CVE-2017-5062

CVE-2017-5062 : A use-after-free in Chrome Apps in Google Chrome (desktop: Mac/Windows/Linux; Android: 58.0.3029.83+) allowed remote memory corruption via a crafted Chrome extension. Root cause: use-after-free in the Chrome Apps code path leading to possible out-of-bounds access. Impact per descr...

CVE-2017-5071

CVE-2017-5071 : Insufficient validation of untrusted input in the V8 component of Google Chrome/Chromium allowed a remote attacker to trigger an out-of-bounds memory read via a crafted HTML page. Affected: V8 in Chromium/Chrome prior to 59.0.3071.86 on Linux/Windows/macOS and prior to 59.0.3071.9...

CVE-2018-6079

CVE-2018-6079 describes an information disclosure in WebGL within Google Chrome versions prior to 65.0.3325.146, allowing a remote attacker to leak cross-origin data via a crafted HTML page. Affected software is Google Chrome (WebGL implementation in Chrome’s rendering engine). The root cause is ...

CVE-2018-6104

CVE-2018-6104 affects Google Chrome/Chromium where the URL Formatter mishandled confusable characters (IDN homographs), enabling domain spoofing. The issue lies in the URL formatting component and could allow a remote attacker to lure users to a spoofed domain. Vulnerable versions are Chrome/Chro...

CVE-2018-6119

CVE-2018-6119 affects Google Chrome prior to 64.0.3282.119, where an incorrect security UI in the Omnibox (URL bar) allowed a remote attacker to spoof the Omnibox content via a crafted HTML page. The vulnerability originates from the Omnibox security UI handling and is confirmed in connected sour...

CVE-2018-6161

CVE-2018-6161 affects Chromium/Google Chrome Blink WebAudio: a Same-Origin Policy bypass via a crafted HTML page was reported, with affected versions prior to 68.0.3440.75. Debian and FreeBSD security listings confirm the CVE and note the fix in 68.0.3440.75 (stretch) / updated package lines; no ...

CVE-2018-6169

CVE-2018-6169 relates to Google Chrome/Chromium where a lack of timeout on the extension install prompt allowed a remote attacker to bypass permission checks and trigger installation of a unwanted extension via a crafted HTML page. Affected software is the Chrome/Chromium extension installation f...

CVE-2021-21200

CVE-2021-21200 describes an out-of-bounds read in Chrome’s WebUI Settings prior to 89.0.4389.72. A remote attacker could trigger an out-of-bounds memory read by presenting a crafted HTML page. According to the provided documents, the attack requires user interaction and does not grant privileges ...

CVE-2022-0793

CVE-2022-0793 is a Use-After-Free in the Cast component of Google Chrome prior to 99.0.4844.51 that can be triggered by convincing a user to install a malicious extension and perform specific interactions, potentially causing heap corruption. The issue is documented across multiple sources (e.g.,...

CVE-2022-4909

CVE-2022-4909 describes an inappropriate XML implementation in Google Chrome/Chromium that could allow a remote attacker to bypass ASLR via a crafted HTML page. The vulnerability is reported as affecting Chrome/Chromium versions prior to 107.0.5304.62 (NVD entry cites 107.0.5304.62; Fedora adviso...

CVE-2025-1915

CVE-2025-1915 affects Google Chrome on Windows with a DevTools path handling issue. An attacker could entice a user to install a crafted Chrome Extension to bypass file access restrictions, enabling high-impact access (CVE score 8.1, HIGH) when the user is convinced to install the malicious exten...

CVE-2014-1705

CVE-2014-1705 affects Google Chrome’s V8 engine. Chrome versions before 33.0.1750.152 (OS X/Linux) and 33.0.1750.154 (Windows) are affected by a memory corruption bug in V8 that could be exploited remotely to cause a denial of service or other impacts. Public documentation in the provided sources...

CVE-2016-9651

CVE-2016-9651 is a private-property access flaw in the V8 component of Chromium/Chrome prior to version 55.0.2883.75. The root cause is a missing check for whether a JS object property is private, enabling a remote attacker to bypass access restrictions and potentially execute arbitrary code insi...

