CVE-2024-0809

The CVE concerns Google Chrome/Chromium: an inappropriate Autofill implementation allows a remote attacker to bypass Autofill restrictions via a crafted HTML page in Chrome/Chromium versions prior to 121.0.6167.85. Impact described in connected sources is limited to bypassing Autofill controls (n...

CVE-2009-2416

CVE-2009-2416 is a use-after-free in libxml2 (versions 2.5.10, 2.6.16, 2.6.26, 2.6.27, 2.6.32) and libxml 1.8.17 triggered by crafted Notation/Enumeration attribute types in a DTD; leads to denial of service (application crash). Related CVE-2009-2414 is a stack-growth DoS via deep DTD structures....

CVE-2017-5058

CVE-2017-5058 describes a use-after-free in PrintPreview in Google Chrome prior to 58.0.3029.81 for Windows, allowing a remote attacker to potentially cause out-of-bounds memory access via a crafted HTML page. Connected advisories confirm Chromium/Chrome involvement with version 58.x as the fixed...

CVE-2018-17471

CVE-2018-17471 affects Google Chrome/Chromium before 70.0.3538.67, due to a WebContents full-screen UI issue that could enable content spoofing or UI occlusion. Debian and Arch Linux advisories (DSA-4330-1, ASA-201810-12) confirm a remediation by upgrading to 70.0.3538.67-1 (Chromium). Other repo...

CVE-2018-18340

CVE-2018-18340 affects Chromium/Google Chrome MediaRecorder. The vulnerability is a use-after-free in the MediaRecorder implementation, leading to potential heap corruption and remote code execution via a crafted HTML page. Affected version range is before 71.0.3578.80 (the fix version per upstre...

CVE-2018-18347

CVE-2018-18347 affects Chromium/WebKit’s Navigation component. A flaw in handling failed navigations with invalid URLs allowed a remote attacker to craft an HTML page that tricks a user into running JavaScript in an arbitrary origin. The Arch Linux advisory (ASA-201812-2) and Debian advisories no...

CVE-2018-6042

CVE-2018-6042 is a Chrome/Omnibox vulnerability: an incorrect security UI in the Omnibox allowed a remote attacker to spoof the URL bar via a crafted HTML page in Chrome versions prior to 64.0.3282.119. The issue enables spoofing of the OmniBox UI, potentially misleading users about the page they...

CVE-2018-6093

CVE-2018-6093 affects Google Chrome/Chromium Blink: a vulnerability in origin checks that could allow a remote attacker to bypass same-origin protections and leak cross-origin data via crafted HTML. The issue is listed as a Same Origin Policy bypass in Service Worker/Blink components. Debian and ...

CVE-2018-6123

CVE-2018-6123 is a use-after-free in Blink of Google Chrome prior to 67.0.3396.62, enabling a remote attacker to potentially corrupt the heap via a crafted HTML page. CNVD catalogs this Chrome/Blink memory misuse; Debian advisories note fixes in Chrome 67.0.3396.87 and later. Remediation: upgrade...

CVE-2021-37991

CVE-2021-37991 is a race condition in the V8 component of the Chromium browser engine prior to version 95.0.4638.54 that could enable a remote attacker to potentially cause heap corruption via a crafted HTML page. The connected advisories confirm the issue affects Chromium/Chrome builds before th...

CVE-2021-37995

CVE-2021-37995 affects Chromium-based browsers (e.g., Google Chrome/Chromium) via an inappropriate implementation in the WebApp Installer before 95.0.4638.54. A remote attacker could potentially overlay and spoof the Omnibox (URL bar) contents with a crafted HTML page. The vulnerability is part o...

CVE-2022-0298

CVE-2022-0298 is a Google Chrome use-after-free in the Scheduling component that can lead to heap corruption via a crafted HTML page. Multiple connected advisories confirm the vulnerability in Chrome before version 97.0.4692.99, with Debian noting a fix in 97.0.4692.99-1~deb11u2 and Chrome releas...

