CVE-2023-2464

CVE-2023-2464 affects Google Chrome (Chromium-based) via an inappropriate implementation in PictureInPicture. A crafted HTML page and a malicious extension can lead to an origin spoof in the Chrome security UI. The vulnerability is tied to Chrome/Chromium builds prior to 113.0.5672.63 (the fixed ...

CVE-2023-4366

The CVE-2023-4366 entry describes a Use-after-free vulnerability in Chrome/Chromium Extensions prior to version 116.0.5845.96, potentially allowing heap corruption when a user is tricked into installing a malicious extension via a crafted HTML page. The issue is tied to the Extensions component, ...

CVE-2018-6149

CVE-2018-6149: Out-of-bounds write in the V8 JavaScript engine of Chromium/Google Chrome prior to 67.0.3396.87. A remote attacker could exploit this via a crafted webpage to execute arbitrary code. Remediation: upgrade to 67.0.3396.87 or newer (upstream fix). Connected sources note the issue and ...

CVE-2022-0454

CVE-2022-0454 corresponds to a heap buffer overflow in ANGLE within Google Chrome prior to 98.0.4758.80, enabling a remote attacker to potentially corrupt heap memory via a crafted HTML page. The vulnerability affects Chrome/ANGLE components, with exploitation possible through network-driven HTML...

CVE-2022-2998

CVE-2022-2998 is a Chrome use-after-free in Browser Creation that could enable heap corruption when a user engages a specific UI interaction via a crafted HTML page. Affected product/version: Google Chrome prior to 104.0.5112.101; vulnerable component is the Browser Creation path (heap misuse). I...

CVE-2022-4436

CVE-2022-4436 describes a Use-After-Free in Blink Media used by Google Chrome before version 108.0.5359.124, enabling a remote attacker to potentially trigger heap corruption via a crafted HTML page. Affected product is Google Chrome (Blink/Chromium stack). The root cause is a use-after-free in B...

CVE-2023-3733

CVE-2023-3733 affects Google Chrome/Chromium: Inappropriate implementation in WebApp Installs can allow a crafted HTML page to spoof the Omnibox contents. The issue is fixed in Chrome/Chromium around 115.0.5790.98 (and later, e.g., 115.0.5790.99 per update notes); Debian and other advisories conf...

CVE-2023-4353

CVE-2023-4353 affects ANGLE in Google Chrome up to version 116.0.5845.96. The vulnerability is a heap buffer overflow in ANGLE that can lead to heap corruption via a crafted HTML page, enabling a remote attacker to potentially exploit the browser. Affected software is Google Chrome/Chromium with ...

CVE-2026-13024

CVE-2026-13024 : The issue is in Google Chrome’s Navigation logic, where insufficient validation of untrusted input in the renderer allows a remote attacker who has compromised the renderer process to bypass site isolation via a crafted HTML page. Affected product: Google Chrome (Chromium-based)....

CVE-2026-13030

CVE-2026-13030 affects Google Chrome on Android. It describes an uninitialized use in GPU that could allow a remote attacker to read potentially sensitive data from process memory via a crafted HTML page. Impact is stated as high severity by Chromium, with the version note indicating exposure pri...

CVE-2026-14062

The CVE-2026-14062 entry concerns Google Chrome on ChromeOS with an incorrect implementation in the Views component, affecting versions prior to 150.0.7871.47. A user convincing a target to install a malicious extension could allow access to potentially sensitive data from process memory via that...

CVE-2019-5856

CVE-2019-5856 affects Chromium before 76.0.3809.87; described as an access restriction bypass due to insufficient filesystem URI permission checks. Arch Linux advisory confirms remediation by upgrading to 76.0.3809.87-1, with upstream fixes in that release. Other sources note broader Chromium fix...

CVE-2021-21214

CVE-2021-21214 refers to a use‑after‑free in the Network API of Google Chrome. The issue, exploitable via a crafted Chrome Extension, can lead to heap corruption and potentially remote code execution. Affected software is Google Chrome prior to 90.0.4430.72; multiple connected advisories corrobor...

