CVE-2018-16073

CVE-2018-16073 describes an attacker bypassing Chromium’s site isolation due to insufficient policy enforcement in Chrome’s site isolation prior to 69.0.3497.81. The CVE affects Google Chrome/Chromium and is listed among Chrome security updates (e.g.,Chromium 69.0.3497.81 fixes included in Fedora...

CVE-2018-6033

CVE-2018-6033 is listed in Debian security notes as affecting the Chromium/Google Chrome stack with a race condition in the Downloads handling when opening downloaded files. The connected documents confirm the vulnerability is associated with chromium-browser and describe it as a race condition, ...

CVE-2021-4061

CVE-2021-4061 describes a type confusion in V8 within Chromium/Google Chrome prior to 96.0.4664.93, enabling a remote attacker to potentially exploit heap corruption via a crafted HTML page. The vulnerability affects Chromium-based browsers and is tracked in multiple advisories; upgrade to versio...

CVE-2021-4099

CVE-2021-4099 describes a use-after-free vulnerability in SwiftShader within Google Chrome, prior to version 96.0.4664.110. The underlying issue is heap corruption that could be exploited by a crafted HTML page, potentially enabling remote code execution. The connected documents corroborate the s...

CVE-2022-0290

CVE-2022-0290 is a use-after-free vulnerability in Chrome/Chromium’s Site isolation that could enable a remote attacker to escape the sandbox via a crafted HTML page. The issue affects Chrome/Chromium prior to version 97.0.4692.99 and is categorized with high severity in multiple advisories. Expl...

CVE-2022-0301

CVE-2022-0301 affects Google Chrome DevTools prior to 97.0.4692.99. The issue is a heap buffer overflow in DevTools that could allow heap corruption when a user is convinced to install a crafted or malicious extension and visit a crafted HTML page. Affected product: Chrome/DevTools. Root cause: h...

CVE-2025-1917

CVE-2025-1917 affects Google Chrome on Android with an inappropriate UI implementation that enables UI spoofing via a crafted HTML page, up to version 134.0.6998.35. The vulnerability is described as a medium-severity issue (CVSS 4.3, UI interaction required, no confidentiality impact, low integr...

CVE-2026-13929

CVE-2026-13929 : In Google Chrome for Android, DevTools policy enforcement is insufficient, allowing a local attacker to bypass navigation restrictions via a malicious file. Affected component: DevTools navigation/policy enforcement; root cause: insufficient policy enforcement in DevTools prior t...

CVE-2026-7934

CVE-2026-7934 in Google Chrome’s Popup Blocker: Insufficient validation of untrusted input allowed a remote attacker who had access to the renderer process to bypass navigation restrictions via a crafted HTML page. Affected component: Popup Blocker in Chrome prior to version 148.0.7778.96. Root c...

CVE-2026-8562

CVE-2026-8562 describes a side-channel information leakage flaw in the Navigation component of Google Chrome (upstream Chromium) prior to 148.0.7778.168. A crafted HTML page could leak cross-origin data, as indicated by multiple sources (NVD/Red Hat/ Debian trackers) and upstream Chromium bug 400...

CVE-2026-9943

CVE-2026-9943 describes an out-of-bounds read in WebGL within the Chromium-based Google Chrome browser for Android, prior to version 148.0.7778.216. The flaw could allow a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability is rooted in WebGL handling in Chrome/Ch...

CVE-2017-5056

CVE-2017-5056 is a use-after-free in Blink in Google Chrome that allowed a remote attacker to trigger an out-of-bounds memory read via a crafted HTML page. Affected: Chrome on Linux/Windows/macOS before 57.0.2987.133 and Android before 57.0.2987.132. Mitigation: apply the Chrome updates (stable c...

CVE-2017-5116

CVE-2017-5116 is a type-confusion vulnerability in Google Chrome/Chromium’s V8 engine. A race-condition based flaw allowed remote attackers to execute arbitrary code by enticing a user to open a crafted HTML page. Affected product family is Chromium/Chrome with V8 in the browser’s JavaScript engi...

CVE-2018-16087

CVE-2018-16087 involves Google Chrome/Chromium where a lack of proper state tracking in Permissions allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. The issue affects Chromium/Chrome versions prior to 69.0.3497.81 and is triggered by manipulating permission sta...

CVE-2018-6155

CVE-2018-6155 is a use-after-free in the VP8 handling path (libvpx) used by WebRTC/video processing. Exploitation could arise from processing crafted VP8 frames, potentially affecting Chrome/WebRTC users prior to version 68.0.3440.75. The vulnerability is rooted in VP8 parsing/processing (frames ...

CVE-2018-6176

CVE-2018-6176 affects Google Chrome/Chromium: insufficient file-type enforcement in the Extensions API enables privilege escalation via a crafted extension when the renderer is compromised. Several advisories (Debian DSA, Gentoo GLSA, CNVD) confirm local privilege escalation via the Extensions me...

CVE-2022-0294

CVE-2022-0294 refers to an “Inappropriate implementation in Push messaging” in Google Chrome before version 97.0.4692.99. The publicly provided data states that a remote attacker who had already compromised the renderer process could bypass site isolation via a crafted HTML page. The linked Chrom...

