CVE-2025-0999

CVE-2025-0999 is a real vulnerability affecting Google Chrome's V8 engine, with a heap buffer overflow in V8 prior to 133.0.6943.126 that could allow a remote attacker to trigger heap corruption via a crafted HTML page. Public advisories consistently tie this to high severity and potential arbitr...

CVE-2026-14136

CVE-2026-14136 affects Chrome for iOS (Google Chrome on iOS) prior to 150.0.7871.47, due to insufficient validation of untrusted input. A remote attacker could trigger UI spoofing by presenting a crafted HTML page. The vulnerability is documented across multiple feeds (NVD, Debian, EUVD, CVE list...

CVE-2017-15429

The CVE-2017-15429 entry concerns Google Chrome prior to 63.0.3239.108, where an insecure implementation in V8 WebAssembly JS bindings could allow a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. Affected component is the V8 bindings used by Chrome’s WebAssemb...

CVE-2018-17458

CVE-2018-17458 affects Google Chrome WebAssembly: an improper update of the WebAssembly dispatch table in WebAssembly (Chrome before 69.0.3497.92) allowed a remote attacker to execute arbitrary code in a sandbox via a crafted HTML page. This is evidenced by NVD details and CNVD entries, which des...

CVE-2018-6053

CVE-2018-6053 is an information-leak vulnerability in Google Chrome’s New Tab Page caused by an inappropriate implementation. In affected versions prior to 64.0.3282.119, a local attacker could view website thumbnail images after clearing browser data by presenting a crafted HTML page. The issue ...

CVE-2018-6125

CVE-2018-6125 refers to an overly permissive policy in WebUSB within Chromium/Google Chrome on Windows, enabling a remote attacker to potentially access sensitive information via a crafted HTML page. The connected sources corroborate the issue as part of Chromium/Chrome updates and enumerate a fi...

CVE-2018-6150

CVE-2018-6150 is a Chrome/ServiceWorker information-disclosure flaw triggered by incorrect Cross-Origin Resource Sharing handling in Chrome’s Service Worker. Affected product: Google Chrome (pre-66.0.3359.117). Impact: potential leakage of cross-origin data via a crafted page. Root cause: imprope...

CVE-2018-6157

CVE-2018-6157 is a type-confusion vulnerability in WebRTC within Google Chrome (pre-68.0.3440.75). A crafted video packet can cause the H264 parser to mis-handle data, leading to potential heap corruption. Affected product: Google Chrome/WebRTC; impact described as heap corruption via crafted vid...

CVE-2019-13692

CVE-2019-13692 relates to Google Chrome before 77.0.3865.75 where insufficient policy enforcement in reader mode allowed a remote attacker to bypass site isolation via a crafted HTML page. Affected software: Google Chrome (reader mode). Root cause: policy enforcement weakness enabling isolation b...

CVE-2021-38004

CVE-2021-38004 affects Chromium-based Google Chrome Autofill: insufficient policy enforcement allows a remote attacker to leak cross-origin data via a crafted HTML page, prior to version 95.0.4638.69. Affected component: Autofill in Chromium/Chrome; root cause is policy enforcement gaps. Impact: ...

CVE-2021-4063

CVE-2021-4063 is a Use-After-Free vulnerability in the Chromium browser engine’s Developer Tools before version 96.0.4664.93. The issue, described across multiple trusted sources, can allow a remote attacker to potentially cause heap corruption via a crafted HTML page, with impact including arbit...

CVE-2021-4324

CVE-2021-4324 affects Google Chrome (Chromium-based) prior to version 90.0.4430.93. Root cause: insufficient policy enforcement in Google Update. Impact: remote attacker could read arbitrary files via a malicious file. Affected versions are before 90.0.4430.93; remediation is to update to 90.0.44...

