CVE-2025-2137

CVE-2025-2137 affects Google Chrome (Chromium’s V8) with an out-of-bounds read in V8 prior to 134.0.6998.88, allowing remote memory access via a crafted HTML page. Affected component: V8 (Chrome/Chromium web engine); root cause: out-of-bounds read. Impact per sources includes potential informatio...

CVE-2013-0894

CVE-2013-0894 affects FFmpeg’s libavcodec vorbis decoding (vorbisdec.c) where a buffer overflow in vorbis_parse_setup_hdr_floors can be triggered by a zero bark-map size. This can cause a denial of service via divide-by-zero or out-of-bounds access, with possible other impact. The description exp...

CVE-2018-16068

CVE-2018-16068 concerns a missing validation in Mojo within Google Chrome before 69.0.3497.81, which could allow a remote attacker to perform a sandbox escape via a crafted HTML page. The vulnerability is tied to the Mojo component in Chrome’s architecture and is addressed in Chromium/Chrome upda...

CVE-2018-17467

CVE-2018-17467 refers to a URL spoofing vulnerability in Chromium/Google Chrome’s Omnibox due to insufficiently quick clearing of stale rendered content in navigation, allowing a remote attacker to spoof the URL bar via a crafted HTML page. The issue affects Chromium before version 70.0.3538.67 (...

CVE-2018-17469

CVE-2018-17469 affects Google/Chromium’s PDFium component: a heap-based buffer overflow in PDFium prior to 70.0.3538.67 (in PDF filter chain handling) can enable a remote attacker to trigger out-of-bounds memory reads and potentially execute code. Public sources in connected docs confirm the issu...

CVE-2018-17475

CVE-2018-17475 is a URL-spoofing vulnerability in Chromium/Google Chrome’s Omnibox stemming from an incorrect handling of history during Navigation, reported for Chrome/Chromium builds before 70.0.3538.67. The issue enables a remote attacker to spoof the URL bar via a crafted HTML page. Affected ...

CVE-2018-18339

CVE-2018-18339 affects Chromium/Google Chrome where a use-after-free in the WebAudio implementation (before 71.0.3578.80) can lead to remote code execution via crafted HTML pages. Arch Linux notes the fix is in Chromium 71.0.3578.80-1 (upgrade recommended). Other sources corroborate the vulnerabi...

CVE-2018-6067

CVE-2018-6067 is a vulnerability in Google Chrome/Chromium where the Skia library contains a buffer/heap overflow issue. Affected component: Skia inside Chrome/Chromium prior to version 65.0.3325.146. Root cause: unspecified in the provided documents beyond “buffer overflow in the Skia library.” ...

CVE-2018-6080

CVE-2018-6080 is an information-disclosure vulnerability in Google Chrome (Chromium base) where lack of access-control checks in Instrumentation allowed a renderer-compromised attacker to obtain memory metadata from privileged processes. The issue affects Chrome prior to 65.0.3325.146 and was cat...

CVE-2018-6154

CVE-2018-6154 affects Google Chrome/Chromium WebGL: insufficient data validation in WebGL leads to heap/buffer overflow. A remote attacker could exploit via a crafted HTML page to trigger heap corruption and potential code execution. Public references in connected docs confirm the WebGL heap over...

CVE-2021-38021

CVE-2021-38021 affects the Chromium engine used by Google Chrome/Chromium. The issue is an inappropriate implementation in the referrer handling component, before version 96.0.4664.45, which can allow a remote attacker to bypass navigation restrictions via a crafted HTML page, potentially leading...

CVE-2022-0100

CVE-2022-0100 describes a heap/buffer overflow in Chrome’s Media streams API. A remote attacker could trigger heap corruption via a crafted HTML page. Affected software is Google Chrome (Chromium-based); vulnerability is associated with versions before 97.0.4692.71. The CVSS data indicates high i...

