CVE-2020-6528

CVE-2020-6528 affects Google Chrome/iOS with a vulnerability in basic authentication that allowed spoofing the Omnibox. The issue is fixed in Chrome 84.0.4147.89 (stable channel); update to that release or newer. Other connected advisories confirm a fix in the corresponding Chromium/Chrome releas...

CVE-2020-6566

CVE-2020-6566 affects Google Chrome/Chromium prior to 85.0.4183.83, where insufficient policy enforcement in media could allow a remote attacker to leak cross-origin data via a crafted HTML page. The issue is evidenced in multiple advisories and CVE trackers, with Debian/ Fedora updates indicatin...

CVE-2021-21115

CVE-2021-21115 : In Google Chrome before 87.0.4280.141, a use-after-free in the Safe Browsing component could allow a renderer-compromised remote attacker to escape the sandbox via a crafted HTML page. This is confirmed in connected advisories (e.g., Arch Linux ASA-202101-6) referencing Chromium ...

CVE-2021-21134

CVE-2021-21134 is a Chromium/Chrome Page Info UI security issue reported as content spoofing. Affected software: Chromium/Chrome prior to version 88.0.4324.96. Root cause: incorrect security UI handling in Page Info allowed a remote attacker to spoof security UI via a crafted page. Impact stateme...

CVE-2023-3215

The CVE-2023-3215 vulnerability affects Google's Chromium-based WebRTC: a use-after-free in WebRTC can lead to heap corruption when processing crafted HTML pages. Exploitable in Chrome/Chromium prior to version 114.0.5735.133. Remediation is to upgrade to 114.0.5735.133 or newer (as reflected in ...

CVE-2018-17481

CVE-2018-17481 describes a use-after-free in PDFium used by Google Chrome before 71.0.3578.98, enabling potential heap corruption via a crafted PDF file. Affected software/components: Google Chrome and the PDFium library. Impact per sources: remote attacker could exploit heap corruption; Chrome’s...

CVE-2020-16021

CVE-2020-16021 describes a race condition in the ImageBurner component of Chromium/Google Chrome prior to 87.0.4280.66 (ChromeOS context). If a attacker could compromise the browser process and trigger handling of a malicious file, it could lead to OS‑level privilege escalation. Public mentions i...

CVE-2020-16023

CVE-2020-16023 affects Chromium/WebCodecs prior to 87.0.4280.66. The underlying issue is a use-after-free in the WebCodecs component, which could allow remote code execution via a crafted page. Public entries confirm the vulnerability as arbitrary code execution in WebCodecs, with Debian noting t...

CVE-2020-16034

CVE-2020-16034 affects Google Chrome (Chromium/WebRTC component) and was caused by an inappropriate implementation in WebRTC prior to Chrome 87.0.4280.66. This allowed a local attacker to bypass policy restrictions via a crafted HTML page, potentially enabling UI/policy circumvention. Public advi...

CVE-2020-6402

CVE-2020-6402 affects Google Chrome on macOS (OS X) prior to 80.0.3987.87, where Insufficient policy enforcement in downloads could let a user who installed a crafted Chrome Extension execute arbitrary code. The root cause is a policy enforcement flaw in the Downloads component, enabling code exe...

CVE-2020-6460

CVE-2020-6460 concerns insufficient data validation in URL formatting in Chromium/Google Chrome prior to 81.0.4044.122, enabling domain spoofing via crafted domain names. Connected advisories show downstream fixes and versions: Debian/DSA-4714-1 notes Chromium updates around 83.0.4103.116 for sta...

CVE-2020-6472

CVE-2020-6472 affects Chromium-based browsers (e.g., Chrome/Chromium) through the developer tools policy enforcement component. Affected version lineage is before 83.0.4103.61, per multiple advisories. The vulnerability is a policy enforcement error in the developer tools that could allow an atta...

