CVE-2018-6078

CVE-2018-6078 describes a URL spoofing vulnerability in Google Chrome’s Omnibox (URL bar) caused by incorrect handling of confusable characters. The issue affects Chrome prior to version 65.0.3325.146, enabling a remote attacker to spoof the displayed URL via a crafted domain name. The vulnerabil...

CVE-2018-6133

CVE-2018-6133 affects Google Chrome/Chromium URL formatting: incorrect handling of confusable characters in the URL Formatter allowed domain spoofing via IDN homographs. Affected versions are Chrome prior to 67.0.3396.62 (Chromium before 67.0.3396.62). The CNVD entry notes an attacker could explo...

CVE-2021-37990

CVE-2021-37990 describes an inappropriate implementation in the WebView component of the Chromium browser engine on Android prior to 95.0.4638.54. The issue allows a remote attacker to leak cross-origin data through a crafted Android app, i.e., data exfiltration from cross-origin contexts via Web...

CVE-2021-37997

CVE-2021-37997 affects Chromium’s Sign-In path: a use-after-free in the Sign-In component allows remote code execution via a crafted HTML page, with heap corruption as the underlying issue. Affected versions are Chromium before 95.0.4638.69. Mitigation: upgrade to 95.0.4638.69 or newer (as reflec...

CVE-2021-38008

CVE-2021-38008 is a use-after-free vulnerability in Chromium’s media component, affecting Chromium/Chrome prior to 96.0.4664.45. Impact: remote attackers could exploit this to execute arbitrary code or corrupt heap via crafted HTML content. Affected: Chromium browser engine (media component); roo...

CVE-2022-3045

CVE-2022-3045 describes insufficient validation of untrusted input in V8 affecting Google Chrome/Chromium prior to 105.0.5195.52, enabling potential heap corruption via a crafted HTML page. Connected documents corroborate the same issue in Chromium/Chrome and reference fixes in the 105.0.5195.52 ...

CVE-2022-3307

CVE-2022-3307 affects Google Chrome/Chromium media module: Use after free leading to potential heap corruption via a crafted HTML page. Affected versions prior to 106.0.5249.62. The Chrome update to 106.x (stable channel 106.0.5249.61/62 and later) includes fixes for this use-after-free in Media;...

CVE-2022-3448

CVE-2022-3448 describes a memory misreference/heap corruption vulnerability in Google Chrome’s Permissions API prior to 106.0.5249.119. The issue can be triggered when a user is convinced to perform specific UI gestures on a crafted HTML page, enabling remote execution of code via heap corruption...

CVE-2022-4190

CVE-2022-4190 affects Google Chrome/Chromium prior to version 108.0.5359.71, due to insufficient data validation in Directory. A remote attacker could bypass file system restrictions via a crafted HTML page. The Chrome blog release notes document fixes for this and related CVEs; chromium/chrome m...

CVE-2023-1226

The CVE-2023-1226 entry concerns Google Chrome’s Web Payments API: insufficient policy enforcement allowed CSP bypass via a crafted HTML page, affecting Chromium prior to 111.0.5563.64. The Connected Astra Linux bulletin mirrors this Chrome vulnerability. The impact is a bypass of content securit...

CVE-2017-5088

CVE-2017-5088 refers to an out-of-bounds read vulnerability in the V8 JavaScript engine of Google Chrome/Chromium before version 59.0.3071.104 (Android: 59.0.3071.117). The issue arises from insufficient validation in V8, allowing a remote attacker to read memory via a crafted HTML page. Public a...

CVE-2018-16081

CVE-2018-16081 affects Chromium/Chrome where the chrome.debugger API could run on file:// URLs in DevTools, enabling a remote-style attacker who persuades a user to install a malicious extension to access local files without file access permission. The vulnerability stems from DevTools allowing l...

