CVE-2017-5121

CVE-2017-5121 concerns the Chromium/Google Chrome V8 component. Reports in the connected sources confirm an out-of-bounds memory access in V8 before version 61.0.3163.100, enabling a remote attacker to execute arbitrary code within the Chrome sandbox on Linux, Windows, and Mac via a crafted page....

CVE-2018-16082

CVE-2018-16082 is an out-of-bounds read in SwiftShader used by Google Chrome prior to 69.0.3497.81, allowing a remote attacker to potentially trigger memory access via a crafted HTML page. Public fixes exist in Chromium/Chrome updates to version 69.0.3497.81+ (e.g., Chromium 69.0.3497.81 per open...

CVE-2018-17474

CVE-2018-17474 concerns a use-after-free in the Blink component, specifically in the HTMLImportsController, affecting Google Chrome and Blink before version 70.0.3538.67. The issue could allow a remote attacker to cause heap corruption via a crafted HTML page, as described in multiple sources. Th...

CVE-2018-6062

CVE-2018-6062 is a heap overflow write in Skia used by Google Chrome (pre-65.0.3325.146). The vulnerability arises in the v8/skia stack as a result of improper boundary handling on crafted HTML, enabling a remote attacker to cause memory corruption. Public disclosures in CVE records and multiple ...

CVE-2021-37985

Chromium/Google Chrome 95.x before 95.0.4638.54 is affected by CVE-2021-37985 due to a use-after-free in the V8 engine. The issue enables arbitrary code execution or memory corruption when a user is coaxed into loading crafted content, with impact described as remote code execution and potential ...

CVE-2021-4066

CVE-2021-4066 is an integer underflow in the ANGLE component of the Chromium browser engine, present before version 96.0.4664.93. The vulnerability could allow a remote attacker to cause heap corruption through crafted HTML/web content, potentially enabling arbitrary code execution. Concrete refe...

CVE-2022-0307

CVE-2022-0307 is a use-after-free in Google Chrome’s Optimization Guide component, potentially enabling heap corruption when a user is convinced to interact with crafted HTML. Affects Chrome prior to 97.0.4692.99. Google's Stable Channel and Chrome release notes confirm a security fix in version ...

CVE-2023-0137

CVE-2023-0137 describes a heap buffer overflow in Platform Apps of Google Chrome on Chrome OS prior to 109.0.5414.74. The vulnerability could be triggered if a user is convinced to install a malicious extension, potentially enabling heap corruption via a crafted HTML page. Connected sources confi...

CVE-2023-6705

CVE-2023-6705 is a use-after-free vulnerability in WebRTC within Google Chrome/Chromium prior to version 120.0.6099.109. The issue could allow a remote attacker to trigger heap corruption via a crafted HTML page, as indicated by multiple sources. Exploitation status is not described beyond the vu...

CVE-2026-14075

Technical details are not publicly available in the provided documents; the reports describe the vulnerability at a high level (no specifics on affected products/versions, exploitability, or fixes). Monitor for updates.

CVE-2026-7935

CVE-2026-7935 concerns an Inappropriate implementation in the Speech component of Google Chrome, affecting Chrome versions prior to 148.0.7778.96. A remote attacker could induce UI spoofing via a crafted HTML page. The Debian OSV, ENISA EUVD, CVE lists, and PT Security entry corroborate the issue...

CVE-2018-16066

CVE-2018-16066 describes a use-after-free in Blink that affects Google Chrome prior to 69.0.3497.81, enabling potential heap corruption via a crafted HTML page. The connected documents confirm Chrome/Chromium updates (e.g., Chromium 69.0.3497.81) as the remediation, with multiple advisories notin...

CVE-2018-16078

CVE-2018-16078 affects Google Chrome’s Autofill: unsafe handling of credit card details in Autofill prior to version 69.0.3497.81 may allow a remote attacker to obtain sensitive information from memory via a crafted HTML page. Publicly documented references from multiple vendors (e.g., OpenSUSE/F...

