CVE-2010-4008

CVE-2010-4008 affects libxml2 prior to 2.7.8 and is triggered by malformed XPath expressions, causing an application crash via invalid memory access. It is noted in advisories tied to libxml2 updates for platforms using the library (e.g., Chrome and Safari stacks). The connected records reference...

CVE-2018-6068

CVE-2018-6068 describes an object lifecycle issue in Chrome Custom Tab that could let a remote attacker spoof the Omnibox (URL bar) in Google Chrome prior to 65.0.3325.146. Related connected advisories indicate Chromium/Chrome updates fixed this family of issues around version 65.0.3325.146 (and ...

CVE-2018-6079

CVE-2018-6079 describes an information disclosure in WebGL within Google Chrome versions prior to 65.0.3325.146, allowing a remote attacker to leak cross-origin data via a crafted HTML page. Affected software is Google Chrome (WebGL implementation in Chrome’s rendering engine). The root cause is ...

CVE-2018-6121

CVE-2018-6121 affects Google Chrome (Blink/HTML rendering) prior to 66.0.3359.170 where Insufficient validation of input allows a remote attacker to escalate privileges via a crafted HTML page. In the provided documents, the vulnerability is tied to Chrome’s Blink component, with the impact descr...

CVE-2021-4064

CVE-2021-4064 affects Chromium-based browsers. A use-after-free in the screen capture component of the Chromium engine before version 96.0.4664.93 could allow a remote attacker to potentially trigger heap corruption and arbitrary code execution or content spoofing through a crafted HTML page. Ups...

CVE-2022-0110

CVE-2022-0110 affects Google Chrome/Chromium Autofill in the Omnibox where an incorrect security UI could be spoofed by a crafted HTML page. The issue is observed in Chrome prior to 97.0.4692.71; Debian notes a fix in 97.0.4692.71-0.1~deb11u1 for bullseye, while Gentoo references Chromium/Chrome ...

CVE-2022-0120

CVE-2022-0120 affects Google Chrome Passwords with an inappropriate implementation that could allow a remote attacker to leak cross-origin data via a malicious website. Affected product: Chrome (Passwords); vulnerable component: Password handling implementation prior to 97.0.4692.71. Impact: pote...

CVE-2022-0304

CVE-2022-0304 is a use-after-free in Google Chrome’s Bookmarks handling, where heap corruption could be triggered by a crafted HTML page after specific user interactions. The issue affects Chrome versions before 97.0.4692.99; fixed by upgrading to 97.0.4692.99 or later (per Chrome release notes a...

CVE-2022-4915

CVE-2022-4915 is a Chrome/Chromium URL formatting vulnerability: an improper URL handling in Chrome prior to 103.0.5060.134 allowed a remote attacker to spoof domains via a crafted HTML page. Documents consistently reference Google Chrome/Chromium and a domain-spoofing impact; desktop Chrome vers...

CVE-2024-3175

CVE-2024-3175 concerns insufficient data validation in the Chrome Extensions component, enabling privilege escalation via a crafted Chrome Extension. The primary documentation states vulnerable component as Extensions, with affected Chrome versions before 120.0.6099.62 (remediation: update to 120...

CVE-2026-13997

The CVE-2026-13997 entry concerns Google Chrome on Android before 150.0.7871.47, where an incorrect security UI in Extensions could allow UI spoofing via a crafted HTML page if a user performed specific UI gestures after being convinced to engage them. The core issue is a flawed UI trust boundary...

CVE-2026-17980

CVE-2026-17980 is tied to Google Chrome on Android, with an inappropriate UI implementation prior to version 151.0.7922.72 . The vulnerability allows a remote attacker to leak cross-origin data by persuading a user to perform specific UI gestures on a crafted HTML page. The impact is described as...

CVE-2011-2821

CVE-2011-2821 is a libxml2 double-free vulnerability triggered by crafted XPath expressions. The description notes impact as a denial of service and potential unspecified effects, with affected product usage including Google Chrome before 13.0.782.215. Connected documents corroborate this CVE acr...

