CVE-2022-3450

Affects Google Chrome/Chromium with a use-after-free in Peer Connection that can lead to heap corruption. Vulnerable versions: prior to 106.0.5249.119. Impact: remote attacker via a crafted HTML page. Remediation: upgrade to 106.0.5249.119 or newer (per Debian DSA-5253-1 and Gentoo/GN sources). C...

CVE-2023-6703

CVE-2023-6703 is a use-after-free in Blink affecting Chromium-based browsers (notably Google Chrome) before version 120.0.6099.109. The issue enables potential heap corruption via a crafted HTML page and is rated High. Publicly documented fixes include Chromium/Chromium-derived patches in various...

CVE-2025-9132

CVE-2025-9132 concerns Google Chrome’s V8 engine: an out-of-bounds write can lead to heap corruption when processing crafted HTML pages. The vulnerability affects Chrome/Chromium prior to version 139.0.7258.138. Impact is described as potential arbitrary code execution/heap damage, with a High se...

CVE-2018-16085

CVE-2018-16085 describes a use-after-free in ResourceCoordinator in Google Chrome prior to 69.0.3497.81. This could enable a remote attacker to cause heap corruption via a crafted HTML page. A fix is available in Chrome 69.0.3497.81 and later. Other connected records corroborate the Chrome/Resour...

CVE-2018-16086

Summary: CVE-2018-16086 affects Google Chrome/Chromium prior to 69.0.3497.81. The issue is caused by insufficient policy enforcement in the extensions API, enabling a user-driven attacker to bypass navigation restrictions via a crafted Chrome Extension. Impact (as stated): bypass of navigation re...

CVE-2018-17470

CVE-2018-17470 is a memory corruption bug in the GPU backend of Chromium/Google Chrome, before version 70.0.3538.67. A remote attacker who can render a crafted HTML page could potentially escape the sandbox. Publicly documented details across Debian security advisories and Arch Linux security not...

CVE-2018-6094

CVE-2018-6094 affects Google Chrome/Chromium, where a regression in GarbageCollection (Oilpan) could enable a remote attacker to exploit heap corruption via a crafted HTML page. The vulnerability is documented as fixed in Chrome/Chromium around version 66.0.3359.117 (e.g., Debian/ Gentoo advisori...

CVE-2018-6111

CVE-2018-6111 corresponds to a memory misreference/object lifetime issue in Google Chrome’s DevTools network handler, prior to version 66.0.3359.117. A local attacker could run arbitrary code via a crafted HTML page. Affected: Chrome/Chromium DevTools. Root cause: memory misreference in DevTools ...

CVE-2018-6153

CVE-2018-6153 is a buffer/precision error in the Skia library used by Google Chrome prior to 68.0.3440.75. The issue allows a remote attacker who has already compromised the renderer process to perform an out-of-bounds memory write via a crafted HTML page, enabling potential arbitrary code execut...

CVE-2018-6163

CVE-2018-6163 is a URL spoofing vulnerability in Google Chrome’s Omnibox caused by incorrect handling of confusable characters in the URL Formatter, allowing a remote attacker to trick users with IDN homographs. Affected product/version: Google Chrome (Omnibox) prior to 68.0.3440.75. Impact: doma...

CVE-2018-6167

CVE-2018-6167 is a Google Chrome/Chromium URL spoofing vulnerability in the Omnibox due to incorrect handling of confusable characters in the URL formatter. The flaw allowed a remote attacker to spoof a domain by presenting IDN homographs via a crafted domain name, with the issue tracked under Ch...

CVE-2018-6170

CVE-2018-6170 refers to a type confusion/bad cast in PDFium used by Google Chrome, affecting versions prior to 68.0.3440.75. The vulnerability enables a crafted PDF to trigger heap corruption, with CVSS3 base score 8.8 (HIGH) and CVSS2 6.8 (MEDIUM). Affected product: Google Chrome (PDFium compone...

