CVE-2021-4056

CVE-2021-4056 is a type-confusion vulnerability in the loader component of the Chromium browser engine, present in Chrome/Chromium prior to version 96.0.4664.93. A remote attacker could potentially cause arbitrary code execution through a crafted HTML page, as described in multiple vendor advisor...

CVE-2022-0310

CVE-2022-0310 refers to a heap buffer overflow in Chrome’s Task Manager prior to version 97.0.4692.99, allowing a remote attacker to potentially trigger heap corruption via specific user interactions. Multiple connected sources confirm the same description and link the issue to Chrome revisions a...

CVE-2022-3039

CVE-2022-3039 : Use-after-free in WebSQL of Google Chrome prior to 105.0.5195.52 allows remote heap corruption via a crafted HTML page. Affected: Chrome/WebSQL; root cause: use-after-free. Impact: high (potential full/partial heap corruption). Mitigation: upgrade to Chrome 105.0.5195.52 or later ...

CVE-2022-4192

CVE-2022-4192 affects Google Chrome/Chromium Live Caption and is a use-after-free in Live Caption leading to potential heap corruption. The issue is tied to Chrome 108-era code and is mitigated by upgrading to version 108.0.5359.71 or later (stable channel) where the fix is released. The provided...

CVE-2026-14128

CVE-2026-14128 concerns Google Chrome on iOS (Chrome for iOS) prior to version 150.0.7871.47. The issue is an inappropriate implementation that allows a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. The documented impact is that the URL bar could display ...

CVE-2018-16068

CVE-2018-16068 concerns a missing validation in Mojo within Google Chrome before 69.0.3497.81, which could allow a remote attacker to perform a sandbox escape via a crafted HTML page. The vulnerability is tied to the Mojo component in Chrome’s architecture and is addressed in Chromium/Chrome upda...

CVE-2018-16077

The CVE-2018-16077 entry concerns Google Chrome (Blink) and is caused by an object lifecycle issue in Blink that allowed a remote attacker to bypass content security policy via a crafted HTML page. Affected: Chrome versions prior to 69.0.3497.81. Impact: content security policy bypass; exploitati...

CVE-2018-17467

CVE-2018-17467 refers to a URL spoofing vulnerability in Chromium/Google Chrome’s Omnibox due to insufficiently quick clearing of stale rendered content in navigation, allowing a remote attacker to spoof the URL bar via a crafted HTML page. The issue affects Chromium before version 70.0.3538.67 (...

CVE-2018-18339

CVE-2018-18339 affects Chromium/Google Chrome where a use-after-free in the WebAudio implementation (before 71.0.3578.80) can lead to remote code execution via crafted HTML pages. Arch Linux notes the fix is in Chromium 71.0.3578.80-1 (upgrade recommended). Other sources corroborate the vulnerabi...

CVE-2018-6067

CVE-2018-6067 is a vulnerability in Google Chrome/Chromium where the Skia library contains a buffer/heap overflow issue. Affected component: Skia inside Chrome/Chromium prior to version 65.0.3325.146. Root cause: unspecified in the provided documents beyond “buffer overflow in the Skia library.” ...

CVE-2018-6080

CVE-2018-6080 is an information-disclosure vulnerability in Google Chrome (Chromium base) where lack of access-control checks in Instrumentation allowed a renderer-compromised attacker to obtain memory metadata from privileged processes. The issue affects Chrome prior to 65.0.3325.146 and was cat...

CVE-2018-6137

CVE-2018-6137 is a Blink information-leak vulnerability in Google Chrome, present in Blink-based builds prior to 67.0.3396.62. A crafted HTML page could allow a remote attacker to disclose cross-origin data. Connected CNVD-2018-11487 describes the Chrome/Blink impact and mode of disclosure. Publi...

CVE-2021-37991

CVE-2021-37991 is a race condition in the V8 component of the Chromium browser engine prior to version 95.0.4638.54 that could enable a remote attacker to potentially cause heap corruption via a crafted HTML page. The connected advisories confirm the issue affects Chromium/Chrome builds before th...

