CVE-2021-4052

CVE-2021-4052 describes a use-after-free bug in the Chromium-based Chrome engine before version 96.0.4664.93, affecting the web apps component. An attacker could convince a user to install a crafted extension, potentially enabling heap corruption and arbitrary code execution. Publicly documented ...

CVE-2026-9950

Technical details about CVE-2026-9950 are not publicly provided in the supplied documents. Monitor for updates from official advisories; no concrete affected products, versions, impact or remediation are disclosed here.

CVE-2011-3062

CVE-2011-3062 : An off-by-one error in the OpenType Sanitizer used by Google Chrome prior to 18.0.1025.142 allows remote attackers to cause a denial of service or possibly other impact via a crafted OpenType file. The MiracleLinux/OpenSUSE/Oracle Solaris advisories reference this CVE as part of C...

CVE-2018-18345

CVE-2018-18345 affects Google Chrome/Chromium WebKit-based browsers prior to 71.0.3578.80, with an error in Site Isolation that allowed a renderer-compromised page to bypass site isolation protections. Public sources in the connected docs identify the issue as an access-restriction bypass in Site...

CVE-2018-18348

CVE-2018-18348 concerns the Chrome/Chromium Omnibox: a bug in the handling of bidirectional domain names with RTL characters allowed remote spoofing of the URL bar. The issue arises from an incorrect Omnibox implementation in Chromium-based browsers before version 71.0.3578.80, enabling a crafted...

CVE-2018-6105

CVE-2018-6105 describes an issue in Google Chrome/Chromium where the Omnibox mishandled confusable characters in IDN homographs, enabling domain spoofing via a crafted domain name. Affected product: Google Chrome (Chromium core) prior to version 66.0.3359.117. Root cause: incorrect handling of co...

CVE-2018-6129

CVE-2018-6129 is a WebRTC-related out-of-bounds read affecting Google Chrome prior to 67.0.3396.62. A remote attacker could trigger memory access violations by-serving a crafted HTML page, via unverified RTP packet handling in WebRTC. The record states no exploit details beyond that the issue is ...

CVE-2018-6130

CVE-2018-6130 is an out-of-bounds read in WebRTC VP9 processing in Google Chrome prior to 67.0.3396.62. The bug arises when processing RTP/VP9 data: a value (t10_pic_idx) is read from an RTP packet and used to index a std::map (gof_info_). If the value is absent, dereferencing map.find(...)->s...

CVE-2021-37985

Chromium/Google Chrome 95.x before 95.0.4638.54 is affected by CVE-2021-37985 due to a use-after-free in the V8 engine. The issue enables arbitrary code execution or memory corruption when a user is coaxed into loading crafted content, with impact described as remote code execution and potential ...

CVE-2021-4054

CVE-2021-4054 affects Google Chrome/Chromium autofill UI prior to 96.0.4664.93. The root cause is an incorrect security UI in the autofill path, allowing a remote attacker to spoof the displayed domain via a crafted HTML page. Affected component: Chromium browser engine’s autofill UI. Impact: dom...

CVE-2022-0101

The CVE-2022-0101 entry describes a heap buffer overflow in Google Chrome's Bookmarks component, prior to version 97.0.4692.71. The vulnerability could allow a remote attacker to potentially exploit heap corruption if a user is convinced to perform a specific user gesture. Affected product line: ...

CVE-2022-1866

Chromium/Google Chrome on ChromeOS Tablet Mode is affected by CVE-2022-1866 (Use-after-free in Tablet Mode). The underlying issue is a use-after-free that can lead to heap corruption when a user is steered through specific interactions. Affected versions are Chrome/Chromium prior to 102.0.5005.61...

CVE-2022-4193

CVE-2022-4193 affects Google Chrome/Chromium File System API. Root cause: insufficient policy enforcement allowing a crafted HTML page to bypass file system restrictions. Impact: remote bypass of file system policy with CVSS 3.1 base score 8.8 (High) per NVD; Chrome’s 108.0.5359.71 stable update ...