CVE-2018-16081

CVE-2018-16081 affects Chromium/Chrome where the chrome.debugger API could run on file:// URLs in DevTools, enabling a remote-style attacker who persuades a user to install a malicious extension to access local files without file access permission. The vulnerability stems from DevTools allowing l...

CVE-2018-18357

CVE-2018-18357 involves Google Chrome’s URL Formatter. The issue is an insufficient policy enforcement in the URL Formatter component, allowing a remote attacker to spoof the Omnibox content with a crafted domain name. Affected versions are prior to 71.0.3578.80 (Chrome/Chromium), with mitigation...

CVE-2018-6031

CVE-2018-6031 is a use-after-free in PDFium used by Google Chrome before 64.0.3282.119, allowing a remote attacker to potentially trigger heap corruption via a crafted PDF file. Public advisories confirm Chrome/Chromium updates addressing this CVE (64.0.3282.119 and later). Affected product is Go...

CVE-2018-6105

CVE-2018-6105 describes an issue in Google Chrome/Chromium where the Omnibox mishandled confusable characters in IDN homographs, enabling domain spoofing via a crafted domain name. Affected product: Google Chrome (Chromium core) prior to version 66.0.3359.117. Root cause: incorrect handling of co...

CVE-2018-6129

CVE-2018-6129 is a WebRTC-related out-of-bounds read affecting Google Chrome prior to 67.0.3396.62. A remote attacker could trigger memory access violations by-serving a crafted HTML page, via unverified RTP packet handling in WebRTC. The record states no exploit details beyond that the issue is ...

CVE-2018-6130

CVE-2018-6130 is an out-of-bounds read in WebRTC VP9 processing in Google Chrome prior to 67.0.3396.62. The bug arises when processing RTP/VP9 data: a value (t10_pic_idx) is read from an RTP packet and used to index a std::map (gof_info_). If the value is absent, dereferencing map.find(...)->s...

CVE-2021-37988

CVE-2021-37988 is a use-after-free in the Profiles component of the Chromium browser engine (Chromium/Chrome), prior to version 95.0.4638.54. A remote attacker could lure a user to perform specific gestures on a crafted HTML page to potentially trigger heap corruption. Supported details from secu...

CVE-2022-0096

Summary: CVE-2022-0096 is a use-after-free in Storage in Google Chrome/Chromium leading to potential heap corruption via a crafted HTML page. Affected versions: Google Chrome/Chromium prior to 97.0.4692.71. Root cause: use-after-free in Storage. Impact: remote attacker could potentially exploit h...

CVE-2022-0117

Consolidated details for CVE-2022-0117: A policy bypass in Blink (Chrome) prior to 97.0.4692.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Affected component is Blink in Google Chrome; underlying issue is policy restrictions bypass. Impact is cross-origin data di...

CVE-2022-0295

CVE-2022-0295 is a Use-After-Free vulnerability in Chrome/Chromium’s Omnibox. The connected sources describe a heap-corruption risk when a user is enticed to perform specific interactions via a crafted HTML page, with the issue reported for Chrome prior to version 97.0.4692.99. The Chrome securit...

CVE-2022-3054

Vulnerability CVE-2022-3054 affects Google Chrome/Chromium where DevTools policy enforcement is insufficient, allowing potential heap corruption via a crafted HTML page on versions prior to 105.0.5195.52. Connected sources confirm Chrome/Chromium updates addressing this: Debian lists fixed 105.0....

CVE-2022-3448

CVE-2022-3448 describes a memory misreference/heap corruption vulnerability in Google Chrome’s Permissions API prior to 106.0.5249.119. The issue can be triggered when a user is convinced to perform specific UI gestures on a crafted HTML page, enabling remote execution of code via heap corruption...

CVE-2022-4190

CVE-2022-4190 affects Google Chrome/Chromium prior to version 108.0.5359.71, due to insufficient data validation in Directory. A remote attacker could bypass file system restrictions via a crafted HTML page. The Chrome blog release notes document fixes for this and related CVEs; chromium/chrome m...

