CVE-2018-6116

CVE-2018-6116 concerns a null pointer dereference in WebAssembly within Google Chrome before 66.0.3359.117, enabling a remote attacker to potentially trigger out-of-bounds memory access via a crafted HTML page. Connected advisories confirm the vulnerability as part of Chrome/WebAssembly issues an...

CVE-2021-38009

CVE-2021-38009 affects Chromium/Chrome cache component prior to 96.0.4664.45. Root cause: inappropriate implementation in cache. Impact: remote attacker could leak cross-origin data via crafted HTML. Remediation: upgrade to Chromium/Chrome 96.0.4664.45 or newer (as reflected in Debian/Arch Linux ...

CVE-2022-0306

CVE-2022-0306 is a reported heap buffer overflow in PDFium used by Google Chrome, prior to version 97.0.4692.99. The issue allows a remote attacker to potentially cause heap corruption via a crafted HTML page. Multiple connected sources confirm the same description and link the vulnerability to C...

CVE-2022-2854

CVE-2022-2854: A use-after-free in SwiftShader within Google Chrome/Chromium (pre-104.0.5112.101) could allow a remote attacker to cause heap corruption via a crafted HTML page. The vulnerability is confirmed in Linux distributions (e.g., Debian Chromium package fixed to 104.0.5112.101) and is de...

CVE-2023-4358

The CVE-2023-4358 entry concerns a Use-After-Free in DNS in Google Chrome/Chromium before version 116.0.5845.96, enabling remote heap corruption via a crafted HTML page. Affected products include Google Chrome/Chromium (and derivatives); root cause is a DNS-use-after-free. Impact is high (potenti...

CVE-2023-6509

CVE-2023-6509 describes a Use-After-Free vulnerability in Chrome/Chromium's Side Panel Search, where handling of specific UI interactions could lead to heap corruption. Affected product: Google Chrome/Chromium browsers (Chromium-based). Root cause: use-after-free in the Side Panel Search componen...

CVE-2024-0810

CVE-2024-0810 affects Google Chrome/Chromium DevTools. The issue is an insufficient policy enforcement vulnerability in DevTools that, when a user installs a crafted malicious extension, can leak cross-origin data. Impact is described as medium severity. Affected versions are Chrome/Chromium prio...

CVE-2026-13023

CVE-2026-13023: Uninitialized Use in Chrome’s GPU (before 149.0.7827.197). A remote attacker who already compromised the renderer could read potentially sensitive data from process memory via a crafted HTML page. Impact = memory disclosure; remediation = update to Chrome 149.0.7827.197 or newer (...

CVE-2026-19560

CVE-2026-19560 is a use-after-free in Blink used by Google Chrome prior to 151.0.7922.137. The issue allows a remote attacker to execute arbitrary code inside the Chrome sandbox via a crafted HTML page. Affected component: Blink (core rendering engine); root cause: use-after-free in Blink on HTML...

CVE-2018-6120

CVE-2018-6120 affects Google Chrome’s PDFium component. An integer overflow could cause a heap out-of-bounds write in PDFium, enabling a remote attacker to execute arbitrary code inside Chrome’s sandbox via a crafted PDF file. Affected version: Chrome prior to 66.0.3359.170. Remediation: upgrade ...

CVE-2021-37964

CVE-2021-37964 is an Inappropriate implementation vulnerability in ChromeOS Networking within Google Chrome on ChromeOS, prior to version 94.0.4606.54. An attacker with a rogue wireless access point could perform a wifi impersonation attack via a crafted ONC file. Public references confirm the is...

CVE-2021-4057

CVE-2021-4057 is a use-after-free in Chromium’s file API prior to 96.0.4664.93. Multiple connected advisories describe it as allowing a remote attacker who gains renderer access to potentially trigger heap corruption. The vulnerability is among a set of Chromium issues fixed in version 96.0.4664....

CVE-2022-1860

CVE-2022-1860 affects Google Chrome UI Foundations on Chrome OS prior to 102.0.5005.61. It is described as a use-after-free vulnerability in the UI Foundations component that can lead to heap corruption when a user is drawn into specific interactions. The issue is confirmed in Chrome release note...

CVE-2022-1873

CVE-2022-1873 applies to Google Chrome where insufficient policy enforcement in COOP allowed cross-origin data leakage via a crafted HTML page. The issue is tied to Chrome versions before 102.0.5005.61. Affected components: Chrome’s COOP handling in cross-origin contexts. Impact per sources: pote...

CVE-2022-3886

CVE-2022-3886 is a use-after-free in Google Chrome’s Speech Recognition feature, prior to 107.0.5304.106, allowing a remote attacker to potentially cause heap corruption via a crafted HTML page. The Chrome update notes indicate this and other fixes in Stable Channel 107.x, with the CVE listed as ...

CVE-2022-4177

CVE-2022-4177 : Use-after-free in Chrome extensions; vulnerable as of Chrome/Chromium before 108.0.5359.71. An attacker who persuades a user to install a crafted extension via UI interaction could exploit heap corruption. The Chrome stable release 108.0.5359.71 and related Chromium fixes address ...