CVE-2022-0302

CVE-2022-0302 involves a use-after-free in the Omnibox of Google Chrome before 97.0.4692.99, leading to potential heap corruption when a user is convinced to perform specific interactions via a crafted HTML page. The issue is associated with the Chromium/Chrome 97.0.4692.99 security fixes rollout...

CVE-2022-3047

Chrome CVE-2022-3047 affects Google Chrome (Chromium-based) prior to 105.0.5195.52. The issue is Insufficient policy enforcement in the Extensions API, allowing a user who is convinced to install a malicious extension to bypass downloads policy via a crafted HTML page. Affected component: Extensi...

CVE-2022-3058

CVE-2022-3058 affects Google Chrome (Sign-In Flow) with a use-after-free in the UI interaction path that could lead to heap corruption. The issue is reported across multiple records and is mitigated by upgrading to Chrome 105.0.5195.52 or newer (as noted by Debian security advisory for Chromium)....

CVE-2026-12033

CVE-2026-12033 affects Google Chrome’s VideoCapture component. The issue is an out-of-bounds read in VideoCapture that could allow a remote attacker who has compromised the GPU process to read potentially sensitive data from process memory via a crafted HTML page. The vulnerability is tied to Chr...

CVE-2026-13969

CVE-2026-13969 affects Google Chrome on Android: an uninitialized UI state in the renderer allows reading potentially sensitive memory via a crafted HTML page when the renderer is compromised. Exploitation involves a network attack with user interaction required; impact is confidentiality (high)....

CVE-2026-17676

CVE-2026-17676 is an In ANGLE vulnerability in Google Chrome on Android before 151.0.7922.72 caused by an inappropriate ANGLE implementation that could allow a renderer-compromised remote attacker to escape the sandbox via a crafted HTML page. The issue affects ANGLE in Chrome for Android; the im...

CVE-2026-17810

CVE-2026-17810 affects Google Chrome prior to 151.0.7922.72, with an Uninitialized Use in the Dawn component that allowed a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability is characterized in the supplied documents as Medium severity (CVSS: Network, Low Confid...

CVE-2026-19164

CVE-2026-19164 concerns Google Chrome: insubstantial validation of untrusted input in the Codecs component allowed a remote attacker to potentially escape the sandbox via a crafted HTML page. Affected software is Chrome prior to version 151.0.7922.109 (stable channel). The underlying issue is in ...

CVE-2026-19169

CVE-2026-19169 refers to insufficient validation of untrusted input in Chrome’s Contextual Tasks, allowing remote privilege escalation via a crafted HTML page. Affected product: Google Chrome; affected versions are prior to 151.0.7922.109. Remediation: update to Chrome 151.0.7922.109 or later (St...

CVE-2026-76033

CVE-2026-76033 is an inappropriate implementation in CORS in Google Chrome prior to 151.0.7922.169 . A remote attacker who had already compromised the renderer process could bypass site isolation via a crafted HTML page. The vulnerability was reported by Google on 2026-05-26 (bug 516715010) and c...

CVE-2026-8565

CVE-2026-8565 affects Google Chrome on macOS. The issue is an inappropriate implementation in the Downloads component that, before version 148.0.7778.168, could allow an attacker who persuades a user to install a malicious Chrome Extension to perform UI spoofing via that extension. The vulnerabil...

CVE-2026-8586

CVE-2026-8586 affects the Chromoting component in Google Chrome (upstream Chromium). The issue is an inappropriate implementation that allows a local attacker to bypass discretionary access control via a malicious file, with impact described as medium. Affected versions are Chrome prior to 148.0....

CVE-2017-15420

CVE-2017-15420 describes a URL spoofing issue in Google Chrome/Chromium’s Omnibox caused by incorrect handling of back navigations on error pages, allowing a crafted HTML page to spoof the URL bar. Affected products/versions: Chrome prior to 63.0.3239.84 (per the CVE description). Remediation: up...

CVE-2017-5054

CVE-2017-5054 is an out-of-bounds read in V8 that affects Google Chrome prior to 57.0.2987.133 on Linux, Windows and macOS (57.0.2987.132 on Android). This vulnerability lets a remote attacker obtain heap memory contents via a crafted HTML page, with the desktop impact including potential arbitra...

CVE-2018-6036

CVE-2018-6036 is an integer underflow in WebAssembly within Google Chrome64-bit era (V8) that could allow a remote attacker to leak user data via a crafted HTML page. The vulnerability was fixed in the Chrome stable update 64.0.3282.119; affected products are Google Chrome released before that v...

CVE-2018-6087

CVE-2018-6087 describes a use-after-free in WebAssembly in Google Chrome prior to 66.0.3359.117. The issue allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The connected sources confirm the root cause (WebAssembly use-after-free) and the impact (remo...

CVE-2020-6419

CVE-2020-6419 : In Google Chrome, the V8 engine contains an out-of-bounds write prior to 81.0.4044.92, which could allow a remote attacker to induce heap corruption via a crafted HTML page. The description notes heap corruption as the impact and mentions the affected browser version; no explicit ...