CVE-2021-37987

CVE-2021-37987 affects Chromium’s Network APIs component, prior to 95.0.4638.54. The vulnerability is a use-after-free/heap issue that could allow a remote attacker to trigger heap corruption via crafted HTML. Affected product/version: Chromium browser engine before 95.0.4638.54. Source entries (...

CVE-2021-37996

CVE-2021-37996: Insufficient validation of untrusted input in the Downloads component of the Chromium-based Google Chrome engine before version 95.0.4638.54. This vulnerability allows a remote attacker to bypass navigation restrictions via a malicious file. The connected advisories (e.g., ASA-202...

CVE-2022-3071

CVE-2022-3071 is a use-after-free in the Tab Strip of Google Chrome on ChromeOS/Lacros prior to 105.0.5195.52, potentially allowing heap corruption via crafted UI interactions. Affected: ChromeOS Lacros environment; vulnerable component/process: Tab Strip UI handling. Impact: remote attacker coul...

CVE-2022-3370

CVE-2022-3370 is a Chrome/Chromium vulnerability: a use-after-free in Custom Elements leading to potential heap corruption. Affects Chrome/Chromium prior to version 106.0.5249.91. Exploitation would require a crafted HTML page and could lead to high-severity impact across confidentiality, integri...

CVE-2022-3888

CVE-2022-3888 is a use-after-free in Chrome’s WebCodecs implementation that could allow a remote attacker to cause heap corruption via a crafted HTML page. Affected product: Google Chrome (WebCodecs component). Root cause: use-after-free in WebCodecs leading to memory corruption. Impact: high (re...

CVE-2023-1816

CVE-2023-1816 affects Google Chrome/Chromium’s Picture-in-Picture feature, with root cause described as an incorrect security UI. It allows a remote attacker to potentially perform navigation spoofing through a crafted HTML page. Affected versions are Chrome/Chromium prior to 112.0.5615.49; remed...

CVE-2023-2134

CVE-2023-2134 affects Google Chrome/Chromium prior to 112.0.5615.137, due to an out-of-bounds memory access in the Service Worker API that could allow a remote attacker to trigger heap corruption via a crafted HTML page. The vulnerability is rated High severity with network attack vector and user...

CVE-2023-2465

CVE-2023-2465 affects Google Chrome / Chromium. The issue is an inappropriate CORS implementation that could allow a remote attacker to leak cross-origin data via a crafted HTML page. Affected component: Chromium-based browsers (Chrome/Chromium); root cause is flawed CORS handling leading to data...

CVE-2024-9121

Mode C: Concrete details found. CVE-2024-9121 affects Chromium-based Chrome/Chromium. In Chromium’s V8, an inappropriate implementation allowed out-of-bounds memory access via a crafted HTML page, with a High impact (memory corruption/potential code execution). Public references indicate Chrome/C...

CVE-2010-4494

CVE-2010-4494 is a double-free vulnerability in libxml2 (notably 2.7.8 and related versions) used by Chrome and other products. The issue affects libxml2’s handling of XPath/XML entities and could allow a remote attacker to crash or potentially execute code via crafted XML input. Public advisorie...

CVE-2011-1202

The CVE-2011-1202 issue affects libxslt 1.1.26 and earlier, where xsltGenerateIdFunction could leak heap addresses via an XSLT generate-id call (affects Chrome before 10.0.648.127 and other products). Impact: potential disclosure of memory addresses; no explicit exploitation details provided. Roo...

CVE-2021-30583

CVE-2021-30583 affects Google Chrome on iOS. The vulnerability arises from insufficient policy enforcement in image handling, allowing a remote attacker to leak cross-origin data via a crafted HTML page. Affected version: Chrome on iOS prior to 92.0.4515.107. Impact is cross-origin data leakage; ...

