CVE-2025-1914

CVE-2025-1914 corresponds to a vulnerability in Google Chrome/Chromium where an out-of-bounds read in V8 could allow a remote attacker to perform memory access via a crafted HTML page. The issue affects Chrome versions prior to 134.0.6998.35 (Chromium parity), as indicated by multiple sources. Th...

CVE-2025-3068

CVE-2025-3068 – Google Chrome on Android : An inappropriate implementation in Intents allows privilege escalation via a crafted HTML page. Affected software is Chrome for Android (pre-135.0.7049.52). The underlying issue is in the Intents handling path, enabling a remote attacker to escalate priv...

CVE-2026-18016

CVE-2026-18016 affects Chrome for iOS (Google Chrome on iOS) before version 151.0.7922.72. The issue is described as insufficient policy enforcement, enabling a remote attacker to perform UI spoofing via a crafted HTML page. The documented impact is limited to UI spoofing with a Low severity in C...

CVE-2018-16067

CVE-2018-16067 describes a use-after-free in WebAudio in Google Chrome/Chromium prior to 69.0.3497.81, enabling a remote attacker to potentially cause heap corruption via a crafted HTML page. Connected sources document remediation via upgrading to Chromium/Chrome version 69.0.3497.81 or newer (e....

CVE-2018-17473

CVE-2018-17473 is a URL spoofing vulnerability in Google Chrome/Chromium’s Omnibox prior to version 70.0.3538.67. The fixed release is 70.0.3538.67 (upstream) and Debian/Arch advisories document the remediation to update to 70.0.3538.67 or newer. Affected component is the Omnibox; root cause rela...

CVE-2018-6110

CVE-2018-6110 affects Google Chrome/Chromium where the Downloads component wrongly parses documents as HTML during processing, allowing a remote attacker to cause script execution via a local non-HTML page. Public sources in the connected set confirm affected product families (Chromium/Chrome) an...

CVE-2018-6163

CVE-2018-6163 is a URL spoofing vulnerability in Google Chrome’s Omnibox caused by incorrect handling of confusable characters in the URL Formatter, allowing a remote attacker to trick users with IDN homographs. Affected product/version: Google Chrome (Omnibox) prior to 68.0.3440.75. Impact: doma...

CVE-2021-4323

CVE-2021-4323 relates to Google Chrome’s extension framework. The issue is caused by insufficient validation of untrusted input in Extensions, affecting Chrome versions prior to 90.0.4430.72. A user who installs a malicious extension could enable access to local files via a crafted extension, as ...

CVE-2025-7657

Chrome/WebRTC use-after-free vulnerability CVE-2025-7657 in WebRTC (Chromium) allows remote heap corruption via a crafted HTML page. Affected product/version: Google Chrome/Chromium prior to 138.0.7204.157. Impact and details are as stated in the sources: heap corruption risk with potential remot...

CVE-2026-14136

CVE-2026-14136 affects Chrome for iOS (Google Chrome on iOS) prior to 150.0.7871.47, due to insufficient validation of untrusted input. A remote attacker could trigger UI spoofing by presenting a crafted HTML page. The vulnerability is documented across multiple feeds (NVD, Debian, EUVD, CVE list...

CVE-2026-8553

Affected product: Google Chrome (GPU/renderer path). Issue: Use-after-free in GPU code leading to an out-of-bounds memory write when a crafted HTML page is processed after compromise of the renderer. Impact: remote attacker could exploit via the compromised renderer process; severity is indicated...

CVE-2017-5069

CVE-2017-5069 affects Google Chrome (Blink) and its XSS-Protection reporting mime types. Root cause: incorrect MIME type handling in Blink, allowing a crafted HTML page to bypass Cross-Origin Resource Sharing checks. Impact: mitigates same-origin policy checks; versioned fixes exist in Chrome 58....

