CVE-2026-11645

Google Chrome's V8 JavaScript engine is vulnerable to an out-of-bounds read and write caused by a specific code pattern triggering type confusion between internal V8 objects. This flaw allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. The vulnerability h...

CVE-2024-7971

CVE-2024-7971 is a Type Confusion in Google Chrome’s V8 engine that allows remote heap corruption via a crafted HTML page. Affected software is Google Chrome (and Chromium-based browsers) prior to version 128.0.6613.84. The root cause is a V8 type confusion issue, enabling exploitation when proce...

CVE-2025-5283

A Use after free vulnerability exists in libvpx , affecting Google Chrome versions prior to 137.0.7151.55 . This flaw allows a remote attacker to potentially cause heap corruption by navigating to a crafted HTML page . Additionally, the vulnerability has been identified as a Double-free in the li...

CVE-2018-20346

CVE-2018-20346 affects SQLite when the FTS3 extension is enabled. SQLite before 3.25.3 exhibits an integer overflow (and resulting buffer overflow) for FTS3 queries after crafted changes to FTS3 shadow tables, enabling remote attackers to execute arbitrary SQL statements and potentially take cont...

CVE-2023-6350

CVE-2023-6350 is a use-after-free in libavif used by Google Chrome/Chromium before version 119.0.6045.199, potentially enabling remote heap corruption via a crafted avif file. Affected software stacks include Chromium-based browsers (Chrome/Chromium) and related Electron builds, with multiple sec...

CVE-2023-4068

CVE-2023-4068: Type Confusion in V8 affects Chromium/Google Chrome; vulnerable component is V8, leading to remote arbitrary read/write via crafted HTML pages. Root cause: type confusion. Impact per sources: high; exploit details not provided. Remediation: upgrade Chromium/Chrome to 115.0.5790.170...

CVE-2023-6345

CVE-2023-6345 is an integer overflow in the Skia graphics library used by Google Chrome prior to 119.0.6045.199. The vulnerability allows a renderer-compromised attacker to potentially escape the sandbox via a malicious file. Affected product: Google Chrome (Skia component). Root cause: integer o...

CVE-2026-85046

A type confusion vulnerability exists in the V8 engine of Google Chrome (prior to version 152.0.7977.82 ). This flaw allows a remote attacker to execute arbitrary code inside the sandbox by viewing a crafted HTML page . The vulnerability has been identified as actively exploited in the wild, with...

CVE-2025-9867

An inappropriate implementation in the Downloads component of Google Chrome on Android prior to version 140.0.7339.80 allows a remote attacker to perform UI spoofing via a crafted HTML page. The vulnerability is associated with CWE-451 (User Interface Misrepresentation of Critical Information) an...

CVE-2025-5419

Google Chrome, Microsoft Edge, and Opera are affected by a High severity out-of-bounds read and write vulnerability in the V8 engine. A remote attacker can exploit heap corruption by navigating to a specially crafted HTML page. This vulnerability is actively exploited in the wild and has been add...

CVE-2023-4427

CVE-2023-4427 is an out-of-bounds memory read vulnerability in V8 used by Google Chrome/Chromium prior to 116.0.5845.110. A remote attacker could craft an HTML page to trigger the issue, with high impact (C/H, I/N, A/H) and public exploits reportedly existing. The issue affects Chromium-based bro...

CVE-2024-0519

CVE-2024-0519 is a Google Chrome/V8 vulnerability: an out-of-bounds memory access in V8 allows potential heap corruption via a crafted HTML page. Affected products include Chrome before version 120.0.6099.224; the Chromium/Chrome Stable Channel update to 120.0.6099.224 (Linux and Mac) and 120.0.6...

CVE-2022-0801

CVE-2022-0801 describes an issue in Google Chrome’s HTML parser where an improper implementation could bypass XSS protections via a crafted HTML page. Affected product: Google Chrome (via Chromium codebase). Root cause: insecure HTML parsing logic preceding version 99.0.4844.51. Impact: remote at...

CVE-2025-9865

In Google Chrome on Android (versions prior to 140.0.7339.80 ), an inappropriate implementation in the Toolbar component allows a remote attacker to perform domain spoofing . The attacker must first convince a user to engage in specific UI gestures while visiting a crafted HTML page. This vulnera...

CVE-2020-16044

CVE-2020-16044 is a use-after-free in WebRTC detected in Chromium-based browsers, including Google Chrome before 88.0.4324.96 (and related Chromium builds). A remote attacker could potentially exploit a crafted SCTP COOKIE-ECHO packet to trigger heap corruption and execute arbitrary code. Public ...

CVE-2025-5281

An inappropriate implementation in the BFCache of Google Chrome (prior to version 137.0.7151.55 ) allows a remote attacker to potentially obtain user information through a crafted HTML page. This issue has a Medium severity rating. Remediation is available via updates to version 137.0.7151.55 , s...

CVE-2026-19167

Google Chrome and Microsoft Edge are vulnerable to an integer overflow in GPU components . A remote attacker who has already compromised the renderer process can exploit this flaw to leak cross-origin data using a specially crafted HTML page. This issue affects versions of Chrome prior to 151.0.7...