CVE-2022-0458

CVE-2022-0458 is a Chrome use-after-free vulnerability in the Thumbnail Tab Strip prior to 98.0.4758.80 that could allow heap corruption via a crafted HTML page. The weakness affects Chrome/Chromium up to version 98.0.4758.80 and was publicly acknowledged in Chrome’s February 2022 stable-channel ...

CVE-2022-0460

CVE-2022-0460 affects Google Chrome (Windows, Mac, Linux): a use-after-free in Window Dialog handling allowed by a crafted HTML page to potentially trigger heap corruption. The vulnerability is tied to Chrome versions prior to 98.0.4758.80. Exploitation could be remote and require no user interac...

CVE-2023-0697

CVE-2023-0697: In Google Chrome for Android, prior to 110.0.5481.77, an inappropriate Fullscreen implementation allows a remote attacker to spoof the security UI via a crafted HTML page. The issue is fixed in Chrome 110.0.5481.77+. Affected product: Google Chrome on Android; root cause: Fullscree...

CVE-2024-9123

CVE-2024-9123 is a chromium/Chrome Skia vulnerability: an integer overflow in Skia prior to 129.0.6668.70 enables a remote attack via a crafted HTML page to trigger an out-of-bounds memory write. Affected software includes Google Chrome (Chromium-based) with versions before 129.0.6668.70; related...

CVE-2011-1187

CVE-2011-1187 affects Google Chrome prior to 10.0.648.127, allowing remote attackers to bypass the Same Origin Policy via an unspecified error-message leak vector. The vulnerability targets the browser’s SOP checks, enabling cross-origin access that should be restricted. Public sources within the...

CVE-2018-16074

CVE-2018-16074 affects Google Chrome/Chromium site isolation: insufficient policy enforcement allowed a remote attacker to bypass site isolation via a crafted HTML page. Affected versions are before 69.0.3497.81. Remediation: update to Chrome/Chromium 69.0.3497.81 or newer. Exploitation details a...

CVE-2018-17459

CVE-2018-17459 describes an issue in Google Chrome where the Omnibox (URL bar) could be spoofed due to incorrect handling of clicks in the omnibox during Navigation. A crafted HTML page could trigger this to mislead users. The vulnerability affects Chrome versions prior to 69.0.3497.92, with impa...

CVE-2018-6063

CVE-2018-6063 refers to an issue in Google Chrome/Chromium before 65.0.3325.146 where Mojo's shared memory permissions were mishandled via mojo::WrapSharedMemoryHandle in Mojo. This allowed a remote attacker who had already compromised a renderer process to perform an out-of-bounds memory write v...

CVE-2018-6076

CVE-2018-6076 affects Google Chrome (Blink) where URL fragment identifiers were not encoded correctly, enabling a remote attacker to trigger a DOM-based XSS via a crafted HTML page. Concrete details in connected records place the vulnerable component in Blink/Chrome prior to version 65.0.3325.146...

CVE-2021-21217

CVE-2021-21217 affects Google Chrome via the PDFium component. The issue is uninitialized memory in PDFium that could allow a remote attacker to obtain potentially sensitive information from a process’s memory when processing a crafted PDF file. It applies to Chrome versions prior to 90.0.4430.72...

CVE-2021-37983

CVE-2021-37983: A use-after-free vulnerability in Dev Tools of Chromium (Chrome/Chromium) before version 95.0.4638.54 can allow a remote attacker to cause heap corruption via a crafted HTML page. Exploitation could enable arbitrary code execution or impact memory integrity. Remediation is to upgr...

CVE-2021-38002

CVE-2021-38002 is a use-after-free in Chrome/Chromium’s Web Transport prior to 95.0.4638.69 that could allow a remote attacker to escape the sandbox via a crafted HTML page. The issue is fixed upstream in version 95.0.4638.69, with advisories confirming upgrade as remediation. Arch Linux ASA entr...

CVE-2021-38010

CVE-2021-38010 : In Chromium (Google Chrome/Chromium) the service workers component had an inappropriate implementation flaw before version 96.0.4664.45 that allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. The practical impact i...