CVE-2021-37995

CVE-2021-37995 affects Chromium-based browsers (e.g., Google Chrome/Chromium) via an inappropriate implementation in the WebApp Installer before 95.0.4638.54. A remote attacker could potentially overlay and spoof the Omnibox (URL bar) contents with a crafted HTML page. The vulnerability is part o...

CVE-2021-37998

CVE-2021-37998 is a use-after-free vulnerability in the Garbage Collection component of the Chromium browser engine (Chrome) prior to 95.0.4638.69. The issue could allow a remote attacker to cause heap corruption via a crafted HTML page, potentially enabling arbitrary code execution. Public recor...

CVE-2022-0458

CVE-2022-0458 is a Chrome use-after-free vulnerability in the Thumbnail Tab Strip prior to 98.0.4758.80 that could allow heap corruption via a crafted HTML page. The weakness affects Chrome/Chromium up to version 98.0.4758.80 and was publicly acknowledged in Chrome’s February 2022 stable-channel ...

CVE-2022-3195

The CVE-2022-3195 entry affects Google Chrome/Chromium before version 105.0.5195.125, with an Out-of-bounds write in Storage that enables a remote attacker to trigger memory corruption via a crafted HTML page. The vulnerability is categorized with High severity (CVSSv3.1: AV:N/AC:L/PR:N/UI:R/S:U/...

CVE-2022-4438

CVE-2022-4438 describes a use-after-free in Blink Frames in Google Chrome/Chromium before 108.0.5359.124, where a remote attacker convincing a user to engage in specific UI interactions could trigger heap corruption via a crafted HTML page. Affected software: Google Chrome/Chromium (Blink Frames)...

CVE-2024-0809

The CVE concerns Google Chrome/Chromium: an inappropriate Autofill implementation allows a remote attacker to bypass Autofill restrictions via a crafted HTML page in Chrome/Chromium versions prior to 121.0.6167.85. Impact described in connected sources is limited to bypassing Autofill controls (n...

CVE-2018-17475

CVE-2018-17475 is a URL-spoofing vulnerability in Chromium/Google Chrome’s Omnibox stemming from an incorrect handling of history during Navigation, reported for Chrome/Chromium builds before 70.0.3538.67. The issue enables a remote attacker to spoof the URL bar via a crafted HTML page. Affected ...

CVE-2018-6066

CVE-2018-6066 affects Google Chrome (Blink) due to lack of CORS checking in ResourceFetcher/ResourceLoader, enabling a remote attacker to leak cross-origin data via crafted HTML. Publicly reported as a Same Origin Policy bypass in Chrome/Chromium before 65.0.3325.146; multiple vendors referenced ...

CVE-2018-6081

CVE-2018-6081 affects Google Chrome interstitials; a cross-site scripting flaw in Chrome prior to 65.0.3325.146 could be triggered by convincing a user to install a malicious extension or open Developer Console, via a crafted HTML page. Connected advisories confirm patches: Debian fixes in Chrome...

CVE-2018-6102

CVE-2018-6102 affects Google Chrome/Chromium, enabling an attacker to spoof the Omnibox (URL bar) via a crafted domain name. The vulnerability is described as a URL spoofing issue in Omnibox and is fixed in Chrome/Chromium around version 66.0.3359.117 (example Debian update notes reference 66.0.3...

CVE-2021-21217

CVE-2021-21217 affects Google Chrome via the PDFium component. The issue is uninitialized memory in PDFium that could allow a remote attacker to obtain potentially sensitive information from a process’s memory when processing a crafted PDF file. It applies to Chrome versions prior to 90.0.4430.72...

CVE-2021-38002

CVE-2021-38002 is a use-after-free in Chrome/Chromium’s Web Transport prior to 95.0.4638.69 that could allow a remote attacker to escape the sandbox via a crafted HTML page. The issue is fixed upstream in version 95.0.4638.69, with advisories confirming upgrade as remediation. Arch Linux ASA entr...

