVE-2020-16036

CVE-2020-16036 : In Google Chrome/Chromium, an inappropriate implementation in cookies allowed a remote attacker to bypass cookie restrictions via a crafted HTML page. The vulnerability is tied to the cookies component and is classified as an access restriction bypass . Public fixes were released...

CVE-2020-6473

CVE-2020-6473 is a Blink/WebKit policy-enforcement error in Google Chrome prior to 83.0.4103.61 that could allow a remote attacker to obtain potentially sensitive information from a process’s memory via a crafted HTML page. Documents from Debian and Arch Linux confirm the vulnerability in Chrome/...

CVE-2020-6569

CVE-2020-6569 is an integer overflow in WebUSB in Google Chrome/Chromium prior to 85.0.4183.83. The vulnerability could allow a remote attacker who has compromised the renderer process to potentially cause heap corruption via a crafted HTML page. Public advisories in the connected set (e.g., Debi...

CVE-2021-21114

CVE-2021-21114 affects the Chromium-based browser (Chromium/Google Chrome family) with an issue in the audio component prior to version 87.0.4280.141 . The root cause is described as a use-after-free leading to potential heap corruption when processing crafted HTML pages, enabling a remote attack...

CVE-2021-30596

CVE-2021-30596 is a Chromium-based browser vulnerability affecting Google Chrome/Chromium before version 92.0.4515.131. The issue is an incorrect security UI in the Navigation component that allows a remote attacker to spoof the Omnibox (URL bar) from a crafted HTML page. Public advisories (Arch ...

CVE-2022-0804

CVE-2022-0804 affects Google Chrome on Android (pre-99.0.4844.51). Root cause: Inappropriate Full screen implementation can let a crafted HTML page hide the Omnibox contents. Public sources confirm a fixed version 99.0.4844.51 in Debian (security tracker DSA-5089-1) and related updates in Fedora/...

CVE-2026-13950

CVE-2026-13950 affects Google Chrome (GPU component) with an uninitialized use in GPU that could allow a remote attacker who already compromised the renderer process to read potentially sensitive data from process memory via a crafted HTML page. Affected version range is Chrome before 150.0.7871....

CVE-2026-14127

CVE-2026-14127 involves an inappropriate implementation in Chrome’s printing flow prior to 150.0.7871.47. A remote attacker who already had code execution in the renderer could trigger UI spoofing via a crafted HTML page. Affected product is Google Chrome (Chromium-based); impact described as low...

CVE-2020-15977

The CVE entry CVE-2020-15977 describes an insufficient data validation issue in the dialogs component of the Chromium browser prior to 86.0.4240.75, enabling a remote attacker to potentially disclose data from disk via a crafted HTML page. Connected advisories (e.g., Arch Linux ASA-202010-1) enum...

CVE-2020-16001

CVE-2020-16001 is a use-after-free vulnerability in Chrome’s media component (video/multimedia stack) that could allow remote code execution via a crafted HTML page. It was fixed in the Chromium/Chrome stable channel with version 86.0.4240.111. The associated advisory notes this as a high-severit...

CVE-2020-16030

CVE-2020-16030 affects the Blink component in Chromium/Google Chrome prior to 87.0.4280.66. The issue is insufficient data validation in Blink, enabling a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. Publicly cited sources in the provided documents confirm C...

CVE-2020-16031

CVE-2020-16031 is a vulnerability in Chromium/Chrome related to the tab-Preview UI. Multiple connected sources (e.g., Arch Linux security advisory ASA-202011-11) describe it as a content spoofing issue in the tab preview component caused by an incorrect security UI, allowing a remote attacker to ...

CVE-2020-16038

CVE-2020-16038 refers to a use-after-free in the media component of Chromium/Google Chrome (pre-87.0.4280.88). The vulnerability could allow a remote attacker to achieve arbitrary code execution via a crafted HTML page, potentially leading to heap corruption. Public advisories from Debian, Arch L...

CVE-2020-6529

CVE-2020-6529 involves an inappropriate WebRTC implementation in Google Chrome versions prior to 84.0.4147.89. An attacker positioned on an privileged network could leak cross-origin data via a crafted HTML page. The CVE is tied to WebRTC data handling in Chrome, with a base impact characterized ...

CVE-2021-30562

CVE-2021-30562 describes a use-after-free in the WebSerial component of the Chromium browser engine before version 91.0.4472.164. The issue allows a remote attacker to potentially trigger heap corruption through a crafted HTML page, with the impact limited to the affected WebSerial path as docume...

CVE-2021-30597

CVE-2021-30597 is a use-after-free vulnerability in the Browser UI of the Chromium/Chrome stack prior to version 92.0.4515.131. The issue, located in the Browser UI component, enables a remote attacker to potentially trigger heap corruption and execute arbitrary code via crafted web content or in...

