CVE-2021-4059

CVE-2021-4059 is a Chromium/Google Chrome loader vulnerability with insufficient data validation in the loader prior to version 96.0.4664.93, enabling a remote attacker to leak cross-origin data via a crafted HTML page. Affected software entry points include the Chromium browser engine used in Ch...

CVE-2022-0102

CVE-2022-0102 affects Google Chrome/Chromium’s V8 engine through type confusion, allowing remote attackers to potentially trigger heap corruption. The vulnerability is tied to Chrome/Chromium before version 97.0.4692.71. Impact per sources includes arbitrary code execution, denial of service, or ...

CVE-2022-3661

Google Chrome/Chromium vulnerability CVE-2022-3661 arises from insufficient data validation in Extensions, allowing a remote attacker who already compromised the renderer to leak cross-origin data via a crafted extension. Affected versions are Chrome/Chromium prior to 107.0.5304.62; the issue is ...

CVE-2023-2462

The connected documents confirm CVE-2023-2462 affects Google Chrome/Chromium, tied to an inappropriate implementation in Prompts that allowed a remote attacker to obfuscate main origin data via a crafted HTML page. Impact is described as Medium; affected components relate to Chrome/Chromium promp...

CVE-2023-3737

CVE-2023-3737: A vulnerability in Google Chrome/Chromium—Inappropriate implementation in Notifications—could allow a remote attacker to spoof media notifications via a crafted HTML page. Affected: Chrome/Chromium (Notifications component). Root cause: improper implementation in notification handl...

CVE-2023-4356

CVE-2023-4356 describes a use-after-free in Audio for Google Chrome prior to 116.0.5845.96, enabling a remote attacker who induces user UI interaction to potentially trigger heap corruption via a crafted HTML page. Public advisories (Debian, FreeBSD, Gentoo, Fedora, etc.) align on affected produc...

CVE-2023-4364

CVE-2023-4364 describes an insecure implementation in Chrome’s Permission Prompts prior to 116.0.5845.96, allowing a crafted HTML page to obfuscate security UI. The issue affects Google Chrome (Chromium) and stems from an inappropriate implementation in Permission Prompts, with a Medium severity ...

CVE-2024-0806

CVE-2024-0806 describes a use-after-free in Google Chrome Passwords, leading to potential heap corruption via specific UI interaction. Affected component: Chrome/Chromium Passwords module; vulnerable before version 121.0.6167.85. Evidence from multiple sources (including Debian security advisory ...

CVE-2026-15130

CVE-2026-15130 affects Google Chrome navigation policy enforcement. The vulnerability arises from insufficient policy enforcement in Navigation, enabling a remote attacker to bypass site isolation via a crafted HTML page. A fix is available in the Stable channel: Windows/Mac 150.0.7871.114/115 an...

CVE-2018-16065

CVE-2018-16065 is a Javascript reentrancy/use-after-free bug in V8 within Google Chrome, before version 69.0.3497.81, allowing a remote attacker to execute arbitrary code inside the Chrome sandbox via a crafted HTML page. Multiple connected sources confirm the issue and reference a fix in Chromiu...

CVE-2018-17464

CVE-2018-17464 refers to a URL spoofing vulnerability in the Omnibox component of Chromium/Google Chrome for iOS, caused by incorrect handling of browsing history prior to version 70.0.3538.67. A remote attacker could craft HTML to spoof the Omnibox content. Connected advisories confirm the issue...

CVE-2018-6138

CVE-2018-6138 affects Google Chrome/Chromium extensions via insufficient policy enforcement in the Extensions API, enabling a user-assisted bypass of navigation restrictions by installing a malicious extension. Affected are versions prior to 67.0.3396.62; remediation per advisories is to upgrade ...

CVE-2021-37965

CVE-2021-37965 affects Google Chrome/Chromium’s Background Fetch API. The vulnerability stems from an inappropriate implementation, enabling a remote attacker to leak cross-origin data via a crafted HTML page. The NVD records a CVSS v3.1 base score of 4.3 (Medium) with network attack vector, no p...