CVE-2022-3657

CVE-2022-3657 is a Chrome/Chromium vulnerability in the Extensions component: Use-after-free in Extensions in Google Chrome prior to 107.0.5304.62, potentially enabling heap corruption via a crafted extension after a user visit/install. The connected Chrome release notes confirm the fix was shipp...

CVE-2023-0704

CVE-2023-0704 affects Google Chrome/Chromium DevTools. The issue is an insufficient policy enforcement flaw that allowed a remote attacker to bypass the same-origin policy and proxy settings via a crafted HTML page. Affected versions are prior to 110.0.5481.77. Chrome’s security fixes released in...

CVE-2025-3067

CVE-2025-3067 affects Google Chrome/Chromium on Android via an Inappropriate implementation in Custom Tabs, prior to version 135.0.7049.52. Root cause: flawed handling of UI gestures enabling privilege escalation via a crafted app. Impact per CVE: high confidentiality, integrity, and availability...

CVE-2026-9110

The CVE-2026-9110 entry describes an issue in Google Chrome on Windows (pre-148.0.7778.179) where an attacker who has compromised the renderer could abuse an Inappropriate UI implementation to spoof UI via a crafted HTML page. The vulnerability affects the UI layer of Chrome’s renderer, enabling ...

CVE-2018-16064

CVE-2018-16064 concerns Google Chrome’s Extensions API. It states that insufficient data validation in the Extensions API, for Chrome versions prior to 68.0.3440.75, could let an attacker who tricks a user into installing a crafted extension bypass navigation restrictions. Affected: Google Chrome...

CVE-2018-16088

CVE-2018-16088 affects Google Chrome (Blink) due to a missing check for JS-simulated input events, allowing a remote attacker to download arbitrary files with no user input via a crafted HTML page. Chrome 69.0.3497.81 addresses the flaw; updating to that version or newer is the remediation descri...

CVE-2018-6032

CVE-2018-6032 affects Blink in Google Chrome (pre-64.0.3282.119). The vulnerability stems from insufficient policy enforcement, enabling a remote attacker to potentially bypass same-origin policy and leak cross-origin data via a crafted HTML page (Shared Worker context cited by Debian/RHSA/Gentoo...

CVE-2018-6047

Google Chrome WebGL vulnerability CVE-2018-6047 involves insufficient policy enforcement in WebGL that could leak a user’s redirect URL via a crafted page. Affected product: Google Chrome (WebGL component). Root cause: policy enforcement issue in WebGL. Impact: potential information disclosure of...

CVE-2018-6070

CVE-2018-6070 is a CSP bypass vulnerability in Google Chrome/Chromium where an attacker could lure a user to install a crafted extension to bypass Content Security Policy. Technical details across connected records confirm the flaw resides in how extensions interact with WebUI CSP enforcement, en...

CVE-2018-6085

CVE-2018-6085 describes a use-after-free in Google Chrome’s Networking Disk Cache. The vulnerability affects Chrome/Chromium’s Disk Cache component and is triggered by a crafted HTML page, enabling a remote attacker to execute arbitrary code. The vulnerability is characterized as a use-after-free...

CVE-2018-6101

CVE-2018-6101 affects Google Chrome DevTools (the DevTools remote debugging protocol). The issue is a lack of host validation in DevTools prior to 66.0.3359.117, enabling a remote attacker to execute arbitrary code via a crafted HTML page when a user is running a remote DevTools debugging server....

CVE-2018-6135

CVE-2018-6135 affects Google ChromeBlink UI: prior to 67.0.3396.62, Chrome loaded alerts from a new site without clearing the previous site, enabling remote domain spoofing via crafted HTML. Affected: Blink UI loading flow; root cause: not clearing prior site context when loading new alerts. Impa...

CVE-2019-13691

CVE-2019-13691: Google Chrome prior to 77.0.3865.75 is affected by insufficient validation of untrusted input in navigation, enabling a remote attacker to spoof the Omnibox (URL bar) via a crafted HTML page. The issue affects Chrome’s Omnibox rendering logic and is documented across multiple sour...