CVE-2021-37971

CVE-2021-37971 affects Google Chrome up to 94.0.4606.54 where the Web Browser UI could be spoofed in the Omnibox via a crafted HTML page due to an incorrect security UI. The vulnerability allows a remote attacker to mislead users by altering the URL bar contents. The initial and connected documen...

CVE-2022-1306

CVE-2022-1306 affects Chromium/Google Chrome via an inappropriate implementation in compositing prior to version 100.0.4896.88, enabling a remote attacker to spoof the Omnibox (URL bar) with a crafted HTML page. Public sources confirm the vulnerability in Chrome/Chromium and document that updates...

CVE-2022-3040

CVE-2022-3040 is a memory-safety issue in Google Chrome’s Layout component, described as a use-after-free leading to heap corruption on crafted HTML pages. Affected versions are Chrome prior to 105.0.5195.52. Connected sources confirm the issue and trace fixes in subsequent Chrome/Chromium update...

CVE-2023-2459

CVE-2023-2459 affects Chromium-based browsers (Google Chrome/Chromium). The vulnerability is an inappropriate implementation in Prompts that allows a remote attacker to bypass permission restrictions through a crafted HTML page. Severity is described as Medium. Technical details across connected ...

CVE-2023-6508

CVE-2023-6508 describes a use-after-free in Media Stream of Chromium-based browsers (Google Chrome) that could allow remote heap corruption via a crafted HTML page. Public details in the connected sources confirm affected products are Google Chrome/Chromium, with the issue triggered by Media Stre...

CVE-2026-13874

CVE-2026-13874 describes a race in DataTransfer in Google Chrome (Chromium) prior to version 150.0.7871.47 that could allow a remote attacker to read potentially sensitive information from a process’s memory via a crafted HTML page. The issue is a data race in the DataTransfer pathway, with a net...

CVE-2026-9113

CVE-2026-9113: Out-of-bounds memory read in the GPU of Google Chrome on macOS, prior to 148.0.7778.179. A remote attacker could exploit this via a crafted HTML page. The issue affects Chrome’s GPU path and is mitigated by updating to the patched version (148.0.7778.179). The vulnerability is desc...

CVE-2019-5760

CVE-2019-5760 affects Google Chrome’s WebRTC implementation. Insufficient pointer validation could lead to heap corruption via a crafted HTML page, enabling remote exploitation. The fix is available in Chrome updates from 72.0.3626.81 onward.

CVE-2020-6391

CVE-2020-6391 concerns Blink in Google Chrome. The vulnerability arises from insufficient validation of untrusted input in Blink, allowing a local attacker to bypass Content Security Policy via a specially crafted HTML page on Chrome versions prior to 80.0.3987.87. Affected product: Google Chrome...

CVE-2020-6480

CVE-2020-6480 is documented as an access restriction bypass in Chromium/Google Chrome’s enterprise component, caused by insufficient policy enforcement. The Arch Linux ASA-202005-12 details multiple issues with chromium before 83.0.4103.61-1, including the CVE-2020-6480 bypass of navigation restr...

CVE-2021-21169

CVE-2021-21169 is a real vulnerability: an out-of-bounds memory access in the V8 JavaScript engine used by Chromium/Chrome. Connected advisories confirm the issue affects Chromium before version 89.0.4389.72 and has been fixed in newer Chrome/Chromium releases. Debian Security Advisories and Arch...

CVE-2021-37974

CVE-2021-37974 affects Google Chrome's Safebrowsing component and is a use-after-free vulnerability that could allow a remote attacker who compromises the renderer process to cause heap corruption via a crafted HTML page. The issue is rooted in Safe Browsing handling prior to version 94.0.4606.71...

CVE-2021-37984

CVE-2021-37984: A heap buffer overflow in PDFium within Chromium/Chrome (before 95.0.4638.54). Affected: Google Chrome and Chromium-based browsers; vulnerability arises from PDFium aging, enabling potential remote heap corruption via crafted HTML. Remediation: update to Chrome/Chromium 95.0.4638....

CVE-2022-0108

CVE-2022-0108 describes an iframe sandbox/navigation handling issue in WebKit-based components. Connected documents show concrete details across multiple products: Google Chrome before 97.0.4692.71: leakage of cross-origin data via crafted HTML navigation (Description: Inappropriate implementatio...

CVE-2022-1127

CVE-2022-1127 concerns Google Chrome prior to version 100.0.4896.60, with a use-after-free in the QR Code Generator that could allow a remote attacker, after convincing a user to perform specific interactions, to potentially exploit heap corruption. The issue is tied to Chrome’s QR Code Generator...

CVE-2022-2614

CVE-2022-2614 is a use-after-free in Google Chrome/Chromium’s Sign-In Flow that could allow heap corruption via a crafted HTML page, affecting Chrome versions before 104.0.5112.79. Multiple connected sources confirm the issue and reference a public fix in 104.0.5112.79 (and Debian’s DSA noting th...