CVE-2021-4057

CVE-2021-4057 is a use-after-free in Chromium’s file API prior to 96.0.4664.93. Multiple connected advisories describe it as allowing a remote attacker who gains renderer access to potentially trigger heap corruption. The vulnerability is among a set of Chromium issues fixed in version 96.0.4664....

CVE-2021-4316

CVE-2021-4316 affects Google Chrome (Cast UI) held in Chromium-based builds. The vulnerability arises from an inappropriate implementation in Cast UI that allowed a remote attacker to spoof the browser UI via a crafted HTML page. The impact is described as spoofing the UI with Low severity (NVD C...

CVE-2022-0452

CVE-2022-0452 is a Chrome vulnerability described in multiple sources as a use-after-free in Safe Browsing that could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. The issue affects Chrome prior to version 98.0.4758.80 and was addressed in the Chrome 98 ...

CVE-2022-1489

Summary of CVE-2022-1489 details from connected documents: Google Chrome/Chromium’s UI Shelf on Chrome OS with Lacros, prior to version 101.0.4951.41, is affected by an out-of-bounds memory access bug that can lead to heap corruption through specific user interactions. The vulnerability is descri...

CVE-2022-3652

CVE-2022-3652 is a type confusion issue in V8 affecting Google Chrome/Chromium prior to 107.0.5304.62, enabling potential remote exploitation via crafted HTML pages and leading to heap corruption. The Chrome stable-channel fix is 107.0.5304.62 (Windows/Linux/macOS) with subsequent 107.0.5304.68 D...

CVE-2023-3734

CVE-2023-3734: In Google Chrome/Chromium, an inappropriate implementation in Picture in Picture allowed a remote attacker to potentially spoof the Omnibox via a crafted HTML page. The issue is described as affecting Chrome/Chromium prior to version 115.0.5790.98, with remediation by upgrading to ...

CVE-2024-0807

CVE-2024-0807 : Use-after-free in Web Audio code of Google Chrome/Chromium prior to 121.0.6167.85 can allow a remote attacker to potentially trigger heap corruption via a crafted HTML page. Impact is high (C/H/I/A: high). Fixes are included in Chrome/Chromium updates (e.g., Chrome 121.0.6167.85 a...

CVE-2024-3515

CVE-2024-3515 describes a use-after-free in the Dawn component of Google Chrome/Chromium prior to version 123.0.6312.122. The underlying issue can allow a remote attacker to potentially trigger heap corruption via a crafted HTML page, with the described impact of arbitrary code execution or simil...

CVE-2025-3619

CVE-2025-3619 affects Google Chrome (Windows) and Chromium code paths dealing with codecs. A heap buffer overflow in Codecs allowed a remote attacker to potentially trigger heap corruption via a crafted HTML page, enabling likely arbitrary code execution or crash as described in the entry. Public...

CVE-2026-12446

CVE-2026-12446 : In Chromium-based Google Chrome, an inappropriate implementation in Passwords prior to 149.0.7827.155 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Affected component: Passwords handling in Chrome/Chromium. Root cause: improper cross-origin data han...

CVE-2018-6092

The CVE-2018-6092 entry relates to an integer overflow in Chrome’s WebAssembly implementation on 32‑bit systems, allowing remote code execution inside the sandbox via a crafted HTML page. Affected software from the connected advisories includes Google Chrome/Chromium up to version 66.0.3359.117 (...

CVE-2018-6118

CVE-2018-6118 is a use-after-free in Google Chrome’s Media Cache (incognito cache double-eviction) exploited via crafted HTML on renderer-compromised sites prior to 66.0.3359.139. Affected product: Google Chrome (Media Cache component). Impact: arbitrary code execution or memory corruption; Chrom...

