CVE-2021-21143

CVE-2021-21143 is a heap buffer overflow in the Chromium browser’s Extensions component, fixed in versions before 88.0.4324.146. The incident description from multiple sources indicates an attacker could exploit this via a crafted extension to achieve arbitrary code execution. Public references i...

CVE-2021-37967

CVE-2021-37967 describes an insecure implementation in the Background Fetch API in Google Chrome/Chromium, where a remote attacker who had already compromised the renderer process could leak cross-origin data via a crafted HTML page. The issue affects Chrome/Chromium prior to version 94.0.4606.54...

CVE-2023-1215

CVE-2023-1215 describes a type confusion in CSS in Google Chrome/Chromium before 111.0.5563.64, enabling a remote attacker to potentially trigger heap corruption via a crafted HTML page. The CVSS v3.1 base score is 8.8 (High), with network exposure, no privileges required, user interaction requir...

CVE-2018-17481

CVE-2018-17481 describes a use-after-free in PDFium used by Google Chrome before 71.0.3578.98, enabling potential heap corruption via a crafted PDF file. Affected software/components: Google Chrome and the PDFium library. Impact per sources: remote attacker could exploit heap corruption; Chrome’s...

CVE-2020-16018

CVE-2020-16018 is a use-after-free in the payments component of Chromium/Google Chrome prior to 87.0.4280.66. Connected sources confirm exploitation can lead to arbitrary code execution and sandbox escape when a renderer process is compromised. Public fix status across distributions varies: upstr...

CVE-2020-16034

CVE-2020-16034 affects Google Chrome (Chromium/WebRTC component) and was caused by an inappropriate implementation in WebRTC prior to Chrome 87.0.4280.66. This allowed a local attacker to bypass policy restrictions via a crafted HTML page, potentially enabling UI/policy circumvention. Public advi...

CVE-2020-6460

CVE-2020-6460 concerns insufficient data validation in URL formatting in Chromium/Google Chrome prior to 81.0.4044.122, enabling domain spoofing via crafted domain names. Connected advisories show downstream fixes and versions: Debian/DSA-4714-1 notes Chromium updates around 83.0.4103.116 for sta...

CVE-2020-6472

CVE-2020-6472 affects Chromium-based browsers (e.g., Chrome/Chromium) through the developer tools policy enforcement component. Affected version lineage is before 83.0.4103.61, per multiple advisories. The vulnerability is a policy enforcement error in the developer tools that could allow an atta...

CVE-2022-0459

CVE-2022-0459 concerns a use-after-free vulnerability in Chrome’s Screen Capture code, leading to potential heap corruption. The issue affects Chrome/Chromium prior to version 98.0.4758.80, with exploitation described as requiring a crafted HTML page and user interaction to trigger the vulnerabil...

CVE-2022-2621

CVE-2022-2621 is a use-after-free in Chrome/Chromium extensions before 104.0.5112.79 that can be triggered when a user installs a malicious extension, potentially enabling heap corruption. Affected products include Google Chrome/Chromium with the Extensions component vulnerable to the described u...

CVE-2023-0698

CVE-2023-0698 involves an out-of-bounds memory read in WebRTC within Google Chrome before version 110.0.5481.77. The flaw could be triggered by a crafted HTML page to allow a remote attacker to read memory. The Chrome advisory (and Debian security advisory) confirm a fix in version 110.0.5481.77-...

CVE-2023-1225

CVE-2023-1225 affects Google Chrome on iOS before version 111.0.5563.64, due to insufficient policy enforcement in Navigation that could bypass the same-origin policy via a crafted HTML page. The Fedora update indicates a chromium 111.0.5563.64-1.fc36/111.0.5563.64+ fix exists, aligning with the ...

CVE-2023-2468

CVE-2023-2468 matches multiple sources reporting an insecure implementation in Chrome’s PictureInPicture feature. The vulnerability arises from an inappropriate implementation in PictureInPicture, which allowed a remote attacker who had compromised the renderer process to obfuscate the security U...

CVE-2026-15115

CVE-2026-15115 affects Google Chrome on Android prior to 150.0.7871.115, where insufficient validation of untrusted input in WebAppInstalls could allow a local attacker to bypass the same-origin policy via a crafted HTML page. The vulnerability stems from untrusted input handling within WebAppIns...

CVE-2019-13681

CVE-2019-13681 affects Google Chrome prior to 77.0.3865.75, where insufficient data validation in downloads could let a remote attacker bypass download restrictions via a crafted HTML page. The issue is documented with a vulnerability description and CVSS scores; connected sources indicate Chrome...

CVE-2020-16021

CVE-2020-16021 describes a race condition in the ImageBurner component of Chromium/Google Chrome prior to 87.0.4280.66 (ChromeOS context). If a attacker could compromise the browser process and trigger handling of a malicious file, it could lead to OS‑level privilege escalation. Public mentions i...

CVE-2021-21109

Chromium-based Chrome up to version 87.0.4280.141 is affected by CVE-2021-21109. The issue is a use-after-free in the payments component that can be triggered when the renderer process is compromised via a crafted HTML page, potentially enabling a sandbox escape. Impact is use of arbitrary code a...

