CVE-2025-9478

CVE-2025-9478 : Use-after-free in ANGLE within Google Chrome prior to 139.0.7258.154 can enable a remote attacker to cause heap corruption via a crafted HTML page. Affected component: ANGLE/Chromium WebKit stack used by Chrome. Impact per sources: potential arbitrary code execution, heap corrupti...

CVE-2026-13812

CVE-2026-13812 affects Chrome for iOS (Google Chrome on iOS) prior to version 150.0.7871.47. The issue is insufficient validation of untrusted input in a crafted HTML page, enabling UXSS if a user is induced to perform specific UI gestures. The vulnerability results in potential script/HTML injec...

CVE-2026-13902

CVE-2026-13902 affects Chrome on iOS (Google Chrome on iOS) prior to version 150.0.7871.47 . The issue is described as an inappropriate implementation in Chrome for iOS that allows a remote attacker to perform UI spoofing via a crafted HTML page. The vulnerability is documented across multiple so...

CVE-2026-14137

CVE-2026-14137 describes insufficient validation of untrusted input in Chrome for iOS / Google Chrome on iOS prior to version 150.0.7871.47. The issue allows a remote attacker to trigger UI spoofing by convincing a user to perform specific UI gestures on a crafted HTML page. The vulnerability tar...

CVE-2026-17937

Google Chrome DevTools contains insufficient input validation that could allow a remote attacker to bypass navigation restrictions via a crafted HTML page, affecting Chrome versions prior to 151.0.7922.72. The vulnerability is tied to DevTools handling untrusted input, with a Low severity rating ...

CVE-2017-15407

The CVE-2017-15407 entry concerns an Out-of-bounds write in the QUIC networking stack of Google Chrome, prior to version 63.0.3239.84, allowing a remote attacker to achieve code execution via a malicious server. Affected software is Google Chrome (and Chromium-based components) with the vulnerabl...

CVE-2017-15408

Summary of CVE-2017-15408 : A heap overflow vulnerability was reported in the Google Chrome Omnibox, caused by a PDFium mishandling of crafted PDF files. The issue affects Chrome versions prior to 63.0.3239.84. The root cause is a heap overflow in the pdfium component used when processing PDFs in...

CVE-2021-4100

CVE-2021-4100 affects Chromium/ANGLE in Google Chrome prior to 96.0.4664.110. The connected documents describe an object lifecycle issue in ANGLE that could allow a remote attacker to trigger heap corruption via a crafted HTML page, potentially enabling arbitrary behavior. The vulnerability is ad...

CVE-2022-0300

CVE-2022-0300 affects Google Chrome on Android: Use-after-free in Text Input Method Editor could allow a remote attacker who persuades a user to perform specific interactions to trigger heap corruption via a crafted HTML page. The advisory notes this as a potential exploit path. Remediation: upda...

CVE-2024-9954

CVE-2024-9954 affects Chromium-based Google Chrome prior to 130.0.6723.58, with a use-after-free in the AI component that could allow a remote attacker to cause heap corruption via a crafted HTML page. Affected product scope includes Google Chrome/Chromium (desktop), with ChromeOS updates also ad...

CVE-2025-3620

CVE-2025-3620 is a use-after-free in USB handling within Google Chrome/Chromium, fixed in 135.0.7049.95 for Chromium-based builds. The vulnerability allows a remote attacker to trigger heap corruption via a crafted HTML page, with high impact across confidentiality, integrity, and availability as...

CVE-2026-13808

Chrome for iOS (Google Chrome on iOS) prior to version 150.0.7871.47 is affected by insufficient data validation that could allow a local attacker to read potentially sensitive information from process memory with physical device access. The issue is addressed in the Chrome 150/151 stable updates...

CVE-2026-13998

Impact: Affected software is Google Chrome on macOS. The vulnerability stems from an incorrect security UI in the File Input component, enabling UI spoofing when a user is induced to perform specific UI gestures via a crafted HTML page. Root cause: flawed security UI handling in Chrome/Chromium’s...

CVE-2026-19145

CVE-2026-19145 : Use-after-free in Google Chrome’s Translate component prior to 151.0.7922.109 allows remote code execution in a sandbox via a crafted HTML page. Root cause: use-after-free in translation handling. Impact: arbitrary code execution with high severity; attacker requires no privilege...