CVE-2021-21216

CVE-2021-21216 affects Google Chrome Autofill: an inappropriate implementation allowed remote attackers to spoof the security UI via a crafted HTML page. The issue is categorized as content spoofing and arises from Autofill handling in Chrome prior to 90.0.4430.72. Connected advisories (Arch Linu...

CVE-2021-38007

CVE-2021-38007 describes a type confusion vulnerability in the V8 component of the Chromium-based Chromium browser engine prior to version 96.0.4664.45. Multiple connected advisories confirm the same issue affecting Chromium-derived products (e.g., Chromium, Vivaldi, Opera) and list it among a br...

CVE-2022-1858

CVE-2022-1858 is a Chrome/Chromium DevTools vulnerability: an out-of-bounds memory read in DevTools could be triggered by specific user interaction, leading to potential data exposure. Affected product is Google Chrome through versions prior to 102.0.5005.61 (Chromium/DevTools codebase). The issu...

CVE-2022-3886

CVE-2022-3886 is a use-after-free in Google Chrome’s Speech Recognition feature, prior to 107.0.5304.106, allowing a remote attacker to potentially cause heap corruption via a crafted HTML page. The Chrome update notes indicate this and other fixes in Stable Channel 107.x, with the CVE listed as ...

CVE-2023-4365

CVE-2023-4365 is a Chrome/Chromium vulnerability due to an inappropriate implementation in Fullscreen. Root cause: Fullscreen handling allows a crafted HTML page to obfuscate the security UI. Affects Google Chrome/Chromium (and related Edge in some docs) prior to version 116.0.5845.96. Impact per...

CVE-2025-1920

CVE-2025-1920 affects Google Chrome/Chromium where a Type Confusion in V8 prior to 134.0.6998.88 can lead to heap corruption via a crafted HTML page. The vulnerability originates in V8’s handling of certain objects, with impact described as high for confidentiality, integrity, and availability. A...

CVE-2026-15108

CVE-2026-15108: In Google Chrome, an Integer overflow in the Extensions API prior to 150.0.7871.115 allows an attacker to trigger an out-of-bounds memory read by convincing a user to install a crafted extension. Affected product: Google Chrome (Extensions API). Root cause: integer overflow in the...

CVE-2018-17476

CVE-2018-17476 concerns Google Chrome/Chromium before 70.0.3538.67, where an incorrect Cast UI dialog placement could allow a remote attacker to obscure the full-screen warning via a crafted HTML page. The issue is categorized as content spoofing/UI-related, with potential to mislead users about ...

CVE-2018-18344

CVE-2018-18344 affects Google Chrome/Chromium before 71.0.3578.80 where the setDownloadBehavior devtools protocol feature in Extensions could be abused by a remote attacker who controls an installed extension to access local files. The issue is described as an inappropriate implementation in the ...

CVE-2018-18346

CVE-2018-18346 affects Chromium/Google Chrome before 71.0.3578.80. Reported as an incorrect security UI issue in Blink, enabling a crafted HTML page to cause a confusing browser UI. The Arch Linux advisory confirms the issue set includes CVE-2018-18346 and recommends upgrading to 71.0.3578.80 or ...

CVE-2018-18358

CVE-2018-18358 affects Chromium/Google Chrome prior to 71.0.3578.80, where WPAD handling fails to correctly treat localhost, enabling a local-network attacker to proxy localhost via a crafted WPAD file. Connected advisories (Arch, Debian) confirm this as an access restriction bypass in the Proxy ...

CVE-2018-6179

CVE-2018-6179 is a Google Chrome/Chromium extension vulnerability: insufficient enforcement of file access permission in the activeTab case allowed a malicious extension to read local files. Affected version range is Chrome/Chromium prior to 68.0.3440.75. Impact described in sources as a local fi...

