CVE-2026-13981

CVE-2026-13981: In Chrome for iOS, Google Chrome on iOS contains an inappropriate implementation that enables UI spoofing via a crafted HTML page. Affected product is Chrome for iOS; root cause is an implementation flaw in the iOS build. Impact stated: remote attacker could perform UI spoofing. R...

CVE-2026-19175

CVE-2026-19175 concerns Google Chrome (Payments component) with a use-after-free in the Payments module, leading to a potential sandbox escape via a crafted HTML page. The issue affects Chrome versions prior to 151.0.7922.109 . The stable-channel update released to 151.0.7922.108/109 for Windows/...

CVE-2026-19177

CVE-2026-19177 affects Google Chrome UI components prior to 151.0.7922.109, due to insufficient validation of untrusted input, potentially enabling a sandbox escape when a renderer process is compromised via a crafted HTML page. The impact is a high-severity sandbox escape with same-origin and da...

CVE-2017-15429

The CVE-2017-15429 entry concerns Google Chrome prior to 63.0.3239.108, where an insecure implementation in V8 WebAssembly JS bindings could allow a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. Affected component is the V8 bindings used by Chrome’s WebAssemb...

CVE-2018-16088

CVE-2018-16088 affects Google Chrome (Blink) due to a missing check for JS-simulated input events, allowing a remote attacker to download arbitrary files with no user input via a crafted HTML page. Chrome 69.0.3497.81 addresses the flaw; updating to that version or newer is the remediation descri...

CVE-2018-17458

CVE-2018-17458 affects Google Chrome WebAssembly: an improper update of the WebAssembly dispatch table in WebAssembly (Chrome before 69.0.3497.92) allowed a remote attacker to execute arbitrary code in a sandbox via a crafted HTML page. This is evidenced by NVD details and CNVD entries, which des...

CVE-2018-6045

CVE-2018-6045 affects Google Chrome (DevTools) and is caused by Insufficient policy enforcement in DevTools from extensions, allowing a remote attacker to potentially leak user local file data via a crafted Chrome extension. The vulnerability is tied to Chrome versions prior to 64.0.3282.119. Pub...

CVE-2018-6048

CVE-2018-6048 is a Chrome Blink vulnerability where insufficient enforcement of the referrer policy allowed leakage of referrer information via a crafted HTML page. Affected product: Google Chrome (Blink component). Root cause: bypass of the referrer policy in Blink leading to potential informati...

CVE-2018-6051

CVE-2018-6051 affects Google Chrome prior to 64.0.3282.119. The XSS Auditor component could leak referrer information by reporting a URL to a crafted page from a page with a different origin, exposing potentially sensitive details. Public references in the Chrome 64 stable release note confirm CV...

CVE-2018-6053

CVE-2018-6053 is an information-leak vulnerability in Google Chrome’s New Tab Page caused by an inappropriate implementation. In affected versions prior to 64.0.3282.119, a local attacker could view website thumbnail images after clearing browser data by presenting a crafted HTML page. The issue ...

CVE-2018-6144

CVE-2018-6144 affects Google Chrome via the PDFium library, where an out-of-bounds memory access could be triggered by a crafted PDF. The vulnerability is in PDFium used by Chrome prior to version 67.0.3396.62 and could enable remote code execution or memory corruption. Public advisories and Debi...

CVE-2019-13691

CVE-2019-13691: Google Chrome prior to 77.0.3865.75 is affected by insufficient validation of untrusted input in navigation, enabling a remote attacker to spoof the Omnibox (URL bar) via a crafted HTML page. The issue affects Chrome’s Omnibox rendering logic and is documented across multiple sour...

CVE-2020-6500

CVE-2020-6500 affects Google Chrome interstitials prior to 80.0.3987.87. The vulnerability arises from an inappropriate implementation in interstitials, allowing a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. Exploitation would enable URL-bar spoofing wi...

