CVE-2021-38019

CVE-2021-38019 is a Chromium/Chromium-based browser vulnerability describing insufficient policy enforcement in the CORS component prior to 96.0.4664.45, allowing a remote attacker to leak cross-origin data via a crafted HTML page. Connected advisories (Arch Linux ASA/AVGs, Debian DSA, and AS/AST...

CVE-2022-0461

CVE-2022-0461 describes a policy bypass in COOP that allows a remote attacker to bypass the iframe sandbox in Google Chrome. The vulnerability affects Chrome versions prior to 98.0.4758.80, where a crafted HTML page can exploit COOP sandbox policies. The issue is confirmed in multiple connected s...

CVE-2022-3447

CVE-2022-3447 refers to an issue in Google Chrome on Android prior to 106.0.5249.119 where an inappropriate implementation in Custom Tabs allowed a remote attacker to spoof the Omnibox (URL bar) contents via a crafted HTML page. The vulnerability is associated with Chromium’s High severity and is...

CVE-2022-4179

CVE-2022-4179 is a Use‑After‑Free in the Audio component of Google Chrome prior to 108.0.5359.71, allowing an attacker to potentially exploit heap corruption via a crafted Chrome Extension. Affected software is Chrome 108 and earlier; the fix was released as Chrome 108.0.5359.71 (and Debian/ALT/L...

CVE-2023-6704

Use-after-free in libavif in Google Chrome (Chromium) prior to 120.0.6099.109 can allow a remote attacker to potentially trigger heap corruption via a crafted image file. Official advisories and vendor updates indicate the fix is included in Chrome/Chromium version 120.0.6099.109 and later. Affec...

CVE-2026-13021

Google Chrome prior to 149.0.7827.197 contains an inappropriate implementation in DeviceBoundSessionCredentials that can allow a remote attacker to bypass the same-origin policy via a crafted HTML page. The CVE description notes a Chromium-based issue with High severity; updates to Chrome are ref...

CVE-2026-16424

CVE-2026-16424 is a use-after-free vulnerability in the GPU component of Google Chrome on Android prior to version 150.0.7871.182. The description states a remote attacker who has compromised the renderer process could potentially cause a sandbox escape via a crafted HTML page. Connected sources ...

CVE-2011-3068

Technical details for CVE-2011-3068 are not available in the provided connected documents. The initial description mentions a use-after-free in Chrome's CSS engine but no further specifics are supplied.

CVE-2018-17462

CVE-2018-17462 concerns Google Chrome before 70.0.3538.67, where incorrect refcounting in AppCache could allow a remote attacker to escape the browser sandbox via a crafted HTML page. The practical impact is sandbox escape, enabling potential access to privileged context from a web page. Connecte...

CVE-2018-18342

Chromium before version 71.0.3578.80 is affected by CVE-2018-18342 (and related CVEs listed in ASA-201812-2). The vulnerability for CVE-2018-18342 is an out-of-bounds write in the V8 JavaScript engine, enabling a remote attacker to execute arbitrary code inside the Chrome sandbox via a crafted HT...

CVE-2018-18351

CVE-2018-18351 is a Chromium/Google Chrome vulnerability described in connected sources as an access restriction bypass in the Navigation component, caused by insufficient policy enforcement that allows bypassing the SameSite cookie policy via a crafted HTML page. Affected product: Chromium/Chrom...

CVE-2018-18354

CVE-2018-18354 affects Google Chrome on Windows prior to 71.0.3578.80. The root cause is insufficient validation of external protocols in the Shell Integration component, enabling a remote attacker to launch external programs via a crafted HTML page. The vulnerability allows potential arbitrary c...

CVE-2018-6071

CVE-2018-6071 is a heap/buffer overflow in Skia used by Google Chrome (pre-65.0.3325.146). Connected sources confirm a Skia-related overflow that could trigger an out-of-bounds memory access via a crafted HTML page. Affected context appears in Chrome/Chromium release notes and Debian/Gentoo advis...