CVE-2017-5071

CVE-2017-5071 : Insufficient validation of untrusted input in the V8 component of Google Chrome/Chromium allowed a remote attacker to trigger an out-of-bounds memory read via a crafted HTML page. Affected: V8 in Chromium/Chrome prior to 59.0.3071.86 on Linux/Windows/macOS and prior to 59.0.3071.9...

CVE-2018-6060

CVE-2018-6060 describes a use-after-free in Chrome/Chromium’s Blink/WebKit (WebAudio) prior to version 65.0.3325.146. The issue allows a remote attacker to potentially cause heap corruption via a crafted HTML page. The Debian advisories and Chromium security updates indicate fixes in Chromium/Chr...

CVE-2018-6099

Concretely, CVE-2018-6099 affects Google Chrome/Chromium by a Cross-Origin Resource Sharing bypass in Service Workers (Blink). The root cause is a lack of proper CORS checks in Blink/ServiceWorker handling, enabling a remote attacker to leak limited cross-origin data via a crafted HTML page. The ...

CVE-2018-6104

CVE-2018-6104 affects Google Chrome/Chromium where the URL Formatter mishandled confusable characters (IDN homographs), enabling domain spoofing. The issue lies in the URL formatting component and could allow a remote attacker to lure users to a spoofed domain. Vulnerable versions are Chrome/Chro...

CVE-2021-38011

CVE-2021-38011 is a use-after-free in the storage foundation of the Chromium browser engine, affecting Chromium before 96.0.4664.45. The initial description states a remote attacker could cause heap corruption via a crafted HTML page, enabling arbitrary code execution, with impact on at least the...

CVE-2021-38013

CVE-2021-38013 : Heap buffer overflow in the fingerprint recognition component of the Chromium engine (Chrome/ChromeOS) before version 96.0.4664.45 allows a remote attacker who can reach a WebUI renderer to potentially escape the sandbox via a crafted HTML page. Multiple vendor advisories confirm...

CVE-2022-4187

CVE-2022-4187 affects Google Chrome/DevTools on Windows prior to 108.0.5359.71, where insufficient policy enforcement in DevTools could allow a remote attacker to bypass filesystem restrictions via a crafted HTML page. The vulnerability is listed with a Chromium/Chrome Medium severity and is amon...

CVE-2026-14028

Affected software: Chrome for iOS. Vulnerability: UI spoofing due to incorrect security UI in Google Chrome on iOS prior to 150.0.7871.47. Exploitation requires that a user engages in specific UI gestures, via a crafted HTML page. Impact: potential UI spoofing with low severity per Chromium. Root...

CVE-2026-1504

CVE-2026-1504 concerns the Background Fetch API in Chromium/Google Chrome, where an inappropriate implementation allowed a remote attacker to leak cross-origin data via a crafted HTML page. Affected software is Chromium/Chrome prior to 144.0.7559.110 (per the initial description). The root cause ...

CVE-2016-9651

CVE-2016-9651 is a private-property access flaw in the V8 component of Chromium/Chrome prior to version 55.0.2883.75. The root cause is a missing check for whether a JS object property is private, enabling a remote attacker to bypass access restrictions and potentially execute arbitrary code insi...

CVE-2017-15399

Chromium/Google Chrome prior to version 62.0.3202.89 is affected by CVE-2017-15399 (use-after-free in V8) and CVE-2017-15398 (QUIC stack-based buffer overflow), enabling a remote attacker to potentially execute arbitrary code via a crafted page. Debian security advisories and Arch Linux security ...

CVE-2017-5053

CVE-2017-5053 describes an out-of-bounds read in V8 that could allow remote code execution in Google Chrome. Affected: Google Chrome on Linux/Windows/macOS older than 57.0.2987.133, and Android older than 57.0.2987.132; vulnerability linked to Array.prototype.indexOf. Impact: arbitrary code execu...