CVE-2021-30600

CVE-2021-30600 — Google Chrome (Printing) Use-after-free : The issue lies in the Printing path of Chrome, where a use-after-free in the rendering process could allow a remote attacker who already footholds the renderer to trigger heap corruption via a crafted HTML page. Affected versions prior to...

CVE-2023-3421

CVE-2023-3421 is a use-after-free in Media in Google Chrome/Chromium prior to 114.0.5735.198 that could allow a remote attacker to cause heap corruption via a crafted HTML page. The vulnerability is documented across multiple advisories confirming the affected component as Chromium’s media handli...

CVE-2023-3422

The CVE-2023-3422 issue affects Chromium-based browsers (notably Google Chrome) and is triggered by a use-after-free in Guest View on versions before 114.0.5735.198. An attacker could persuade a user to install a malicious extension, potentially exploiting heap corruption via a crafted HTML page,...

CVE-2024-1059

CVE-2024-1059 refers to a use-after-free in Chrome/Chromium’s WebRTC Peer Connection, prior to version 121.0.6167.139, enabling a remote attacker to potentially trigger stack corruption via a crafted HTML page. Connected sources confirm affected component as Chromium/WebRTC, with a High severity ...

CVE-2025-3619

CVE-2025-3619 affects Google Chrome (Windows) and Chromium code paths dealing with codecs. A heap buffer overflow in Codecs allowed a remote attacker to potentially trigger heap corruption via a crafted HTML page, enabling likely arbitrary code execution or crash as described in the entry. Public...

CVE-2026-10881

The CVE-2026-10881 issue affects ANGLE in Google Chrome, with an out-of-bounds read/write that could enable a sandbox escape via a crafted HTML page. It is resolved in Chrome 149.0.7827.53 and later, per Chrome’s stability update notes. The vulnerability is identified across multiple sources (NVD...

CVE-2020-15983

CVE-2020-15983 affects the Chromium browser’s webUI component and is tied to insufficient data validation before version 86.0.4240.75 (ChromeOS) that could allow a local attacker to bypass content security policy with a crafted HTML page. Public advisories and vendor notes show fixes in the 86.0....

CVE-2021-21124

CVE-2021-21124 is a use-after-free vulnerability in the Speech Recognizer component of the Chromium browser (tracked across multiple advisories). Impacted versions are Chromium before 88.0.4324.96. The issue could allow a remote attacker to escape sandbox and execute arbitrary code via a crafted ...

CVE-2021-37992

CVE-2021-37992 affects the WebAudio component of Chromium/Google Chrome, with an out-of-bounds read that could enable a remote attacker to cause heap corruption via a crafted HTML page. Affected product: Chromium/Chrome prior to 95.0.4638.54. Mitigation: upgrade to Chromium 95.0.4638.54 or newer ...

CVE-2022-0791

CVE-2022-0791 describes a use-after-free in Google Chrome's Omnibox prior to 99.0.4844.51, enabling heap corruption when a user is coerced into specific interactions. The flaw allows remote code execution with a high impact (as reflected in multiple advisories) but exploitation requires user inte...

CVE-2022-2609

CVE-2022-2609 describes a use-after-free in Nearby Share on Chrome OS Chrome/Chromium prior to 104.0.5112.79, allowing heap corruption via specific UI interactions after user engagement. Affected component: Nearby Share workflow in Chromium-based Chrome OS. Root cause: use-after-free leading to p...

CVE-2022-3656

CVE-2022-3656 affects Google Chrome/Chromium’s File System API, with Insufficient data validation that allowed bypassing file-system restrictions via a crafted HTML page. Affected: Chrome/Chromium prior to 107.0.5304.62; impact per NVD: high (CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; base 8....

CVE-2023-0929

CVE-2023-0929 describes a use-after-free in the Vulkan component of Google Chrome/Chromium before version 110.0.5481.177, allowing a remote attacker to potentially cause heap corruption via a crafted HTML page. The issue is tied to the Vulkan path in Chromium’s render/GPU stack and is categorized...

CVE-2024-0225

The CVE affects Google Chrome (Chromium/WebGPU) with a use-after-free in WebGPU, leading to potential heap corruption via a crafted HTML page. Affected versions are prior to 120.0.6099.199; remediation is to update to 120.0.6099.199 or newer, as reflected by multiple advisories (e.g., Fedora/Debi...

CVE-2024-0808

The CVE-2024-0808 entry is supported by multiple connected documents: it describes an Integer underflow in Chromium’s WebUI that affects Google Chrome prior to 121.0.6167.85, enabling a remote attacker to potentially trigger heap corruption via a malicious file (High/CRITICAL via CVSS). Affected ...

CVE-2024-10229

CVE-2024-10229 affects Google Chrome/Chromium via an Inappropriate implementation in Extensions that bypasses site isolation when a crafted Chrome Extension is used, prior to patch version 130.0.6723.69. Public advisories (Debian, Fedora) confirm the fix is in 130.0.6723.69-1..., and Debian/Fedor...

