CVE-2026-7934

CVE-2026-7934 in Google Chrome’s Popup Blocker: Insufficient validation of untrusted input allowed a remote attacker who had access to the renderer process to bypass navigation restrictions via a crafted HTML page. Affected component: Popup Blocker in Chrome prior to version 148.0.7778.96. Root c...

CVE-2017-5060

CVE-2017-5060 affects Google Chrome/Chromium Omnibox prior to version 58.0.3029.81 (desktop) and 58.0.3029.83 (Android) due to insufficient policy enforcement, enabling domain spoofing via IDN homographs in crafted domain names. Public details in connected docs verify affected Chromium releases (...

CVE-2017-5087

CVE-2017-5087 is a use-after-free in Blink in Google Chrome that enables a remote attacker to perform an out-of-bounds memory read via a crafted HTML page (IndexedDB sandbox escape). Affected Chrome versions: prior to 59.0.3071.104 on Mac/Windows/Linux and 59.0.3071.117 on Android. Impact describ...

CVE-2018-6097

CVE-2018-6097 describes an issue in Google Chrome for macOS where improper handling of asynchronous methods in the Fullscreen UI could allow a remote attacker to enter full screen without showing a warning via a crafted HTML page. The root cause is an incorrect handling of asynchronous fullscreen...

CVE-2021-4100

CVE-2021-4100 affects Chromium/ANGLE in Google Chrome prior to 96.0.4664.110. The connected documents describe an object lifecycle issue in ANGLE that could allow a remote attacker to trigger heap corruption via a crafted HTML page, potentially enabling arbitrary behavior. The vulnerability is ad...

CVE-2022-3306

CVE-2022-3306 involves a Use-after-Free in Survey within Google Chrome on ChromeOS before 106.0.5249.62, leading to potential heap corruption via a crafted HTML page. Affected component is the Survey-handling path in ChromeOS/Chromium; root cause is use-after-free. Public references in connected ...

CVE-2026-8579

CVE-2026-8579 concerns insufficient validation of untrusted input in Skia within Google Chrome before 148.0.7778.168. The underlying issue allows a remote attacker who has already compromised the renderer process to trigger an out-of-bounds memory write via a crafted print file. Affected componen...

CVE-2020-16045

CVE-2020-16045 : A use-after-free in the Payments component of Google Chrome on Android (before 87.0.4280.66) allowed a remote attacker who had compromised the renderer process to potentially escape the Chrome sandbox via a crafted HTML page. The issue is documented in multiple feeds (including R...

CVE-2020-6453

CVE-2020-6453 affects Google Chrome’s V8 engine. An inappropriate implementation allowed a remote attacker to potentially trigger heap corruption with a crafted HTML page. This is tied to Chrome versions prior to 80.0.3987.162. The vulnerability is addressed by upgrading to 80.0.3987.162 or later...

CVE-2022-0099

CVE-2022-0099 — Summary (supported by connected docs): Use-after-free in Sign-in in Google Chrome prior to 97.0.4692.71 may allow a remote attacker who entices a user to perform specific gestures to potentially cause heap corruption. This vulnerability affects Chromium/Chrome components involved ...

CVE-2022-0118

The CVE-2022-0118 issue affects Google Chrome/Chromium’s WebShare implementation. A bug allowed a remote attacker to potentially hide the Omnibox contents via a crafted HTML page. Public materials trace the vulnerability to WebShare behavior and indicate fixes were shipped in Chrome/Chromium arou...

CVE-2022-1141

CVE-2022-1141: Use-after-free in Chrome File Manager affecting Google Chrome versions before 100.0.4896.60. The vulnerability could allow heap corruption via a specific user gesture after convincing a user to engage in certain interaction. Impact is described as high for confidentiality, integrit...

CVE-2022-2587

CVE-2022-2587 refers to an out-of-bounds write in the ChromeOS CRAS (Chrome OS Audio Server) component of Google Chrome on ChromeOS before 102.0.5005.125. The underlying cause is an unsafe strcpy-based copy of a user-controlled identity string, allocated as 128 bytes on the heap, allowing a remot...