CVE-2017-5122

CVE-2017-5122 is an out-of-bounds memory access in Google Chrome/Chromium’s V8 engine prior to 61.0.3163.100 (Windows and Chromium) that could be triggered by a crafted HTML page, enabling remote code execution. Public notices from Debian, Arch Linux, Gentoo, Fedora, and others confirm the issue ...

CVE-2018-16069

CVE-2018-16069 affects SwiftShader in Google Chrome/Chromium. The initial description ties the vulnerability to unintended floating-point error accumulation that could leak cross-origin data via a crafted HTML page. Several connected advisories corroborate that this CVE was addressed in Chromium ...

CVE-2018-20066

CVE-2018-20066 affects Google Chrome Extensions: vulnerable component is the Extensions lifecycle, where an incorrect object lifecycle can lead to heap corruption via a crafted HTML page. Affected: Chrome versions prior to 71.0.3578.80. Impact: remote code execution/heap corruption as described. ...

CVE-2018-6037

CVE-2018-6037 concerns Google Chrome before 64.0.3282.119, where an insufficient user gesture requirement in the autofill feature could allow a remote attacker to obtain autofill data via a crafted HTML page. Connected sources corroborate the issue as an autofill/IP privacy bypass rooted in insuf...

CVE-2018-6054

Chromium-based Google Chrome WebUI vulnerability CVE-2018-6054 is a use-after-free in WebUI prior to 64.0.3282.119 that could enable remote heap corruption via crafted Chrome Extensions. Affected product: Google Chrome (Windows, macOS, Linux) with WebUI component; root cause: use-after-free in We...

CVE-2018-6152

CVE-2018-6152 is a Chrome/Chromium developer tools vulnerability where the Page.downloadBehavior backend could cause downloaded files to be treated as safe, enabling a crafted HTML page and user interaction to potentially escape the sandbox. Connected sources indicate this issue affected Chromium...

CVE-2018-6161

CVE-2018-6161 affects Chromium/Google Chrome Blink WebAudio: a Same-Origin Policy bypass via a crafted HTML page was reported, with affected versions prior to 68.0.3440.75. Debian and FreeBSD security listings confirm the CVE and note the fix in 68.0.3440.75 (stretch) / updated package lines; no ...

CVE-2018-6169

CVE-2018-6169 relates to Google Chrome/Chromium where a lack of timeout on the extension install prompt allowed a remote attacker to bypass permission checks and trigger installation of a unwanted extension via a crafted HTML page. Affected software is the Chrome/Chromium extension installation f...

CVE-2022-3052

The CVE-2022-3052 issue affects Google Chrome on ChromeOS (Lacros) before 105.0.5195.52, tied to a heap-buffer/heap-corruption risk in Window Manager when processing crafted UI interactions. The vulnerability requires a user to perform specific UI actions and could enable remote exploitation via ...

CVE-2017-15418

CVE-2017-15418 concerns Google Chrome (Skia) prior to 63.0.3239.84, where use of uninitialized memory in Skia could allow a remote attacker to read sensitive data from a process memory via a crafted HTML page. Technical details across sources consistently identify Skia’s uninitialized values as t...

CVE-2017-5061

Google Chrome before 58.0.3029.81 on Linux/Windows/macOS is affected by a race condition during navigation that allowed a remote attacker to spoof the Omnibox (URL bar) contents via a crafted HTML page. The entry is supported by CVE-2017-5061 details and related advisories; remediation is to upgr...

CVE-2018-16070

CVE-2018-16070 : Concrete details show integer/heap issues in Skia used by Google Chrome before 69.0.3497.81, allowing a remote attacker to potentially cause heap corruption via a crafted HTML page. Connected sources confirm this CVE is tracked across Chrome/Chromium releases and tied to Chromium...