CVE-2018-16084

CVE-2018-16084 affects Chromium/Google Chrome prior to 69.0.3497.81. Root cause: the default selected dialog button in CustomHandlers could be exploited via a crafted HTML page to trigger opening external programs. Impact: remote attacker could have the user open external programs, enabling possi...

CVE-2018-6106

CVE-2018-6106 affects the Chromium/Google Chrome stack (Chromium project) and is tied to the V8 JavaScript engine. The issue arises with an asynchronous generator that may return an incorrect state, allowing a remote attacker to potentially exploit object corruption via a crafted HTML page. Publi...

CVE-2018-6140

CVE-2018-6140 affects Google Chrome’s debugger extension API: before 67.0.3396.62, a crafted Chrome Extension could bypass restrictions and lead to arbitrary code execution if a user installs the malicious extension. The issue is tied to the debugger extension API in DevTools. Remediation in the ...

CVE-2021-4065

CVE-2021-4065 is a concrete Chrome/Chromium use-after-free in the autofill component, before version 96.0.4664.93. The connected advisories (Arch Linux ASA-202112-6 and ASA-202112-7, Debian DSA-5046-1) describe the issue as an arbitrary code execution risk via crafted content and note remediation...

CVE-2022-0295

CVE-2022-0295 is a Use-After-Free vulnerability in Chrome/Chromium’s Omnibox. The connected sources describe a heap-corruption risk when a user is enticed to perform specific interactions via a crafted HTML page, with the issue reported for Chrome prior to version 97.0.4692.99. The Chrome securit...

CVE-2022-0305

CVE-2022-0305 involves an Inappropriate implementation in Chrome’s Service Worker API. Multiple connected advisories confirm the vulnerability affects Google Chrome prior to 97.0.4692.99, where a compromised renderer process could bypass site isolation via a crafted HTML page. The issue is identi...

CVE-2022-2853

CVE-2022-2853 : A heap buffer overflow in Google Chrome for Android, related to the Downloads component, exists in versions before 104.0.5112.101. The issue can be exploited by a remote attacker who has compromised the renderer process via a crafted HTML page, potentially causing heap corruption....

CVE-2022-3054

Vulnerability CVE-2022-3054 affects Google Chrome/Chromium where DevTools policy enforcement is insufficient, allowing potential heap corruption via a crafted HTML page on versions prior to 105.0.5195.52. Connected sources confirm Chrome/Chromium updates addressing this: Debian lists fixed 105.0....

CVE-2022-3057

CVE-2022-3057 affects Google Chrome prior to 105.0.5195.52, where an inappropriate implementation in the iframe Sandbox could allow a remote attacker to leak cross-origin data via a crafted HTML page. Affected product: Google Chrome (iframe Sandbox component). Root cause per sources: flawed Sandb...

CVE-2022-3195

The CVE-2022-3195 entry affects Google Chrome/Chromium before version 105.0.5195.125, with an Out-of-bounds write in Storage that enables a remote attacker to trigger memory corruption via a crafted HTML page. The vulnerability is categorized with High severity (CVSSv3.1: AV:N/AC:L/PR:N/UI:R/S:U/...

CVE-2026-11254

Affected software: Google Chrome. The CVE-2026-11254 describes an insecure implementation in Permissions that allowed a remote attacker to perform UI spoofing via a crafted HTML page. The issue is tied to Chrome/Chromium before version 149.0.7827.53, with a stated remediation path implied by the ...

CVE-2013-0900

CVE-2013-0900 describes a race-condition vulnerability in the ICU library used by Google Chrome (and other ICU-dependent software). The issue could allow a remote attacker to cause a denial of service or potentially other impact via crafted ICU data, with remediation provided by upgrading ICU to ...

CVE-2018-6046

CVE-2018-6046 refers to an issue in Chromium/Google Chrome DevTools where insufficient data validation allowed a remote attacker to potentially leak user cross-origin data via a crafted Chrome Extension. The vulnerability is described in multiple sources (e.g., Debian DSA-4103, RHSA-2018:0265) as...