CVE-2023-3734

CVE-2023-3734: In Google Chrome/Chromium, an inappropriate implementation in Picture in Picture allowed a remote attacker to potentially spoof the Omnibox via a crafted HTML page. The issue is described as affecting Chrome/Chromium prior to version 115.0.5790.98, with remediation by upgrading to ...

CVE-2026-12446

CVE-2026-12446 : In Chromium-based Google Chrome, an inappropriate implementation in Passwords prior to 149.0.7827.155 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Affected component: Passwords handling in Chrome/Chromium. Root cause: improper cross-origin data han...

CVE-2018-17464

CVE-2018-17464 refers to a URL spoofing vulnerability in the Omnibox component of Chromium/Google Chrome for iOS, caused by incorrect handling of browsing history prior to version 70.0.3538.67. A remote attacker could craft HTML to spoof the Omnibox content. Connected advisories confirm the issue...

CVE-2021-37966

Technical details for CVE-2021-37966 are not publicly available in the provided connected documents. Monitor for updates; no confirmed exploit vectors, impacted products, or remediation details are present in these sources.

CVE-2021-37986

CVE-2021-37986 is a heap buffer overflow in the Settings component of the Chromium browser engine (Chrome/Chromium) prior to 95.0.4638.54. The issue could allow a remote attacker to trigger heap corruption via a crafted HTML page by interacting with DevTools. Affected product scope includes Chrom...

CVE-2021-38018

CVE-2021-38018 affects the Chromium/Chrome navigation component. An inappropriate navigation implementation can allow a remote attacker to spoof a domain via a crafted HTML page. Public advisories and CVE records consistently describe this as a domain spoofing vulnerability in Chromium-based engi...

CVE-2022-0102

CVE-2022-0102 affects Google Chrome/Chromium’s V8 engine through type confusion, allowing remote attackers to potentially trigger heap corruption. The vulnerability is tied to Chrome/Chromium before version 97.0.4692.71. Impact per sources includes arbitrary code execution, denial of service, or ...

CVE-2022-0465

CVE-2022-0465 concerns a use-after-free in Chrome’s Extensions component, leading to potential heap corruption. The vulnerability affects Google Chrome/Chromium builds before version 98.0.4758.80, with the underlying issue described as a use-after-free in Extensions, which could be triggered by u...

CVE-2022-1489

Summary of CVE-2022-1489 details from connected documents: Google Chrome/Chromium’s UI Shelf on Chrome OS with Lacros, prior to version 101.0.4951.41, is affected by an out-of-bounds memory access bug that can lead to heap corruption through specific user interactions. The vulnerability is descri...

CVE-2023-2462

The connected documents confirm CVE-2023-2462 affects Google Chrome/Chromium, tied to an inappropriate implementation in Prompts that allowed a remote attacker to obfuscate main origin data via a crafted HTML page. Impact is described as Medium; affected components relate to Chrome/Chromium promp...

CVE-2024-9120

CVE-2024-9120 is a use-after-free in Dawn within Chromium-based Chrome on Windows, enabling potential heap corruption via a crafted HTML page. Affected software is Google Chrome/Chromium with Dawn integration; the issue has a CVSS v3.1 base score of 8.8 (HIGH) with network attack vector, no privi...

CVE-2026-17651

CVE-2026-17651 refers to a vulnerability in Dawn within Google Chrome on Android, caused by insufficient validation of untrusted input. The issue could potentially allow a sandbox escape via a crafted HTML page. The vulnerability is labeled as Critical (CVSS 3.1: 9.6) with network attack vector a...

CVE-2026-19162

CVE-2026-19162 affects Google Chrome’s V8 engine prior to version 151.0.7922.109. The vulnerability is an out-of-bounds write in V8 that, via a crafted HTML page, could let a remote attacker execute arbitrary code inside the browser sandbox. The connected Chrome advisory indicates a stable-channe...

CVE-2018-18336

CVE-2018-18336 is a use-after-free in the PDFium component of Chromium/Google Chrome prior to version 71.0.3578.80, enabling potential heap corruption via a crafted PDF file. The Arch Linux security advisory ASA-201812-2 (and Debian/DSA-4352-1 apart from other sources) confirm the issue and state...

CVE-2018-18350

CVE-2018-18350 is part of a set of Chromium/browser CSP-policy issues fixed in the 71.0.3578.80 update. The described vulnerability is an access/ CSP enforcement bypass in Blink during navigations, allowing a crafted HTML page to bypass content security policy and potentially lead to arbitrary co...

CVE-2021-37956

CVE-2021-37956 describes a use-after-free in Offline use in Google Chrome on Android prior to 94.0.4606.54, where a renderer compromise could potentially enable heap corruption via a crafted HTML page. The connected Debian advisory confirms this CVE is among multiple Chromium issues and provides ...

CVE-2021-38005

CVE-2021-38005 affects Google Chrome/Chromium's loader component, with a use-after-free vulnerability prior to 96.0.4664.45 that could enable remote code execution via a crafted HTML page. Affected engines: Chromium-based Chrome/Chromium up to version 96.0.4664.45; root cause: use-after-free in t...

