CVE-2021-37994

CVE-2021-37994 affects the iFrame Sandbox component in Chromium/Google Chrome prior to version 95.0.4638.54. The root cause is an inappropriate implementation in iFrame Sandbox that lets a remote attacker bypass navigation restrictions via a crafted HTML page. The issue is mitigated by upgrading ...

CVE-2022-0116

CVE-2022-0116 affects Google Chrome/Chromium. Root cause: inappropriate implementation in Compositing. Impact: remote attacker can spoof the Omnibox (URL bar) via a crafted HTML page. Affected: Chrome/Chromium builds prior to 97.0.4692.71. Mitigation: upgrade to 97.0.4692.71 or newer (per linked ...

CVE-2022-2855

CVE-2022-2855 is a use-after-free in ANGLE affecting Google Chrome/Chromium prior to 104.0.5112.101, potentially enabling a remote attacker to trigger heap corruption via a crafted HTML page. The core issue is in ANGLE, leading to high-severity impact (CVE referenced with base score 8.8). Remedia...

CVE-2022-4193

CVE-2022-4193 affects Google Chrome/Chromium File System API. Root cause: insufficient policy enforcement allowing a crafted HTML page to bypass file system restrictions. Impact: remote bypass of file system policy with CVSS 3.1 base score 8.8 (High) per NVD; Chrome’s 108.0.5359.71 stable update ...

CVE-2023-1218

The connected Astra Linux security bulletin confirms CVE-2023-1218 affects Chromium/WebRTC, describing a Use-After-Free in Chrome before 111.0.5563.64 that could enable a remote attacker to exploit heap corruption via a crafted HTML page. The vulnerability impact is High, and the stated remediati...

CVE-2024-3174

The CVE-2024-3174 entry describes an issue in Google Chrome/Chromium’s V8: an inappropriate implementation allowed remote attackers to potentially trigger object corruption via a crafted HTML page. Affected version set is before 119.0.6045.105 (Chromium), with High severity per NVD. The vulnerabi...

CVE-2026-9921

Summary: CVE-2026-9921 is a WebGL-related flaw in the Chromium-based Google Chrome browser for Android. The issue is described as an uninitialized use in WebGL that allows a remote attacker to leak cross-origin information via a crafted HTML page. Affected product/area: Google Chrome on Android, ...

CVE-2026-9986

The CVE-2026-9986 entry concerns the Chromium-based Google Chrome component OptimizationGuide. Affected product: Google Chrome (OptimizationGuide in Chromium). The flaw is insufficient validation of untrusted input, exploitable when an attacker who has compromised the renderer process crafts an H...

CVE-2011-1187

CVE-2011-1187 affects Google Chrome prior to 10.0.648.127, allowing remote attackers to bypass the Same Origin Policy via an unspecified error-message leak vector. The vulnerability targets the browser’s SOP checks, enabling cross-origin access that should be restricted. Public sources within the...

CVE-2018-17459

CVE-2018-17459 describes an issue in Google Chrome where the Omnibox (URL bar) could be spoofed due to incorrect handling of clicks in the omnibox during Navigation. A crafted HTML page could trigger this to mislead users. The vulnerability affects Chrome versions prior to 69.0.3497.92, with impa...

CVE-2018-18355

Affected software: Google Chrome (and Chromium) prior to version 71.0.3578.80. Issue: CVE-2018-18355 is a policy enforcement/URL Formatter vulnerability caused by incorrect handling of confusable characters, allowing a remote attacker to spoof the Omnibox (address bar) with a crafted domain name....

CVE-2018-6076

CVE-2018-6076 affects Google Chrome (Blink) where URL fragment identifiers were not encoded correctly, enabling a remote attacker to trigger a DOM-based XSS via a crafted HTML page. Concrete details in connected records place the vulnerable component in Blink/Chrome prior to version 65.0.3325.146...