CVE-2024-10230

CVE-2024-10230 is a Type Confusion in V8 affecting Google Chrome/Chromium prior to 130.0.6723.69. The flaw can enable remote heap corruption via a crafted HTML page. Affected component: V8 (JavaScript engine) within Chrome/Chromium; impact is High for confidentiality, integrity, and availability....

CVE-2025-0999

CVE-2025-0999 is a real vulnerability affecting Google Chrome's V8 engine, with a heap buffer overflow in V8 prior to 133.0.6943.126 that could allow a remote attacker to trigger heap corruption via a crafted HTML page. Public advisories consistently tie this to high severity and potential arbitr...

CVE-2025-3067

CVE-2025-3067 affects Google Chrome/Chromium on Android via an Inappropriate implementation in Custom Tabs, prior to version 135.0.7049.52. Root cause: flawed handling of UI gestures enabling privilege escalation via a crafted app. Impact per CVE: high confidentiality, integrity, and availability...

CVE-2017-5110

CVE-2017-5110 affects Chromium/Chrome Web Payments, specifically the payments dialog spoofing vulnerability in the Omnibox/payment UI. The root cause is an inappropriate implementation of the web payments API on blob: and data: schemes, enabling a remote attacker to spoof the Omnibox contents via...

CVE-2018-16083

CVE-2018-16083: Out-of-bounds read in WebRTC FEC within Google Chrome’s WebRTC stack. A crafted HTML page could trigger an out-of-bounds memory read via RTP/FEC processing, allowing remote data exposure. The vulnerability affects Chrome versions prior to 69.0.3497.81; remediation is to update Chr...

CVE-2018-18345

CVE-2018-18345 affects Google Chrome/Chromium WebKit-based browsers prior to 71.0.3578.80, with an error in Site Isolation that allowed a renderer-compromised page to bypass site isolation protections. Public sources in the connected docs identify the issue as an access-restriction bypass in Site...

CVE-2018-18348

CVE-2018-18348 concerns the Chrome/Chromium Omnibox: a bug in the handling of bidirectional domain names with RTL characters allowed remote spoofing of the URL bar. The issue arises from an incorrect Omnibox implementation in Chromium-based browsers before version 71.0.3578.80, enabling a crafted...

CVE-2018-6069

CVE-2018-6069: Stack overflow in Skia used by Google Chrome prior to 65.0.3325.146 allows remote code access via a crafted HTML page (out-of-bounds read). Affected software is Google Chrome/Chromium with Skia; remediation is upgrading to Chrome 65.0.3325.146+ or Chromium package versions that inc...

CVE-2021-37997

CVE-2021-37997 affects Chromium’s Sign-In path: a use-after-free in the Sign-In component allows remote code execution via a crafted HTML page, with heap corruption as the underlying issue. Affected versions are Chromium before 95.0.4638.69. Mitigation: upgrade to 95.0.4638.69 or newer (as reflec...

CVE-2021-38016

CVE-2021-38016 stems from insufficient policy enforcement in Chromium’s background fetch component, allowing a remote attacker to bypass the same-origin policy via a crafted HTML page. The CVE affects Chromium-based browsers before version 96.0.4664.45 (notably Chrome/Chromium builds referenced i...

CVE-2021-4065

CVE-2021-4065 is a concrete Chrome/Chromium use-after-free in the autofill component, before version 96.0.4664.93. The connected advisories (Arch Linux ASA-202112-6 and ASA-202112-7, Debian DSA-5046-1) describe the issue as an arbitrary code execution risk via crafted content and note remediation...

CVE-2022-0113

The CVE-2022-0113 issue concerns Google Chrome/Blink: an inappropriate implementation in Blink prior to 97.0.4692.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Affected product: Chrome/Chromium (Blink). Root cause as stated: improper Blink behavior enabling cross...