CVE-2022-2860

CVE-2022-2860 affects Google Chrome/Chromium with insufficient cookie-prefix policy enforcement that could bypass restrictions via a crafted HTML page. Connected sources (Debian, Gentoo/Gentoo GLSA, Astra Linux) confirm the issue and provide the remediation: upgrade Chromium/Chrome to 104.0.5112....

CVE-2022-3313

CVE-2022-3313 : Affects Google Chrome prior to 106.0.5249.62 where the Full Screen security UI can be spoofed via a crafted HTML page. The Chromium/Chrome update fixed this in Chrome 106 (106.0.5249.61/62 in the release notes; fixed version noted as 106.0.5249.62+). Affected product: Google Chrom...

CVE-2022-4955

CVE-2022-4955 concerns Google Chrome before 108.0.5359.71, where an improper DevTools implementation could allow a user who installs a crafted extension via a malicious HTML page to bypass file access restrictions. The vulnerability stems from DevTools behavior and enables an attacker to exploit ...

CVE-2026-13981

CVE-2026-13981: In Chrome for iOS, Google Chrome on iOS contains an inappropriate implementation that enables UI spoofing via a crafted HTML page. Affected product is Chrome for iOS; root cause is an implementation flaw in the iOS build. Impact stated: remote attacker could perform UI spoofing. R...

CVE-2026-14028

Affected software: Chrome for iOS. Vulnerability: UI spoofing due to incorrect security UI in Google Chrome on iOS prior to 150.0.7871.47. Exploitation requires that a user engages in specific UI gestures, via a crafted HTML page. Impact: potential UI spoofing with low severity per Chromium. Root...

CVE-2026-7962

CVE-2026-7962 describes insufficient policy enforcement in Chrome’s DirectSockets, allowing a remote attacker to trigger arbitrary read/write via a crafted Chrome Extension. Public documents identify the vulnerable component as DirectSockets in Google Chrome, with the root cause tied to policy en...

CVE-2017-5079

CVE-2017-5079 affects Blink in Chromium/Chrome on Mac, Windows and Linux (desktop) and Android, allowing a remote attacker to spoof UI by crafting HTML in a non-attacker tab. Desktop impact reported as UI spoofing; affected Chrome versions before 59.0.3071.86 (and Android before 59.0.3071.92). Re...

CVE-2017-5109

CVE-2017-5109 affects Chromium before version 60.0.3112.78, where a UI spoofing vulnerability was identified in the browser’s UI components (per Arch/Debian advisories). The issue is fixed in 60.0.3112.78 (upstream) with the Debian/Arch advisories confirming remediation. Affected product: Chromiu...

CVE-2018-6115

CVE-2018-6115 affects Google Chrome (and Chromium) prior to 66.0.3359.117. The issue is an inappropriate setting of the SEE_MASK_FLAG_NO_UI flag in file downloads, which could allow a remote, crafted HTML page to bypass operating system malware checks. Public advisories and vendor updates indicat...

CVE-2019-13684

CVE-2019-13684: Chrome prior to 72.0.3626.81 has an inappropriate JavaScript implementation that allows a remote attacker to leak cross-origin data via a crafted HTML page. Affected product: Google Chrome (desktop/mobile), version not explicitly stated beyond the pre-72.0.3626.81 range in the pro...

CVE-2022-0301

CVE-2022-0301 affects Google Chrome DevTools prior to 97.0.4692.99. The issue is a heap buffer overflow in DevTools that could allow heap corruption when a user is convinced to install a crafted or malicious extension and visit a crafted HTML page. Affected product: Chrome/DevTools. Root cause: h...

CVE-2022-4916

Affected software: Google Chrome (Media component) with Chromium-based engine. Vulnerability: Use-after-free in Media leading to arbitrary read/write via a crafted HTML page. Root cause: use-after-free condition in Chrome’s media handling prior to version 103.0.5060.53. Impact: remote attacker co...