CVE-2021-30543

CVE-2021-30543 affects Google Chrome’s Tab Strip in versions prior to 91.0.4472.77. A use-after-free in the Tab Strip component could be triggered when a user is convinced to install a malicious extension and visit a crafted HTML page, potentially enabling heap corruption and arbitrary code execu...

CVE-2021-38022

CVE-2021-38022 affects Google Chrome’s WebAuthentication component in the Chromium engine, with an inappropriate implementation before 96.0.4664.45 that could allow a remote attacker to leak cross-origin data via a crafted HTML page. The issue is described in multiple security entries and advisor...

CVE-2021-4055

CVE-2021-4055 is a heap buffer overflow in the extensions component of the Chromium/Google Chrome browser before version 96.0.4664.93. The vulnerability could allow a remote attacker, via a crafted Chrome extension, to potentially exploit heap corruption and execute arbitrary code. Public advisor...

CVE-2022-0101

The CVE-2022-0101 entry describes a heap buffer overflow in Google Chrome's Bookmarks component, prior to version 97.0.4692.71. The vulnerability could allow a remote attacker to potentially exploit heap corruption if a user is convinced to perform a specific user gesture. Affected product line: ...

CVE-2022-0293

CVE-2022-0293 is a Chrome vulnerability described in connected documents as a use-after-free in Web packaging, allowing a remote attacker to potentially exploit heap corruption via a crafted HTML page. Affected product: Google Chrome (Web packaging component). Root cause: use-after-free leading t...

CVE-2023-0702

CVE-2023-0702 affects Google Chrome/Chromium: Type Confusion in Data Transfer leading to potential heap corruption via a crafted HTML page, exploitable after user interactions. Fixed in Chrome/Chromium updates (110.0.5481.77+. Users should upgrade to the latest Chrome/Chromium release (e.g., 110....

CVE-2026-11199

CVE-2026-11199 affects Google Chrome WebRTC. The issue is described as an “inappropriate implementation” in WebRTC that, in Chrome versions prior to 149.0.7827.53, could allow a privileged-network attacker to leak cross-origin data via malicious network traffic. The CVE is categorized with a Chro...

CVE-2026-11254

Affected software: Google Chrome. The CVE-2026-11254 describes an insecure implementation in Permissions that allowed a remote attacker to perform UI spoofing via a crafted HTML page. The issue is tied to Chrome/Chromium before version 149.0.7827.53, with a stated remediation path implied by the ...

CVE-2026-13933

CVE-2026-13933 concerns insufficient policy enforcement in the Passwords feature of Google Chrome, prior to version 150.0.7871.47. A remote attacker who has already compromised the renderer process could exfiltrate potentially sensitive data from process memory via a crafted HTML page. The CVE is...

CVE-2026-19151

Summary: CVE-2026-19151 is a use-after-free vulnerability in V8 within Google Chrome, prior to version 151.0.7922.109, that could allow a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page (Chromium security severity: High). Affected software: Google Chrome (V8 e...

CVE-2026-19172

CVE-2026-19172 : Use-after-free in Chrome’s Views component allows a remote attacker, with renderer process access, to potentially escape the sandbox via a crafted HTML page on pre-151.0.7922.109 builds. Affects Google Chrome; root cause is a use-after-free in Views. The issue is being addressed ...

CVE-2017-5094

CVE-2017-5094: Type confusion in the extensions JavaScript bindings of Chromium/Google Chrome before 60.0.3112.78. Affected component is the extensions subsystem; root cause described as a type confusion. Impact stated across connected advisories: remote attacker could potentially maliciously mod...

CVE-2018-18347

CVE-2018-18347 affects Chromium/WebKit’s Navigation component. A flaw in handling failed navigations with invalid URLs allowed a remote attacker to craft an HTML page that tricks a user into running JavaScript in an arbitrary origin. The Arch Linux advisory (ASA-201812-2) and Debian advisories no...