CVE-2018-6050

CVE-2018-6050: In Google Chrome, the Omnibox (URL bar) UI could be spoofed via a crafted HTML page, allowing a remote attacker to misrepresent the target URL. This affects Chrome versions prior to 64.0.3282.119. Root cause is a security UI weakness in Omnibox handling that permits spoofed content...

CVE-2018-6114

CVE-2018-6114: A vulnerability in Chromium/Blink allowed bypass of Content Security Policy via CSP enforcement failure for tags. Affected products include Google Chrome and Chromium (Blink engine). Root cause is CSP bypass in the rendering pipeline, enabling remote HTML crafted pages to bypass C...

CVE-2018-6164

CVE-2018-6164 relates to Google Chrome/Chromium’s Blink component. The initial CVE description notes “insufficient origin checks for CSS content in Blink” which allowed a remote attacker to leak cross-origin data via a crafted HTML page. Connected documents corroborate a broader class of cross-or...

CVE-2018-6170

CVE-2018-6170 refers to a type confusion/bad cast in PDFium used by Google Chrome, affecting versions prior to 68.0.3440.75. The vulnerability enables a crafted PDF to trigger heap corruption, with CVSS3 base score 8.8 (HIGH) and CVSS2 6.8 (MEDIUM). Affected product: Google Chrome (PDFium compone...

CVE-2019-5783

CVE-2019-5783 corresponds to an "insufficient validation of untrusted input" vulnerability in Google Chrome’s DevTools prior to version 72.0.3626.81. The flaw enables a remote attacker to perform a Dangling Markup Injection attack by delivering a crafted HTML page, as described in the public CVE ...

CVE-2021-38014

CVE-2021-38014 describes an out-of-bounds write in the SwiftShader component of the Chromium/Google Chrome browser before version 96.0.4664.45. The vulnerability can enable a remote attacker to potentially trigger heap corruption via a crafted HTML page, leading to arbitrary code execution or bro...

CVE-2022-0291

CVE-2022-0291 concerns Google Chrome. The issue is an inappropriate implementation in Storage that, before version 97.0.4692.99, allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. The vulnerability affects Chrome’s storage handling...

CVE-2022-3655

CVE-2022-3655 describes a heap buffer overflow in Chrome/Chromium’s Media Galleries. Multiple sources (Chrome release notes and security trackers) confirm this affects Chrome before version 107.0.5304.62, with the risk that a user who installs a crafted malicious extension could trigger heap corr...

CVE-2026-13782

CVE-2026-13782 affects Google Chrome browser prior to 150.0.7871.47, where a use-after-free in the browser renderer could allow a remote attacker to escape the sandbox via a crafted HTML page. Upgrade to Chrome 150.0.7871.47 or later (per Chrome security updates) to remediate.

CVE-2017-5124

CVE-2017-5124 is a cross-site scripting (UXSS) vulnerability in the MHTML handling of Chromium/Blink, allowing a remote attacker to inject scripts/HTML via a crafted MHTML page in Google Chrome prior to 62.0.3202.62. Affected software: Google Chrome/Chromium (Blink). Impact: arbitrary script exec...

CVE-2018-6064

CVE-2018-6064 is a type-confusion vulnerability in Google Chrome’s V8 engine, caused by incorrect handling of defineGetter that could lead to heap corruption via a crafted HTML page. Affected software: Google Chrome (V8/javascript engine) prior to version 65.0.3325.146. Impact: remote code execut...

CVE-2018-6111

CVE-2018-6111 corresponds to a memory misreference/object lifetime issue in Google Chrome’s DevTools network handler, prior to version 66.0.3359.117. A local attacker could run arbitrary code via a crafted HTML page. Affected: Chrome/Chromium DevTools. Root cause: memory misreference in DevTools ...

CVE-2018-6167

CVE-2018-6167 is a Google Chrome/Chromium URL spoofing vulnerability in the Omnibox due to incorrect handling of confusable characters in the URL formatter. The flaw allowed a remote attacker to spoof a domain by presenting IDN homographs via a crafted domain name, with the issue tracked under Ch...