CVE-2022-0460

CVE-2022-0460 affects Google Chrome (Windows, Mac, Linux): a use-after-free in Window Dialog handling allowed by a crafted HTML page to potentially trigger heap corruption. The vulnerability is tied to Chrome versions prior to 98.0.4758.80. Exploitation could be remote and require no user interac...

CVE-2023-0697

CVE-2023-0697: In Google Chrome for Android, prior to 110.0.5481.77, an inappropriate Fullscreen implementation allows a remote attacker to spoof the security UI via a crafted HTML page. The issue is fixed in Chrome 110.0.5481.77+. Affected product: Google Chrome on Android; root cause: Fullscree...

CVE-2023-0701

CVE-2023-0701 describes a heap buffer overflow in the WebUI of Google Chrome before 110.0.5481.77. The flaw can be triggered by a remote attacker who convinces a user to perform specific UI interactions, potentially leading to heap corruption via the UI. Affected software: Google Chrome/Chromium ...

CVE-2023-4367

CVE-2023-4367 affects Google Chrome/Chromium’s Extensions API. The vulnerability arises from insufficient policy enforcement, enabling a user who installs a crafted malicious extension to bypass enterprise policy. Public advisories and vendor updates reference Chrome/Chromium fixes in the 116.0.5...

CVE-2024-6988

CVE-2024-6988 is a Use-After-Free in Downloads in Google Chrome on iOS prior to 127.6533.72, potentially enabling heap corruption via a crafted HTML page. Connected documents confirm Chromium/Chromium-based updates with fixes (e.g., chromium packages updated to 127.0.6533.88 in Debian; Fedora upd...

CVE-2025-1918

CVE-2025-1918 is an out-of-bounds read vulnerability in PDFium used by Google Chrome prior to 134.0.6998.35. A crafted PDF file could trigger out-of-bounds memory access. The CVE is listed with a Chromium/Chrome security severity of Medium and a high impact on confidentiality, integrity, and avai...

CVE-2026-7968

CVE-2026-7968 affects Google Chrome prior to 148.0.7778.96. The vulnerability arises from insufficient input validation in Cross-Origin Resource Sharing (CORS), which could let a remote attacker who already compromised a renderer process bypass the same-origin policy via a crafted HTML page. Affe...

CVE-2009-2416

CVE-2009-2416 is a use-after-free in libxml2 (versions 2.5.10, 2.6.16, 2.6.26, 2.6.27, 2.6.32) and libxml 1.8.17 triggered by crafted Notation/Enumeration attribute types in a DTD; leads to denial of service (application crash). Related CVE-2009-2414 is a stack-growth DoS via deep DTD structures....

CVE-2018-17471

CVE-2018-17471 affects Google Chrome/Chromium before 70.0.3538.67, due to a WebContents full-screen UI issue that could enable content spoofing or UI occlusion. Debian and Arch Linux advisories (DSA-4330-1, ASA-201810-12) confirm a remediation by upgrading to 70.0.3538.67-1 (Chromium). Other repo...

CVE-2018-18343

CVE-2018-18343 affects Chromium/Chrome with a use-after-free in Skia prior to 71.0.3578.80. The issue is triggered via crafted HTML and can lead to heap corruption and remote code execution. Affected component: Skia (Chromium/WebKit rendering stack). The Arch Linux ASA-201812-2 entry confirms a s...

CVE-2018-6043

CVE-2018-6043 affects Google Chrome (Chromium project) via the External Protocol Handler. The root cause is insufficient data validation in the handler, allowing a remote attacker to potentially execute arbitrary code on a user’s machine by presenting a crafted HTML page. Publicly documented impa...

CVE-2018-6098

CVE-2018-6098 refers to a URL spoofing vulnerability in Google Chrome's URL Formatter caused by incorrect handling of confusable characters in IDN homographs. The issue affects Chrome prior to 66.0.3359.117, enabling a remote attacker to perform domain spoofing via a crafted domain name. The publ...