CVE-2022-4917

CVE-2022-4917 affects Google Chrome on Android (pre-103.0.5060.53) where an incorrect security UI in Notifications could allow a remote attacker to obscure the full-screen notification via a crafted HTML page. This is rooted in Chromium’s UI handling for notifications. The published entry (NVD) l...

CVE-2023-0701

CVE-2023-0701 describes a heap buffer overflow in the WebUI of Google Chrome before 110.0.5481.77. The flaw can be triggered by a remote attacker who convinces a user to perform specific UI interactions, potentially leading to heap corruption via the UI. Affected software: Google Chrome/Chromium ...

CVE-2023-4367

CVE-2023-4367 affects Google Chrome/Chromium’s Extensions API. The vulnerability arises from insufficient policy enforcement, enabling a user who installs a crafted malicious extension to bypass enterprise policy. Public advisories and vendor updates reference Chrome/Chromium fixes in the 116.0.5...

CVE-2024-3174

The CVE-2024-3174 entry describes an issue in Google Chrome/Chromium’s V8: an inappropriate implementation allowed remote attackers to potentially trigger object corruption via a crafted HTML page. Affected version set is before 119.0.6045.105 (Chromium), with High severity per NVD. The vulnerabi...

CVE-2024-9956

CVE-2024-9956 affects Google Chrome on Android prior to 130.0.6723.58, with an Inappropriate implementation in WebAuthentication allowing a local attacker to escalate privileges via a crafted HTML page. The CVE’s standard metrics show LOCAL attack vector, LOW attack complexity, NONE privileges re...

CVE-2017-5094

CVE-2017-5094: Type confusion in the extensions JavaScript bindings of Chromium/Google Chrome before 60.0.3112.78. Affected component is the extensions subsystem; root cause described as a type confusion. Impact stated across connected advisories: remote attacker could potentially maliciously mod...

CVE-2018-18357

CVE-2018-18357 involves Google Chrome’s URL Formatter. The issue is an insufficient policy enforcement in the URL Formatter component, allowing a remote attacker to spoof the Omnibox content with a crafted domain name. Affected versions are prior to 71.0.3578.80 (Chrome/Chromium), with mitigation...

CVE-2018-6040

CVE-2018-6040 : In Google Chrome, there was a CSP bypass due to insufficient policy enforcement in the Blink component. Version information in the provided docs indicates this affected Chrome prior to 64.0.3282.119 and was addressed by the 64.0.3282.119 update. The vulnerability could allow a cra...

CVE-2018-6173

CVE-2018-6173 affects Google Chrome/Chromium Omnibox (URL bar) via URL spoofing by confusable characters in the URL Formatter, prior to version 68.0.3440.75. Connected sources confirm URL spoofing in Omnibox with Chrome/Chromium and list upgrades to 68.0.3440.75 as remediation; no explicit exploi...

CVE-2022-0109

The CVE-2022-0109 entry concerns Google Chrome’s Autofill: an inappropriate implementation allowed a remote attacker to obtain potentially sensitive information via a crafted HTML page. Affected software is Google Chrome (prior to version 97.0.4692.71); the root cause is incorrect Autofill handli...

CVE-2022-0116

CVE-2022-0116 affects Google Chrome/Chromium. Root cause: inappropriate implementation in Compositing. Impact: remote attacker can spoof the Omnibox (URL bar) via a crafted HTML page. Affected: Chrome/Chromium builds prior to 97.0.4692.71. Mitigation: upgrade to 97.0.4692.71 or newer (per linked ...

CVE-2022-2855

CVE-2022-2855 is a use-after-free in ANGLE affecting Google Chrome/Chromium prior to 104.0.5112.101, potentially enabling a remote attacker to trigger heap corruption via a crafted HTML page. The core issue is in ANGLE, leading to high-severity impact (CVE referenced with base score 8.8). Remedia...

