CVE-2018-18354

CVE-2018-18354 affects Google Chrome on Windows prior to 71.0.3578.80. The root cause is insufficient validation of external protocols in the Shell Integration component, enabling a remote attacker to launch external programs via a crafted HTML page. The vulnerability allows potential arbitrary c...

CVE-2018-6056

CVE-2018-6056 : A type confusion in Google Chrome’s V8 JavaScript engine could cause a heap out-of-bounds write, enabling remote arbitrary code execution inside the sandbox via a crafted HTML page. Affected: Chrome with V8 up to version prior to 64.0.3282.168. Remediation : upgrade to Chrome 64.0...

CVE-2018-6124

CVE-2018-6124 is a type confusion vulnerability in Blink ReadableStreams in Google Chrome (Chromium) prior to 67.0.3396.62. The underlying issue is a type confusion in Blink’s ReadableStreams, allowing a remote attacker to potentially cause object corruption via a crafted HTML page. Affected soft...

CVE-2021-21219

CVE-2021-21219 concerns uninitialized data in PDFium used by Google Chrome prior to 90.0.4430.72, enabling a remote attacker to glean potentially sensitive information from process memory via a crafted PDF. The connected documents corroborate this information-disclosure impact via PDFium across C...

CVE-2021-4079

CVE-2021-4079 refers to an out-of-bounds write in WebRTC within Google Chrome before version 96.0.4664.93, leading to potential heap corruption by crafted WebRTC packets. The connected security notices confirm the affected component as Chromium-based Chrome/WebRTC, with the vulnerability enabling...

CVE-2022-0464

CVE-2022-0464 – Google Chrome/Chromium: Use-after-free in Accessibility leading to possible heap corruption. Affected: Chrome/Chromium browsers prior to 98.0.4758.80. Root cause: use-after-free in Accessibility code path; exploit could require user interaction. Impact: high (potential for comprom...

CVE-2022-3449

CVE-2022-3449 affects Google Chrome/Chromium prior to 106.0.5249.119, due to a use-after-free in Safe Browsing that could allow heap corruption via a crafted Chrome Extension after user installation of a malicious extension. The connected documents corroborate the issue and specify the impact as ...

CVE-2022-4178

Summary of CVE-2022-4178 : A use-after-free in Mojo within Google Chrome before 108.0.5359.71 allows a remote attacker who has compromised the renderer process to potentially cause heap corruption via a crafted HTML page. The vulnerability affects the Mojo IPC path used by Chrome’s rendering comp...

CVE-2023-3739

CVE-2023-3739 affects Google Chrome on ChromeOS, via Chromad. The vulnerability stems from insufficient validation of untrusted input in Chromad, enabling a remote attacker to execute arbitrary code with a crafted shell script on ChromeOS builds prior to 115.0.5790.131. Impact is remote code exec...

CVE-2023-6509

CVE-2023-6509 describes a Use-After-Free vulnerability in Chrome/Chromium's Side Panel Search, where handling of specific UI interactions could lead to heap corruption. Affected product: Google Chrome/Chromium browsers (Chromium-based). Root cause: use-after-free in the Side Panel Search componen...

CVE-2024-1060

CVE-2024-1060 is a Chrome/Chromium issue described as a use-after-free in the Canvas module that could enable remote heap corruption via a crafted HTML page prior to version 121.0.6167.139. The affected product is Google Chrome/Chromium; the root cause is a memory management bug in Canvas. The pu...

CVE-2025-3066

CVE-2025-3066: In Google Chrome/Chromium, a use-after-free in Site Isolation could allow a remote attacker to trigger heap corruption via a crafted HTML page. The issue affects Chrome before 135.0.7049.84; a security fix was released in the ChromeOS/Chrome desktop Stable channel update to 135.0.7...

CVE-2026-15899

The CVE-2026-15899 entry relates to Google Chrome on macOS before version 150.0.7871.128, where a use-after-free in CameraCapture could allow a remote attacker to escape the Chromium sandbox via a crafted HTML page (CRITICAL impact). The connected EUVD entry confirms the same issue. No publicly d...