CVE-2018-6042

CVE-2018-6042 is a Chrome/Omnibox vulnerability: an incorrect security UI in the Omnibox allowed a remote attacker to spoof the URL bar via a crafted HTML page in Chrome versions prior to 64.0.3282.119. The issue enables spoofing of the OmniBox UI, potentially misleading users about the page they...

CVE-2018-6093

CVE-2018-6093 affects Google Chrome/Chromium Blink: a vulnerability in origin checks that could allow a remote attacker to bypass same-origin protections and leak cross-origin data via crafted HTML. The issue is listed as a Same Origin Policy bypass in Service Worker/Blink components. Debian and ...

CVE-2018-6173

CVE-2018-6173 affects Google Chrome/Chromium Omnibox (URL bar) via URL spoofing by confusable characters in the URL Formatter, prior to version 68.0.3440.75. Connected sources confirm URL spoofing in Omnibox with Chrome/Chromium and list upgrades to 68.0.3440.75 as remediation; no explicit exploi...

CVE-2021-4054

CVE-2021-4054 affects Google Chrome/Chromium autofill UI prior to 96.0.4664.93. The root cause is an incorrect security UI in the autofill path, allowing a remote attacker to spoof the displayed domain via a crafted HTML page. Affected component: Chromium browser engine’s autofill UI. Impact: dom...

CVE-2022-0109

The CVE-2022-0109 entry concerns Google Chrome’s Autofill: an inappropriate implementation allowed a remote attacker to obtain potentially sensitive information via a crafted HTML page. Affected software is Google Chrome (prior to version 97.0.4692.71); the root cause is incorrect Autofill handli...

CVE-2022-3045

CVE-2022-3045 describes insufficient validation of untrusted input in V8 affecting Google Chrome/Chromium prior to 105.0.5195.52, enabling potential heap corruption via a crafted HTML page. Connected documents corroborate the same issue in Chromium/Chrome and reference fixes in the 105.0.5195.52 ...

CVE-2022-4917

CVE-2022-4917 affects Google Chrome on Android (pre-103.0.5060.53) where an incorrect security UI in Notifications could allow a remote attacker to obscure the full-screen notification via a crafted HTML page. This is rooted in Chromium’s UI handling for notifications. The published entry (NVD) l...

CVE-2023-0700

CVE-2023-0700 affects Google Chrome/Chromium prior to 110.0.5481.77, due to an inappropriate implementation in the Download path that could allow a remote attacker to spoof the Omnibox (URL bar) via a crafted HTML page. The vulnerability is categorized as Medium severity with an impact on confide...

CVE-2026-15903

CVE-2026-15903 affects Google Chrome’s V8 engine, with an out-of-bounds read/write vulnerability in V8 prior to version 150.0.7871.128. The issue allows a crafted HTML page to run arbitrary code inside the sandbox. The description notes the vulnerability as High severity and implies remote code e...

CVE-2026-7937

Summary (concrete details from sources): CVE-2026-7937 concerns insufficient policy enforcement in Chrome’s DevTools that could allow an attacker, if a user installs a crafted malicious Chrome Extension, to bypass navigation restrictions. The issue is tied to Chrome before version 148.0.7778.96. ...

CVE-2011-3062

CVE-2011-3062 : An off-by-one error in the OpenType Sanitizer used by Google Chrome prior to 18.0.1025.142 allows remote attackers to cause a denial of service or possibly other impact via a crafted OpenType file. The MiracleLinux/OpenSUSE/Oracle Solaris advisories reference this CVE as part of C...

CVE-2018-16074

CVE-2018-16074 affects Google Chrome/Chromium site isolation: insufficient policy enforcement allowed a remote attacker to bypass site isolation via a crafted HTML page. Affected versions are before 69.0.3497.81. Remediation: update to Chrome/Chromium 69.0.3497.81 or newer. Exploitation details a...