CVE-2022-3308

CVE-2022-3308 is a Medium-severity issue in Google Chrome/Chromium Developer Tools (insufficient policy enforcement) that could enable sandbox escape via a crafted HTML page. Debian/ Mageia advisories indicate the fix was released in Chromium 106.x: Debian notes 106.0.5249.61 (chromium) as the fi...

CVE-2023-0702

CVE-2023-0702 affects Google Chrome/Chromium: Type Confusion in Data Transfer leading to potential heap corruption via a crafted HTML page, exploitable after user interactions. Fixed in Chrome/Chromium updates (110.0.5481.77+. Users should upgrade to the latest Chrome/Chromium release (e.g., 110....

CVE-2023-1218

The connected Astra Linux security bulletin confirms CVE-2023-1218 affects Chromium/WebRTC, describing a Use-After-Free in Chrome before 111.0.5563.64 that could enable a remote attacker to exploit heap corruption via a crafted HTML page. The vulnerability impact is High, and the stated remediati...

CVE-2026-10881

The CVE-2026-10881 issue affects ANGLE in Google Chrome, with an out-of-bounds read/write that could enable a sandbox escape via a crafted HTML page. It is resolved in Chrome 149.0.7827.53 and later, per Chrome’s stability update notes. The vulnerability is identified across multiple sources (NVD...

CVE-2026-9955

CVE-2026-9955 affects Google Chrome on iOS prior to 148.0.7778.216 due to an inappropriate implementation in iOS, enabling a remote attacker to leak cross-origin data via a crafted HTML page. Affected product: Chrome for iOS. Root cause: inappropriate implementation summarized in the reports; no ...

CVE-2018-16079

CVE-2018-16079 describes a race condition in Chrome/Chromium where a prompt-permission prompt and a navigation race could allow a crafted HTML page to spoof the Omnibox (URL bar). Affected product family is Google Chrome/Chromium prior to version 69.0.3497.81. The vulnerability could enable URL s...

CVE-2018-16083

CVE-2018-16083: Out-of-bounds read in WebRTC FEC within Google Chrome’s WebRTC stack. A crafted HTML page could trigger an out-of-bounds memory read via RTP/FEC processing, allowing remote data exposure. The vulnerability affects Chrome versions prior to 69.0.3497.81; remediation is to update Chr...

CVE-2018-17474

CVE-2018-17474 concerns a use-after-free in the Blink component, specifically in the HTMLImportsController, affecting Google Chrome and Blink before version 70.0.3538.67. The issue could allow a remote attacker to cause heap corruption via a crafted HTML page, as described in multiple sources. Th...

CVE-2018-6031

CVE-2018-6031 is a use-after-free in PDFium used by Google Chrome before 64.0.3282.119, allowing a remote attacker to potentially trigger heap corruption via a crafted PDF file. Public advisories confirm Chrome/Chromium updates addressing this CVE (64.0.3282.119 and later). Affected product is Go...

CVE-2018-6134

Chrome Blink vulnerability CVE-2018-6134: information leak via bypass of the No-Referrer policy in a crafted HTML page, affecting Chrome prior to 67.0.3396.62. Remediation demonstrated by Debian advisories: update to 67.0.3396.87-1~deb9u1 (and newer).

CVE-2021-21218

CVE-2021-21218 maps to a memory-disclosure flaw in PDFium used by Google Chrome before 90.0.4430.72. A crafted PDF could let remote attackers read potentially sensitive data from process memory. Remediation is to upgrade Chrome to 90.0.4430.72 or newer as indicated by multiple advisories.

CVE-2021-37994

CVE-2021-37994 affects the iFrame Sandbox component in Chromium/Google Chrome prior to version 95.0.4638.54. The root cause is an inappropriate implementation in iFrame Sandbox that lets a remote attacker bypass navigation restrictions via a crafted HTML page. The issue is mitigated by upgrading ...

CVE-2021-38022

CVE-2021-38022 affects Google Chrome’s WebAuthentication component in the Chromium engine, with an inappropriate implementation before 96.0.4664.45 that could allow a remote attacker to leak cross-origin data via a crafted HTML page. The issue is described in multiple security entries and advisor...