CVE-2023-7024

CVE-2023-7024 describes a heap buffer overflow in WebRTC , affecting Google Chrome/WebRTC prior to version 120.0.6099.129. The vulnerability could allow a remote attacker to trigger heap corruption via a crafted HTML page, with impact summarized as high. Public references confirm ChromeOS fixes i...

CVE-2019-5827

CVE-2019-5827 is an out-of-bounds read in the SQLite library leveraged via Chromium/Chrome. Public records in Debian and related advisories indicate this affects Chromium/Chrome components and was mitigated by upgrading the sqlite3 library (e.g., to versions in Chromium security updates and Debia...

CVE-2023-4070

CVE-2023-4070 affects Google Chrome/Chromium via a Type Confusion in V8 before 115.0.5790.170, allowing a remote attacker to perform arbitrary read/write through a crafted HTML page. The issue is confirmed across multiple advisories (Debian DSA-5467-1, Gentoo GLSAs, FreeBSD/vuxml, Astra Linux) an...

CVE-2024-4761

CVE-2024-4761: Out-of-bounds memory write in V8 used by Google Chrome/Chromium prior to 124.0.6367.207 via a crafted HTML page. A remote attacker could trigger an out-of-bounds write, with impact described as high for confidentiality, integrity, and availability. Affected software is Chrome/Chrom...

CVE-2026-2441

CVE-2026-2441 is a Chromium/Google Chrome use-after-free in CSS vulnerability that could allow a remote attacker to execute arbitrary code inside the sandbox. Affected software includes Google Chrome/Chromium prior to 145.0.7632.75; the issue stems from a CSS handling use-after-free bug in the br...

CVE-2012-4929

CVE-2012-4929 (CRIME) : The vulnerability stems from TLS/SSL compression, where the TLS protocol (1.2 and earlier) used by browsers (e.g., Mozilla Firefox, Google Chrome, Qt) can encrypt compressed data without hiding the length of unencrypted data. This length leakage enables a MITM attacker to ...

CVE-2023-2940

CVE-2023-2940 relates to Google Chrome: an inappropriate implementation in the Downloads component prior to 114.0.5735.90 allowed an attacker, by convincing a user to install a malicious extension, to bypass file access restrictions via a crafted HTML page. The issue is tied to the Downloads hand...

CVE-2026-19160

The Skia graphic library used by Google Chrome and Microsoft Edge is affected by an uninitialized use vulnerability. This flaw allows a remote attacker who has already compromised the renderer process to leak cross-origin data by interacting with a specially crafted HTML page. The vulnerability e...

CVE-2025-0448

A vulnerability exists in the Compositing component of Google Chrome prior to version 132.0.6834.83 . Due to an inappropriate implementation, a remote attacker can perform UI spoofing by hosting a crafted HTML page. While the Chromium security severity is rated as Low , the vulnerability is assoc...

CVE-2023-4761

CVE-2023-4761 is a memory‑safety issue in FedCM within Google Chrome/Chromium prior to 116.0.5845.179, allowing a renderer‑compromised attacker to perform an out‑of‑bounds memory read via a crafted page (severity HIGH). Connected sources confirm affected products include Chromium/Chrome; Debian a...

CVE-2026-2322

Google Chrome contains a Low severity vulnerability (CVE-2026-2322) caused by an inappropriate implementation in the File input component. A remote attacker who successfully convinces a user to perform specific UI gestures can use a crafted HTML page to perform UI spoofing . This issue affects ve...

CVE-2025-5067

A vulnerability exists in the Tab Strip tab control of the Google Chrome browser due to an inappropriate implementation. This flaw allows a remote attacker to perform UI spoofing by using a specially crafted HTML page or link to manipulate the user interface. The issue is categorized as CWE-290 (...

CVE-2025-9479

Google Chrome versions prior to 133.0.6943.141 are vulnerable to an out-of-bounds read within the V8 JavaScript engine . A remote attacker can exploit this flaw by serving a crafted HTML page , which may lead to heap corruption and potentially allow the attacker to impact the availability of prot...

CVE-2026-87491

Google Chrome's V8 engine contains an out-of-bounds write vulnerability (CVE-2026-87491) in the JavaScript script handler. A remote attacker can exploit this by hosting a crafted HTML page to execute arbitrary code inside the sandbox. This vulnerability is confirmed to be exploited in the wild an...

CVE-2026-19161

A vulnerability exists in the Skia graphic library used by Google Chrome (prior to version 151.0.7922.109 ) due to an uninitialized use error. A remote attacker who has already compromised the renderer process can exploit this flaw to leak cross-origin data by navigating the user to a crafted HTM...

CVE-2019-5798

CVE-2019-5798: In Google Chrome, a lack of proper bounds checking in Skia allowed out-of-bounds memory read via a crafted HTML page. Affected product is Chrome (before 73.0.3683.75); root cause is insufficient bounds checking in Skia’s handling of HTML content. Impact stated: remote attacker coul...