CVE-2022-0606

CVE-2022-0606 is a Use-after-Free in ANGLE affecting Google Chrome prior to 98.0.4758.102. The vulnerability could allow a remote attacker to cause heap corruption via a crafted HTML page. Affected component is ANGLE within Chrome/Chromium. The fix was released in Chrome 98.0.4758.102 (stable cha...

CVE-2022-1134

CVE-2022-1134 is a Type Confusion in V8 affecting Google Chrome up to version 100.0.4896.60 prior to the March 2022 stability update. The vulnerability allows a remote attacker to potentially trigger heap corruption through a crafted HTML page. The Chrome release notes for Chrome 100 enumerate th...

CVE-2022-3053

CVE-2022-3053 corresponds to an “Inappropriate implementation in Pointer Lock” in Google Chrome on macOS prior to 105.0.5195.52, enabling a remote attacker to restrict user navigation via a crafted HTML page. The connected documents confirm this vulnerability in Chromium/Chrome with affected vers...

CVE-2023-0128

CVE-2023-0128 is a use-after-free in Chrome OS Overview Mode for Google Chrome prior to 109.0.5414.74, enabling heap corruption via a crafted HTML page when a user is prompted by specific UI interactions. The vulnerability affects Chrome OS/Chrome Desktop builds and was publicly addressed in the ...

CVE-2023-0928

Affected software: Google Chrome (SwiftShader component). Issue: Use-after-free in SwiftShader could enable heap corruption via a crafted HTML page. Version scope: prior to 110.0.5481.177. Impact: remote attacker could potentially exploit, with high severity (CVE-2023-0928). Root cause: use-after...

CVE-2023-4363

CVE-2023-4363–Inappropriate implementation in WebShare in Google Chrome (Android) prior to 116.0.5845.96 allowed a remote attacker to spoof the contents of a dialog URL via a crafted HTML page. Connected advisories confirm this CVE is tracked with Chromium updates; fixes are part of Chrome/Chromi...

CVE-2023-6511

CVE-2023-6511 : Concrete details across connected sources show an inappropriate implementation in Autofill for Google Chrome prior to version 120.0.6099.62, allowing a remote attacker to bypass Autofill restrictions via a crafted HTML page. The Chromium-based issue is described as a low-severity ...

CVE-2026-13023

CVE-2026-13023: Uninitialized Use in Chrome’s GPU (before 149.0.7827.197). A remote attacker who already compromised the renderer could read potentially sensitive data from process memory via a crafted HTML page. Impact = memory disclosure; remediation = update to Chrome 149.0.7827.197 or newer (...

CVE-2011-3068

Technical details for CVE-2011-3068 are not available in the provided connected documents. The initial description mentions a use-after-free in Chrome's CSS engine but no further specifics are supplied.

CVE-2018-17477

CVE-2018-17477 affects Chromium/Google Chrome extensions UI: a UI spoofing vulnerability in the extensions pane allows a remote attacker to spoof extension popups via a crafted page. Root cause is a UI spoofing vulnerability in the Extensions component present before version 70.0.3538.67. Exploit...

CVE-2018-18341

CVE-2018-18341 affects Chromium/Google Chrome prior to 71.0.3578.80. The Blink/WebKit component contains a heap-based buffer overflow that could allow a remote attacker to exploit heap corruption via a crafted HTML page. Impact is remote code execution potential as part of heap corruption; exploi...

CVE-2018-18342

Chromium before version 71.0.3578.80 is affected by CVE-2018-18342 (and related CVEs listed in ASA-201812-2). The vulnerability for CVE-2018-18342 is an out-of-bounds write in the V8 JavaScript engine, enabling a remote attacker to execute arbitrary code inside the Chrome sandbox via a crafted HT...

CVE-2018-18351

CVE-2018-18351 is a Chromium/Google Chrome vulnerability described in connected sources as an access restriction bypass in the Navigation component, caused by insufficient policy enforcement that allows bypassing the SameSite cookie policy via a crafted HTML page. Affected product: Chromium/Chrom...