CVE-2011-1440

CVE-2011-1440 affects Google Chrome prior to 11.0.696.57. The vulnerability is a use-after-free in handling the ruby element and CSS token sequences in the rendering pipeline (WebKit-based). Exploitation is remote and could cause a denial of service or possibly other unspecified impact. The avail...

CVE-2022-0469

CVE-2022-0469 refers to a use-after-free in Cast within Google Chrome (pre-98.0.4758.80). The underlying issue allows a remote attacker to potentially trigger heap corruption through a crafted HTML page when a user is persuaded to perform specific interactions. The CVE entry is corroborated by mu...

CVE-2022-2612

CVE-2022-2612 affects Google Chrome/Chromium prior to version 104.0.5112.79. The issue is a side-channel information leakage in keyboard input that lets a remote attacker who has already compromised the renderer process exfiltrate potentially sensitive data from process memory via a crafted HTML ...

CVE-2024-0804

CVE-2024-0804 affects Google Chrome/Chromium: Insufficient policy enforcement in the iOS Security UI allows a crafted HTML page to leak cross-origin data. Public references indicate the issue is tied to Chrome/Chromium’s UI policy enforcement and was addressed in Chrome 121.0.6167.85 (and related...

CVE-2018-6149

CVE-2018-6149: Out-of-bounds write in the V8 JavaScript engine of Chromium/Google Chrome prior to 67.0.3396.87. A remote attacker could exploit this via a crafted webpage to execute arbitrary code. Remediation: upgrade to 67.0.3396.87 or newer (upstream fix). Connected sources note the issue and ...

CVE-2019-5856

CVE-2019-5856 affects Chromium before 76.0.3809.87; described as an access restriction bypass due to insufficient filesystem URI permission checks. Arch Linux advisory confirms remediation by upgrading to 76.0.3809.87-1, with upstream fixes in that release. Other sources note broader Chromium fix...

CVE-2021-30630

CVE-2021-30630 concerns Blink in Google Chrome. The issue is an unsafe implementation in Blink before 93.0.4577.82 that allows a remote attacker, after compromising the renderer process, to leak cross-origin data via a crafted HTML page. Affected component: Blink/Chromium rendering engine; affect...

CVE-2022-1867

CVE-2022-1867 affects Google Chrome/Chromium upstream: insufficient validation of untrusted input in Data Transfer allows bypass of same-origin policy via crafted clipboard content. Affected: Chrome/Chromium before 102.0.5005.61. Remediation: update to Chrome/Chromium 102.0.5005.61 or later; Debi...

CVE-2022-3196

Concrete details confirm CVE-2022-3196 affects Chromium/Google Chrome PDF handling with a use-after-free leading to possible heap corruption via crafted PDFs, fixed in upstream Chrome/Chromium at version 105.0.5195.125 and newer. Public sources describe the vulnerability as a PDF memory reuse-aft...

CVE-2023-4359

CVE-2023-4359 affects Google Chrome on iOS before 116.0.5845.96 due to an inappropriate implementation in the App Launcher. The issue could allow a remote attacker to spoof elements of the security UI through a crafted HTML page. Public advisories/updates indicate that Chromium-based browsers (Ch...

CVE-2026-14013

CVE-2026-14013 affects Google Chrome before version 150.0.7871.47, due to an inappropriate SVG implementation that enables UI spoofing via a crafted HTML page. The issue is documented across multiple feeds (NVD, Debian OSV, EUVD) with a Medium severity. The connected references indicate a patch/r...

CVE-2021-37977

CVE-2021-37977 is a use-after-free in the Garbage Collection of the Chromium browser engine (pre-94.0.4606.81). Exploitation could enable remote code execution via a crafted HTML page, with heap corruption as the underlying risk. The vulnerability affects Google Chrome/Chromium prior to the patch...