CVE-2026-9967

CVE-2026-9967 affects Google Chrome's GPU/Chromium component. Out-of-bounds write in the GPU code prior to version 148.0.7778.216 enables a remote attacker to potentially escape the sandbox via a crafted HTML page. Public references indicate a Chromium/Chrome update addressing this in the 148.0.7...

CVE-2017-5087

CVE-2017-5087 is a use-after-free in Blink in Google Chrome that enables a remote attacker to perform an out-of-bounds memory read via a crafted HTML page (IndexedDB sandbox escape). Affected Chrome versions: prior to 59.0.3071.104 on Mac/Windows/Linux and 59.0.3071.117 on Android. Impact describ...

CVE-2018-6052

The CVE-2018-6052 entry documents a vulnerability in Google Chrome (Blink) where the no-referrer policy policy was incompletely implemented, allowing a remote attacker to obtain referrer details from a page that believed it opted out. Affected software is Google Chrome (Blink component); impact i...

CVE-2019-5866

CVE-2019-5866 describes an out-of-bounds memory access in JavaScript in Google Chrome prior to 75.0.3770.142, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. Affected product: Google Chrome (JS engine). Root cause: out-of-bounds memory access. I...

CVE-2022-0118

The CVE-2022-0118 issue affects Google Chrome/Chromium’s WebShare implementation. A bug allowed a remote attacker to potentially hide the Omnibox contents via a crafted HTML page. Public materials trace the vulnerability to WebShare behavior and indicate fixes were shipped in Chrome/Chromium arou...

CVE-2022-2860

CVE-2022-2860 affects Google Chrome/Chromium with insufficient cookie-prefix policy enforcement that could bypass restrictions via a crafted HTML page. Connected sources (Debian, Gentoo/Gentoo GLSA, Astra Linux) confirm the issue and provide the remediation: upgrade Chromium/Chrome to 104.0.5112....

CVE-2022-3305

CVE-2022-3305 is a use-after-free/memory misreference vulnerability in the Survey component of Google Chrome/Chromium (pre-106.0.5249.62 on ChromeOS and desktop). Exploitation could crash the browser or cause heap corruption; the advisorys indicate fixes in Chrome/Chromium 106.x (e.g., 106.0.5249...

CVE-2022-3313

CVE-2022-3313 : Affects Google Chrome prior to 106.0.5249.62 where the Full Screen security UI can be spoofed via a crafted HTML page. The Chromium/Chrome update fixed this in Chrome 106 (106.0.5249.61/62 in the release notes; fixed version noted as 106.0.5249.62+). Affected product: Google Chrom...

CVE-2026-13842

CVE-2026-13842 (Chrome for iOS) : Inappropriate implementation in Google Chrome on iOS (Chrome for iOS) prior to 150.0.7871.47 allows a remote attacker to spoof the Omnibox (URL bar) via a crafted HTML page. Affected product: Chrome for iOS / Google Chrome on iOS. Root cause: improper handling in...

CVE-2026-13946

CVE-2026-13946 concerns Google Chrome on iOS. The issue is an inappropriate implementation in ScriptInjections , allowing a remote attacker to leak cross-origin data via a crafted HTML page. Affected product: Google Chrome on iOS prior to version 150.0.7871.47. Impact is cross-origin data leakage...

CVE-2026-13955

Technical details are not publicly available in the provided documents. Monitor for updates on CVE-2026-13955.

CVE-2026-17720

CVE-2026-17720 describes insufficient policy enforcement in Passwords handling in Google Chrome prior to 151.0.7922.72, enabling a remote attacker who compromised the renderer process to leak cross-origin data via a crafted HTML page. Impact is described as cross-origin data leakage; CVSS metrics...

CVE-2026-17763

CVE-2026-17763 affects Google Chrome’s GPU implementation. The vulnerability arises from an inappropriate GPU handling in Chrome prior to 151.0.7922.72, enabling a remote attacker who compromises the renderer process to leak cross-origin data via a crafted HTML page. This is a renderer-based data...

CVE-2026-19139

CVE-2026-19139 describes a race in CredentialProvider in Google Chrome on Windows that could allow a local attacker to achieve OS‑level privilege escalation via a malicious file. Affected software: Google Chrome for Windows prior to version 151.0.7922.109. Root cause: race condition in Credential...

CVE-2026-19140

CVE-2026-19140 is a GPU use-after-free vulnerability in Google Chrome prior to 151.0.7922.109 that could allow a remote attacker who compromised the renderer process to potentially escape the sandbox via a crafted HTML page. The issue affects Chrome's GPU path and is documented across the CVE/NVD...