CVE-2021-30592

CVE-2021-30592 is an out-of-bounds write in the Tab Groups component of the Chromium browser engine, fixed in Chromium 92.0.4515.131+. The initial CVE description notes an out-of-bounds write via a crafted HTML page when a user is convinced to install a malicious extension. Connected advisories f...

CVE-2022-3445

CVE-2022-3445: Use-after-free in Skia within Google Chrome prior to 106.0.5249.119 allows remote exploitation via a crafted HTML page, enabling heap corruption (severity High). A Chrome stable update to 106.0.5249.119 addresses this vulnerability; systems should upgrade to this build to remediate...

CVE-2026-14063

The CVE-2026-14063 entry describes an out-of-bounds read in Chromecast within Google Chrome prior to 150.0.7871.47. The issue allows a local attacker to obtain potentially sensitive information from process memory via malicious network traffic. The documented impact is information disclosure with...

CVE-2026-14072

CVE-2026-14072 relates to an Inappropriate implementation in SplitView in Google Chrome prior to 150.0.7871.47, enabling UI spoofing via a crafted HTML page. The underlying issue is a SplitView implementation flaw; impact is UI spoofing with Low severity per the CVSS 3.1 metrics (AV:N/AC:L/PR:N/U...

CVE-2026-9113

CVE-2026-9113: Out-of-bounds memory read in the GPU of Google Chrome on macOS, prior to 148.0.7778.179. A remote attacker could exploit this via a crafted HTML page. The issue affects Chrome’s GPU path and is mitigated by updating to the patched version (148.0.7778.179). The vulnerability is desc...

CVE-2020-16018

CVE-2020-16018 is a use-after-free in the payments component of Chromium/Google Chrome prior to 87.0.4280.66. Connected sources confirm exploitation can lead to arbitrary code execution and sandbox escape when a renderer process is compromised. Public fix status across distributions varies: upstr...

CVE-2021-37967

CVE-2021-37967 describes an insecure implementation in the Background Fetch API in Google Chrome/Chromium, where a remote attacker who had already compromised the renderer process could leak cross-origin data via a crafted HTML page. The issue affects Chrome/Chromium prior to version 94.0.4606.54...

CVE-2022-4182

CVE-2022-4182 concerns Google Chrome’s Fenced Frames implementation. Affected software: Google Chrome (Chromium-based) prior to version 108.0.5359.71. Root cause: Inappropriate implementation of Fenced Frames allowed a remote attacker to bypass fenced frame restrictions via a crafted HTML page. I...

CVE-2023-2931

CVE-2023-2931 : A use-after-free in the PDF handling code of Google Chrome/Chromium allows a remote attacker to potentially cause heap corruption and execute arbitrary code via a crafted PDF file. Affected components include the PDF component of Chrome/Chromium before version 114.0.5735.90. The C...

CVE-2023-4351

CVE-2023-4351 is a use-after-free in Chromium/Google Chrome networking path exploited via a crafted HTML page, allowing remote heap corruption. The issue affects Google Chrome before version 116.0.5845.96 and is classed with High severity. Multiple connected advisories (e.g., Debian DSA-5479, Gen...

CVE-2023-4355

CVE-2023-4355 affects Chromium-derived browsers (Google Chrome/Chromium) due to an out-of-bounds memory access in V8 that can lead to heap corruption via a crafted HTML page. The vulnerability is rated High severity (CVSS 3.1 base score 8.8) with network attack vector and user interaction require...

CVE-2023-4368

CVE-2023-4368 : In Google Chrome/Chromium, insufficient policy enforcement in the Extensions API prior to 116.0.5845.96 allowed a user-wacched to install a malicious extension to bypass an enterprise policy via a crafted HTML page. The issue is described as a Medium severity in the Chromium advis...

CVE-2019-13681

CVE-2019-13681 affects Google Chrome prior to 77.0.3865.75, where insufficient data validation in downloads could let a remote attacker bypass download restrictions via a crafted HTML page. The issue is documented with a vulnerability description and CVSS scores; connected sources indicate Chrome...