CVE-2021-37970

CVE-2021-37970: Use-after-free in the File System API of Google Chrome (Chromium) prior to 94.0.4606.54 can allow a remote attacker to potentially cause heap corruption via a crafted HTML page. Multiple vendor advisories note this as a Chrome/Chromium vulnerability with remediation via updates. P...

CVE-2022-0470

CVE-2022-0470 corresponds to an issue in Google Chrome’s V8 engine prior to 98.0.4758.80, described as an out-of-bounds memory access that could allow a remote attacker to potentially trigger heap corruption via a crafted HTML page. The vulnerability applies to Chrome/Chromium deployments using a...

CVE-2022-2618

CVE-2022-2618 affects Google Chrome/Chromium up to version 104.0.5112.79, with the root cause described as insufficient validation of untrusted input in Internals. The vulnerability could allow a remote attacker to bypass download restrictions via a malicious file, with a measured CVSSv3.1 base s...

CVE-2022-3304

CVE-2022-3304 is a use-after-free in CSS in Google Chrome/Chromium prior to 106.0.5249.62 that could allow remote heap corruption via a crafted HTML page. The issue affects Chrome/Chromium’s CSS handling and was fixed in Chrome 106.0.5249.61–106.0.5249.62 (stable channel). Exploitation status is ...

CVE-2022-4910

CVE-2022-4910: In Google Chrome, an inappropriate Autofill implementation allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Affected product: Google Chrome (Chromium-based). Root cause: incorrect Autofill handling as described in the CVE entry. Impact: navigatio...

CVE-2023-4360

CVE-2023-4360 affects Color in Google Chrome (Chromium) prior to 116.0.5845.96. A remote attacker could craft an HTML page to obfuscate security UI. The issue is confirmed public in Chromium’s advisory and Chrome/Debian updates note the fix in version 116.0.5845.96 (and later). Remediation: upgra...

CVE-2023-6347

CVE-2023-6347 is a use-after-free in Mojo within Google Chrome/Chromium, prior to version 119.0.6045.199, exposing potential heap corruption via a crafted HTML page. Connected sources confirm the affected component is Mojo in Chromium-based Chrome, with an impact described as high (network attack...

CVE-2026-19557

CVE-2026-19557 is a use-after-free in Chrome’s TabStrip on macOS, allowing a renderer-compromised attacker to potentially escape the sandbox via a crafted HTML page. Affects Google Chrome versions prior to 151.0.7922.137 (Mac; also 151.0.7922.137/138 for Windows/macOS per the Chrome stable update...

CVE-2022-3652

CVE-2022-3652 is a type confusion issue in V8 affecting Google Chrome/Chromium prior to 107.0.5304.62, enabling potential remote exploitation via crafted HTML pages and leading to heap corruption. The Chrome stable-channel fix is 107.0.5304.62 (Windows/Linux/macOS) with subsequent 107.0.5304.68 D...

CVE-2024-0806

CVE-2024-0806 describes a use-after-free in Google Chrome Passwords, leading to potential heap corruption via specific UI interaction. Affected component: Chrome/Chromium Passwords module; vulnerable before version 121.0.6167.85. Evidence from multiple sources (including Debian security advisory ...

CVE-2026-13857

CVE-2026-13857 describes an insecure implementation in Chrome’s Geometry handling that permits a remote attacker to spoof UI via a crafted HTML page, requiring the user to perform specific UI gestures. The vulnerability affects Chrome versions prior to 150.0.7871.47 and can be triggered when a us...

CVE-2026-13941

CVE-2026-13941 affects Google Chrome on Android. The vulnerability arises from an inappropriate SiteSettings implementation that enables UI spoofing via a crafted HTML page. Affected version is Chrome for Android before 150.0.7871.47. Impact is UI spoofing (no confidentiality, no data loss per th...

CVE-2026-14039

CVE-2026-14039 concerns Google Chrome’s GetUserMedia, where insufficient policy enforcement before version 150.0.7871.47 allowed a remote attacker to bypass the same-origin policy via a crafted HTML page. The vulnerability affects Chrome components related to media permissions and page-origin che...