CVE-2020-6497

CVE-2020-6497 is a policy enforcement issue in Omnibox on Google Chrome for iOS, allowing domain spoofing via a crafted URI. The connected Nessus entries confirm this CVE is part of the Chrome 83.0.4103.88– era fixes set. Affected component: Omnibox URL handling; root cause: insufficient policy e...

CVE-2021-30542

CVE-2021-30542 affects Google Chrome/Chromium before 91.0.4472.77. It is a use-after-free in the Tab Strip component that can potentially cause heap corruption via a crafted HTML page when a user is convinced to install a malicious extension. Impact: arbitrary code execution or other severe outco...

CVE-2022-0106

CVE-2022-0106 refers to a use-after-free in Autofill in Google Chrome up to version 97.0.4692.71, which could allow a remote attacker to trigger heap corruption via a crafted HTML page after convincing a user to perform a specific gesture. The Astra Linux bulletin and CVE entries corroborate this...

CVE-2022-2608

CVE-2022-2608 is a use-after-free in Chrome OS Overview Mode (Ash) of Google Chrome/Chromium. The issue can lead to heap corruption via specific UI interactions if a user is tricked into certain actions. Connected sources confirm the vulnerability in Chromium/Chrome with affected versions around ...

CVE-2022-3056

CVE-2022-3056 affects Google Chrome/Chromium. Root cause: insufficient policy enforcement in Content Security Policy. Vulnerability allows a remote attacker to bypass CSP via a crafted HTML page, as described in public advisories. Remediation: update to Chrome 105.0.5195.52 or later (listed fixes...

CVE-2026-19140

CVE-2026-19140 is a GPU use-after-free vulnerability in Google Chrome prior to 151.0.7922.109 that could allow a remote attacker who compromised the renderer process to potentially escape the sandbox via a crafted HTML page. The issue affects Chrome's GPU path and is documented across the CVE/NVD...

CVE-2026-19168

CVE-2026-19168 affects Google Chrome’s V8 engine. The flaw is an inappropriate implementation in V8 that could allow a remote attacker to execute arbitrary code inside Chrome’s sandbox via a crafted HTML page. The vulnerability is tied to Chrome versions before 151.0.7922.109; the Chrome stable r...

CVE-2026-8528

CVE-2026-8528 affects Google Chrome’s SiteIsolation in Chromium. The issue is "insufficient validation of untrusted input" in SiteIsolation, allowing a remote attacker who has already compromised the renderer process to bypass Site Isolation via a crafted HTML page. The vulnerability is present i...

CVE-2026-8541

CVE-2026-8541 describes an out-of-bounds read in Google Chrome UI that could allow a remote attacker—who has already compromised the renderer process—to read potentially sensitive data from process memory via a crafted HTML page. The issue affects Chrome versions prior to 148.0.7778.168. The vuln...

CVE-2016-9652

CVE-2016-9652 concerns Google Chrome/Chromium with multiple vulnerabilities reported in the Chromium project prior to version 55.0.2883.75. The connected advisories confirm this CVE is addressed by upgrading to 55.0.2883.75 (e.g., Debian: 55.0.2883.75-1~deb8u1; Gentoo GLSA 201612-11; Debian DSA-3...

CVE-2017-5083

CVE-2017-5083: In Google Chrome Blink, an inappropriate implementation allowed a remote attacker to display UI on a non-attacker-controlled tab via a crafted HTML page. Affected versions are Chrome desktop/macOS/Linux prior to 59.0.3071.86 and Android prior to 59.0.3071.92. Mitigation is to upgra...

CVE-2018-17461

CVE-2018-17461 affects Google Chrome via PDFium. An out-of-bounds read in PDF rendering could be triggered by a crafted PDF file, allowing a remote attacker to read memory. Affected: Google Chrome prior to 68.0.3440.75 (PDFium component). Impact per CVSS3: High (partial confidentiality/integrity/...

CVE-2018-20068

CVE-2018-20068 concerns Google Chrome’s Navigation handling prior to 71.0.3578.80. The vulnerability arises from incorrect handling of 304 status codes, enabling a remote attacker to craft a page that can confuse the user about the origin of the current page. Affected product: Google Chrome (vers...

CVE-2018-6151

CVE-2018-6151 concerns a bad cast in Chrome DevTools that allowed an attacker, by convincing a user to install a crafted Chrome extension, to trigger an out-of-bounds memory read. Affected software: Google Chrome with DevTools prior to 66.0.3359.117. The issue is addressed in later Chrome release...

CVE-2022-0798

CVE-2022-0798 is a use-after-free in Google Chrome/Chromium’s MediaStream pathway. The connected documents consistently describe a memory safety issue in Chrome’s MediaStream that can lead to heap corruption when a user is convinced to install a crafted Chrome Extension, with exploitation potenti...

CVE-2022-3306

CVE-2022-3306 involves a Use-after-Free in Survey within Google Chrome on ChromeOS before 106.0.5249.62, leading to potential heap corruption via a crafted HTML page. Affected component is the Survey-handling path in ChromeOS/Chromium; root cause is use-after-free. Public references in connected ...