CVE-2021-37989

CVE-2021-37989 is an issue in the Blink component of Google Chrome prior to 95.0.4638.54 . The problem is an inappropriate implementation that allows a remote attacker to abuse the Content Security Policy via a crafted HTML page. Impact is described as potential policy abuse with craftable conten...

CVE-2022-2296

CVE-2022-2296 is a use-after-free in Chrome OS Shell on Chrome OS prior to 103.0.5060.114, potentially allowing a remote attacker who entices user interactions to cause heap corruption. Affected software includes Chromium/Chrome family on Chrome OS; the issue is classified with high impact (avail...

CVE-2023-4366

The CVE-2023-4366 entry describes a Use-after-free vulnerability in Chrome/Chromium Extensions prior to version 116.0.5845.96, potentially allowing heap corruption when a user is tricked into installing a malicious extension via a crafted HTML page. The issue is tied to the Extensions component, ...

CVE-2024-1059

CVE-2024-1059 refers to a use-after-free in Chrome/Chromium’s WebRTC Peer Connection, prior to version 121.0.6167.139, enabling a remote attacker to potentially trigger stack corruption via a crafted HTML page. Connected sources confirm affected component as Chromium/WebRTC, with a High severity ...

CVE-2011-1202

The CVE-2011-1202 issue affects libxslt 1.1.26 and earlier, where xsltGenerateIdFunction could leak heap addresses via an XSLT generate-id call (affects Chrome before 10.0.648.127 and other products). Impact: potential disclosure of memory addresses; no explicit exploitation details provided. Roo...

CVE-2021-37987

CVE-2021-37987 affects Chromium’s Network APIs component, prior to 95.0.4638.54. The vulnerability is a use-after-free/heap issue that could allow a remote attacker to trigger heap corruption via crafted HTML. Affected product/version: Chromium browser engine before 95.0.4638.54. Source entries (...

CVE-2022-0111

CVE-2022-0111 relates to Google Chrome’s navigation logic. Several connected sources confirm an “Inappropriate implementation in Navigation” vulnerability in Chrome prior to 97.0.4692.71 that allowed a remote attacker to incorrectly set the origin via a crafted HTML page. The Debian bulletin note...

CVE-2022-0467

CVE-2022-0467 affects Google Chrome on Windows before 98.0.4758.80, where an inappropriate implementation in Pointer Lock allows a remote attacker to bypass navigation restrictions via a crafted HTML page. The issue impacts Chrome/Chromium components related to Pointer Lock handling. According to...

CVE-2023-2464

CVE-2023-2464 affects Google Chrome (Chromium-based) via an inappropriate implementation in PictureInPicture. A crafted HTML page and a malicious extension can lead to an origin spoof in the Chrome security UI. The vulnerability is tied to Chrome/Chromium builds prior to 113.0.5672.63 (the fixed ...

CVE-2025-6192

CVE-2025-6192 is a Use-after-free vulnerability in Google Chrome/Chromium’s memory management related to Metrics/Profiler, allowing remote code execution via a crafted HTML page. Affected versions precede 137.0.7151.119 (Chrome stable channel; Chromium baseline). Debian security advisories confir...

CVE-2010-4494

CVE-2010-4494 is a double-free vulnerability in libxml2 (notably 2.7.8 and related versions) used by Chrome and other products. The issue affects libxml2’s handling of XPath/XML entities and could allow a remote attacker to crash or potentially execute code via crafted XML input. Public advisorie...

CVE-2018-6148

CVE-2018-6148 affects Google Chrome/chromium prior to version 67.0.3396.79, where incorrect handling of the Content Security Policy (CSP) header allowed a remote attacker to bypass navigation restrictions with a crafted HTML page. The vulnerability is due to CSP header handling and is mitigated b...

CVE-2022-2998

CVE-2022-2998 is a Chrome use-after-free in Browser Creation that could enable heap corruption when a user engages a specific UI interaction via a crafted HTML page. Affected product/version: Google Chrome prior to 104.0.5112.101; vulnerable component is the Browser Creation path (heap misuse). I...