CVE-2022-0107

CVE-2022-0107 describes a use-after-free in Chrome OS File Manager API, enabling heap corruption when a user installs a malicious extension via a crafted HTML page. Affected product: Google Chrome on Chrome OS (pre-97.0.4692.71). The Debian security advisory notes a fix in chromium 97.0.4692.71-0...

CVE-2022-3655

CVE-2022-3655 describes a heap buffer overflow in Chrome/Chromium’s Media Galleries. Multiple sources (Chrome release notes and security trackers) confirm this affects Chrome before version 107.0.5304.62, with the risk that a user who installs a crafted malicious extension could trigger heap corr...

CVE-2023-3738

CVE-2023-3738 affects Google Chrome (Chromium-based) where an Inappropriate implementation in Autofill allows a remote attacker to obfuscate security UI via a crafted HTML page. Connected advisories confirm affected products include Google Chrome/Chromium, with fixes in Chrome 115.0.5790.98 (and ...

CVE-2026-13973

CVE-2026-13973 affects Google Chrome UI handling: an inappropriate UI implementation prior to version 150.0.7871.47 allows a remote attacker to spoof UI via a crafted HTML page when a user is guided to perform specific UI gestures. The vulnerability is described across NVD/ENISA/CVE records with ...

CVE-2010-4008

CVE-2010-4008 affects libxml2 prior to 2.7.8 and is triggered by malformed XPath expressions, causing an application crash via invalid memory access. It is noted in advisories tied to libxml2 updates for platforms using the library (e.g., Chrome and Safari stacks). The connected records reference...

CVE-2018-6035

CVE-2018-6035 concerns insufficient isolation of DevTools from extensions in Chromium/Google Chrome, enabling a crafted extension to potentially leak local user data. Affected product: Google Chrome (Chromium base). Root cause: insufficient policy enforcement in DevTools that allows extension int...

CVE-2018-6039

CVE-2018-6039 describes an issue in Google Chrome’s DevTools where insufficient data validation could allow a remote attacker to leak user cross-origin data via a crafted Chrome Extension. Affected software: Google Chrome with DevTools. Root cause: inadequate input validation in DevTools leading ...

CVE-2018-6144

CVE-2018-6144 affects Google Chrome via the PDFium library, where an out-of-bounds memory access could be triggered by a crafted PDF. The vulnerability is in PDFium used by Chrome prior to version 67.0.3396.62 and could enable remote code execution or memory corruption. Public advisories and Debi...

CVE-2021-38020

CVE-2021-38020 : A information-disclosure vulnerability in Chromium’s contacts picker (Chromium-based Chrome/Chromium) before 96.0.4664.45 arises from insufficient policy enforcement, allowing leakage of contact information via crafted content. Public advisories (Debian DSA-5046-1 and Arch Linux ...

CVE-2022-0097

CVE-2022-0097 involves an Inappropriate implementation in Chrome DevTools prior to 97.0.4692.71, where a user who installs a malicious extension could potentially allow the extension to escape the sandbox via a crafted HTML page. Reports in multiple sources (Chrome Release notes, Debian security ...

CVE-2022-0098

CVE-2022-0098 involves a use-after-free in Chrome OS Screen Capture. The vulnerability can allow heap corruption when a user is convinced to perform specific gestures, potentially enabling arbitrary code execution. Affected software is Google Chrome/Chromium with the Screen Capture component prio...

CVE-2022-3055

CVE-2022-3055 is a use-after-free vulnerability in Passwords handling in Google Chrome (Chromium) prior to version 105.0.5195.52. The issue could allow a remote attacker, who entices a user to perform specific UI interactions via a crafted HTML page, to trigger heap corruption. Public sources in ...

CVE-2024-3172

CVE-2024-3172 concerns Insufficient data validation in DevTools of Google Chrome prior to 121.0.6167.85. A remote attacker could trick a user into UI gestures to execute arbitrary code via a crafted HTML page. Affected software: Google Chrome (DevTools). Root cause: input/data validation gaps in ...