CVE-2022-0104

The CVE-2022-0104 entry corresponds to a heap buffer overflow in ANGLE used by Google Chrome, fixed before Chrome 97.0.4692.71. The vulnerability allows remote exploitation via a crafted HTML page to cause heap corruption in ANGLE, with the impact described as high for confidentiality, integrity ...

CVE-2022-0463

CVE-2022-0463 is a use-after-free vulnerability in the Accessibility component of Google Chrome/Chromium prior to 98.0.4758.80, potentially allowing heap corruption via specific user interaction. The issue affects Chrome/Chromium’s accessibility pathways and is addressed in Chrome 98 (98.0.4758.8...

CVE-2022-3198

CVE-2022-3198 involves a use-after-free in PDF handling in Google Chrome (Chromium) prior to version 105.0.5195.125 , allowing a remote attacker to potentially exploit heap corruption via a crafted PDF file. The vulnerability affects Chromium-based Chrome and related builds (as reflected in multi...

CVE-2022-3447

CVE-2022-3447 refers to an issue in Google Chrome on Android prior to 106.0.5249.119 where an inappropriate implementation in Custom Tabs allowed a remote attacker to spoof the Omnibox (URL bar) contents via a crafted HTML page. The vulnerability is associated with Chromium’s High severity and is...

CVE-2022-4192

CVE-2022-4192 affects Google Chrome/Chromium Live Caption and is a use-after-free in Live Caption leading to potential heap corruption. The issue is tied to Chrome 108-era code and is mitigated by upgrading to version 108.0.5359.71 or later (stable channel) where the fix is released. The provided...

CVE-2023-2463

CVE-2023-2463 : In Google Chrome (Android), an inappropriate implementation in Full Screen Mode could allow a remote attacker to hide the contents of the Omnibox (URL bar) via a crafted HTML page. Affected software is Chrome/Chromium family, with the issue linked to Full Screen handling. The vuln...

CVE-2023-6510

CVE-2023-6510 is a Chrome/Chromium use-after-free in Media Capture (prior to 120.0.6099.62) that could allow a remote attacker to potentially exploit heap corruption via specific UI interaction. Affected product: Chromium/Chrome browser components handling Media Capture. Root cause: use-after-fre...

CVE-2023-6706

CVE-2023-6706 is a use-after-free in FedCM for Google Chrome/Chromium prior to 120.0.6099.109, enabling a remote attacker who tricked a user into UI interaction to potentially trigger heap corruption via a crafted HTML page. Public references in the connected documents confirm this vulnerability ...

CVE-2026-14058

CVE-2026-14058 affects Google Chrome: insufficient policy enforcement in the HTML Parser allows a remote attacker to bypass Content Security Policy via a crafted HTML page. Affected version range is Chrome prior to 150.0.7871.47. The vulnerability is documented across multiple sources (NVD, Debia...

CVE-2018-16075

CVE-2018-16075 concerns the Blink component in Google Chrome. The vulnerability arises from insufficient file type enforcement, allowing a crafted HTML page to obtain local file data. The initial Chrome/Blink issue is described as affecting versions prior to 69.0.3497.81. Public fixes are documen...

CVE-2018-16077

The CVE-2018-16077 entry concerns Google Chrome (Blink) and is caused by an object lifecycle issue in Blink that allowed a remote attacker to bypass content security policy via a crafted HTML page. Affected: Chrome versions prior to 69.0.3497.81. Impact: content security policy bypass; exploitati...

CVE-2018-18343

CVE-2018-18343 affects Chromium/Chrome with a use-after-free in Skia prior to 71.0.3578.80. The issue is triggered via crafted HTML and can lead to heap corruption and remote code execution. Affected component: Skia (Chromium/WebKit rendering stack). The Arch Linux ASA-201812-2 entry confirms a s...

CVE-2018-6066

CVE-2018-6066 affects Google Chrome (Blink) due to lack of CORS checking in ResourceFetcher/ResourceLoader, enabling a remote attacker to leak cross-origin data via crafted HTML. Publicly reported as a Same Origin Policy bypass in Chrome/Chromium before 65.0.3325.146; multiple vendors referenced ...