CVE-2018-6061

CVE-2018-6061: A race condition in Google's Chrome/Chromium WebAssembly/V8 stack (SharedArrayBuffers) could allow a remote attacker to trigger heap corruption via a crafted HTML page. Affected product: Google Chrome (65.x), fixed in Chrome 65.0.3325.146 (and related Chromium releases). Remediatio...

CVE-2018-6072

CVE-2018-6072 is a PDFium-related vulnerability in Google Chrome prior to 65.0.3325.146. Description: an integer overflow in the PDFium library could lead to heap corruption, potentially exploitable via a crafted PDF file. Connected sources confirm PDFium involvement and the Chrome 65.0.3325.146 ...

CVE-2018-6082

CVE-2018-6082 affects Google Chrome/Chromium prior to 65.0.3325.146. The entry describes a vulnerability where including port 22 among allowed FTP ports in Chrome’s Networking could let a remote attacker enumerate internal host services via a crafted HTML page. The connected Chrome security updat...

CVE-2018-6090

CVE-2018-6090 refers to a heap buffer overflow in Skia used by Google Chrome before 66.0.3359.117, allowing remote code execution inside the sandbox via a crafted HTML page. Connected sources confirm the flaw affects Chrome/Chromium’s Skia component and state that the fix is included in Chrome 66...

CVE-2018-6110

CVE-2018-6110 affects Google Chrome/Chromium where the Downloads component wrongly parses documents as HTML during processing, allowing a remote attacker to cause script execution via a local non-HTML page. Public sources in the connected set confirm affected product families (Chromium/Chrome) an...

CVE-2018-6143

CVE-2018-6143 is a Chrome/V8 vulnerability: an out-of-bounds memory read in the V8 engine that could be exploited remotely via a crafted HTML page to leak memory. Affected software is Google Chrome (and Chromium-derived builds) prior to 67.0.3396.62; exploitation is via malicious web content. Pub...

CVE-2021-4067

CVE-2021-4067: A use-after-free in the Chromium window manager before version 96.0.4664.93 allows a remote attacker to potentially execute arbitrary code or spoof content through crafted web content. Affected product: Chromium browser engine (window manager component). Root cause: use-after-free ...

CVE-2022-0117

Consolidated details for CVE-2022-0117: A policy bypass in Blink (Chrome) prior to 97.0.4692.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Affected component is Blink in Google Chrome; underlying issue is policy restrictions bypass. Impact is cross-origin data di...

CVE-2022-2858

CVE-2022-2858 affects Google Chrome/Chromium: a use-after-free in the Sign-In Flow can lead to heap corruption via specific UI interactions. Affected products/versions are Chromium/Chrome before 104.0.5112.101; Debian and other trackers note the fix in 104.0.5112.101 (or later) for Chromium. Expl...

CVE-2026-7937

Summary (concrete details from sources): CVE-2026-7937 concerns insufficient policy enforcement in Chrome’s DevTools that could allow an attacker, if a user installs a crafted malicious Chrome Extension, to bypass navigation restrictions. The issue is tied to Chrome before version 148.0.7778.96. ...

CVE-2026-9921

Summary: CVE-2026-9921 is a WebGL-related flaw in the Chromium-based Google Chrome browser for Android. The issue is described as an uninitialized use in WebGL that allows a remote attacker to leak cross-origin information via a crafted HTML page. Affected product/area: Google Chrome on Android, ...

CVE-2018-16067

CVE-2018-16067 describes a use-after-free in WebAudio in Google Chrome/Chromium prior to 69.0.3497.81, enabling a remote attacker to potentially cause heap corruption via a crafted HTML page. Connected sources document remediation via upgrading to Chromium/Chrome version 69.0.3497.81 or newer (e....

CVE-2018-17473

CVE-2018-17473 is a URL spoofing vulnerability in Google Chrome/Chromium’s Omnibox prior to version 70.0.3538.67. The fixed release is 70.0.3538.67 (upstream) and Debian/Arch advisories document the remediation to update to 70.0.3538.67 or newer. Affected component is the Omnibox; root cause rela...