CVE-2018-6148

CVE-2018-6148 affects Google Chrome/chromium prior to version 67.0.3396.79, where incorrect handling of the Content Security Policy (CSP) header allowed a remote attacker to bypass navigation restrictions with a crafted HTML page. The vulnerability is due to CSP header handling and is mitigated b...

CVE-2021-21117

CVE-2021-21117 is a Chromium/ Cryptohome policy enforcement issue reported as a local privilege-escalation vulnerability. The connected documents confirm the flaw exists in Cryptohome before Chromium 88.0.4324.96, allowing a local attacker to escalate OS privileges via a crafted file. The impact ...

CVE-2022-3446

CVE-2022-3446 is a heap buffer overflow in WebSQL within Google Chrome (Chromium) prior to 106.0.5249.119. The vulnerability affects the WebSQL component and could enable heap corruption via a crafted HTML page. Google Chrome’s stable channel update 106.0.5249.119 (and related release notes) indi...

CVE-2022-4180

CVE-2022-4180 affects Google Chrome prior to 108.0.5359.71, involving a use-after-free in the Mojo component that can be triggered when a user is lured into installing a malicious Chrome extension. The underlying issue is heap corruption via crafted Extension payloads. The vulnerability is rated ...

CVE-2023-1815

CVE-2023-1815: Use-after-free in Chrome/Chromium Networking APIs (heap corruption) due to a memory reuse issue. Affects Google Chrome/Chromium prior to 112.0.5615.49; exploitation requires user interaction (UI click) after convincing the user. Remediation: update to Chromium 112.0.5615.49 or newe...

CVE-2023-3740

CVE-2023-3740 is a low-severity vulnerability in Google Chrome/Chromium themes due to insufficient validation of untrusted input in Themes, allowing a remote attacker to deliver malicious content via a crafted background URL. Affected product: Google Chrome (Chromium-based) before 115.0.5790.98. ...

CVE-2019-5859

CVE-2019-5859 : Google Chrome on Windows prior to 76.0.3809.87 was vulnerable due to insufficient filtering in URI schemes, allowing a crafted HTML page to bypass navigation restrictions by loading alternative browsers. The issue was fixed in the 76.0.3809.87 (or later) Chrome update; Debian/Arch...

CVE-2021-30586

CVE-2021-30586 is a use-after-free vulnerability in Chrome’s dialog-box handling on Windows, affecting Chrome versions before 92.0.4515.107. A remote attacker could exploit this by convincing a user to install a malicious extension and by presenting a crafted HTML page, potentially triggering hea...

CVE-2023-3735

CVE-2023-3735 concerns Google Chrome/Chromium: an inappropriate implementation in the Web API Permission Prompts allowed a crafted HTML page to obfuscate security UI. The issue affects Chrome/Chromium’s permission UI handling and is classified as Medium severity (CVSS v3.1: AV:N/AC:L/PR:N/UI:R/S:...

CVE-2023-6512

The CVE-2023-6512 issue affects Google Chrome’s Web Browser UI, where an inappropriate implementation in the UI could allow a remote attacker to spoof the contents of an iframe dialog context menu via a crafted HTML page. Affected product/versions include Chrome prior to 120.0.6099.62. The underl...

CVE-2024-0224

The CVE-2024-0224 entry describes a use-after-free in WebAudio in Google Chrome/Chromium, leading to potential heap corruption via a crafted HTML page. Affected component: Web Audio in Chromium-based browsers prior to version 120.0.6099.199. Root cause: use-after-free in WebAudio code path that m...

CVE-2024-0811

CVE-2024-0811 describes an insecure Extensions API implementation in Google Chrome prior to 121.0.6167.85 that could allow a user-assisted attacker to leak cross-origin data via a malicious extension. The issue is tied to Chrome/Chromium’s Extensions API and is labeled with a low severity. Affect...