CVE-2018-6124

CVE-2018-6124 is a type confusion vulnerability in Blink ReadableStreams in Google Chrome (Chromium) prior to 67.0.3396.62. The underlying issue is a type confusion in Blink’s ReadableStreams, allowing a remote attacker to potentially cause object corruption via a crafted HTML page. Affected soft...

CVE-2021-37969

CVE-2021-37969 affects Google Chrome/Chromium components on Windows prior to 94.0.4606.54 due to an inappropriate implementation in Google Updater, enabling local privilege escalation via a crafted file. Remediation is to update to a patched version; Chrome/Chromium updates have been released (e....

CVE-2021-4321

CVE-2021-4321 affects Google Chrome (Blink/Chromium) with CSP bypass in Blink prior to Chrome 91.0.4472.77 via a crafted HTML page. Root cause: CSP enforcement bypass in Blink. Impact: potential to bypass content security policy; no exploitation details provided in the documents beyond the CSP by...

CVE-2022-0100

CVE-2022-0100 describes a heap/buffer overflow in Chrome’s Media streams API. A remote attacker could trigger heap corruption via a crafted HTML page. Affected software is Google Chrome (Chromium-based); vulnerability is associated with versions before 97.0.4692.71. The CVSS data indicates high i...

CVE-2022-0104

The CVE-2022-0104 entry corresponds to a heap buffer overflow in ANGLE used by Google Chrome, fixed before Chrome 97.0.4692.71. The vulnerability allows remote exploitation via a crafted HTML page to cause heap corruption in ANGLE, with the impact described as high for confidentiality, integrity ...

CVE-2022-3198

CVE-2022-3198 involves a use-after-free in PDF handling in Google Chrome (Chromium) prior to version 105.0.5195.125 , allowing a remote attacker to potentially exploit heap corruption via a crafted PDF file. The vulnerability affects Chromium-based Chrome and related builds (as reflected in multi...

CVE-2022-3308

CVE-2022-3308 is a Medium-severity issue in Google Chrome/Chromium Developer Tools (insufficient policy enforcement) that could enable sandbox escape via a crafted HTML page. Debian/ Mageia advisories indicate the fix was released in Chromium 106.x: Debian notes 106.0.5249.61 (chromium) as the fi...

CVE-2022-3654

CVE-2022-3654 is a Google Chrome/Chromium use-after-free in Layout vulnerability (pre-107.0.5304.62). The description notes potential heap corruption and remote code execution via a crafted HTML page, with high severity. Connected sources confirm Chrome/Chromium fixes, including a Chrome 107 upda...

CVE-2024-9956

CVE-2024-9956 affects Google Chrome on Android prior to 130.0.6723.58, with an Inappropriate implementation in WebAuthentication allowing a local attacker to escalate privileges via a crafted HTML page. The CVE’s standard metrics show LOCAL attack vector, LOW attack complexity, NONE privileges re...

CVE-2017-5058

CVE-2017-5058 describes a use-after-free in PrintPreview in Google Chrome prior to 58.0.3029.81 for Windows, allowing a remote attacker to potentially cause out-of-bounds memory access via a crafted HTML page. Connected advisories confirm Chromium/Chrome involvement with version 58.x as the fixed...

CVE-2018-6132

CVE-2018-6132 corresponds to an uninitialized memory issue in WebRTC within Google Chrome/Chromium prior to 67.0.3396.62. The description states that a remote attacker could obtain potentially sensitive information from process memory via a crafted video file. The connected Debian advisory notes ...

CVE-2018-6177

CVE-2018-6177 is a cross-origin information leak in Blink found in Chromium/Google Chrome before version 68.0.3440.75. The vulnerability allows leakage of cross-origin data via a crafted page. Debian security advisories and related entries reference this CVE among a set of Chromium/Blink fixes an...