CVE-2017-5061

Google Chrome before 58.0.3029.81 on Linux/Windows/macOS is affected by a race condition during navigation that allowed a remote attacker to spoof the Omnibox (URL bar) contents via a crafted HTML page. The entry is supported by CVE-2017-5061 details and related advisories; remediation is to upgr...

CVE-2018-16069

CVE-2018-16069 affects SwiftShader in Google Chrome/Chromium. The initial description ties the vulnerability to unintended floating-point error accumulation that could leak cross-origin data via a crafted HTML page. Several connected advisories corroborate that this CVE was addressed in Chromium ...

CVE-2018-16070

CVE-2018-16070 : Concrete details show integer/heap issues in Skia used by Google Chrome before 69.0.3497.81, allowing a remote attacker to potentially cause heap corruption via a crafted HTML page. Connected sources confirm this CVE is tracked across Chrome/Chromium releases and tied to Chromium...

CVE-2018-6054

Chromium-based Google Chrome WebUI vulnerability CVE-2018-6054 is a use-after-free in WebUI prior to 64.0.3282.119 that could enable remote heap corruption via crafted Chrome Extensions. Affected product: Google Chrome (Windows, macOS, Linux) with WebUI component; root cause: use-after-free in We...

CVE-2018-6060

CVE-2018-6060 describes a use-after-free in Chrome/Chromium’s Blink/WebKit (WebAudio) prior to version 65.0.3325.146. The issue allows a remote attacker to potentially cause heap corruption via a crafted HTML page. The Debian advisories and Chromium security updates indicate fixes in Chromium/Chr...

CVE-2018-6152

CVE-2018-6152 is a Chrome/Chromium developer tools vulnerability where the Page.downloadBehavior backend could cause downloaded files to be treated as safe, enabling a crafted HTML page and user interaction to potentially escape the sandbox. Connected sources indicate this issue affected Chromium...

CVE-2021-4098

CVE-2021-4098 affects Mojo in Google Chrome/Chromium prior to 96.0.4664.110, enabling a renderer-compromised remote attacker to potentially escape sandbox via a crafted HTML page. Affected: Chromium-based browsers; root cause: insufficient data validation in Mojo. Impact: sandbox escape risk as d...

CVE-2021-4101

CVE-2021-4101: Heap buffer overflow in SwiftShader within Google Chrome/Chromium prior to 96.0.4664.110 may allow remote heap corruption via a crafted HTML page. The incident is addressed in subsequent Chrome/Chromium updates; Debian/Fedora advisories indicate the fix is included in newer Chromiu...

CVE-2022-0120

CVE-2022-0120 affects Google Chrome Passwords with an inappropriate implementation that could allow a remote attacker to leak cross-origin data via a malicious website. Affected product: Chrome (Passwords); vulnerable component: Password handling implementation prior to 97.0.4692.71. Impact: pote...

CVE-2022-0311

The CVE-2022-0311 entry concerns a heap buffer overflow in Google Chrome’s Task Manager. The vulnerability is triggered via a crafted HTML page and requires user interaction, enabling a remote attacker to potentially cause heap corruption. Affected product scope centers on Google Chrome, with the...

CVE-2022-0455

CVE-2022-0455 affects Google Chrome on Android before 98.0.4758.80, where an improper Full Screen Mode implementation allowed a crafted HTML page to spoof the Omnibox (URL bar). The issue is documented in Chrome release notes and CVE trackers, with Chrome/Chromium security fixes in the 98.0.4758....

CVE-2024-10230

CVE-2024-10230 is a Type Confusion in V8 affecting Google Chrome/Chromium prior to 130.0.6723.69. The flaw can enable remote heap corruption via a crafted HTML page. Affected component: V8 (JavaScript engine) within Chrome/Chromium; impact is High for confidentiality, integrity, and availability....