CVE-2026-7351

CVE-2026-7351 describes a race in MHTML handling in Google Chrome prior to 147.0.7727.138. The vulnerability allows a user who is induced to install a crafted Chrome Extension to leak cross-origin data via MHTML processing. The root cause, per sources, is a race condition in MHTML handling; no ex...

CVE-2024-0813

The CVE-2024-0813 entry documents a Use‑After‑Free in Google Chrome’s Reading Mode prior to 121.0.6167.85. The underlying issue could allow heap corruption when a user is persuaded to install a malicious extension through specific UI interaction, as described in multiple sources. Affected softwar...

CVE-2024-3176

CVE-2024-3176 affects Google Chrome with an out-of-bounds write in SwiftShader triggered by a crafted HTML page, enabling remote memory corruption. Chrome versions prior to 117.0.5938.62 are vulnerable; upgrade to 117.0.5938.62 or later to mitigate. Other connected sources corroborate the same Ch...

CVE-2025-0997

CVE-2025-0997 affects Google Chrome (Chromium-based) prior to 133.0.6943.98. The issue is a use-after-free in Navigation triggered by a crafted Chrome Extension, potentially enabling heap corruption. Impact per sources: high severity (CVSS 3.1 base 8.1) with network attack vector, but user intera...

CVE-2018-6041

CVE-2018-6041 is a Chrome/Chromium URL spoofing vulnerability in the navigation/UI that allowed a crafted HTML page to spoof the Omnibox contents. The initial description confirms incorrect security UI in navigation, enabling spoofing of the URL bar. Connected documents identify the issue as occu...

CVE-2018-6089

Google Chrome/Chromium prior to 66.0.3359.117 was affected by CVE-2018-6089, a Same Origin Policy bypass in Service Workers triggered by a cross-origin PDF redirect after a Safari-like CORS gap. The workaround is upgrading to 66.0.3359.117 or newer; Chrome’s 66 stable release notes confirm the fi...

CVE-2018-6177

CVE-2018-6177 is a cross-origin information leak in Blink found in Chromium/Google Chrome before version 68.0.3440.75. The vulnerability allows leakage of cross-origin data via a crafted page. Debian security advisories and related entries reference this CVE among a set of Chromium/Blink fixes an...

CVE-2021-4321

CVE-2021-4321 affects Google Chrome (Blink/Chromium) with CSP bypass in Blink prior to Chrome 91.0.4472.77 via a crafted HTML page. Root cause: CSP enforcement bypass in Blink. Impact: potential to bypass content security policy; no exploitation details provided in the documents beyond the CSP by...

CVE-2022-0456

CVE-2022-0456 affects Google Chrome/Chromium: use-after-free in the Web Search feature leading to potential heap corruption via profile destruction. Public details in Chrome/Chromium advisories and Chrome stable-channel release notes confirm this vulnerability and list Chrome 98.0.4758.80+ as the...

CVE-2022-0461

CVE-2022-0461 describes a policy bypass in COOP that allows a remote attacker to bypass the iframe sandbox in Google Chrome. The vulnerability affects Chrome versions prior to 98.0.4758.80, where a crafted HTML page can exploit COOP sandbox policies. The issue is confirmed in multiple connected s...

CVE-2022-4179

CVE-2022-4179 is a Use‑After‑Free in the Audio component of Google Chrome prior to 108.0.5359.71, allowing an attacker to potentially exploit heap corruption via a crafted Chrome Extension. Affected software is Chrome 108 and earlier; the fix was released as Chrome 108.0.5359.71 (and Debian/ALT/L...

CVE-2023-0932

CVE-2023-0932: Use-after-free in WebRTC for Google Chrome on Windows prior to 110.0.5481.177. Root cause is heap corruption via crafted HTML page, with high impact (C/H/I/A). Affected product is Chrome/Chromium WebRTC component; remediation is to upgrade to Chrome 110.0.5481.177 or newer (or corr...