CVE-2024-3168

CVE-2024-3168 corresponds to a Use-after-free vulnerability in Chrome DevTools prior to 122.0.6261.57 that could allow a remote attacker to cause heap corruption via a crafted HTML page. Affected product is Google Chrome (DevTools component); root cause is a use-after-free in DevTools as describe...

CVE-2026-12033

CVE-2026-12033 affects Google Chrome’s VideoCapture component. The issue is an out-of-bounds read in VideoCapture that could allow a remote attacker who has compromised the GPU process to read potentially sensitive data from process memory via a crafted HTML page. The vulnerability is tied to Chr...

CVE-2011-0480

CVE-2011-0480 involves FFmpeg’s Vorbis decoder (libavcodec/vorbis_dec.c) with multiple buffer overflows that can be triggered by a crafted WebM file, leading to memory corruption and possible denial of service or other impact. The vulnerability affects FFmpeg as used in browsers (e.g., Chrome pri...

CVE-2015-1212

CVE-2015-1212 affects Google Chrome before 40.0.2214.111 on Windows/macOS/Linux and before 40.0.2214.109 on Android, with multiple unspecified vulnerabilities that can cause a denial of service or other impact via unknown vectors. The connected documents corroborate a specific issue described as ...

CVE-2017-15415

Google Chrome IPC Pointer Information Disclosure vulnerability (CVE-2017-15415) stems from incorrect serialization in the IPC component, allowing a remote attacker to leak a pointer value via a crafted HTML page on affected builds prior to 63.0.3239.84. Public descriptions in CNVD-2018-22403 corr...

CVE-2017-5068

CVE-2017-5068: In Google Chrome (Chromium-based) prior to 58.0.3029.96, WebRTC’s handling of picture IDs could trigger a race condition via a crafted HTML page on Mac/Windows/Linux. This is the concrete vulnerability: the race condition could be exploited remotely by a crafted page. Affected soft...

CVE-2017-5111

CVE-2017-5111 is a use-after-free vulnerability in the PDFium component of Chromium/Google Chrome prior to 61.0.3163.79. It allows remote memory corruption via a crafted PDF file. Connected advisories confirm the issue affects Chromium/Chromium-derived packages and that the fix was introduced in ...

CVE-2017-5126

CVE-2017-5126: A use-after-free in PDFium found in the Chromium/Chrome PDF rendering path prior to 62.0.3202.62 allows a remote attacker to cause heap corruption via a crafted PDF file, enabling arbitrary code execution. Affected software/component: PDFium inside Chromium/Chrome on versions

CVE-2018-20070

CVE-2018-20070 describes a vulnerability in Google Chrome’s URL Formatter (Omnibox) where incorrect handling of confusable characters allowed a remote attacker to spoof the Omnibox via a crafted domain name. Affected releases are Chrome versions prior to 71.0.3578.80; exploitation could mislead u...

CVE-2019-5873

CVE-2019-5873 affects Google Chrome on iOS prior to 77.0.3865.75, where insufficient policy validation in navigation allows a remote attacker to spoof the Omnibox (URL bar) contents via a crafted HTML page. Connected advisories corroborate the same vulnerability and indicate the fixed version is ...

CVE-2022-0115

This CVE corresponds to Google Chrome/Chromium’s Uninitialized use in the File API, allowing a remote attacker to potentially cause out-of-bounds memory access via a crafted HTML page. Public sources confirm the issue affects Chrome/Chromium prior to version 97.0.4692.71 and that the vulnerabilit...

CVE-2022-3305

CVE-2022-3305 is a use-after-free/memory misreference vulnerability in the Survey component of Google Chrome/Chromium (pre-106.0.5249.62 on ChromeOS and desktop). Exploitation could crash the browser or cause heap corruption; the advisorys indicate fixes in Chrome/Chromium 106.x (e.g., 106.0.5249...