CVE-2019-5826

CVE-2019-5826 is documented as a use-after-free in Chromium/Google Chrome components. The initial description cites a use-after-free in IndexedDB for Chrome before 73.0.3683.86, potentially enabling heap corruption via a crafted HTML page when a renderer is compromised. Connected Debian/Fedora ad...

CVE-2021-30543

CVE-2021-30543 affects Google Chrome’s Tab Strip in versions prior to 91.0.4472.77. A use-after-free in the Tab Strip component could be triggered when a user is convinced to install a malicious extension and visit a crafted HTML page, potentially enabling heap corruption and arbitrary code execu...

CVE-2021-37999

CVE-2021-37999 stems from insufficient data validation in the Chromium-based New Tab Page component before version 95.0.4638.69, enabling a remote attacker to inject arbitrary scripts/HTML via a crafted HTML page. Connected advisories confirm the issue affects Google Chrome/Chromium, with remedia...

CVE-2021-38006

CVE-2021-38006 affects Chromium’s storage foundation component prior to version 96.0.4664.45. Description in connected docs confirms a use-after-free vulnerability, enabling potential remote code execution or browser instability via crafted content. The issue is addressed upstream in Chromium 96....

CVE-2024-6988

CVE-2024-6988 is a Use-After-Free in Downloads in Google Chrome on iOS prior to 127.6533.72, potentially enabling heap corruption via a crafted HTML page. Connected documents confirm Chromium/Chromium-based updates with fixes (e.g., chromium packages updated to 127.0.6533.88 in Debian; Fedora upd...

CVE-2017-5069

CVE-2017-5069 affects Google Chrome (Blink) and its XSS-Protection reporting mime types. Root cause: incorrect MIME type handling in Blink, allowing a crafted HTML page to bypass Cross-Origin Resource Sharing checks. Impact: mitigates same-origin policy checks; versioned fixes exist in Chrome 58....

CVE-2018-6050

CVE-2018-6050: In Google Chrome, the Omnibox (URL bar) UI could be spoofed via a crafted HTML page, allowing a remote attacker to misrepresent the target URL. This affects Chrome versions prior to 64.0.3282.119. Root cause is a security UI weakness in Omnibox handling that permits spoofed content...

CVE-2018-6064

CVE-2018-6064 is a type-confusion vulnerability in Google Chrome’s V8 engine, caused by incorrect handling of defineGetter that could lead to heap corruption via a crafted HTML page. Affected software: Google Chrome (V8/javascript engine) prior to version 65.0.3325.146. Impact: remote code execut...

CVE-2018-6164

CVE-2018-6164 relates to Google Chrome/Chromium’s Blink component. The initial CVE description notes “insufficient origin checks for CSS content in Blink” which allowed a remote attacker to leak cross-origin data via a crafted HTML page. Connected documents corroborate a broader class of cross-or...

CVE-2019-5783

CVE-2019-5783 corresponds to an "insufficient validation of untrusted input" vulnerability in Google Chrome’s DevTools prior to version 72.0.3626.81. The flaw enables a remote attacker to perform a Dangling Markup Injection attack by delivering a crafted HTML page, as described in the public CVE ...

CVE-2021-4323

CVE-2021-4323 relates to Google Chrome’s extension framework. The issue is caused by insufficient validation of untrusted input in Extensions, affecting Chrome versions prior to 90.0.4430.72. A user who installs a malicious extension could enable access to local files via a crafted extension, as ...

CVE-2022-1144

CVE-2022-1144 is a use-after-free in Chrome's WebUI (pre-100.0.4896.60) that could enable heap corruption via specific input in DevTools, requiring user interaction. It affects Google Chrome (WebUI component) and is tracked with a high CVSS v3.1 base score (8.8; High). Related advisories confirm ...