CVE-2026-11309

CVE-2026-11309 affects Google Chrome (Chromium-based) where insufficient policy enforcement in History permits a remote attacker to spoof UI via a crafted HTML page. Affected versions before 149.0.7827.53 are vulnerable; Chrome 149.0.7827.53 and later mitigate. Root cause is policy enforcement ga...

CVE-2026-14128

CVE-2026-14128 concerns Google Chrome on iOS (Chrome for iOS) prior to version 150.0.7871.47. The issue is an inappropriate implementation that allows a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. The documented impact is that the URL bar could display ...

CVE-2017-15396

CVE-2017-15396 is described in the connected IBM ICU bulletin as a stack buffer overflow in ICU’s NumberingSystem (C/C++) that could allow a remote attacker to trigger heap corruption via a crafted HTML page. The description in the initial document notes ICU for C/C++ before 60.2 (used in V8/Chro...

CVE-2018-16082

CVE-2018-16082 is an out-of-bounds read in SwiftShader used by Google Chrome prior to 69.0.3497.81, allowing a remote attacker to potentially trigger memory access via a crafted HTML page. Public fixes exist in Chromium/Chrome updates to version 69.0.3497.81+ (e.g., Chromium 69.0.3497.81 per open...

CVE-2018-6172

CVE-2018-6172 affects Google Chrome (Omnibox/URL Formatter). The vulnerability arises from incorrect handling of confusable characters in the URL formatter, allowing a remote attacker to spoof a domain via IDN homographs in a crafted domain name. Affected product/versions: Google Chrome prior to ...

CVE-2021-37988

CVE-2021-37988 is a use-after-free in the Profiles component of the Chromium browser engine (Chromium/Chrome), prior to version 95.0.4638.54. A remote attacker could lure a user to perform specific gestures on a crafted HTML page to potentially trigger heap corruption. Supported details from secu...

CVE-2021-4055

CVE-2021-4055 is a heap buffer overflow in the extensions component of the Chromium/Google Chrome browser before version 96.0.4664.93. The vulnerability could allow a remote attacker, via a crafted Chrome extension, to potentially exploit heap corruption and execute arbitrary code. Public advisor...

CVE-2022-0293

CVE-2022-0293 is a Chrome vulnerability described in connected documents as a use-after-free in Web packaging, allowing a remote attacker to potentially exploit heap corruption via a crafted HTML page. Affected product: Google Chrome (Web packaging component). Root cause: use-after-free leading t...

CVE-2022-3373

CVE-2022-3373 affects Google Chrome’s V8 in the Chromium base. The issue is an out-of-bounds write via a crafted HTML page, allowing a remote attacker to perform an out-of-bounds memory write with a High severity impact. The vulnerability is associated with Chrome/Chromium builds prior to 106.0.5...

CVE-2022-3654

CVE-2022-3654 is a Google Chrome/Chromium use-after-free in Layout vulnerability (pre-107.0.5304.62). The description notes potential heap corruption and remote code execution via a crafted HTML page, with high severity. Connected sources confirm Chrome/Chromium fixes, including a Chrome 107 upda...

CVE-2022-4191

CVE-2022-4191 affects Google Chrome/Chromium Sign-In. Root cause: use-after-free leading to potential heap corruption on profile destruction. Vulnerable upstream builds prior to 108.0.5359.71; fixed in Chrome 108.0.5359.71 (and the corresponding Debian package update 108.0.5359.71-2~deb11u1). Exp...

CVE-2023-0137

CVE-2023-0137 describes a heap buffer overflow in Platform Apps of Google Chrome on Chrome OS prior to 109.0.5414.74. The vulnerability could be triggered if a user is convinced to install a malicious extension, potentially enabling heap corruption via a crafted HTML page. Connected sources confi...