CVE-2020-15983

CVE-2020-15983 affects the Chromium browser’s webUI component and is tied to insufficient data validation before version 86.0.4240.75 (ChromeOS) that could allow a local attacker to bypass content security policy with a crafted HTML page. Public advisories and vendor notes show fixes in the 86.0....

CVE-2021-21143

CVE-2021-21143 is a heap buffer overflow in the Chromium browser’s Extensions component, fixed in versions before 88.0.4324.146. The incident description from multiple sources indicates an attacker could exploit this via a crafted extension to achieve arbitrary code execution. Public references i...

CVE-2021-37992

CVE-2021-37992 affects the WebAudio component of Chromium/Google Chrome, with an out-of-bounds read that could enable a remote attacker to cause heap corruption via a crafted HTML page. Affected product: Chromium/Chrome prior to 95.0.4638.54. Mitigation: upgrade to Chromium 95.0.4638.54 or newer ...

CVE-2022-2609

CVE-2022-2609 describes a use-after-free in Nearby Share on Chrome OS Chrome/Chromium prior to 104.0.5112.79, allowing heap corruption via specific UI interactions after user engagement. Affected component: Nearby Share workflow in Chromium-based Chrome OS. Root cause: use-after-free leading to p...

CVE-2022-3040

CVE-2022-3040 is a memory-safety issue in Google Chrome’s Layout component, described as a use-after-free leading to heap corruption on crafted HTML pages. Affected versions are Chrome prior to 105.0.5195.52. Connected sources confirm the issue and trace fixes in subsequent Chrome/Chromium update...

CVE-2023-1225

CVE-2023-1225 affects Google Chrome on iOS before version 111.0.5563.64, due to insufficient policy enforcement in Navigation that could bypass the same-origin policy via a crafted HTML page. The Fedora update indicates a chromium 111.0.5563.64-1.fc36/111.0.5563.64+ fix exists, aligning with the ...

CVE-2023-1814

CVE-2023-1814 affects Google Chrome/Chromium: insufficient validation of untrusted input in Safe Browsing allows bypassing download checking via a crafted HTML page. Public advisories note this as a Chrome/Chromium vulnerability; fixes were released in Chrome/Chromium 112.0.5615.49 (and related p...

CVE-2023-2468

CVE-2023-2468 matches multiple sources reporting an insecure implementation in Chrome’s PictureInPicture feature. The vulnerability arises from an inappropriate implementation in PictureInPicture, which allowed a remote attacker who had compromised the renderer process to obfuscate the security U...

CVE-2023-6508

CVE-2023-6508 describes a use-after-free in Media Stream of Chromium-based browsers (Google Chrome) that could allow remote heap corruption via a crafted HTML page. Public details in the connected sources confirm affected products are Google Chrome/Chromium, with the issue triggered by Media Stre...

CVE-2026-3910

CVE-2026-3910 is an inappropriately implemented Google Chrome V8 vulnerability (pre-146.0.7680.75) that allows remote code execution via a crafted HTML page in a sandbox. Public fixes landed in Chrome 146.0.7680.75 (and related channels); exploitation has been observed in reports, including notes...

CVE-2026-5906

CVE-2026-5906 affects Google Chrome/Chromium on Android, where an incorrect Omnibox security UI could allow spoofing of the URL bar via a crafted HTML page. The issue is tied to Chromium’s Omnibox handling and is described as Low severity (CVSS ~4.3). Remediation appears to be upgrading to Chromi...

CVE-2019-13673

CVE-2019-13673 affects Google Chrome/Chromium: insufficient data validation in developer tools allowed a remote attacker to leak cross-origin data via a crafted HTML page. Fixes are shipped in Chromium/Chrome updates (e.g., Debian security advisory lists Chromium versions 78.0.3904.97+ and relate...