CVE-2023-3736

CVE-2023-3736 concerns an Inappropriate implementation in Custom Tabs in Google Chrome on Android, prior to version 115.0.5790.98, enabling a remote attacker to leak cross-origin data via a crafted HTML page. Affected software: Google Chrome/Chromium family with Custom Tabs integration; root caus...

CVE-2023-6704

Use-after-free in libavif in Google Chrome (Chromium) prior to 120.0.6099.109 can allow a remote attacker to potentially trigger heap corruption via a crafted image file. Official advisories and vendor updates indicate the fix is included in Chrome/Chromium version 120.0.6099.109 and later. Affec...

CVE-2024-3170

CVE-2024-3170 affects Google Chrome prior to 121.0.6167.85, where a Use-after-Free in WebRTC could allow a remote attacker to cause heap corruption via a crafted HTML page. The issue is in Chromium’s WebRTC handling and is addressed by updating Chrome to 121.0.6167.85 or later. Public exploits ex...

CVE-2018-17462

CVE-2018-17462 concerns Google Chrome before 70.0.3538.67, where incorrect refcounting in AppCache could allow a remote attacker to escape the browser sandbox via a crafted HTML page. The practical impact is sandbox escape, enabling potential access to privileged context from a web page. Connecte...

CVE-2018-6071

CVE-2018-6071 is a heap/buffer overflow in Skia used by Google Chrome (pre-65.0.3325.146). Connected sources confirm a Skia-related overflow that could trigger an out-of-bounds memory access via a crafted HTML page. Affected context appears in Chrome/Chromium release notes and Debian/Gentoo advis...

CVE-2018-6141

Summary: Google Chrome's Skia image filter had insufficient validation that could allow a remote attacker with renderer access to perform an out-of-bounds memory read via a crafted HTML page. Affected versions are before 67.0.3396.62; the issue is resolved in 67.0.3396.62+.

CVE-2018-6142

CVE-2018-6142 describes an out-of-bounds read vulnerability in Google Chrome’s V8 engine (pre-67.0.3396.62) that can be triggered by a crafted PDF file, allowing remote memory access. Connected advisories (Debian DSA-4237-1) indicate a fix in Chromium-based packages and note updates to version 67...

CVE-2021-37969

CVE-2021-37969 affects Google Chrome/Chromium components on Windows prior to 94.0.4606.54 due to an inappropriate implementation in Google Updater, enabling local privilege escalation via a crafted file. Remediation is to update to a patched version; Chrome/Chromium updates have been released (e....

CVE-2021-38015

CVE-2021-38015 affects the Chromium-based browser engine. The provided security advisories describe an inappropriate implementation in the input handling of Chromium (prior to 96.0.4664.45) that could allow a user-assisted attacker who persuades a user to install a malicious extension to bypass n...

CVE-2021-38019

CVE-2021-38019 is a Chromium/Chromium-based browser vulnerability describing insufficient policy enforcement in the CORS component prior to 96.0.4664.45, allowing a remote attacker to leak cross-origin data via a crafted HTML page. Connected advisories (Arch Linux ASA/AVGs, Debian DSA, and AS/AST...

CVE-2022-0457

The CVE-2022-0457 entry concerns a type confusion in V8 used by Google Chrome/Chromium, allowing remote heap corruption via a crafted HTML page. Affected software is Chrome/Chromium prior to version 98.0.4758.80, with the root cause described as V8 type confusion leading to heap corruption. The p...

CVE-2022-4177

CVE-2022-4177 : Use-after-free in Chrome extensions; vulnerable as of Chrome/Chromium before 108.0.5359.71. An attacker who persuades a user to install a crafted extension via UI interaction could exploit heap corruption. The Chrome stable release 108.0.5359.71 and related Chromium fixes address ...

CVE-2023-0699

CVE-2023-0699 is a use-after-free vulnerability in the GPU component of Google Chrome/Chromium prior to 110.0.5481.77. A remote attacker could exploit heap corruption via a crafted HTML page and browser shutdown. Several connected sources confirm the issue and its remediation path, including Chro...