CVE-2018-16079

CVE-2018-16079 describes a race condition in Chrome/Chromium where a prompt-permission prompt and a navigation race could allow a crafted HTML page to spoof the Omnibox (URL bar). Affected product family is Google Chrome/Chromium prior to version 69.0.3497.81. The vulnerability could enable URL s...

CVE-2018-6040

CVE-2018-6040 : In Google Chrome, there was a CSP bypass due to insufficient policy enforcement in the Blink component. Version information in the provided docs indicates this affected Chrome prior to 64.0.3282.119 and was addressed by the 64.0.3282.119 update. The vulnerability could allow a cra...

CVE-2018-6063

CVE-2018-6063 refers to an issue in Google Chrome/Chromium before 65.0.3325.146 where Mojo's shared memory permissions were mishandled via mojo::WrapSharedMemoryHandle in Mojo. This allowed a remote attacker who had already compromised a renderer process to perform an out-of-bounds memory write v...

CVE-2018-6083

CVE-2018-6083 affects Google Chrome and Chromium-based products due to an issue in AppManifests handling for CSP sandboxed pages, where the browser failed to disallow PWA installation from sandboxed contexts. The root cause is improper processing of AppManifests, enabling a remote attacker to acc...

CVE-2018-6091

CVE-2018-6091 corresponds to a Chrome/Chromium vulnerability where Service Workers incorrectly handle plugins. The connected documentation links this CVE to the Chrome/Chromium 66.0.3359.117 line, with advisories noting affected releases and urging upgrades. Affected product: Google Chrome (Chrom...

CVE-2018-6134

Chrome Blink vulnerability CVE-2018-6134: information leak via bypass of the No-Referrer policy in a crafted HTML page, affecting Chrome prior to 67.0.3396.62. Remediation demonstrated by Debian advisories: update to 67.0.3396.87-1~deb9u1 (and newer).

CVE-2021-4052

CVE-2021-4052 describes a use-after-free bug in the Chromium-based Chrome engine before version 96.0.4664.93, affecting the web apps component. An attacker could convince a user to install a crafted extension, potentially enabling heap corruption and arbitrary code execution. Publicly documented ...

CVE-2022-1866

Chromium/Google Chrome on ChromeOS Tablet Mode is affected by CVE-2022-1866 (Use-after-free in Tablet Mode). The underlying issue is a use-after-free that can lead to heap corruption when a user is steered through specific interactions. Affected versions are Chrome/Chromium prior to 102.0.5005.61...

CVE-2022-2853

CVE-2022-2853 : A heap buffer overflow in Google Chrome for Android, related to the Downloads component, exists in versions before 104.0.5112.101. The issue can be exploited by a remote attacker who has compromised the renderer process via a crafted HTML page, potentially causing heap corruption....

CVE-2022-3373

CVE-2022-3373 affects Google Chrome’s V8 in the Chromium base. The issue is an out-of-bounds write via a crafted HTML page, allowing a remote attacker to perform an out-of-bounds memory write with a High severity impact. The vulnerability is associated with Chrome/Chromium builds prior to 106.0.5...

CVE-2022-4191

CVE-2022-4191 affects Google Chrome/Chromium Sign-In. Root cause: use-after-free leading to potential heap corruption on profile destruction. Vulnerable upstream builds prior to 108.0.5359.71; fixed in Chrome 108.0.5359.71 (and the corresponding Debian package update 108.0.5359.71-2~deb11u1). Exp...

CVE-2024-10231

CVE-2024-10231 is a Type Confusion in V8 affecting Google Chrome/Chromium before version 130.0.6723.69, enabling potential heap corruption via a crafted HTML page and classified as High risk. Connected sources confirm the same issue across Chromium-based releases, with patches provided in downstr...

CVE-2017-15396

CVE-2017-15396 is described in the connected IBM ICU bulletin as a stack buffer overflow in ICU’s NumberingSystem (C/C++) that could allow a remote attacker to trigger heap corruption via a crafted HTML page. The description in the initial document notes ICU for C/C++ before 60.2 (used in V8/Chro...