CVE-2024-3175

CVE-2024-3175 concerns insufficient data validation in the Chrome Extensions component, enabling privilege escalation via a crafted Chrome Extension. The primary documentation states vulnerable component as Extensions, with affected Chrome versions before 120.0.6099.62 (remediation: update to 120...

CVE-2025-3072

CVE-2025-3072 describes an improper implementation in Google Chrome’s Custom Tabs prior to 135.0.7049.52, enabling a remote attacker to trigger UI spoofing via a crafted HTML page after user engagement with specific UI gestures. Affected component: Custom Tabs in Chrome/Chromium. Impact per sourc...

CVE-2026-14123

CVE-2026-14123 affects Google Chrome on iOS (Chrome for iOS) prior to version 150.0.7871.47. The flaw is an incorrect security UI that allows a remote attacker to spoof the Omnibox (URL bar) via a crafted HTML page. This is a UI rendering issue, not a network-processing flaw, potentially misleadi...

CVE-2011-2821

CVE-2011-2821 is a libxml2 double-free vulnerability triggered by crafted XPath expressions. The description notes impact as a denial of service and potential unspecified effects, with affected product usage including Google Chrome before 13.0.782.215. Connected documents corroborate this CVE acr...

CVE-2017-15418

CVE-2017-15418 concerns Google Chrome (Skia) prior to 63.0.3239.84, where use of uninitialized memory in Skia could allow a remote attacker to read sensitive data from a process memory via a crafted HTML page. Technical details across sources consistently identify Skia’s uninitialized values as t...

CVE-2017-5122

CVE-2017-5122 is an out-of-bounds memory access in Google Chrome/Chromium’s V8 engine prior to 61.0.3163.100 (Windows and Chromium) that could be triggered by a crafted HTML page, enabling remote code execution. Public notices from Debian, Arch Linux, Gentoo, Fedora, and others confirm the issue ...

CVE-2018-6037

CVE-2018-6037 concerns Google Chrome before 64.0.3282.119, where an insufficient user gesture requirement in the autofill feature could allow a remote attacker to obtain autofill data via a crafted HTML page. Connected sources corroborate the issue as an autofill/IP privacy bypass rooted in insuf...

CVE-2018-6099

Concretely, CVE-2018-6099 affects Google Chrome/Chromium by a Cross-Origin Resource Sharing bypass in Service Workers (Blink). The root cause is a lack of proper CORS checks in Blink/ServiceWorker handling, enabling a remote attacker to leak limited cross-origin data via a crafted HTML page. The ...

CVE-2021-38011

CVE-2021-38011 is a use-after-free in the storage foundation of the Chromium browser engine, affecting Chromium before 96.0.4664.45. The initial description states a remote attacker could cause heap corruption via a crafted HTML page, enabling arbitrary code execution, with impact on at least the...

CVE-2021-38013

CVE-2021-38013 : Heap buffer overflow in the fingerprint recognition component of the Chromium engine (Chrome/ChromeOS) before version 96.0.4664.45 allows a remote attacker who can reach a WebUI renderer to potentially escape the sandbox via a crafted HTML page. Multiple vendor advisories confirm...

CVE-2021-4064

CVE-2021-4064 affects Chromium-based browsers. A use-after-free in the screen capture component of the Chromium engine before version 96.0.4664.93 could allow a remote attacker to potentially trigger heap corruption and arbitrary code execution or content spoofing through a crafted HTML page. Ups...

CVE-2022-0110

CVE-2022-0110 affects Google Chrome/Chromium Autofill in the Omnibox where an incorrect security UI could be spoofed by a crafted HTML page. The issue is observed in Chrome prior to 97.0.4692.71; Debian notes a fix in 97.0.4692.71-0.1~deb11u1 for bullseye, while Gentoo references Chromium/Chrome ...

CVE-2025-1914

CVE-2025-1914 corresponds to a vulnerability in Google Chrome/Chromium where an out-of-bounds read in V8 could allow a remote attacker to perform memory access via a crafted HTML page. The issue affects Chrome versions prior to 134.0.6998.35 (Chromium parity), as indicated by multiple sources. Th...