CVE-2025-1918

CVE-2025-1918 is an out-of-bounds read vulnerability in PDFium used by Google Chrome prior to 134.0.6998.35. A crafted PDF file could trigger out-of-bounds memory access. The CVE is listed with a Chromium/Chrome security severity of Medium and a high impact on confidentiality, integrity, and avai...

CVE-2026-13933

CVE-2026-13933 concerns insufficient policy enforcement in the Passwords feature of Google Chrome, prior to version 150.0.7871.47. A remote attacker who has already compromised the renderer process could exfiltrate potentially sensitive data from process memory via a crafted HTML page. The CVE is...

CVE-2026-15901

CVE-2026-15901 is a Use-After-Free in the Network component of Google Chrome/Chromium prior to 150.0.7871.128, enabling a remote attacker to potentially exploit heap corruption via a crafted HTML page. The issue affects Chrome/Chromium’s network handling and is rated with CRITICAL impact; remedia...

CVE-2026-7968

CVE-2026-7968 affects Google Chrome prior to 148.0.7778.96. The vulnerability arises from insufficient input validation in Cross-Origin Resource Sharing (CORS), which could let a remote attacker who already compromised a renderer process bypass the same-origin policy via a crafted HTML page. Affe...

CVE-2017-5121

CVE-2017-5121 concerns the Chromium/Google Chrome V8 component. Reports in the connected sources confirm an out-of-bounds memory access in V8 before version 61.0.3163.100, enabling a remote attacker to execute arbitrary code within the Chrome sandbox on Linux, Windows, and Mac via a crafted page....

CVE-2018-16078

CVE-2018-16078 affects Google Chrome’s Autofill: unsafe handling of credit card details in Autofill prior to version 69.0.3497.81 may allow a remote attacker to obtain sensitive information from memory via a crafted HTML page. Publicly documented references from multiple vendors (e.g., OpenSUSE/F...

CVE-2018-6062

CVE-2018-6062 is a heap overflow write in Skia used by Google Chrome (pre-65.0.3325.146). The vulnerability arises in the v8/skia stack as a result of improper boundary handling on crafted HTML, enabling a remote attacker to cause memory corruption. Public disclosures in CVE records and multiple ...

CVE-2018-6069

CVE-2018-6069: Stack overflow in Skia used by Google Chrome prior to 65.0.3325.146 allows remote code access via a crafted HTML page (out-of-bounds read). Affected software is Google Chrome/Chromium with Skia; remediation is upgrading to Chrome 65.0.3325.146+ or Chromium package versions that inc...

CVE-2018-6083

CVE-2018-6083 affects Google Chrome and Chromium-based products due to an issue in AppManifests handling for CSP sandboxed pages, where the browser failed to disallow PWA installation from sandboxed contexts. The root cause is improper processing of AppManifests, enabling a remote attacker to acc...

CVE-2018-6091

CVE-2018-6091 corresponds to a Chrome/Chromium vulnerability where Service Workers incorrectly handle plugins. The connected documentation links this CVE to the Chrome/Chromium 66.0.3359.117 line, with advisories noting affected releases and urging upgrades. Affected product: Google Chrome (Chrom...

CVE-2018-6159

CVE-2018-6159 affects Google Chrome/Chromium via an information-disclosure vulnerability in ServiceWorker caused by insufficient policy enforcement, allowing a crafted HTML page to access potentially sensitive data from process memory. Public references (including Debian security advisories) indi...

CVE-2018-6171

CVE-2018-6171 is a WebBluetooth use-after-free vulnerability in Google Chrome/Chromium before version 68.0.3440.75. The flaw occurs in the WebBluetooth implementation and could allow a remote attacker who convinces a user to install a malicious extension to read potentially sensitive information ...

CVE-2021-38016

CVE-2021-38016 stems from insufficient policy enforcement in Chromium’s background fetch component, allowing a remote attacker to bypass the same-origin policy via a crafted HTML page. The CVE affects Chromium-based browsers before version 96.0.4664.45 (notably Chrome/Chromium builds referenced i...