CVE-2022-3888

CVE-2022-3888 is a use-after-free in Chrome’s WebCodecs implementation that could allow a remote attacker to cause heap corruption via a crafted HTML page. Affected product: Google Chrome (WebCodecs component). Root cause: use-after-free in WebCodecs leading to memory corruption. Impact: high (re...

CVE-2022-4910

CVE-2022-4910: In Google Chrome, an inappropriate Autofill implementation allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Affected product: Google Chrome (Chromium-based). Root cause: incorrect Autofill handling as described in the CVE entry. Impact: navigatio...

CVE-2023-2465

CVE-2023-2465 affects Google Chrome / Chromium. The issue is an inappropriate CORS implementation that could allow a remote attacker to leak cross-origin data via a crafted HTML page. Affected component: Chromium-based browsers (Chrome/Chromium); root cause is flawed CORS handling leading to data...

CVE-2024-2631

CVE-2024-2631 affects Google Chrome/Chromium on iOS with insecure UI handling in versions before 123.0.6312.58, enabling a remote attacker to spoof UI via a crafted HTML page. The vulnerability is categorized as Medium severity in the provided metrics, with network attack vector, user interaction...

CVE-2026-14049

CVE-2026-14049 affects Google Chrome versions with an inappropriate GPU implementation prior to 150.0.7871.47. A remote attacker who has compromised the renderer process can obtain potentially sensitive information from process memory via a crafted HTML page. Impact is described as Low severity; ...

CVE-2021-21117

CVE-2021-21117 is a Chromium/ Cryptohome policy enforcement issue reported as a local privilege-escalation vulnerability. The connected documents confirm the flaw exists in Cryptohome before Chromium 88.0.4324.96, allowing a local attacker to escalate OS privileges via a crafted file. The impact ...

CVE-2021-21214

CVE-2021-21214 refers to a use‑after‑free in the Network API of Google Chrome. The issue, exploitable via a crafted Chrome Extension, can lead to heap corruption and potentially remote code execution. Affected software is Google Chrome prior to 90.0.4430.72; multiple connected advisories corrobor...

CVE-2021-30587

CVE-2021-30587 affects Google Chrome/Chromium before 92.0.4515.107 due to an inappropriate implementation in Compositing that could allow a remote attacker to spoof the Omnibox (URL bar) via a crafted HTML page. Impact is spoofing of URL bar contents with no broader data disclosure stated in the ...

CVE-2021-37993

CVE-2021-37993 describes a use-after-free in the PDF Accessibility component of the Chromium-based Google Chrome prior to 95.0.4638.54, enabling a remote attacker to potentially trigger heap corruption via a crafted HTML page. The vulnerability affects Google Chrome’s PDF Accessibility path (Chro...

CVE-2021-37996

CVE-2021-37996: Insufficient validation of untrusted input in the Downloads component of the Chromium-based Google Chrome engine before version 95.0.4638.54. This vulnerability allows a remote attacker to bypass navigation restrictions via a malicious file. The connected advisories (e.g., ASA-202...

CVE-2022-0797

The CVE-2022-0797 entry describes an out-of-bounds memory access/write in Chrome’s Mojo component before version 99.0.4844.51. A remote attacker could trigger this via a crafted HTML page, leading to arbitrary code execution or a crash. Connected sources consistently reference Chrome Mojo as the ...

CVE-2022-3071

CVE-2022-3071 is a use-after-free in the Tab Strip of Google Chrome on ChromeOS/Lacros prior to 105.0.5195.52, potentially allowing heap corruption via crafted UI interactions. Affected: ChromeOS Lacros environment; vulnerable component/process: Tab Strip UI handling. Impact: remote attacker coul...

CVE-2023-3733

CVE-2023-3733 affects Google Chrome/Chromium: Inappropriate implementation in WebApp Installs can allow a crafted HTML page to spoof the Omnibox contents. The issue is fixed in Chrome/Chromium around 115.0.5790.98 (and later, e.g., 115.0.5790.99 per update notes); Debian and other advisories conf...