CVE-2021-38021

CVE-2021-38021 affects the Chromium engine used by Google Chrome/Chromium. The issue is an inappropriate implementation in the referrer handling component, before version 96.0.4664.45, which can allow a remote attacker to bypass navigation restrictions via a crafted HTML page, potentially leading...

CVE-2022-0457

The CVE-2022-0457 entry concerns a type confusion in V8 used by Google Chrome/Chromium, allowing remote heap corruption via a crafted HTML page. Affected software is Chrome/Chromium prior to version 98.0.4758.80, with the root cause described as V8 type confusion leading to heap corruption. The p...

CVE-2022-4194

CVE-2022-4194 affects Google Chrome (Accessibility component) and is due to a use-after-free, enabling remote heap corruption via a crafted HTML page. The issue is listed in Chrome’s November 2022 security fixes and is among numerous Chromium CVEs addressed in Chrome 108.0.5359.71 and related upd...

CVE-2023-1813

CVE-2023-1813 refers to an Inappropriate implementation in Extensions in Google Chrome, fixed by Chrome/Chromium in version 112.0.5615.49 and later. A malicious extension could bypass file access restrictions via a crafted HTML page when the user is convinced to install the extension. Affected pr...

CVE-2024-9123

CVE-2024-9123 is a chromium/Chrome Skia vulnerability: an integer overflow in Skia prior to 129.0.6668.70 enables a remote attack via a crafted HTML page to trigger an out-of-bounds memory write. Affected software includes Google Chrome (Chromium-based) with versions before 129.0.6668.70; related...

CVE-2026-9955

CVE-2026-9955 affects Google Chrome on iOS prior to 148.0.7778.216 due to an inappropriate implementation in iOS, enabling a remote attacker to leak cross-origin data via a crafted HTML page. Affected product: Chrome for iOS. Root cause: inappropriate implementation summarized in the reports; no ...

CVE-2018-6141

Summary: Google Chrome's Skia image filter had insufficient validation that could allow a remote attacker with renderer access to perform an out-of-bounds memory read via a crafted HTML page. Affected versions are before 67.0.3396.62; the issue is resolved in 67.0.3396.62+.

CVE-2018-6142

CVE-2018-6142 describes an out-of-bounds read vulnerability in Google Chrome’s V8 engine (pre-67.0.3396.62) that can be triggered by a crafted PDF file, allowing remote memory access. Connected advisories (Debian DSA-4237-1) indicate a fix in Chromium-based packages and note updates to version 67...

CVE-2021-4062

CVE-2021-4062 is a heap buffer overflow in the BFCache component of Chromium/ Google Chrome prior to 96.0.4664.93. The issue affects the BFCache path, enabling a remote attacker who has compromised the renderer process to potentially trigger heap corruption via a crafted HTML page. The vulnerabil...

CVE-2022-0103

CVE-2022-0103 is a use-after-free in Google Chrome’s SwiftShader component, before version 97.0.4692.71. The vulnerability could allow a remote attacker to exploit heap corruption via a crafted HTML page. Some connected sources (CNVD) describe this as a code execution vulnerability, indicating po...

CVE-2022-0463

CVE-2022-0463 is a use-after-free vulnerability in the Accessibility component of Google Chrome/Chromium prior to 98.0.4758.80, potentially allowing heap corruption via specific user interaction. The issue affects Chrome/Chromium’s accessibility pathways and is addressed in Chrome 98 (98.0.4758.8...

CVE-2022-3197

CVE-2022-3197 affects Google Chrome/Chromium PDF rendering. The issue is a use-after-free in PDF handling that can lead to heap corruption when processing crafted PDFs, enabling a remote attacker to potentially exploit the vulnerability. Affected versions are Chrome/Chromium prior to 105.0.5195.1...

CVE-2026-9950

Technical details about CVE-2026-9950 are not publicly provided in the supplied documents. Monitor for updates from official advisories; no concrete affected products, versions, impact or remediation are disclosed here.