CVE-2018-6112

CVE-2018-6112 concerns Google Chrome/Chromium DevTools where the DevTools component mishandled URLs, enabling a remote attacker to bypass navigation restrictions via a crafted HTML page. The vulnerability is described as an incorrect handling of URLs in DevTools, leading to navigation bypass. Pub...

CVE-2021-37983

CVE-2021-37983: A use-after-free vulnerability in Dev Tools of Chromium (Chrome/Chromium) before version 95.0.4638.54 can allow a remote attacker to cause heap corruption via a crafted HTML page. Exploitation could enable arbitrary code execution or impact memory integrity. Remediation is to upgr...

CVE-2021-38010

CVE-2021-38010 : In Chromium (Google Chrome/Chromium) the service workers component had an inappropriate implementation flaw before version 96.0.4664.45 that allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. The practical impact i...

CVE-2022-0116

CVE-2022-0116 affects Google Chrome/Chromium. Root cause: inappropriate implementation in Compositing. Impact: remote attacker can spoof the Omnibox (URL bar) via a crafted HTML page. Affected: Chrome/Chromium builds prior to 97.0.4692.71. Mitigation: upgrade to 97.0.4692.71 or newer (per linked ...

CVE-2022-0298

CVE-2022-0298 is a Google Chrome use-after-free in the Scheduling component that can lead to heap corruption via a crafted HTML page. Multiple connected advisories confirm the vulnerability in Chrome before version 97.0.4692.99, with Debian noting a fix in 97.0.4692.99-1~deb11u2 and Chrome releas...

CVE-2022-4907

CVE-2022-4907 describes an uninitialized-use flaw in FFmpeg used by Google Chrome prior to 108.0.5359.71, allowing a remote attacker to run arbitrary code in a sandbox via a crafted HTML page. Public connected advisories map this to FFmpeg and Chromium components and indicate remediation through ...

CVE-2026-19149

Concretely affected: Google Chrome on Linux (Aura component). The issue is a use-after-free in Aura that could allow a remote attacker to escape the Chrome sandbox via a crafted HTML page. Impact is described as Critical (confidentiality, integrity and availability impact HIGH). Remediation provi...

CVE-2018-18337

The CVE-2018-18337 issue affects Chromium/Blink. A use-after-free vulnerability in Blink (Chromium’s rendering engine) was identified prior to version 71.0.3578.80, with attackers able to trigger heap corruption through a crafted HTML page. Upstream fixes address Blink use-after-free paths; affec...

CVE-2018-18340

CVE-2018-18340 affects Chromium/Google Chrome MediaRecorder. The vulnerability is a use-after-free in the MediaRecorder implementation, leading to potential heap corruption and remote code execution via a crafted HTML page. Affected version range is before 71.0.3578.80 (the fix version per upstre...

CVE-2018-18352

CVE-2018-18352 affects Chromium/Google Chrome Media handling, where cross-origin audio could be accessed due to an inappropriate implementation that bypassed the same-origin policy for audio content via crafted HTML. The issue is fixed in Chromium up to version 71.0.3578.80; upstream patches exis...

CVE-2018-6034

CVE-2018-6034 originates from an integer overflow in Blink/WebGL leading to an out-of-bounds memory read in Google Chrome before version 64.0.3282.119. The Initial description states the vulnerability as an insufficient data validation in WebGL causing the out-of-bounds read via a crafted HTML pa...

CVE-2018-6088

CVE-2018-6088 affects Google Chrome/Chromium via a use-after-free in the PDFium library. The issue allows remote code execution inside the sandbox when processing crafted PDFs, currently mitigated by updating to Chrome/Chromium 66.0.3359.117 (and similarly updated Chromium packages in Debian/Fedo...

CVE-2018-6093

CVE-2018-6093 affects Google Chrome/Chromium Blink: a vulnerability in origin checks that could allow a remote attacker to bypass same-origin protections and leak cross-origin data via crafted HTML. The issue is listed as a Same Origin Policy bypass in Service Worker/Blink components. Debian and ...