CVE-2022-4440

CVE-2022-4440 affects Google Chrome (Chromium-based) Profiles. It is a use-after-free vulnerability in Profiles that could allow a remote attacker to exploit heap corruption via a crafted HTML page. Affected versions are prior to 108.0.5359.124. Remediation (where applicable) includes upgrading t...

CVE-2026-11199

CVE-2026-11199 affects Google Chrome WebRTC. The issue is described as an “inappropriate implementation” in WebRTC that, in Chrome versions prior to 149.0.7827.53, could allow a privileged-network attacker to leak cross-origin data via malicious network traffic. The CVE is categorized with a Chro...

CVE-2026-14066

CVE-2026-14066 affects Chrome for iOS (Google Chrome on iOS) prior to 150.0.7871.47. The issue is insufficient validation of untrusted input in a crafted HTML page, allowing a remote attacker to bypass navigation restrictions. This is described across multiple feeds (NVD, Debian, EUVD, CVE listin...

CVE-2026-14075

Technical details are not publicly available in the provided documents; the reports describe the vulnerability at a high level (no specifics on affected products/versions, exploitability, or fixes). Monitor for updates.

CVE-2017-5124

CVE-2017-5124 is a cross-site scripting (UXSS) vulnerability in the MHTML handling of Chromium/Blink, allowing a remote attacker to inject scripts/HTML via a crafted MHTML page in Google Chrome prior to 62.0.3202.62. Affected software: Google Chrome/Chromium (Blink). Impact: arbitrary script exec...

CVE-2018-6048

CVE-2018-6048 is a Chrome Blink vulnerability where insufficient enforcement of the referrer policy allowed leakage of referrer information via a crafted HTML page. Affected product: Google Chrome (Blink component). Root cause: bypass of the referrer policy in Blink leading to potential informati...

CVE-2018-6051

CVE-2018-6051 affects Google Chrome prior to 64.0.3282.119. The XSS Auditor component could leak referrer information by reporting a URL to a crafted page from a page with a different origin, exposing potentially sensitive details. Public references in the Chrome 64 stable release note confirm CV...

CVE-2018-6074

Google Chrome prior to version 65.0.3325.146 is vulnerable to a Mark-of-the-Web bypass in downloads. The root cause is the failure to apply the Mark-of-the-Web on downloaded pages, enabling a remote attacker to bypass OS-level protections via a crafted HTML page. The vulnerability is addressed in...

CVE-2018-6109

CVE-2018-6109 affects Google Chrome/Chromium: the File API readAsText() could read the user-selected file repeatedly instead of once, allowing data exposure via a crafted HTML page on Chrome versions prior to 66.0.3359.117. Public advisories (e.g., Debian security notices) confirm a fix was relea...

CVE-2018-6175

CVE-2018-6175 concerns Google Chrome URL handling: an incorrect handling of confusable characters in the Omnibox/URL Formatter allows domain spoofing via IDN homographs in Chrome versions before 68.0.3440.75. Public sources (Debian/DLA entries) indicate this vulnerability was addressed by upgradi...

CVE-2022-0114

CVE-2022-0114 affects Google Chrome/Chromium through the Blink Serial API. The flaw is an out-of-bounds memory access in Blink Serial API that could allow a remote attacker to perform an out-of-bounds memory read via a crafted HTML page and virtual serial port driver. Affected versions are Chrome...

CVE-2026-13021

Google Chrome prior to 149.0.7827.197 contains an inappropriate implementation in DeviceBoundSessionCredentials that can allow a remote attacker to bypass the same-origin policy via a crafted HTML page. The CVE description notes a Chromium-based issue with High severity; updates to Chrome are ref...

CVE-2026-9986

The CVE-2026-9986 entry concerns the Chromium-based Google Chrome component OptimizationGuide. Affected product: Google Chrome (OptimizationGuide in Chromium). The flaw is insufficient validation of untrusted input, exploitable when an attacker who has compromised the renderer process crafts an H...