CVE-2023-4353

CVE-2023-4353 affects ANGLE in Google Chrome up to version 116.0.5845.96. The vulnerability is a heap buffer overflow in ANGLE that can lead to heap corruption via a crafted HTML page, enabling a remote attacker to potentially exploit the browser. Affected software is Google Chrome/Chromium with ...

CVE-2019-5859

CVE-2019-5859 : Google Chrome on Windows prior to 76.0.3809.87 was vulnerable due to insufficient filtering in URI schemes, allowing a crafted HTML page to bypass navigation restrictions by loading alternative browsers. The issue was fixed in the 76.0.3809.87 (or later) Chrome update; Debian/Arch...

CVE-2021-30583

CVE-2021-30583 affects Google Chrome on iOS. The vulnerability arises from insufficient policy enforcement in image handling, allowing a remote attacker to leak cross-origin data via a crafted HTML page. Affected version: Chrome on iOS prior to 92.0.4515.107. Impact is cross-origin data leakage; ...

CVE-2021-37981

CVE-2021-37981 is a Chrome/Chromium vulnerability: a heap buffer overflow in the Skia component prior to 95.0.4638.54 allows a renderer-compromised remote attacker to potentially escape the sandbox via a crafted HTML page. The connected documents confirm the flaw lies in Skia, affects Chromium-ba...

CVE-2022-2618

CVE-2022-2618 affects Google Chrome/Chromium up to version 104.0.5112.79, with the root cause described as insufficient validation of untrusted input in Internals. The vulnerability could allow a remote attacker to bypass download restrictions via a malicious file, with a measured CVSSv3.1 base s...

CVE-2022-4436

CVE-2022-4436 describes a Use-After-Free in Blink Media used by Google Chrome before version 108.0.5359.124, enabling a remote attacker to potentially trigger heap corruption via a crafted HTML page. Affected product is Google Chrome (Blink/Chromium stack). The root cause is a use-after-free in B...

CVE-2024-0814

CVE-2024-0814 describes an incorrect security UI in Google Chrome’s Payments component that could allow a remote attacker to spoof security UI via a crafted HTML page. Concrete details across connected sources specify: affected product/versions include Chrome/Chromium before 121.0.6167.85 (e.g., ...

CVE-2026-15131

CVE-2026-15131 affects Google Chrome in the Navigation path where an inappropriate implementation could allow a remote attacker to bypass site isolation via a crafted HTML page. The issue is tied to Chromium security in the Navigation component and is classified as Medium severity. Affected versi...

CVE-2018-17479

CVE-2018-17479 is a Chrome GPU use-after-free vulnerability caused by incorrect object lifetime handling in GPU code, potentially leading to heap corruption. It affects Google Chrome prior to 70.0.3538.110. Public references describe an in-the-wild risk and indicate remediation via updating to ve...

CVE-2021-37970

CVE-2021-37970: Use-after-free in the File System API of Google Chrome (Chromium) prior to 94.0.4606.54 can allow a remote attacker to potentially cause heap corruption via a crafted HTML page. Multiple vendor advisories note this as a Chrome/Chromium vulnerability with remediation via updates. P...

CVE-2022-0470

CVE-2022-0470 corresponds to an issue in Google Chrome’s V8 engine prior to 98.0.4758.80, described as an out-of-bounds memory access that could allow a remote attacker to potentially trigger heap corruption via a crafted HTML page. The vulnerability applies to Chrome/Chromium deployments using a...

CVE-2023-1815

CVE-2023-1815: Use-after-free in Chrome/Chromium Networking APIs (heap corruption) due to a memory reuse issue. Affects Google Chrome/Chromium prior to 112.0.5615.49; exploitation requires user interaction (UI click) after convincing the user. Remediation: update to Chromium 112.0.5615.49 or newe...