CVE-2023-2726

CVE-2023-2726 affects Google Chrome/Chromium prior to 113.0.5672.126, where an attacker could bypass the install dialog by convincing a user to install a malicious web app via a crafted HTML page. This is described as an Inappropriate implementation in WebApp Installs, with Chromium security seve...

CVE-2023-3215

The CVE-2023-3215 vulnerability affects Google's Chromium-based WebRTC: a use-after-free in WebRTC can lead to heap corruption when processing crafted HTML pages. Exploitable in Chrome/Chromium prior to version 114.0.5735.133. Remediation is to upgrade to 114.0.5735.133 or newer (as reflected in ...

CVE-2026-13865

CVE-2026-13865 : The connected records confirm an issue in Google Chrome/Chromium where insufficient validation of untrusted input in the browser UI allows a remote attacker to spoof the UI via a crafted HTML page. Affected component is the browser UI handling, with the root cause described as in...

CVE-2026-19170

CVE-2026-19170 involves a use-after-free in WebGL within Google Chrome on Android, allowing potential sandbox escape via a crafted HTML page. Affected software is Google Chrome (Android) with WebGL as the vulnerable component; root cause details are described in the CVE description. The vulnerabi...

CVE-2020-15978

CVE-2020-15978 affects Chromium/Google Chrome navigation in the renderer on Android before 86.0.4240.75. The issue is described as insufficient data validation in the navigation component, allowing a compromised renderer to bypass navigation restrictions via a crafted HTML page. Connected sources...

CVE-2020-16041

CVE-2020-16041 affects Chromium-based Google Chrome before 87.0.4280.88. The issue is an out-of-bounds read in the networking component, enabling a remote attacker who has compromised the renderer process to potentially read memory from the process via a crafted HTML page. The vulnerability is do...

CVE-2020-6384

CVE-2020-6384 is a use-after-free in WebAudio of Google Chrome/Chromium prior to version 80.0.3987.116, potentially enabling heap corruption via a crafted HTML page. Connected advisories confirm this issue is fixed in later Chromium/Chrome updates (e.g., Chromium 80.0.3987.132 and newer, with Red...

CVE-2020-6531

CVE-2020-6531 describes a side-channel information leakage in Chrome/Chromium’s Scroll to Text feature. A crafted HTML page could allow a remote attacker to leak cross-origin data. Public details indicate the issue affects Chrome/Chromium versions prior to 84.0.4147.89, with Debian noting a fix i...

CVE-2021-21107

CVE-2021-21107 is a Use-After-Free in the Chromium drag-and-drop path affecting Google Chrome/Chromium on Linux prior to 87.0.4280.141. The vulnerability could allow a remote attacker who compromises the renderer process to escape the sandbox via a crafted HTML page. Public advisories (Arch Linux...

CVE-2021-30604

CVE-2021-30604 corresponds to a use-after-free in ANGLE used by Google Chrome (Chromium). The vulnerability is described as enabling a remote attacker to potentially trigger heap corruption via a crafted HTML page in Chrome prior to 92.0.4515.159. Connected sources corroborate the same "Use after...

CVE-2021-30627

CVE-2021-30627 describes a type confusion in Blink layout in Google Chrome prior to 93.0.4577.82, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. The connected documents identify the same description across multiple sources (Astra Linux security...

CVE-2022-2622

CVE-2022-2622 affects Google Chrome on Windows (Safe Browsing component). The issue is “insufficient validation of untrusted input,” allowing a remote attacker to bypass download restrictions with a crafted file. Public documents corroborate the vulnerability and reference Chrome versions around ...

CVE-2023-1216

CVE-2023-1216 corresponds to a Use-After-Free in Chrome/Chromium DevTools (prior to 111.0.5563.64) that can allow a remote attacker to potentially exploit heap corruption via a crafted HTML page after social-engineering a user into direct UI interaction. The connected Astra Linux bulletin and Fed...

CVE-2023-1222

CVE-2023-1222: Heap buffer overflow in the Web Audio API of Google Chrome/Chromium before 111.0.5563.64 allows remote exploitation via a crafted HTML page, risking heap corruption. Affected: Chromium-based browsers; root cause is a heap buffer overflow in Web Audio API handling. Remediation: upgr...

CVE-2026-14072

CVE-2026-14072 relates to an Inappropriate implementation in SplitView in Google Chrome prior to 150.0.7871.47, enabling UI spoofing via a crafted HTML page. The underlying issue is a SplitView implementation flaw; impact is UI spoofing with Low severity per the CVSS 3.1 metrics (AV:N/AC:L/PR:N/U...

CVE-2026-14130

CVE-2026-14130 concerns a security UI issue in Chrome’s Omnibox. A remote attacker could trigger UI spoofing by serving a crafted HTML page, affecting Chrome builds prior to 150.0.7871.47. The CVE’s sources (NVD, Debian OSV, EUVD/ENISA, CVE list, etc.) consistently describe an incorrect security ...