CVE-2013-0894

CVE-2013-0894 affects FFmpeg’s libavcodec vorbis decoding (vorbisdec.c) where a buffer overflow in vorbis_parse_setup_hdr_floors can be triggered by a zero bark-map size. This can cause a denial of service via divide-by-zero or out-of-bounds access, with possible other impact. The description exp...

CVE-2018-16075

CVE-2018-16075 concerns the Blink component in Google Chrome. The vulnerability arises from insufficient file type enforcement, allowing a crafted HTML page to obtain local file data. The initial Chrome/Blink issue is described as affecting versions prior to 69.0.3497.81. Public fixes are documen...

CVE-2018-17469

CVE-2018-17469 affects Google/Chromium’s PDFium component: a heap-based buffer overflow in PDFium prior to 70.0.3538.67 (in PDF filter chain handling) can enable a remote attacker to trigger out-of-bounds memory reads and potentially execute code. Public sources in connected docs confirm the issu...

CVE-2018-18349

CVE-2018-18349 affects Chromium/Chrome Blink prior to version 71.0.3578.80, where an insufficient policy enforcement in Blink allowed remote frame navigations to access local files via a crafted Chrome Extension. Connected advisories (Arch Linux ASA-201812-2, Debian DSA-4352-1, Debian DSA-4352-1:...

CVE-2018-6096

CVE-2018-6096 is a Fullscreen UI spoof vulnerability in Google Chrome/Chromium where a JavaScript window could overlap the fullscreen notification, enabling a remote attacker to obscure the fullscreen warning via a crafted HTML page. Public details confirm the issue affects Chromium/Chrome prior ...

CVE-2018-6136

CVE-2018-6136 is an out-of-bounds read in V8 (Chrome/Chromium) prior to version 67.0.3396.62, enabling remote exploitation via a crafted HTML page to read memory. Publicly disclosed within multiple advisories (CNVD-2018-11486, CVE lists) and linked to Chrome/Chromium updates. Affected product: Go...

CVE-2018-6139

CVE-2018-6139 affects Google Chrome/Chromium’s debugger extension API in DevTools, before 67.0.3396.62. An attacker convincing a user to install a malicious extension could bypass restrictions and execute arbitrary code. Public exploits exist. Remediation: upgrade to 67.0.3396.62 or newer. Affect...

CVE-2018-6154

CVE-2018-6154 affects Google Chrome/Chromium WebGL: insufficient data validation in WebGL leads to heap/buffer overflow. A remote attacker could exploit via a crafted HTML page to trigger heap corruption and potential code execution. Public references in connected docs confirm the WebGL heap over...

CVE-2021-21215

CVE-2021-21215 affects Google Chrome Autofill: Inappropriately implemented Autofill allowed a remote attacker to spoof the security UI via a crafted HTML page (pre-90.0.4430.72). Concrete advisories across distributions confirm the issue in Chrome and Chromium-derived packages. Remediation: updat...

CVE-2021-21218

CVE-2021-21218 maps to a memory-disclosure flaw in PDFium used by Google Chrome before 90.0.4430.72. A crafted PDF could let remote attackers read potentially sensitive data from process memory. Remediation is to upgrade Chrome to 90.0.4430.72 or newer as indicated by multiple advisories.

CVE-2021-4053

CVE-2021-4053 affects Chromium-based browsers: a use-after-free in the UI of the Chromium engine before version 96.0.4664.93. Impact per connected sources: remote code execution or content spoofing through crafted content. Affected component: Chromium UI/web UI layer; root cause: use-after-free i...

CVE-2021-4056

CVE-2021-4056 is a type-confusion vulnerability in the loader component of the Chromium browser engine, present in Chrome/Chromium prior to version 96.0.4664.93. A remote attacker could potentially cause arbitrary code execution through a crafted HTML page, as described in multiple vendor advisor...