CVE-2024-3173

The CVE-2024-3173 entry describes an insufficient data validation in Chrome’s Updater, enabling OS‑level privilege escalation via a malicious file prior to Chrome 120.0.6099.62. Affected component: Updater in Google Chrome (Chromium). Root cause: insufficient input validation in updater workflow....

CVE-2025-3074

CVE-2025-3074 affects Google Chrome/Chromium on desktop, due to an inappropriate implementation in Downloads . The flaw enables a remote attacker to perform UI spoofing via a crafted HTML page . Affected component is the Downloads UI logic; root cause described as improper implementation in Downl...

CVE-2026-15764

CVE-2026-15764 is a use-after-free in Chrome’s Ozone path on Linux, enabling potential heap corruption when a user is coerced into specific UI gestures via a crafted HTML page. Affected software is Google Chrome on Linux prior to the fixed build, with the issue classified as Critical (CVSS v3.1: ...

CVE-2017-5062

CVE-2017-5062 : A use-after-free in Chrome Apps in Google Chrome (desktop: Mac/Windows/Linux; Android: 58.0.3029.83+) allowed remote memory corruption via a crafted Chrome extension. Root cause: use-after-free in the Chrome Apps code path leading to possible out-of-bounds access. Impact per descr...

CVE-2017-5071

CVE-2017-5071 : Insufficient validation of untrusted input in the V8 component of Google Chrome/Chromium allowed a remote attacker to trigger an out-of-bounds memory read via a crafted HTML page. Affected: V8 in Chromium/Chrome prior to 59.0.3071.86 on Linux/Windows/macOS and prior to 59.0.3071.9...

CVE-2018-20066

CVE-2018-20066 affects Google Chrome Extensions: vulnerable component is the Extensions lifecycle, where an incorrect object lifecycle can lead to heap corruption via a crafted HTML page. Affected: Chrome versions prior to 71.0.3578.80. Impact: remote code execution/heap corruption as described. ...

CVE-2018-6068

CVE-2018-6068 describes an object lifecycle issue in Chrome Custom Tab that could let a remote attacker spoof the Omnibox (URL bar) in Google Chrome prior to 65.0.3325.146. Related connected advisories indicate Chromium/Chrome updates fixed this family of issues around version 65.0.3325.146 (and ...

CVE-2018-6079

CVE-2018-6079 describes an information disclosure in WebGL within Google Chrome versions prior to 65.0.3325.146, allowing a remote attacker to leak cross-origin data via a crafted HTML page. Affected software is Google Chrome (WebGL implementation in Chrome’s rendering engine). The root cause is ...

CVE-2018-6104

CVE-2018-6104 affects Google Chrome/Chromium where the URL Formatter mishandled confusable characters (IDN homographs), enabling domain spoofing. The issue lies in the URL formatting component and could allow a remote attacker to lure users to a spoofed domain. Vulnerable versions are Chrome/Chro...

CVE-2018-6119

CVE-2018-6119 affects Google Chrome prior to 64.0.3282.119, where an incorrect security UI in the Omnibox (URL bar) allowed a remote attacker to spoof the Omnibox content via a crafted HTML page. The vulnerability originates from the Omnibox security UI handling and is confirmed in connected sour...

CVE-2018-6121

CVE-2018-6121 affects Google Chrome (Blink/HTML rendering) prior to 66.0.3359.170 where Insufficient validation of input allows a remote attacker to escalate privileges via a crafted HTML page. In the provided documents, the vulnerability is tied to Chrome’s Blink component, with the impact descr...

CVE-2020-6500

CVE-2020-6500 affects Google Chrome interstitials prior to 80.0.3987.87. The vulnerability arises from an inappropriate implementation in interstitials, allowing a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. Exploitation would enable URL-bar spoofing wi...