CVE-2020-6384

CVE-2020-6384 is a use-after-free in WebAudio of Google Chrome/Chromium prior to version 80.0.3987.116, potentially enabling heap corruption via a crafted HTML page. Connected advisories confirm this issue is fixed in later Chromium/Chrome updates (e.g., Chromium 80.0.3987.132 and newer, with Red...

CVE-2020-6449

CVE-2020-6449 is a use-after-free vulnerability in the audio component of Google Chrome prior to 80.0.3987.149. The issue could allow a remote attacker to cause heap corruption via a crafted HTML page. Documents confirm the affected product is Google Chrome/Chromium and that the fix was applied i...

CVE-2020-6568

CVE-2020-6568 affects Google Chrome on Android prior to 85.0.4183.83, where insufficient policy enforcement in the intent handling could allow a remote attacker to bypass navigation restrictions via a crafted HTML page. The issue is tied to Chrome/Chromium ecosystem; Debian/Fedora advisories refe...

CVE-2021-21108

CVE-2021-21108 is a use-after-free in the Chromium media component prior to version 87.0.4280.141. The flaw could allow a remote attacker who already compromised the renderer process to potentially escape the sandbox via a crafted HTML page. Impact is described as enabling arbitrary code executio...

CVE-2021-21115

CVE-2021-21115 : In Google Chrome before 87.0.4280.141, a use-after-free in the Safe Browsing component could allow a renderer-compromised remote attacker to escape the sandbox via a crafted HTML page. This is confirmed in connected advisories (e.g., Arch Linux ASA-202101-6) referencing Chromium ...

CVE-2021-21139

CVE-2021-21139 : In Chromium/Google Chrome, an incorrect implementation in the iframe sandbox allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Affected: Chromium/Chrome before 88.0.4324.96. Impact: potential navigation bypass; remote exploitation risk is descri...

CVE-2022-2616

CVE-2022-2616 affects Google Chrome prior to 104.0.5112.79 due to an inappropriate Extension API implementation that allowed a user tricked into installing a malicious extension to spoof the Omnibox. The issue is tied to Extensions API handling and could enable spoofing of the URL bar content. De...

CVE-2022-4185

CVE-2022-4185 affects Google Chrome on iOS prior to 108.0.5359.71. The issue is an Inappropriate implementation in Navigation that allows a remote attacker to spoof the contents of a modal dialogue via a crafted HTML page. Impact is spoofing of modal content; no exploitation details are provided ...

CVE-2023-3728

CVE-2023-3728 is a use-after-free vulnerability in WebRTC components of Google Chrome/Chromium before version 115.0.5790.98. The issue, tied to heap corruption via a crafted HTML page, affects Chrome/Chromium WebRTC handling and has a high severity with potential for remote exploitation. The conn...

CVE-2023-4355

CVE-2023-4355 affects Chromium-derived browsers (Google Chrome/Chromium) due to an out-of-bounds memory access in V8 that can lead to heap corruption via a crafted HTML page. The vulnerability is rated High severity (CVSS 3.1 base score 8.8) with network attack vector and user interaction require...

CVE-2025-0995

CVE-2025-0995 affects V8 in Google Chrome prior to 133.0.6943.98, with a use-after-free in heap handling on crafted HTML pages. The underlying issue is a heap corruption vulnerability in V8, allowing remote code execution potential as indicated by the high severity (CVSS 3.1: AV:N/AC:L/PR:N/UI:R/...

CVE-2026-5906

CVE-2026-5906 affects Google Chrome/Chromium on Android, where an incorrect Omnibox security UI could allow spoofing of the URL bar via a crafted HTML page. The issue is tied to Chromium’s Omnibox handling and is described as Low severity (CVSS ~4.3). Remediation appears to be upgrading to Chromi...

CVE-2020-16007

CVE-2020-16007 is a vulnerability in the Chromium/Google Chrome installer: insufficient data validation in the installer can allow a local attacker to elevate privileges via a crafted filesystem. Public advisories indicate the fix was shipped in Chrome/Chromium around version 86.0.4240.183 (with ...