CVE-2022-3315

CVE-2022-3315 is confirmed in multiple connected sources as a Type Confusion in Blink affecting Chromium/Google Chrome. It describes a vulnerability in Blink where a crafted HTML page could trigger heap corruption, allowing potential arbitrary code execution. Affected product line is Chromium-bas...

CVE-2022-4176

CVE-2022-4176 refers to an out-of-bounds write in Lacros Graphics for Google Chrome on Chrome OS and Lacros builds prior to 108.0.5359.71. The issue could enable heap corruption via user-driven UI interactions, with the Chrome/Chromium advisory cycle noting a high severity and remote-exploitation...

CVE-2022-4439

CVE-2022-4439 is a use-after-free in Aura within Google Chrome for Windows, exploited via user-initiated UI interactions to potentially cause heap corruption. The vulnerability is part of a set of Chrome/Chromium issues disclosed in the December 2022 security updates, with Chrome’s stable channel...

CVE-2026-13808

Chrome for iOS (Google Chrome on iOS) prior to version 150.0.7871.47 is affected by insufficient data validation that could allow a local attacker to read potentially sensitive information from process memory with physical device access. The issue is addressed in the Chrome 150/151 stable updates...

CVE-2026-13969

CVE-2026-13969 affects Google Chrome on Android: an uninitialized UI state in the renderer allows reading potentially sensitive memory via a crafted HTML page when the renderer is compromised. Exploitation involves a network attack with user interaction required; impact is confidentiality (high)....

CVE-2026-13980

CVE-2026-13980 affects Chrome for iOS (Google Chrome on iOS). The vulnerability stems from an inappropriate implementation in Chrome for iOS prior to version 150.0.7871.47, enabling a remote attacker to perform UI spoofing via a crafted HTML page. Documents consistently describe the issue as a UI...

CVE-2012-0724

CVE-2012-0724 affects Adobe Flash Player prior to 11.2.202.229 in Google Chrome prior to 18.0.1025.151. The vulnerability enables memory corruption leading to a possible denial of service or other unspecified impact via unknown vectors (distinct from CVE-2012-0725). Connected advisories corrobora...

CVE-2017-15411

CVE-2017-15411 affects Google Chrome’s PDFium component. A use-after-free/memory misreference in PDFium prior to 63.0.3239.84 can allow a remote attacker to trigger heap corruption via a crafted PDF file. The exploit could be remotely triggered with no user interaction (per CVSS metrics), leading...

CVE-2017-15417

The CVE-2017-15417 issue affects Google Chrome (Chromium) involving Skia canvas operations. The flaw is described as an inappropriate implementation in Skia canvas composite operations that allowed a remote attacker to disclose cross-origin data via a crafted HTML page. CNVD-2018-20145 confirms t...

CVE-2017-5108

CVE-2017-5108 is a type-confusion vulnerability in the PDFium component of Chromium, affecting Google Chrome/Chromium before 60.0.3112.78 on Mac, Windows, Linux and Android. The connected documents corroborate an arbitrary code execution risk via a crafted PDF file due to PDFium weaknesses, with ...

CVE-2018-20065

CVE-2018-20065 affects Google Chrome prior to 71.0.3578.80 via the PDFium component. The vulnerability arises from how Chrome handles URI actions in PDFs, allowing a remote attacker to trigger potentially unsafe navigations without user gesture through a crafted PDF file. Connected sources specif...

CVE-2018-6162

CVE-2018-6162 is a heap buffer overflow in WebGL within Google Chrome (Mac) prior to 68.0.3440.75, exploitable via crafted HTML to trigger heap corruption. Debian and other advisories confirm a fix in Chrome/Chromium 68.0.3440.75 (and later); remediation is to upgrade to the fixed version. The co...

CVE-2022-0105

The CVE-2022-0105 entry corresponds to a Use-after-Free in PDF Accessibility in Google Chrome/Chromium prior to 97.0.4692.71, allowing remote attackers to potentially exploit heap corruption via a crafted HTML page. Public references show affected software as Google Chrome/Chromium components, wi...