CVE-2024-8907

CVE-2024-8907 affects Chromium-based Chrome on Android (prior to version 129.0.6668.58). The root cause is insufficient data validation in Omnibox related to crafted UI gestures, enabling an attacker to inject arbitrary script or HTML (XSS) when a user is provoked into specific UI actions. Public...

CVE-2024-7965

CVE-2024-7965 affects Google Chrome’s V8 engine (Chromium) with an inappropriate implementation vulnerability that allows remote heap corruption via a crafted HTML page. Impact is High (CVE entry notes potential exploitation, with network attack vector and user interaction required). Affected sof...

CVE-2025-14373

Google Chrome on Android prior to version 143.0.7499.110 is vulnerable to a medium-severity security issue in the Toolbar component. An inappropriate implementation allows a remote attacker to perform domain spoofing by navigating the user to a crafted HTML page. This vulnerability is tracked as ...

CVE-2025-0446

An inappropriate implementation in the Extensions component of Google Chrome prior to version 132.0.6834.83 allows a remote attacker to perform UI spoofing . By convincing a user to engage in specific UI gestures, an attacker can use a crafted Chrome Extension to misrepresent the user interface. ...

CVE-2023-4762

CVE-2023-4762 is a Type Confusion in V8 affecting Google Chrome/Chromium prior to 116.0.5845.179 that allows remote code execution via a crafted HTML page. The vulnerability is documented in multiple sources (Chrome/Chromium release notes; Debian security advisory stating fixes in 116.0.5845.180 ...

CVE-2024-10487

Consolidated details for CVE-2024-10487 indicate an Out-of-bounds write in Dawn within Google Chrome/Chromium, exploitable remotely via a crafted HTML page. Affected software: Google Chrome/Chromium prior to version 130.0.6723.92 (Dawn component). Root cause: out-of-bounds memory access. Impact: ...

CVE-2025-6556

Google Chrome and Chromium are affected by CVE-2025-6556 , which stems from insufficient policy enforcement in the Loader component. This vulnerability allows a remote attacker to bypass content security policies (CSP) using a crafted HTML page. While the Debian security advisory mentions potenti...

CVE-2023-1234

CVE-2023-1234 affects Google Chrome on Android prior to 111.0.5563.64, due to an inappropriate implementation in Intents that enables domain spoofing via a crafted HTML page. The CVSS v3.1 base score is 4.3 (Medium). Public details in connected sources include PoC/exploit repositories related to ...

CVE-2026-19146

Google Chrome on Android (prior to version 151.0.7922.109 ) is vulnerable to an Uninitialized Use in the GPU component. A remote attacker who has already compromised the renderer process can leverage a crafted HTML page to extract sensitive information from process memory. This vulnerability has ...

CVE-2023-4764

CVE-2023-4764 is a Chrome/BFCache security UI issue: a crafted HTML page can spoof the Omnibox (URL bar) due to an incorrect BFCache security UI. The vulnerability affects Google Chrome (Chromium-based) and is addressed by a patch in Chrome 116.0.5845.179 and later. Debian/Fedora Gentoo advisorie...

CVE-2018-18356

CVE-2018-18356: A heap-based or use-after-free issue in Skia (the graphics library) affects multiple browsers/components. Connected sources indicate this vulnerability arises from a use-after-free in Skia that can be triggered via crafted content, with references tying it to Chromium before 71.0....

CVE-2024-3159

CVE-2024-3159 affects Google Chrome/Chromium’s V8 engine. It is an out-of-bounds memory access vulnerability that could allow a remote attacker to perform arbitrary read/write via a crafted HTML page. The flaw exists in Chrome/Chromium versions prior to 123.0.6312.105 and is addressed by updating...

CVE-2024-6100

Summary: CVE-2024-6100 is a type confusion in V8 affecting Google Chrome/Chromium prior to 126.0.6478.114, enabling a remote attacker to execute arbitrary code via a crafted HTML page. The issue is rooted in V8's type handling, with an attack vector over the network and a required user interactio...

CVE-2023-0129

CVE-2023-0129 is a heap buffer overflow in Chrome/Chromium’s Network Service prior to version 109.0.5414.74. The issue can be triggered when a user is persuaded to install a malicious extension and interacts with a crafted HTML page, potentially allowing heap corruption. Affected products include...

CVE-2024-9602

CVE-2024-9602 affects Chromium/Google Chrome's V8 engine. A type confusion in V8 allows a remote attacker to trigger an out-of-bounds memory write via a crafted HTML page on Chrome/Chromium builds older than 129.0.6668.100. Impact is high as per CVSS, with potential for arbitrary code execution o...

CVE-2021-21230

The CVE-2021-21230 issue affects Google Chrome’s V8 component due to a type confusion vulnerability, fixed in Chrome before 90.0.4430.93. Multiple connected sources (Debian security advisory DSA-4911-1, Alpine security page, Astra Linux bulletin, and other trackers) confirm the same root cause: i...

CVE-2026-3909

CVE-2026-3909 is a Google Chrome/Skia vulnerability: an out-of-bounds write in Skia could allow a remote attacker to trigger out-of-bounds memory access via a crafted HTML page. Affects Chrome before 146.0.7680.75; exploits are known to exist in the wild. Chrome/Chromium advisories note that fixe...