CVE-2018-6168

CVE-2018-6168 is a Blink/CORS bypass vulnerability in Google Chrome prior to 68.0.3440.75. Multiple sources describe a cross-origin access issue in Blink that could leak information across origins, consistent with the initial information leakage theme. Affected software: Google Chrome/Chromium (B...

CVE-2021-4324

CVE-2021-4324 affects Google Chrome (Chromium-based) prior to version 90.0.4430.93. Root cause: insufficient policy enforcement in Google Update. Impact: remote attacker could read arbitrary files via a malicious file. Affected versions are before 90.0.4430.93; remediation is to update to 90.0.44...

CVE-2022-0098

CVE-2022-0098 involves a use-after-free in Chrome OS Screen Capture. The vulnerability can allow heap corruption when a user is convinced to perform specific gestures, potentially enabling arbitrary code execution. Affected software is Google Chrome/Chromium with the Screen Capture component prio...

CVE-2022-1144

CVE-2022-1144 is a use-after-free in Chrome's WebUI (pre-100.0.4896.60) that could enable heap corruption via specific input in DevTools, requiring user interaction. It affects Google Chrome (WebUI component) and is tracked with a high CVSS v3.1 base score (8.8; High). Related advisories confirm ...

CVE-2024-3173

The CVE-2024-3173 entry describes an insufficient data validation in Chrome’s Updater, enabling OS‑level privilege escalation via a malicious file prior to Chrome 120.0.6099.62. Affected component: Updater in Google Chrome (Chromium). Root cause: insufficient input validation in updater workflow....

CVE-2025-1915

CVE-2025-1915 affects Google Chrome on Windows with a DevTools path handling issue. An attacker could entice a user to install a crafted Chrome Extension to bypass file access restrictions, enabling high-impact access (CVE score 8.1, HIGH) when the user is convinced to install the malicious exten...

CVE-2025-3074

CVE-2025-3074 affects Google Chrome/Chromium on desktop, due to an inappropriate implementation in Downloads . The flaw enables a remote attacker to perform UI spoofing via a crafted HTML page . Affected component is the Downloads UI logic; root cause described as improper implementation in Downl...

CVE-2025-8010

CVE-2025-8010 is a Type Confusion in V8 affecting Google Chrome prior to version 138.0.7204.168. The vulnerability allows a remote attacker to potentially trigger heap corruption via a crafted HTML page, with the documented impacts including remote code execution, high severity, and network-based...

CVE-2017-5059

CVE-2017-5059 describes a type confusion in Blink used by Google Chrome prior to 58.0.3029.81 on Linux/Windows/macOS (58.0.3029.83 on Android). The underlying issue could allow a remote attacker to potentially obtain code execution through a crafted HTML page. Desktop impact is listed as code exe...

CVE-2018-6109

CVE-2018-6109 affects Google Chrome/Chromium: the File API readAsText() could read the user-selected file repeatedly instead of once, allowing data exposure via a crafted HTML page on Chrome versions prior to 66.0.3359.117. Public advisories (e.g., Debian security notices) confirm a fix was relea...

CVE-2018-6125

CVE-2018-6125 refers to an overly permissive policy in WebUSB within Chromium/Google Chrome on Windows, enabling a remote attacker to potentially access sensitive information via a crafted HTML page. The connected sources corroborate the issue as part of Chromium/Chrome updates and enumerate a fi...

CVE-2018-6158

CVE-2018-6158 refers to a race condition in Google Chrome’s Oilpan component that could lead to heap corruption via a crafted HTML page. The vulnerability affects Chrome/Chromium before version 68.0.3440.75 (the Debian security advisories indicate fixed in 68.0.3440.75 for the stretch release). T...