CVE-2020-16024

CVE-2020-16024 refers to a heap-based buffer overflow in the Chromium UI component (Chromium/Chrome before 87.0.4280.66) that could be triggered by a crafted HTML page, potentially enabling arbitrary code execution and sandbox escape if a renderer process is compromised. Public references confirm...

CVE-2020-16033

CVE-2020-16033 affects Chromium/Google Chrome WebUSB. The issue is an inappropriate WebUSB implementation that enables content spoofing of the security UI via a crafted HTML page, allowing a remote attacker to trick users. Affected: Chromium/Chrome prior to 87.0.4280.66 (WebUSB component). Impact...

CVE-2020-6474

CVE-2020-6474 is a use-after-free in Blink/WebKit within Chromium/Google Chrome before version 83.0.4103.61. The issue can allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. Affected component is Blink/WebKit (Chromium-based browsers). The connected sources co...

CVE-2020-6566

CVE-2020-6566 affects Google Chrome/Chromium prior to 85.0.4183.83, where insufficient policy enforcement in media could allow a remote attacker to leak cross-origin data via a crafted HTML page. The issue is evidenced in multiple advisories and CVE trackers, with Debian/ Fedora updates indicatin...

CVE-2021-30592

CVE-2021-30592 is an out-of-bounds write in the Tab Groups component of the Chromium browser engine, fixed in Chromium 92.0.4515.131+. The initial CVE description notes an out-of-bounds write via a crafted HTML page when a user is convinced to install a malicious extension. Connected advisories f...

CVE-2021-30593

CVE-2021-30593 corresponds to an out-of-bounds read in the Chromium-based Tab Strip component (Chrome/Chromium) before version 92.0.4515.131. The vulnerability allows a remote attacker to cause memory read access via a crafted HTML page and a user-wurnished extension, with impact described as inf...

CVE-2021-37972

CVE-2021-37972 relates to an out-of-bounds read in libjpeg-turbo used by Google Chrome (Chromium) before 94.0.4606.54, enabling a remote attacker to potentially trigger heap corruption via a crafted HTML page. Affected product is Chrome/Chromium with libjpeg-turbo integration; root cause is a mem...

CVE-2022-2607

CVE-2022-2607 is a use-after-free in the Tab Strip of Google Chrome on Chrome OS, prior to 104.0.5112.79, permitting heap corruption via specific user interactions. The issue affects Chrome/Chromium components on ChromeOS according to the CVE entry; Debian advisory confirms a fix in 104.0.5112.79...

CVE-2022-2611

CVE-2022-2611 : Concrete details across connected sources show an issue in the Fullscreen API in Google Chrome/Chromium where, on Android prior to 104.0.5112.79, a crafted HTML page can cause the Omnibox (URL bar) to be spoofed by a remote attacker. The affected software is Google Chrome (Android...

CVE-2023-2935

CVE-2023-2935 involves a type confusion in Chrome/Chromium’s V8 engine that could allow a remote attacker to trigger heap corruption via a crafted HTML page. Affected: Google Chrome (Chromium-based) prior to 114.0.5735.90. Impact is rated high (C/H/I/A all). Remediation in provided documents poin...

CVE-2023-3216

CVE-2023-3216: Type confusion in V8/Chromium’s JavaScript engine causes heap corruption via a crafted HTML page, affecting Google Chrome pre-114.0.5735.133. The issue is documented across multiple feeds (Chromium/V8 type confusion with high impact). Affected software is Google Chrome/Chromium bro...

CVE-2024-2628

CVE-2024-2628: Google Chrome/Chromium downloads UI can be spoofed due to an inappropriate implementation in the Downloads flow. This allowed remote attackers to induce UI spoofing via a crafted URL (Impact: Medium as per CVSS). Affected software is Chromium-based (Chrome/Chromium) prior to versio...