CVE-2023-3730

CVE-2023-3730: Use-after-free in Tab Groups of Google Chrome/Chromium prior to 115.0.5790.98. Root cause is a Tab Groups use-after-free in Chrome/Chromium, enabling potential heap corruption when a user interacts with specific UI. Affected products include Google Chrome and Chromium-based browser...

CVE-2023-6707

CVE-2023-6707 is a Use-after-free in CSS in Google Chrome (Chromium) prior to 120.0.6099.109. The issue affects the CSS handling path in Chrome/Chromium and can lead to heap corruption via a crafted HTML page. The Chrome stable channel update 120.0.6099.109 (and related Chromium 120.0.6099.109 bu...

CVE-2024-2629

CVE-2024-2629 affects Google Chrome for iOS (Chromium-based UI) with an incorrect security UI that allows UI spoofing via a crafted HTML page. Root cause: insecure UI handling in Chrome prior to 123.0.6312.58. Impact: UI spoofing; no explicit exploit details provided in the sources. Remediation: ...

CVE-2018-18349

CVE-2018-18349 affects Chromium/Chrome Blink prior to version 71.0.3578.80, where an insufficient policy enforcement in Blink allowed remote frame navigations to access local files via a crafted Chrome Extension. Connected advisories (Arch Linux ASA-201812-2, Debian DSA-4352-1, Debian DSA-4352-1:...

CVE-2018-6096

CVE-2018-6096 is a Fullscreen UI spoof vulnerability in Google Chrome/Chromium where a JavaScript window could overlap the fullscreen notification, enabling a remote attacker to obscure the fullscreen warning via a crafted HTML page. Public details confirm the issue affects Chromium/Chrome prior ...

CVE-2018-6132

CVE-2018-6132 corresponds to an uninitialized memory issue in WebRTC within Google Chrome/Chromium prior to 67.0.3396.62. The description states that a remote attacker could obtain potentially sensitive information from process memory via a crafted video file. The connected Debian advisory notes ...

CVE-2018-6136

CVE-2018-6136 is an out-of-bounds read in V8 (Chrome/Chromium) prior to version 67.0.3396.62, enabling remote exploitation via a crafted HTML page to read memory. Publicly disclosed within multiple advisories (CNVD-2018-11486, CVE lists) and linked to Chrome/Chromium updates. Affected product: Go...

CVE-2018-6137

CVE-2018-6137 is a Blink information-leak vulnerability in Google Chrome, present in Blink-based builds prior to 67.0.3396.62. A crafted HTML page could allow a remote attacker to disclose cross-origin data. Connected CNVD-2018-11487 describes the Chrome/Blink impact and mode of disclosure. Publi...

CVE-2021-4062

CVE-2021-4062 is a heap buffer overflow in the BFCache component of Chromium/ Google Chrome prior to 96.0.4664.93. The issue affects the BFCache path, enabling a remote attacker who has compromised the renderer process to potentially trigger heap corruption via a crafted HTML page. The vulnerabil...

CVE-2021-4068

The CVE-2021-4068 entry applies to Chromium’s new tab page. The connected documents confirm an insufficient validation vulnerability in the new tab page component of the Chromium browser engine prior to version 96.0.4664.93, enabling a remote attacker to leak cross-origin data via crafted HTML pa...

CVE-2023-1813

CVE-2023-1813 refers to an Inappropriate implementation in Extensions in Google Chrome, fixed by Chrome/Chromium in version 112.0.5615.49 and later. A malicious extension could bypass file access restrictions via a crafted HTML page when the user is convinced to install the extension. Affected pr...

CVE-2023-6348

CVE-2023-6348 describes a Type Confusion in Chrome/Chromium’s Spellcheck that could allow heap corruption when a renderer is compromised via a crafted HTML page. Connected sources confirm affected components as Chromium-based browsers (Chrome/Chromium) and outline remediation by upgrading to Chro...