CVE-2018-6175

CVE-2018-6175 concerns Google Chrome URL handling: an incorrect handling of confusable characters in the Omnibox/URL Formatter allows domain spoofing via IDN homographs in Chrome versions before 68.0.3440.75. Public sources (Debian/DLA entries) indicate this vulnerability was addressed by upgradi...

CVE-2026-8536

CVE-2026-8536 affects Google Chrome on Mac, through the ReadingMode component in Chromium. Root cause: insufficient validation of untrusted input, enabling a renderer-compromised remote attacker to bypass Site Isolation via a crafted HTML page. The Chrome update released to 148.0.7778.167/168 fix...

CVE-2017-15429

The CVE-2017-15429 entry concerns Google Chrome prior to 63.0.3239.108, where an insecure implementation in V8 WebAssembly JS bindings could allow a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. Affected component is the V8 bindings used by Chrome’s WebAssemb...

CVE-2017-5092

CVE-2017-5092 affects Google Chrome on Windows where PPAPI Plugins failed to validate untrusted input, enabling a remote attacker to potentially escape the sandbox through a crafted HTML page. The root cause is insufficient input validation in PPAPI Plugins, leading to sandbox escape. Affected ve...

CVE-2018-16088

CVE-2018-16088 affects Google Chrome (Blink) due to a missing check for JS-simulated input events, allowing a remote attacker to download arbitrary files with no user input via a crafted HTML page. Chrome 69.0.3497.81 addresses the flaw; updating to that version or newer is the remediation descri...

CVE-2018-6045

CVE-2018-6045 affects Google Chrome (DevTools) and is caused by Insufficient policy enforcement in DevTools from extensions, allowing a remote attacker to potentially leak user local file data via a crafted Chrome extension. The vulnerability is tied to Chrome versions prior to 64.0.3282.119. Pub...

CVE-2018-6095

The CVE-2018-6095 entry relates to Google Chrome’s Blink component. It describes an issue where the file picker could be dismissed inappropriately on keyboard events, allowing a remote attacker to read local files via a crafted HTML page. Affected product: Google Chrome/Blink (before version 66.0...

CVE-2018-6101

CVE-2018-6101 affects Google Chrome DevTools (the DevTools remote debugging protocol). The issue is a lack of host validation in DevTools prior to 66.0.3359.117, enabling a remote attacker to execute arbitrary code via a crafted HTML page when a user is running a remote DevTools debugging server....

CVE-2018-6103

CVE-2018-6103 is a Chrome/Chromium UI spoofing vulnerability in the Permissions prompt, where an attacker could bypass permission policy via a crafted HTML page. Connected sources identify the issue as a permissions UI spoof in Chrome/Chromium and note remediation via upgrading to Chrome 66.0.335...

CVE-2018-6131

The CVE-2018-6131 issue is a WebAssembly vulnerability in Google Chrome prior to 67.0.3396.62. According to CNVD-2018-11489, a remote attacker could exploit this via a specially crafted website to bypass security restrictions and gain access to the system. The original description notes an object...

CVE-2022-0097

CVE-2022-0097 involves an Inappropriate implementation in Chrome DevTools prior to 97.0.4692.71, where a user who installs a malicious extension could potentially allow the extension to escape the sandbox via a crafted HTML page. Reports in multiple sources (Chrome Release notes, Debian security ...

CVE-2022-0107

CVE-2022-0107 describes a use-after-free in Chrome OS File Manager API, enabling heap corruption when a user installs a malicious extension via a crafted HTML page. Affected product: Google Chrome on Chrome OS (pre-97.0.4692.71). The Debian security advisory notes a fix in chromium 97.0.4692.71-0...

CVE-2022-3316

CVE-2022-3316 describes an Insufficient validation of untrusted input in Safe Browsing in Google Chrome (Chromium) prior to 106.0.5249.62. The vulnerability allows a remote attacker to bypass a security feature via a crafted HTML page, with network attack vector, low severity, and a medium base C...