CVE-2022-0305

CVE-2022-0305 involves an Inappropriate implementation in Chrome’s Service Worker API. Multiple connected advisories confirm the vulnerability affects Google Chrome prior to 97.0.4692.99, where a compromised renderer process could bypass site isolation via a crafted HTML page. The issue is identi...

CVE-2022-3450

Affects Google Chrome/Chromium with a use-after-free in Peer Connection that can lead to heap corruption. Vulnerable versions: prior to 106.0.5249.119. Impact: remote attacker via a crafted HTML page. Remediation: upgrade to 106.0.5249.119 or newer (per Debian DSA-5253-1 and Gentoo/GN sources). C...

CVE-2023-0704

CVE-2023-0704 affects Google Chrome/Chromium DevTools. The issue is an insufficient policy enforcement flaw that allowed a remote attacker to bypass the same-origin policy and proxy settings via a crafted HTML page. Affected versions are prior to 110.0.5481.77. Chrome’s security fixes released in...

CVE-2023-1226

The CVE-2023-1226 entry concerns Google Chrome’s Web Payments API: insufficient policy enforcement allowed CSP bypass via a crafted HTML page, affecting Chromium prior to 111.0.5563.64. The Connected Astra Linux bulletin mirrors this Chrome vulnerability. The impact is a bypass of content securit...

CVE-2023-1227

CVE-2023-1227 impact: Use-after-free in Core of Google Chrome on Lacros prior to 111.0.5563.64, enabling potential heap corruption via crafted UI interaction. Documents indicate a Chromium/Chrome fix packaged as Chromium 111.0.5563.64 (and related Fedora Chromium update), addressing the vulnerabi...

CVE-2026-19559

CVE-2026-19559 is a Google Chrome use-after-free in HTML that enables remote code execution via a crafted HTML page. Affected software: Google Chrome versions prior to 151.0.7922.137 (and cited sources also reference 151.0.7922.138 as the fixed target). Root cause: use-after-free in HTML handling...

CVE-2018-17465

CVE-2018-17465 affects Google Chrome/Chromium (before 70.0.3538.67) where a use-after-free/memory misreference in V8 could allow a remote attacker to manipulate objects via a crafted HTML page. Public advisories (e.g., Debian/Arch/Gentoo/Debian DSA updates) confirm V8-related impact and the need ...

CVE-2018-6078

CVE-2018-6078 describes a URL spoofing vulnerability in Google Chrome’s Omnibox (URL bar) caused by incorrect handling of confusable characters. The issue affects Chrome prior to version 65.0.3325.146, enabling a remote attacker to spoof the displayed URL via a crafted domain name. The vulnerabil...

CVE-2018-6127

CVE-2018-6127 affects Chromium/Google Chrome before version 67.0.3396.62, where a use-after-free in IndexedDB could be triggered by a crafted HTML page from a compromised renderer, potentially enabling sandbox escape and arbitrary code execution. Public advisories (e.g., Debian DSA-4237-1) indica...

CVE-2018-6133

CVE-2018-6133 affects Google Chrome/Chromium URL formatting: incorrect handling of confusable characters in the URL Formatter allowed domain spoofing via IDN homographs. Affected versions are Chrome prior to 67.0.3396.62 (Chromium before 67.0.3396.62). The CNVD entry notes an attacker could explo...

CVE-2018-6172

CVE-2018-6172 affects Google Chrome (Omnibox/URL Formatter). The vulnerability arises from incorrect handling of confusable characters in the URL formatter, allowing a remote attacker to spoof a domain via IDN homographs in a crafted domain name. Affected product/versions: Google Chrome prior to ...

CVE-2019-5826

CVE-2019-5826 is documented as a use-after-free in Chromium/Google Chrome components. The initial description cites a use-after-free in IndexedDB for Chrome before 73.0.3683.86, potentially enabling heap corruption via a crafted HTML page when a renderer is compromised. Connected Debian/Fedora ad...