CVE-2026-13952

CVE-2026-13952 describes an inappropriate implementation in Chrome's PerformanceAPIs prior to 150.0.7871.47, allowing a remote attacker to leak cross-origin data through a crafted HTML page. The issue affects Google Chrome (Chromium-based). The vulnerability’s root cause is an insecure data expos...

CVE-2026-14020

CVE-2026-14020 affects Google Chrome WebXR prior to 150.0.7871.47. The root cause is insufficient validation of untrusted input in WebXR, allowing a remote attacker who has compromised the renderer process to perform UI spoofing via a crafted HTML page. Impact is UI spoofing with medium severity ...

CVE-2019-5850

CVE-2019-5850 affects Chromium/Google Chrome’s offline page fetcher. A use-after-free in the offline page fetcher before version 76.0.3809.87 could allow a remote attacker with a compromised renderer to potentially escape the sandbox via a crafted HTML page. Affected product/component: Chromium’s...

CVE-2020-16014

CVE-2020-16014 is a use-after-free in the PPAPI component of Chromium/Google Chrome, affecting Chrome/Chromium before 87.0.4280.66 (as noted by Debian/Gentoo/Arch/Fedora advisories). The advisory set indicates that a renderer-compromised remote attacker could potentially escape the sandbox via a ...

CVE-2020-16026

CVE-2020-16026 is a use-after-free vulnerability in the WebRTC component of Chromium/Google Chrome prior to 87.0.4280.66. Evidence from multiple sources confirms it affects Chrome/Chromium and was addressed in Chrome 87 (and Chromium 87.0.4280.66+) with upstream fixes. Debian security tracker not...

CVE-2021-21134

CVE-2021-21134 is a Chromium/Chrome Page Info UI security issue reported as content spoofing. Affected software: Chromium/Chrome prior to version 88.0.4324.96. Root cause: incorrect security UI handling in Page Info allowed a remote attacker to spoof security UI via a crafted page. Impact stateme...

CVE-2021-37968

The CVE-2021-37968 entry describes an insecure implementation in the Background Fetch API in Google Chrome, leading to potential cross-origin data leakage via a crafted HTML page. Affected software: Google Chrome (Background Fetch API); root cause: improper handling in the API implementation; imp...

CVE-2022-3653

CVE-2022-3653 is a Chrome/Chromium vulnerability: a heap buffer overflow in Vulkan that could be triggered by a crafted HTML page, impacting Google Chrome prior to 107.0.5304.62. The issue affects Chromium’s Vulkan path and was addressed in the Chrome 107 stable update (Windows: 107.0.5304.62/63;...

CVE-2023-4368

CVE-2023-4368 : In Google Chrome/Chromium, insufficient policy enforcement in the Extensions API prior to 116.0.5845.96 allowed a user-wacched to install a malicious extension to bypass an enterprise policy via a crafted HTML page. The issue is described as a Medium severity in the Chromium advis...

CVE-2024-2885

Chromium-based Dawn use-after-free in Google Chrome before 123.0.6312.86 can allow a remote attacker to trigger heap corruption via a crafted HTML page. Affected component: Dawn in Chrome/Chromium. Root cause: use-after-free in Dawn logic. Impact: high (confidentiality, integrity, availability). ...

CVE-2026-13947

CVE-2026-13947 concerns Google Chrome’s XR handling. The vulnerability is described as an uninitialized use in XR that affects Chrome prior to version 150.0.7871.47 . A remote attacker who had already compromised the renderer process could potentially read sensitive information from the process m...

CVE-2026-14116

The vulnerability CVE-2026-14116 affects Google Chrome DevTools. The root cause is insufficient validation of untrusted input in DevTools, allowing a remote attacker to leak cross-origin data through a crafted HTML page when a user is guided to perform specific UI gestures. Impact is cross-origin...