CVE-2021-21124

CVE-2021-21124 is a use-after-free vulnerability in the Speech Recognizer component of the Chromium browser (tracked across multiple advisories). Impacted versions are Chromium before 88.0.4324.96. The issue could allow a remote attacker to escape sandbox and execute arbitrary code via a crafted ...

CVE-2021-30600

CVE-2021-30600 — Google Chrome (Printing) Use-after-free : The issue lies in the Printing path of Chrome, where a use-after-free in the rendering process could allow a remote attacker who already footholds the renderer to trigger heap corruption via a crafted HTML page. Affected versions prior to...

CVE-2022-2861

CVE-2022-2861 affects Google Chrome prior to 104.0.5112.101. An improper implementation in the Extensions API allows an attacker who persuades a user to install a malicious extension to inject arbitrary scripts into WebUI via a crafted HTML page, enabling likely impact described as an arbitrary s...

CVE-2022-3653

CVE-2022-3653 is a Chrome/Chromium vulnerability: a heap buffer overflow in Vulkan that could be triggered by a crafted HTML page, impacting Google Chrome prior to 107.0.5304.62. The issue affects Chromium’s Vulkan path and was addressed in the Chrome 107 stable update (Windows: 107.0.5304.62/63;...

CVE-2023-1215

CVE-2023-1215 describes a type confusion in CSS in Google Chrome/Chromium before 111.0.5563.64, enabling a remote attacker to potentially trigger heap corruption via a crafted HTML page. The CVSS v3.1 base score is 8.8 (High), with network exposure, no privileges required, user interaction requir...

CVE-2026-13874

CVE-2026-13874 describes a race in DataTransfer in Google Chrome (Chromium) prior to version 150.0.7871.47 that could allow a remote attacker to read potentially sensitive information from a process’s memory via a crafted HTML page. The issue is a data race in the DataTransfer pathway, with a net...

CVE-2026-13952

CVE-2026-13952 describes an inappropriate implementation in Chrome's PerformanceAPIs prior to 150.0.7871.47, allowing a remote attacker to leak cross-origin data through a crafted HTML page. The issue affects Google Chrome (Chromium-based). The vulnerability’s root cause is an insecure data expos...

CVE-2021-21109

Chromium-based Chrome up to version 87.0.4280.141 is affected by CVE-2021-21109. The issue is a use-after-free in the payments component that can be triggered when the renderer process is compromised via a crafted HTML page, potentially enabling a sandbox escape. Impact is use of arbitrary code a...

CVE-2022-0791

CVE-2022-0791 describes a use-after-free in Google Chrome's Omnibox prior to 99.0.4844.51, enabling heap corruption when a user is coerced into specific interactions. The flaw allows remote code execution with a high impact (as reflected in multiple advisories) but exploitation requires user inte...

CVE-2023-0698

CVE-2023-0698 involves an out-of-bounds memory read in WebRTC within Google Chrome before version 110.0.5481.77. The flaw could be triggered by a crafted HTML page to allow a remote attacker to read memory. The Chrome advisory (and Debian security advisory) confirm a fix in version 110.0.5481.77-...

CVE-2026-13865

CVE-2026-13865 : The connected records confirm an issue in Google Chrome/Chromium where insufficient validation of untrusted input in the browser UI allows a remote attacker to spoof the UI via a crafted HTML page. Affected component is the browser UI handling, with the root cause described as in...

CVE-2019-13708

CVE-2019-13708 affects Google Chrome/Chromium prior to 78.0.3904.70, describing an authentication spoofing issue in which HTTP authentication or omnibox-related UI could be spoofed due to an inconsistent navigation implementation. Public connected sources corroborate that this vulnerability was a...

CVE-2019-13746

CVE-2019-13746 affects Google Chrome Omnibox: Insufficient policy enforcement in Omnibox prior to 79.0.3945.79 allows a remote attacker to spoof the URL bar via a crafted HTML page. Affected: Chrome/Chromium Omnibox (policy enforcement in URL bar). Impact: spoofing of Omnibox contents; no other i...