CVE-2018-6112

CVE-2018-6112 concerns Google Chrome/Chromium DevTools where the DevTools component mishandled URLs, enabling a remote attacker to bypass navigation restrictions via a crafted HTML page. The vulnerability is described as an incorrect handling of URLs in DevTools, leading to navigation bypass. Pub...

CVE-2021-37998

CVE-2021-37998 is a use-after-free vulnerability in the Garbage Collection component of the Chromium browser engine (Chrome) prior to 95.0.4638.69. The issue could allow a remote attacker to cause heap corruption via a crafted HTML page, potentially enabling arbitrary code execution. Public recor...

CVE-2021-4056

CVE-2021-4056 is a type-confusion vulnerability in the loader component of the Chromium browser engine, present in Chrome/Chromium prior to version 96.0.4664.93. A remote attacker could potentially cause arbitrary code execution through a crafted HTML page, as described in multiple vendor advisor...

CVE-2022-0103

CVE-2022-0103 is a use-after-free in Google Chrome’s SwiftShader component, before version 97.0.4692.71. The vulnerability could allow a remote attacker to exploit heap corruption via a crafted HTML page. Some connected sources (CNVD) describe this as a code execution vulnerability, indicating po...

CVE-2022-4194

CVE-2022-4194 affects Google Chrome (Accessibility component) and is due to a use-after-free, enabling remote heap corruption via a crafted HTML page. The issue is listed in Chrome’s November 2022 security fixes and is among numerous Chromium CVEs addressed in Chrome 108.0.5359.71 and related upd...

CVE-2025-2136

CVE-2025-2136 : A use-after-free in the Inspector of Google Chrome/Chromium allows remote heap corruption on crafted HTML pages, prior to version 134.0.6998.88. The issue affects Chrome/Chromium and was addressed in the 134.0.6998.88+ updates (e.g., Debian’s 134.0.6998.88-1~deb12u1). If vulnerabl...

CVE-2018-18337

The CVE-2018-18337 issue affects Chromium/Blink. A use-after-free vulnerability in Blink (Chromium’s rendering engine) was identified prior to version 71.0.3578.80, with attackers able to trigger heap corruption through a crafted HTML page. Upstream fixes address Blink use-after-free paths; affec...

CVE-2018-18355

Affected software: Google Chrome (and Chromium) prior to version 71.0.3578.80. Issue: CVE-2018-18355 is a policy enforcement/URL Formatter vulnerability caused by incorrect handling of confusable characters, allowing a remote attacker to spoof the Omnibox (address bar) with a crafted domain name....

CVE-2018-6043

CVE-2018-6043 affects Google Chrome (Chromium project) via the External Protocol Handler. The root cause is insufficient data validation in the handler, allowing a remote attacker to potentially execute arbitrary code on a user’s machine by presenting a crafted HTML page. Publicly documented impa...

CVE-2018-6098

CVE-2018-6098 refers to a URL spoofing vulnerability in Google Chrome's URL Formatter caused by incorrect handling of confusable characters in IDN homographs. The issue affects Chrome prior to 66.0.3359.117, enabling a remote attacker to perform domain spoofing via a crafted domain name. The publ...

CVE-2018-6139

CVE-2018-6139 affects Google Chrome/Chromium’s debugger extension API in DevTools, before 67.0.3396.62. An attacker convincing a user to install a malicious extension could bypass restrictions and execute arbitrary code. Public exploits exist. Remediation: upgrade to 67.0.3396.62 or newer. Affect...

CVE-2021-4078

The CVE-2021-4078 entry pertains to Google Chrome/V8 with a type-confusion vulnerability in V8 that was present in Chrome up to version 96.0.4664.93. The underlying issue is described as a type confusion in V8, which could allow a remote attacker to potentially trigger heap corruption via a craft...

CVE-2022-0310

CVE-2022-0310 refers to a heap buffer overflow in Chrome’s Task Manager prior to version 97.0.4692.99, allowing a remote attacker to potentially trigger heap corruption via specific user interactions. Multiple connected sources confirm the same description and link the issue to Chrome revisions a...