CVE-2026-15131

CVE-2026-15131 affects Google Chrome in the Navigation path where an inappropriate implementation could allow a remote attacker to bypass site isolation via a crafted HTML page. The issue is tied to Chromium security in the Navigation component and is classified as Medium severity. Affected versi...

CVE-2020-6466

CVE-2020-6466 is a use-after-free vulnerability in Google Chrome’s media component (pre-83.0.4103.61). The issue could allow a remote attacker who has renderer access to potentially execute arbitrary code or escape the sandbox via a crafted HTML page. Debian/Arch advisories confirm mitigation by ...

CVE-2020-6467

CVE-2020-6467 is a use-after-free vulnerability in the WebRTC component of Chromium/Google Chrome prior to 83.0.4103.61. The advisory description from the initial document states a remote attacker could potentially exploit a heap corruption via a crafted HTML page. Connected sources corroborate a...

CVE-2021-38001

CVE-2021-38001 is a type confusion in V8 of the Chromium engine (Chromium-based browsers) prior to version 95.0.4638.69. The issue could allow a remote attacker to trigger heap corruption via crafted HTML, potentially enabling arbitrary code execution. Publicly documented impact includes remote c...

CVE-2022-1496

CVE-2022-1496 : Use-after-free in File Manager of Google Chrome before 101.0.4951.41 can allow a remote attacker to potentially exploit heap corruption via specific and direct user interaction. Affected product: Google Chrome/Chromium File Manager. Root cause: use-after-free vulnerability in File...

CVE-2023-1818

CVE-2023-1818 is a use-after-free in Vulkan within Google Chrome’s rendering stack prior to version 112.0.5615.49, enabling potential heap corruption via a crafted HTML page. The vulnerability affects Chrome’s Vulkan-related code paths and has been reflected across multiple advisories (Debian DSA...

CVE-2023-2135

CVE-2023-2135 : Use-after-free in Chromium/Google Chrome DevTools prior to 112.0.5615.137 could allow a remote attacker to trigger heap corruption via a crafted HTML page after convincing a user to enable preconditions. Impact aligns with a high-severity heap corruption scenario. Affected product...

CVE-2026-13034

Vulnerability summary (CVE-2026-13034). In Google Chrome, an inappropriate implementation in the Passwords component before version 149.0.7827.197 allows a remote attacker who has compromised the renderer process to bypass site isolation via a crafted HTML page. The issue is tied to Chromium’s se...

CVE-2026-13860

Google Chrome on Windows is affected by CVE-2026-13860 due to an Incorrect security UI in Autofill, allowing UI spoofing when a user is induced to perform specific UI gestures via a crafted HTML page. The issue affects Chrome versions prior to 150.0.7871.47; exploitation requires user interaction...

CVE-2026-14049

CVE-2026-14049 affects Google Chrome versions with an inappropriate GPU implementation prior to 150.0.7871.47. A remote attacker who has compromised the renderer process can obtain potentially sensitive information from process memory via a crafted HTML page. Impact is described as Low severity; ...

CVE-2021-30626

CVE-2021-30626 affects the ANGLE component used by Google Chrome. It describes a memory out-of-bounds access in ANGLE prior to Chrome 93.0.4577.82, which could allow a remote attacker to cause heap corruption via a crafted HTML page. The vulnerability impact is described as potentially allowing h...

CVE-2021-37963

Technical details about CVE-2021-37963 are not publicly provided in the connected documents. The sources reiterate the same description without specifics on affected products/versions beyond Chrome prior to 94.0.4606.54. Monitor for updates.

CVE-2021-37977

CVE-2021-37977 is a use-after-free in the Garbage Collection of the Chromium browser engine (pre-94.0.4606.81). Exploitation could enable remote code execution via a crafted HTML page, with heap corruption as the underlying risk. The vulnerability affects Google Chrome/Chromium prior to the patch...

CVE-2022-1130

CVE-2022-1130 affects Google Chrome on Android, specifically the WebOTP component. The vulnerability is caused by insufficient validation of trusted input, allowing a remote attacker to send arbitrary intents from any app via a malicious app. The issue is fixed in Chrome versions 100.0.4896.60 an...

CVE-2022-1864

CVE-2022-1864 : In Google Chrome, a use-after-free in WebApp Installs (prior to 102.0.5005.61) can allow heap corruption when a user is convinced to install a malicious extension and performs specific interactions. The issue affects Chrome’s handling of WebApp Installs and is tied to a post-relea...

CVE-2022-1875

CVE-2022-1875 relates to Google Chrome’s PDF implementation. The vulnerability arises from an inappropriate PDF handling implementation, allowing a remote attacker to leak cross-origin data via a crafted HTML page. Affected versions are Chrome before 102.0.5005.61. Impact is cross-origin data lea...

CVE-2023-1219

CVE-2023-1219: The connected Astra Linux bulletin confirms a heap buffer overflow in Chrome/Chromium’s Metrics prior to 111.0.5563.64, allowing a renderer-compromised, remote attacker to potentially trigger heap corruption via a crafted HTML page. Affected software is Google Chrome/Chromium (Chro...