CVE-2021-4066

CVE-2021-4066 is an integer underflow in the ANGLE component of the Chromium browser engine, present before version 96.0.4664.93. The vulnerability could allow a remote attacker to cause heap corruption through crafted HTML/web content, potentially enabling arbitrary code execution. Concrete refe...

CVE-2022-0096

Summary: CVE-2022-0096 is a use-after-free in Storage in Google Chrome/Chromium leading to potential heap corruption via a crafted HTML page. Affected versions: Google Chrome/Chromium prior to 97.0.4692.71. Root cause: use-after-free in Storage. Impact: remote attacker could potentially exploit h...

CVE-2022-0113

The CVE-2022-0113 issue concerns Google Chrome/Blink: an inappropriate implementation in Blink prior to 97.0.4692.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Affected product: Chrome/Chromium (Blink). Root cause as stated: improper Blink behavior enabling cross...

CVE-2022-1308

CVE-2022-1308 affects Google Chrome (BFCache) with use-after-free in BFCache prior to 100.0.4896.88, enabling potential heap corruption via a crafted HTML page. The issue is associated with Chrome/Chromium family components and is reflected in multiple advisories (Chromium/Chrome updates). Affect...

CVE-2022-1311

CVE-2022-1311 affects Google Chrome/ChromeOS shell. Connected docs describe a Use-after-free in the ChromeOS shell (resource management error) that could enable a remote attacker to cause heap corruption via a crafted HTML page. Prior to 100.0.4896.88, this vulnerability was exploitable; update t...

CVE-2023-1227

CVE-2023-1227 impact: Use-after-free in Core of Google Chrome on Lacros prior to 111.0.5563.64, enabling potential heap corruption via crafted UI interaction. Documents indicate a Chromium/Chrome fix packaged as Chromium 111.0.5563.64 (and related Fedora Chromium update), addressing the vulnerabi...

CVE-2023-6705

CVE-2023-6705 is a use-after-free vulnerability in WebRTC within Google Chrome/Chromium prior to version 120.0.6099.109. The issue could allow a remote attacker to trigger heap corruption via a crafted HTML page, as indicated by multiple sources. Exploitation status is not described beyond the vu...

CVE-2017-5110

CVE-2017-5110 affects Chromium/Chrome Web Payments, specifically the payments dialog spoofing vulnerability in the Omnibox/payment UI. The root cause is an inappropriate implementation of the web payments API on blob: and data: schemes, enabling a remote attacker to spoof the Omnibox contents via...

CVE-2018-16066

CVE-2018-16066 describes a use-after-free in Blink that affects Google Chrome prior to 69.0.3497.81, enabling potential heap corruption via a crafted HTML page. The connected documents confirm Chrome/Chromium updates (e.g., Chromium 69.0.3497.81) as the remediation, with multiple advisories notin...

CVE-2018-17465

CVE-2018-17465 affects Google Chrome/Chromium (before 70.0.3538.67) where a use-after-free/memory misreference in V8 could allow a remote attacker to manipulate objects via a crafted HTML page. Public advisories (e.g., Debian/Arch/Gentoo/Debian DSA updates) confirm V8-related impact and the need ...

CVE-2018-6078

CVE-2018-6078 describes a URL spoofing vulnerability in Google Chrome’s Omnibox (URL bar) caused by incorrect handling of confusable characters. The issue affects Chrome prior to version 65.0.3325.146, enabling a remote attacker to spoof the displayed URL via a crafted domain name. The vulnerabil...

CVE-2018-6127

CVE-2018-6127 affects Chromium/Google Chrome before version 67.0.3396.62, where a use-after-free in IndexedDB could be triggered by a crafted HTML page from a compromised renderer, potentially enabling sandbox escape and arbitrary code execution. Public advisories (e.g., Debian DSA-4237-1) indica...