CVE-2018-18352

CVE-2018-18352 affects Chromium/Google Chrome Media handling, where cross-origin audio could be accessed due to an inappropriate implementation that bypassed the same-origin policy for audio content via crafted HTML. The issue is fixed in Chromium up to version 71.0.3578.80; upstream patches exis...

CVE-2018-6034

CVE-2018-6034 originates from an integer overflow in Blink/WebGL leading to an out-of-bounds memory read in Google Chrome before version 64.0.3282.119. The Initial description states the vulnerability as an insufficient data validation in WebGL causing the out-of-bounds read via a crafted HTML pa...

CVE-2018-6081

CVE-2018-6081 affects Google Chrome interstitials; a cross-site scripting flaw in Chrome prior to 65.0.3325.146 could be triggered by convincing a user to install a malicious extension or open Developer Console, via a crafted HTML page. Connected advisories confirm patches: Debian fixes in Chrome...

CVE-2018-6088

CVE-2018-6088 affects Google Chrome/Chromium via a use-after-free in the PDFium library. The issue allows remote code execution inside the sandbox when processing crafted PDFs, currently mitigated by updating to Chrome/Chromium 66.0.3359.117 (and similarly updated Chromium packages in Debian/Fedo...

CVE-2018-6102

CVE-2018-6102 affects Google Chrome/Chromium, enabling an attacker to spoof the Omnibox (URL bar) via a crafted domain name. The vulnerability is described as a URL spoofing issue in Omnibox and is fixed in Chrome/Chromium around version 66.0.3359.117 (example Debian update notes reference 66.0.3...

CVE-2018-6166

CVE-2018-6166: Google Chrome (Omnibox/URL Formatter) contains a URL spoofing vulnerability due to incorrect handling of confusable characters, enabling domain spoofing via IDN homographs. Affects Chrome up to 68.0.3440.75; fixed in 68.0.3440.75 (Chromium) with security updates across distribution...

CVE-2021-21215

CVE-2021-21215 affects Google Chrome Autofill: Inappropriately implemented Autofill allowed a remote attacker to spoof the security UI via a crafted HTML page (pre-90.0.4430.72). Concrete advisories across distributions confirm the issue in Chrome and Chromium-derived packages. Remediation: updat...

CVE-2021-4053

CVE-2021-4053 affects Chromium-based browsers: a use-after-free in the UI of the Chromium engine before version 96.0.4664.93. Impact per connected sources: remote code execution or content spoofing through crafted content. Affected component: Chromium UI/web UI layer; root cause: use-after-free i...

CVE-2022-3039

CVE-2022-3039 : Use-after-free in WebSQL of Google Chrome prior to 105.0.5195.52 allows remote heap corruption via a crafted HTML page. Affected: Chrome/WebSQL; root cause: use-after-free. Impact: high (potential full/partial heap corruption). Mitigation: upgrade to Chrome 105.0.5195.52 or later ...

CVE-2022-3197

CVE-2022-3197 affects Google Chrome/Chromium PDF rendering. The issue is a use-after-free in PDF handling that can lead to heap corruption when processing crafted PDFs, enabling a remote attacker to potentially exploit the vulnerability. Affected versions are Chrome/Chromium prior to 105.0.5195.1...

CVE-2022-4438

CVE-2022-4438 describes a use-after-free in Blink Frames in Google Chrome/Chromium before 108.0.5359.124, where a remote attacker convincing a user to engage in specific UI interactions could trigger heap corruption via a crafted HTML page. Affected software: Google Chrome/Chromium (Blink Frames)...

CVE-2022-4907

CVE-2022-4907 describes an uninitialized-use flaw in FFmpeg used by Google Chrome prior to 108.0.5359.71, allowing a remote attacker to run arbitrary code in a sandbox via a crafted HTML page. Public connected advisories map this to FFmpeg and Chromium components and indicate remediation through ...