CVE-2018-6119

CVE-2018-6119 affects Google Chrome prior to 64.0.3282.119, where an incorrect security UI in the Omnibox (URL bar) allowed a remote attacker to spoof the Omnibox content via a crafted HTML page. The vulnerability originates from the Omnibox security UI handling and is confirmed in connected sour...

CVE-2018-6174

CVE-2018-6174 : An integer overflow in the SwiftShader library used by Google Chrome/Chromium prior to 68.0.3440.75 allows remote code execution via a crafted HTML page. Public notes across connected sources confirm the issue in Chromium/Chrome’s SwiftShader component, with Debian/DSA and Gentoo ...

CVE-2019-13698

The CVE-2019-13698 entry concerns Google Chrome prior to 73.0.3683.103, where an out-of-bounds memory access in JavaScript can potentially allow a remote attacker to trigger heap corruption via a crafted HTML page. The vulnerability is tied to Chrome’s JavaScript engine handling and is mitigated ...

CVE-2022-3660

CVE-2022-3660 is described as an Inappropriate implementation in Full screen mode affecting Google Chrome on Android prior to 107.0.5304.62, allowing a remote attacker to hide the Omnibox contents via a crafted HTML page (Chromium security severity: Medium). Connected documents corroborate the is...

CVE-2022-4918

CVE-2022-4918 affects Google Chrome (Chromium UI) with a use-after-free in the UI, allowing a remote attacker to perform arbitrary read/write via a crafted HTML page. Affected versions are Chrome before 102.0.5005.61; the issue stems from a post-release reuse problem in the UI. The documented imp...

CVE-2025-1919

CVE-2025-1919 is a Google Chrome/Chromium vulnerability described as an out-of-bounds read in the Media component, allowing a remote attacker to potentially trigger memory access via a crafted HTML page. The advisory notes the issue affects Chrome prior to version 134.0.6998.35 and is categorized...

CVE-2026-13905

Chrome for iOS on Google Chrome (iOS) is affected by a race in versions prior to 150.0.7871.47, allowing a local attacker with physical access to potentially read confidential data from process memory. The issue is documented across CVE-2026-13905 and EUVD-2026-40591. Remediation is to upgrade to...

CVE-2026-13980

CVE-2026-13980 affects Chrome for iOS (Google Chrome on iOS). The vulnerability stems from an inappropriate implementation in Chrome for iOS prior to version 150.0.7871.47, enabling a remote attacker to perform UI spoofing via a crafted HTML page. Documents consistently describe the issue as a UI...

CVE-2026-17912

CVE-2026-17912 : In Chrome for iOS (Google Chrome on iOS), versions prior to 151.0.7922.72 are affected by an inappropriate implementation that allows a remote attacker to bypass navigation restrictions via a crafted HTML page. The vulnerability is described as low severity in Chromium, with expl...

CVE-2026-7962

CVE-2026-7962 describes insufficient policy enforcement in Chrome’s DirectSockets, allowing a remote attacker to trigger arbitrary read/write via a crafted Chrome Extension. Public documents identify the vulnerable component as DirectSockets in Google Chrome, with the root cause tied to policy en...

CVE-2026-8537

CVE-2026-8537 is a Chrome/Chromium vulnerability: insufficient policy enforcement in the ViewTransitions component could allow a remote attacker to leak cross-origin data via a crafted HTML page. Affected version range is Chrome prior to 148.0.7778.168. Remediation is upgrade to the Chrome stable...

CVE-2014-1705

CVE-2014-1705 affects Google Chrome’s V8 engine. Chrome versions before 33.0.1750.152 (OS X/Linux) and 33.0.1750.154 (Windows) are affected by a memory corruption bug in V8 that could be exploited remotely to cause a denial of service or other impacts. Public documentation in the provided sources...

CVE-2017-5107

The CVE-2017-5107 entry describes a timing-based information disclosure in Google Chrome's SVG rendering prior to 60.0.3112.78, enabling a remote attacker to extract pixel values from a cross-origin page loaded in an iframe on Linux/Windows/macOS. The connected sources corroborate Chrome/Chromium...