CVE-2026-15901

CVE-2026-15901 is a Use-After-Free in the Network component of Google Chrome/Chromium prior to 150.0.7871.128, enabling a remote attacker to potentially exploit heap corruption via a crafted HTML page. The issue affects Chrome/Chromium’s network handling and is rated with CRITICAL impact; remedia...

CVE-2019-13675

CVE-2019-13675 affects Google Chrome/Chromium: insufficient data validation in the extensions subsystem allows a remote attacker to disable extensions via a crafted HTML page. Publicly cited in Debian/Fedora advisories, with fixes implemented in Chromium/Chrome 78.x (as seen in Fedora/security ad...

CVE-2019-13755

CVE-2019-13755 : Google Chrome prior to 79.0.3945.79 suffers from insufficient policy enforcement in extensions, allowing a remote attacker to disable extensions via a crafted HTML page. Connected sources confirm this is a Chrome-extension policy issue, with public fixes in 79.0.3945.79 and later...

CVE-2020-16025

CVE-2020-16025 affects Google Chrome/Chromium before 87.0.4280.66. Description: a heap-based buffer overflow in the clipboard component could be triggered by a crafted HTML page, potentially enabling code execution and sandbox escape if the renderer process is compromised. Impact scope is limited...

CVE-2020-6402

CVE-2020-6402 affects Google Chrome on macOS (OS X) prior to 80.0.3987.87, where Insufficient policy enforcement in downloads could let a user who installed a crafted Chrome Extension execute arbitrary code. The root cause is a policy enforcement flaw in the Downloads component, enabling code exe...

CVE-2020-6528

CVE-2020-6528 affects Google Chrome/iOS with a vulnerability in basic authentication that allowed spoofing the Omnibox. The issue is fixed in Chrome 84.0.4147.89 (stable channel); update to that release or newer. Other connected advisories confirm a fix in the corresponding Chromium/Chrome releas...

CVE-2022-2861

CVE-2022-2861 affects Google Chrome prior to 104.0.5112.101. An improper implementation in the Extensions API allows an attacker who persuades a user to install a malicious extension to inject arbitrary scripts into WebUI via a crafted HTML page, enabling likely impact described as an arbitrary s...

CVE-2022-3445

CVE-2022-3445: Use-after-free in Skia within Google Chrome prior to 106.0.5249.119 allows remote exploitation via a crafted HTML page, enabling heap corruption (severity High). A Chrome stable update to 106.0.5249.119 addresses this vulnerability; systems should upgrade to this build to remediate...

CVE-2022-4182

CVE-2022-4182 concerns Google Chrome’s Fenced Frames implementation. Affected software: Google Chrome (Chromium-based) prior to version 108.0.5359.71. Root cause: Inappropriate implementation of Fenced Frames allowed a remote attacker to bypass fenced frame restrictions via a crafted HTML page. I...

CVE-2023-1814

CVE-2023-1814 affects Google Chrome/Chromium: insufficient validation of untrusted input in Safe Browsing allows bypassing download checking via a crafted HTML page. Public advisories note this as a Chrome/Chromium vulnerability; fixes were released in Chrome/Chromium 112.0.5615.49 (and related p...

CVE-2023-2931

CVE-2023-2931 : A use-after-free in the PDF handling code of Google Chrome/Chromium allows a remote attacker to potentially cause heap corruption and execute arbitrary code via a crafted PDF file. Affected components include the PDF component of Chrome/Chromium before version 114.0.5735.90. The C...

CVE-2023-4351

CVE-2023-4351 is a use-after-free in Chromium/Google Chrome networking path exploited via a crafted HTML page, allowing remote heap corruption. The issue affects Google Chrome before version 116.0.5845.96 and is classed with High severity. Multiple connected advisories (e.g., Debian DSA-5479, Gen...

CVE-2020-16023

CVE-2020-16023 affects Chromium/WebCodecs prior to 87.0.4280.66. The underlying issue is a use-after-free in the WebCodecs component, which could allow remote code execution via a crafted page. Public entries confirm the vulnerability as arbitrary code execution in WebCodecs, with Debian noting t...