CVE-2018-17478

CVE-2018-17478 is a V8-related vulnerability in Chromium/Google Chrome prior to version 70.0.3538.102, caused by an out-of-bounds memory access that could lead to object corruption. Reports across multiple security advisories indicate the issue was fixed by upgrading Chromium to 70.0.3538.102 (e....

CVE-2018-6049

CVE-2018-6049 refers to an incorrect security UI in the permissions prompt of Google Chrome before version 64.0.3282.119. The flaw allows a remote attacker to spoof the origin for which a permission is granted via a crafted HTML page, effectively deceiving the user and potentially granting permis...

CVE-2018-6055

Technical details about CVE-2018-6055 are not publicly provided in the connected documents. The Initial Description notes impact and fix version for Chrome, but no deeper technical specifics are given. Monitor for updates.

CVE-2018-6075

Chrome 65.0.3325.146+ fixes CVE-2018-6075 (information disclosure via overly permissive cross-origin downloads). Affected product: Google Chrome/Chromium. Root cause: bypass of Same Origin Policy enabling cross-origin data leakage through a crafted HTML page and user interaction. Remediation: upg...

CVE-2018-6077

CVE-2018-6077 is a Chrome/Blink vulnerability described as a timing attack in SVG filters. Displacement map filters applied to cross-origin images could leak cross-origin data via a crafted HTML page. Affected product: Google Chrome (Blink SVG rendering). Root cause: timing issue in SVG filter pr...

CVE-2018-6107

CVE-2018-6107 is a URL spoofing vulnerability in Google Chrome/Chromium caused by incorrect handling of confusable characters in the URL Formatter (IDN homographs). A remote attacker could spoof domains via crafted domain names. The issue affected Chrome/Chromium versions prior to 66.0.3359.117 a...

CVE-2018-6108

CVE-2018-6108 affects Google Chrome/Chromium URL Formatter, where incorrect handling of confusable characters (IDN homographs) could enable domain spoofing via a crafted HTML page. Affected product: Google Chrome (and Chromium) prior to Chrome 66.0.3359.117. Root cause: misprocessing of internati...

CVE-2018-6114

CVE-2018-6114: A vulnerability in Chromium/Blink allowed bypass of Content Security Policy via CSP enforcement failure for tags. Affected products include Google Chrome and Chromium (Blink engine). Root cause is CSP bypass in the rendering pipeline, enabling remote HTML crafted pages to bypass C...

CVE-2018-6165

CVE-2018-6165 affects Google Chrome/Chromium: URL spoofing in the Omnibox due to incorrect handling of reloads in Navigation prior to 68.0.3440.75. The issue is described as a URL spoof vulnerability in the Omnibox and has been addressed in Chrome/Chromium updates (e.g., 68.0.3440.75/68.x). Publi...

CVE-2018-6168

CVE-2018-6168 is a Blink/CORS bypass vulnerability in Google Chrome prior to 68.0.3440.75. Multiple sources describe a cross-origin access issue in Blink that could leak information across origins, consistent with the initial information leakage theme. Affected software: Google Chrome/Chromium (B...

CVE-2018-6178

CVE-2018-6178 is a UI spoofing vulnerability in Google Chrome/Chromium extensions. A crafted extension could elide or misrepresent UI in the DevTools/infobar flow, enabling a remote attacker to hide Chrome security UI. Affected product: Chromium/Chrome prior to 68.0.3440.75. Root cause: UI spoofi...

CVE-2022-1861

CVE-2022-1861 affects Google Chrome on Chrome OS prior to 102.0.5005.61, with a use-after-free in the Sharing component that could lead to heap corruption after specific user interactions. Debian and Alpine advisories indicate fixes were released in version 102.0.5005.61 for Chromium/Chrome. Reme...