CVE-2021-38004

CVE-2021-38004 affects Chromium-based Google Chrome Autofill: insufficient policy enforcement allows a remote attacker to leak cross-origin data via a crafted HTML page, prior to version 95.0.4638.69. Affected component: Autofill in Chromium/Chrome; root cause is policy enforcement gaps. Impact: ...

CVE-2021-4063

CVE-2021-4063 is a Use-After-Free vulnerability in the Chromium browser engine’s Developer Tools before version 96.0.4664.93. The issue, described across multiple trusted sources, can allow a remote attacker to potentially cause heap corruption via a crafted HTML page, with impact including arbit...

CVE-2021-4101

CVE-2021-4101: Heap buffer overflow in SwiftShader within Google Chrome/Chromium prior to 96.0.4664.110 may allow remote heap corruption via a crafted HTML page. The incident is addressed in subsequent Chrome/Chromium updates; Debian/Fedora advisories indicate the fix is included in newer Chromiu...

CVE-2022-3055

CVE-2022-3055 is a use-after-free vulnerability in Passwords handling in Google Chrome (Chromium) prior to version 105.0.5195.52. The issue could allow a remote attacker, who entices a user to perform specific UI interactions via a crafted HTML page, to trigger heap corruption. Public sources in ...

CVE-2023-3738

CVE-2023-3738 affects Google Chrome (Chromium-based) where an Inappropriate implementation in Autofill allows a remote attacker to obfuscate security UI via a crafted HTML page. Connected advisories confirm affected products include Google Chrome/Chromium, with fixes in Chrome 115.0.5790.98 (and ...

CVE-2025-3072

CVE-2025-3072 describes an improper implementation in Google Chrome’s Custom Tabs prior to 135.0.7049.52, enabling a remote attacker to trigger UI spoofing via a crafted HTML page after user engagement with specific UI gestures. Affected component: Custom Tabs in Chrome/Chromium. Impact per sourc...

CVE-2026-11253

CVE-2026-11253 affects Google Chrome prior to 149.0.7827.53. Insecure Permissions handling allowed a remote attacker to leak cross-origin data via a crafted HTML page. CVSS 3.1: 4.3 (Medium); network attack vector, low complexity, no privileges, user interaction required. No exploitation details ...

CVE-2026-14126

CVE-2026-14126 describes an issue in Google Chrome on Android prior to 150.0.7871.47 where an incorrect security UI could allow a remote attacker to spoof the domain through a crafted HTML page. The vulnerability is associated with Chromium security (severity: Low) and is exploitable via network ...

CVE-2026-8545

CVE-2026-8545 is an object-corruption in the Chromium-based Composite rendering path affecting Google Chrome. Public sources describe that an attacker who already compromised the renderer process could leak cross-origin data via a crafted HTML page. Affected product lineage is Google Chrome/Chrom...

CVE-2017-5089

CVE-2017-5089 is a domain spoofing vulnerability in the Chromium/Omnibox component. The issue is described as insufficient policy enforcement that allows a remote attacker to spoof a domain via a crafted domain name in Chrome/Chromium before version 59.0.3071.104 (e.g., Chromium/Chromium-browser)...

CVE-2018-16064

CVE-2018-16064 concerns Google Chrome’s Extensions API. It states that insufficient data validation in the Extensions API, for Chrome versions prior to 68.0.3440.75, could let an attacker who tricks a user into installing a crafted extension bypass navigation restrictions. Affected: Google Chrome...

CVE-2018-6035

CVE-2018-6035 concerns insufficient isolation of DevTools from extensions in Chromium/Google Chrome, enabling a crafted extension to potentially leak local user data. Affected product: Google Chrome (Chromium base). Root cause: insufficient policy enforcement in DevTools that allows extension int...

CVE-2018-6085

CVE-2018-6085 describes a use-after-free in Google Chrome’s Networking Disk Cache. The vulnerability affects Chrome/Chromium’s Disk Cache component and is triggered by a crafted HTML page, enabling a remote attacker to execute arbitrary code. The vulnerability is characterized as a use-after-free...