CVE-2017-5059

CVE-2017-5059 describes a type confusion in Blink used by Google Chrome prior to 58.0.3029.81 on Linux/Windows/macOS (58.0.3029.83 on Android). The underlying issue could allow a remote attacker to potentially obtain code execution through a crafted HTML page. Desktop impact is listed as code exe...

CVE-2017-5089

CVE-2017-5089 is a domain spoofing vulnerability in the Chromium/Omnibox component. The issue is described as insufficient policy enforcement that allows a remote attacker to spoof a domain via a crafted domain name in Chrome/Chromium before version 59.0.3071.104 (e.g., Chromium/Chromium-browser)...

CVE-2018-6158

CVE-2018-6158 refers to a race condition in Google Chrome’s Oilpan component that could lead to heap corruption via a crafted HTML page. The vulnerability affects Chrome/Chromium before version 68.0.3440.75 (the Debian security advisories indicate fixed in 68.0.3440.75 for the stretch release). T...

CVE-2021-38014

CVE-2021-38014 describes an out-of-bounds write in the SwiftShader component of the Chromium/Google Chrome browser before version 96.0.4664.45. The vulnerability can enable a remote attacker to potentially trigger heap corruption via a crafted HTML page, leading to arbitrary code execution or bro...

CVE-2022-0291

CVE-2022-0291 concerns Google Chrome. The issue is an inappropriate implementation in Storage that, before version 97.0.4692.99, allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. The vulnerability affects Chrome’s storage handling...

CVE-2023-2314

CVE-2023-2314 affects Google Chrome DevTools (Chromium) with insufficient data validation, allowing a remote attacker to bypass navigation restrictions via a crafted HTML page. Affected component: DevTools in Chrome prior to 111.0.5563.64. Root cause: data validation flaw in DevTools. Impact: rem...

CVE-2024-10231

CVE-2024-10231 is a Type Confusion in V8 affecting Google Chrome/Chromium before version 130.0.6723.69, enabling potential heap corruption via a crafted HTML page and classified as High risk. Connected sources confirm the same issue across Chromium-based releases, with patches provided in downstr...

CVE-2025-0999

CVE-2025-0999 is a real vulnerability affecting Google Chrome's V8 engine, with a heap buffer overflow in V8 prior to 133.0.6943.126 that could allow a remote attacker to trigger heap corruption via a crafted HTML page. Public advisories consistently tie this to high severity and potential arbitr...

CVE-2026-14136

CVE-2026-14136 affects Chrome for iOS (Google Chrome on iOS) prior to 150.0.7871.47, due to insufficient validation of untrusted input. A remote attacker could trigger UI spoofing by presenting a crafted HTML page. The vulnerability is documented across multiple feeds (NVD, Debian, EUVD, CVE list...

CVE-2017-15429

The CVE-2017-15429 entry concerns Google Chrome prior to 63.0.3239.108, where an insecure implementation in V8 WebAssembly JS bindings could allow a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. Affected component is the V8 bindings used by Chrome’s WebAssemb...

CVE-2017-5092

CVE-2017-5092 affects Google Chrome on Windows where PPAPI Plugins failed to validate untrusted input, enabling a remote attacker to potentially escape the sandbox through a crafted HTML page. The root cause is insufficient input validation in PPAPI Plugins, leading to sandbox escape. Affected ve...

CVE-2018-17458

CVE-2018-17458 affects Google Chrome WebAssembly: an improper update of the WebAssembly dispatch table in WebAssembly (Chrome before 69.0.3497.92) allowed a remote attacker to execute arbitrary code in a sandbox via a crafted HTML page. This is evidenced by NVD details and CNVD entries, which des...

CVE-2018-6045

CVE-2018-6045 affects Google Chrome (DevTools) and is caused by Insufficient policy enforcement in DevTools from extensions, allowing a remote attacker to potentially leak user local file data via a crafted Chrome extension. The vulnerability is tied to Chrome versions prior to 64.0.3282.119. Pub...