CVE-2021-38017

CVE-2021-38017 affects Chromium/Google Chrome’s iframe sandbox. Before version 96.0.4664.45, insufficient policy enforcement in the iframe sandbox allowed a remote attacker to bypass navigation restrictions via a crafted HTML page (sandbox escape). The issue is documented across multiple advisori...

CVE-2022-0452

CVE-2022-0452 is a Chrome vulnerability described in multiple sources as a use-after-free in Safe Browsing that could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. The issue affects Chrome prior to version 98.0.4758.80 and was addressed in the Chrome 98 ...

CVE-2022-1633

CVE-2022-1633 : Use-after-free in Sharesheet of Google Chrome on Chrome OS prior to 101.0.4951.64. Exploitation required user interaction with specific UI actions, potentially enabling heap corruption and remote code execution as stated in the vulnerability description. Affected product: Google C...

CVE-2022-3661

Google Chrome/Chromium vulnerability CVE-2022-3661 arises from insufficient data validation in Extensions, allowing a remote attacker who already compromised the renderer to leak cross-origin data via a crafted extension. Affected versions are Chrome/Chromium prior to 107.0.5304.62; the issue is ...

CVE-2022-4025

CVE-2022-4025 relates to Google Chrome prior to 98.0.4758.80, where an inappropriate implementation in Paint could leak cross-origin data outside an iframe via a crafted HTML page. The vulnerability affects multiple platforms; exploitation would involve a user loading a crafted page to trigger da...

CVE-2023-3737

CVE-2023-3737: A vulnerability in Google Chrome/Chromium—Inappropriate implementation in Notifications—could allow a remote attacker to spoof media notifications via a crafted HTML page. Affected: Chrome/Chromium (Notifications component). Root cause: improper implementation in notification handl...

CVE-2023-4365

CVE-2023-4365 is a Chrome/Chromium vulnerability due to an inappropriate implementation in Fullscreen. Root cause: Fullscreen handling allows a crafted HTML page to obfuscate the security UI. Affects Google Chrome/Chromium (and related Edge in some docs) prior to version 116.0.5845.96. Impact per...

CVE-2023-6511

CVE-2023-6511 : Concrete details across connected sources show an inappropriate implementation in Autofill for Google Chrome prior to version 120.0.6099.62, allowing a remote attacker to bypass Autofill restrictions via a crafted HTML page. The Chromium-based issue is described as a low-severity ...

CVE-2024-0807

CVE-2024-0807 : Use-after-free in Web Audio code of Google Chrome/Chromium prior to 121.0.6167.85 can allow a remote attacker to potentially trigger heap corruption via a crafted HTML page. Impact is high (C/H/I/A: high). Fixes are included in Chrome/Chromium updates (e.g., Chrome 121.0.6167.85 a...

CVE-2025-3066

CVE-2025-3066: In Google Chrome/Chromium, a use-after-free in Site Isolation could allow a remote attacker to trigger heap corruption via a crafted HTML page. The issue affects Chrome before 135.0.7049.84; a security fix was released in the ChromeOS/Chrome desktop Stable channel update to 135.0.7...

CVE-2026-7351

CVE-2026-7351 describes a race in MHTML handling in Google Chrome prior to 147.0.7727.138. The vulnerability allows a user who is induced to install a crafted Chrome Extension to leak cross-origin data via MHTML processing. The root cause, per sources, is a race condition in MHTML handling; no ex...

CVE-2018-6145

Technical details about CVE-2018-6145 are not publicly available in the provided documents; monitor for updates.

CVE-2021-37965

CVE-2021-37965 affects Google Chrome/Chromium’s Background Fetch API. The vulnerability stems from an inappropriate implementation, enabling a remote attacker to leak cross-origin data via a crafted HTML page. The NVD records a CVSS v3.1 base score of 4.3 (Medium) with network attack vector, no p...

CVE-2021-4059

CVE-2021-4059 is a Chromium/Google Chrome loader vulnerability with insufficient data validation in the loader prior to version 96.0.4664.93, enabling a remote attacker to leak cross-origin data via a crafted HTML page. Affected software entry points include the Chromium browser engine used in Ch...

CVE-2022-3449

CVE-2022-3449 affects Google Chrome/Chromium prior to 106.0.5249.119, due to a use-after-free in Safe Browsing that could allow heap corruption via a crafted Chrome Extension after user installation of a malicious extension. The connected documents corroborate the issue and specify the impact as ...

CVE-2018-18358

CVE-2018-18358 affects Chromium/Google Chrome prior to 71.0.3578.80, where WPAD handling fails to correctly treat localhost, enabling a local-network attacker to proxy localhost via a crafted WPAD file. Connected advisories (Arch, Debian) confirm this as an access restriction bypass in the Proxy ...

CVE-2021-21216

CVE-2021-21216 affects Google Chrome Autofill: an inappropriate implementation allowed remote attackers to spoof the security UI via a crafted HTML page. The issue is categorized as content spoofing and arises from Autofill handling in Chrome prior to 90.0.4430.72. Connected advisories (Arch Linu...