CVE-2018-6135

CVE-2018-6135 affects Google ChromeBlink UI: prior to 67.0.3396.62, Chrome loaded alerts from a new site without clearing the previous site, enabling remote domain spoofing via crafted HTML. Affected: Blink UI loading flow; root cause: not clearing prior site context when loading new alerts. Impa...

CVE-2018-6157

CVE-2018-6157 is a type-confusion vulnerability in WebRTC within Google Chrome (pre-68.0.3440.75). A crafted video packet can cause the H264 parser to mis-handle data, leading to potential heap corruption. Affected product: Google Chrome/WebRTC; impact described as heap corruption via crafted vid...

CVE-2021-4098

CVE-2021-4098 affects Mojo in Google Chrome/Chromium prior to 96.0.4664.110, enabling a renderer-compromised remote attacker to potentially escape sandbox via a crafted HTML page. Affected: Chromium-based browsers; root cause: insufficient data validation in Mojo. Impact: sandbox escape risk as d...

CVE-2026-17981

CVE-2026-17981: In Blink (Google Chrome), an inappropriate implementation allowed a remote attacker to leak cross-origin data via a crafted HTML page. Affected: Chrome prior to 151.0.7922.72. Impact per provided metrics: Confidentiality: Low; Integrity/Availability: None. Severity: Medium (CVSS 3...

CVE-2017-5062

CVE-2017-5062 : A use-after-free in Chrome Apps in Google Chrome (desktop: Mac/Windows/Linux; Android: 58.0.3029.83+) allowed remote memory corruption via a crafted Chrome extension. Root cause: use-after-free in the Chrome Apps code path leading to possible out-of-bounds access. Impact per descr...

CVE-2018-6032

CVE-2018-6032 affects Blink in Google Chrome (pre-64.0.3282.119). The vulnerability stems from insufficient policy enforcement, enabling a remote attacker to potentially bypass same-origin policy and leak cross-origin data via a crafted HTML page (Shared Worker context cited by Debian/RHSA/Gentoo...

CVE-2018-6039

CVE-2018-6039 describes an issue in Google Chrome’s DevTools where insufficient data validation could allow a remote attacker to leak user cross-origin data via a crafted Chrome Extension. Affected software: Google Chrome with DevTools. Root cause: inadequate input validation in DevTools leading ...

CVE-2018-6047

Google Chrome WebGL vulnerability CVE-2018-6047 involves insufficient policy enforcement in WebGL that could leak a user’s redirect URL via a crafted page. Affected product: Google Chrome (WebGL component). Root cause: policy enforcement issue in WebGL. Impact: potential information disclosure of...

CVE-2018-6070

CVE-2018-6070 is a CSP bypass vulnerability in Google Chrome/Chromium where an attacker could lure a user to install a crafted extension to bypass Content Security Policy. Technical details across connected records confirm the flaw resides in how extensions interact with WebUI CSP enforcement, en...

CVE-2018-6150

CVE-2018-6150 is a Chrome/ServiceWorker information-disclosure flaw triggered by incorrect Cross-Origin Resource Sharing handling in Chrome’s Service Worker. Affected product: Google Chrome (pre-66.0.3359.117). Impact: potential leakage of cross-origin data via a crafted page. Root cause: imprope...

CVE-2019-13692

CVE-2019-13692 relates to Google Chrome before 77.0.3865.75 where insufficient policy enforcement in reader mode allowed a remote attacker to bypass site isolation via a crafted HTML page. Affected software: Google Chrome (reader mode). Root cause: policy enforcement weakness enabling isolation b...

CVE-2021-21200

CVE-2021-21200 describes an out-of-bounds read in Chrome’s WebUI Settings prior to 89.0.4389.72. A remote attacker could trigger an out-of-bounds memory read by presenting a crafted HTML page. According to the provided documents, the attack requires user interaction and does not grant privileges ...