CVE-2017-5116

CVE-2017-5116 is a type-confusion vulnerability in Google Chrome/Chromium’s V8 engine. A race-condition based flaw allowed remote attackers to execute arbitrary code by enticing a user to open a crafted HTML page. Affected product family is Chromium/Chrome with V8 in the browser’s JavaScript engi...

CVE-2018-16073

CVE-2018-16073 describes an attacker bypassing Chromium’s site isolation due to insufficient policy enforcement in Chrome’s site isolation prior to 69.0.3497.81. The CVE affects Google Chrome/Chromium and is listed among Chrome security updates (e.g.,Chromium 69.0.3497.81 fixes included in Fedora...

CVE-2018-6033

CVE-2018-6033 is listed in Debian security notes as affecting the Chromium/Google Chrome stack with a race condition in the Downloads handling when opening downloaded files. The connected documents confirm the vulnerability is associated with chromium-browser and describe it as a race condition, ...

CVE-2018-6155

CVE-2018-6155 is a use-after-free in the VP8 handling path (libvpx) used by WebRTC/video processing. Exploitation could arise from processing crafted VP8 frames, potentially affecting Chrome/WebRTC users prior to version 68.0.3440.75. The vulnerability is rooted in VP8 parsing/processing (frames ...

CVE-2018-6174

CVE-2018-6174 : An integer overflow in the SwiftShader library used by Google Chrome/Chromium prior to 68.0.3440.75 allows remote code execution via a crafted HTML page. Public notes across connected sources confirm the issue in Chromium/Chrome’s SwiftShader component, with Debian/DSA and Gentoo ...

CVE-2019-13698

The CVE-2019-13698 entry concerns Google Chrome prior to 73.0.3683.103, where an out-of-bounds memory access in JavaScript can potentially allow a remote attacker to trigger heap corruption via a crafted HTML page. The vulnerability is tied to Chrome’s JavaScript engine handling and is mitigated ...

CVE-2020-6497

CVE-2020-6497 is a policy enforcement issue in Omnibox on Google Chrome for iOS, allowing domain spoofing via a crafted URI. The connected Nessus entries confirm this CVE is part of the Chrome 83.0.4103.88– era fixes set. Affected component: Omnibox URL handling; root cause: insufficient policy e...

CVE-2022-0304

CVE-2022-0304 is a use-after-free in Google Chrome’s Bookmarks handling, where heap corruption could be triggered by a crafted HTML page after specific user interactions. The issue affects Chrome versions before 97.0.4692.99; fixed by upgrading to 97.0.4692.99 or later (per Chrome release notes a...

CVE-2022-4187

CVE-2022-4187 affects Google Chrome/DevTools on Windows prior to 108.0.5359.71, where insufficient policy enforcement in DevTools could allow a remote attacker to bypass filesystem restrictions via a crafted HTML page. The vulnerability is listed with a Chromium/Chrome Medium severity and is amon...

CVE-2022-4915

CVE-2022-4915 is a Chrome/Chromium URL formatting vulnerability: an improper URL handling in Chrome prior to 103.0.5060.134 allowed a remote attacker to spoof domains via a crafted HTML page. Documents consistently reference Google Chrome/Chromium and a domain-spoofing impact; desktop Chrome vers...

CVE-2016-9652

CVE-2016-9652 concerns Google Chrome/Chromium with multiple vulnerabilities reported in the Chromium project prior to version 55.0.2883.75. The connected advisories confirm this CVE is addressed by upgrading to 55.0.2883.75 (e.g., Debian: 55.0.2883.75-1~deb8u1; Gentoo GLSA 201612-11; Debian DSA-3...

CVE-2017-5053

CVE-2017-5053 describes an out-of-bounds read in V8 that could allow remote code execution in Google Chrome. Affected: Google Chrome on Linux/Windows/macOS older than 57.0.2987.133, and Android older than 57.0.2987.132; vulnerability linked to Array.prototype.indexOf. Impact: arbitrary code execu...