CVE-2021-38020

CVE-2021-38020 : A information-disclosure vulnerability in Chromium’s contacts picker (Chromium-based Chrome/Chromium) before 96.0.4664.45 arises from insufficient policy enforcement, allowing leakage of contact information via crafted content. Public advisories (Debian DSA-5046-1 and Arch Linux ...

CVE-2022-0311

The CVE-2022-0311 entry concerns a heap buffer overflow in Google Chrome’s Task Manager. The vulnerability is triggered via a crafted HTML page and requires user interaction, enabling a remote attacker to potentially cause heap corruption. Affected product scope centers on Google Chrome, with the...

CVE-2022-0455

CVE-2022-0455 affects Google Chrome on Android before 98.0.4758.80, where an improper Full Screen Mode implementation allowed a crafted HTML page to spoof the Omnibox (URL bar). The issue is documented in Chrome release notes and CVE trackers, with Chrome/Chromium security fixes in the 98.0.4758....

CVE-2022-0793

CVE-2022-0793 is a Use-After-Free in the Cast component of Google Chrome prior to 99.0.4844.51 that can be triggered by convincing a user to install a malicious extension and perform specific interactions, potentially causing heap corruption. The issue is documented across multiple sources (e.g.,...

CVE-2022-2857

The CVE-2022-2857 entry concerns a use-after-free in Blink (Chromium-based) in Google Chrome prior to 104.0.5112.101, allowing remote attackers to potentially trigger heap corruption via a crafted HTML page. Affected software is Google Chrome (Blink/Chromium). Root cause: use-after-free in Blink ...

CVE-2022-4909

CVE-2022-4909 describes an inappropriate XML implementation in Google Chrome/Chromium that could allow a remote attacker to bypass ASLR via a crafted HTML page. The vulnerability is reported as affecting Chrome/Chromium versions prior to 107.0.5304.62 (NVD entry cites 107.0.5304.62; Fedora adviso...

CVE-2024-3169

The CVE-2024-3169 issue affects Google Chrome (V8/Chromium) and is caused by a Use after free in V8, leading to potential heap corruption via a crafted HTML page. Affected software includes Google Chrome with V8, prior to 121.0.6167.139. Impact is high: remote attacker could potentially exploit t...

CVE-2025-1426

CVE-2025-1426 concerns a heap buffer overflow in the GPU path of Google Chrome on Android before 133.0.6943.126. A crafted HTML page could trigger heap corruption leading to code execution or a crash; this is rated High severity (CVSS 3.1 base 8.8). The issue affects Chromium-derived Chrome and h...

CVE-2026-13939

CVE-2026-13939 concerns Google Chrome on Android. The issue arises from insufficient validation of untrusted input in WebShare, allowing a remote attacker who has compromised the renderer process to perform UI spoofing via a crafted HTML page. Affected version range is Chrome on Android prior to ...

CVE-2026-14123

CVE-2026-14123 affects Google Chrome on iOS (Chrome for iOS) prior to version 150.0.7871.47. The flaw is an incorrect security UI that allows a remote attacker to spoof the Omnibox (URL bar) via a crafted HTML page. This is a UI rendering issue, not a network-processing flaw, potentially misleadi...

CVE-2026-17980

CVE-2026-17980 is tied to Google Chrome on Android, with an inappropriate UI implementation prior to version 151.0.7922.72 . The vulnerability allows a remote attacker to leak cross-origin data by persuading a user to perform specific UI gestures on a crafted HTML page. The impact is described as...

CVE-2026-7945

CVE-2026-7945 refers to insufficient validation of untrusted input in Cross-Origin Opener Policy (COOP) for Google Chrome. A remote attacker who has compromised the renderer process could bypass site isolation by presenting a crafted HTML page, affecting Chrome versions prior to 148.0.7778.96. Pu...