CVE-2026-7363

CVE-2026-7363 describes a use-after-free in Canvas in Google Chrome on Linux and ChromeOS prior to 147.0.7727.138, allowing a remote attacker to execute arbitrary code inside the sandbox. The issue affects Google Chrome: Linux/ChromeOS prior to the fixed build, with a high-severity (Critical) imp...

CVE-2026-76034

Buffer overflow in WebGL in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-8538

CVE-2026-8538 describes insufficient validation of untrusted input in the GPU component of Google Chrome, prior to version 148.0.7778.168. A remote attacker who has compromised the renderer process could trigger a denial of service by presenting a crafted HTML page. The description and connected ...

CVE-2026-8546

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-8578

CVE-2026-8578 affects Google Chrome on Linux, with an out-of-bounds read in the GPU component of Chromium. The issue arises in the GPU path of Chromium’s rendering stack and can allow a remote attacker who has already compromised the renderer process to leak cross-origin data through a crafted HT...

CVE-2011-0480

CVE-2011-0480 involves FFmpeg’s Vorbis decoder (libavcodec/vorbis_dec.c) with multiple buffer overflows that can be triggered by a crafted WebM file, leading to memory corruption and possible denial of service or other impact. The vulnerability affects FFmpeg as used in browsers (e.g., Chrome pri...

CVE-2017-5060

CVE-2017-5060 affects Google Chrome/Chromium Omnibox prior to version 58.0.3029.81 (desktop) and 58.0.3029.83 (Android) due to insufficient policy enforcement, enabling domain spoofing via IDN homographs in crafted domain names. Public details in connected docs verify affected Chromium releases (...

CVE-2018-20067

CVE-2018-20067 affects Google Chrome prior to 71.0.3578.80 in the browser’s Navigation/renderer flow. A crafted HTML page can cause a renderer-initiated back navigation to incorrectly cancel a browser-initiated navigation, enabling a remote attacker to confuse users about the origin of the curren...

CVE-2020-6498

CVE-2020-6498 is described in the initial document as a user interface error in Google Chrome on iOS prior to 83.0.4103.88, with domain spoofing via a crafted HTML page (as per the description). Connected documents confirm CVE-2020-6498 is among multiple Chrome vulnerabilities listed in Debian se...

CVE-2020-6503

CVE-2020-6503 affects Google Chrome before 74.0.3729.108 in the accessibility component. The root cause is an inappropriate implementation that allows a remote attacker to extract potentially sensitive information from a process’s memory via a crafted HTML page. The impact is exposure of memory-r...

CVE-2022-0099

CVE-2022-0099 — Summary (supported by connected docs): Use-after-free in Sign-in in Google Chrome prior to 97.0.4692.71 may allow a remote attacker who entices a user to perform specific gestures to potentially cause heap corruption. This vulnerability affects Chromium/Chrome components involved ...

CVE-2022-0115

This CVE corresponds to Google Chrome/Chromium’s Uninitialized use in the File API, allowing a remote attacker to potentially cause out-of-bounds memory access via a crafted HTML page. Public sources confirm the issue affects Chrome/Chromium prior to version 97.0.4692.71 and that the vulnerabilit...

CVE-2022-1141

CVE-2022-1141: Use-after-free in Chrome File Manager affecting Google Chrome versions before 100.0.4896.60. The vulnerability could allow heap corruption via a specific user gesture after convincing a user to engage in certain interaction. Impact is described as high for confidentiality, integrit...

CVE-2022-3311

CVE-2022-3311 is a Chrome/Chromium vulnerability in the Import memory handling that leads to a use-after-free. The issue can be triggered by a crafted HTML page, potentially enabling a sandbox escape after compromising a WebUI process. Affected software: Google Chrome prior to 106.0.5249.62 (Chro...

CVE-2022-3315

CVE-2022-3315 is confirmed in multiple connected sources as a Type Confusion in Blink affecting Chromium/Google Chrome. It describes a vulnerability in Blink where a crafted HTML page could trigger heap corruption, allowing potential arbitrary code execution. Affected product line is Chromium-bas...

CVE-2022-4955

CVE-2022-4955 concerns Google Chrome before 108.0.5359.71, where an improper DevTools implementation could allow a user who installs a crafted extension via a malicious HTML page to bypass file access restrictions. The vulnerability stems from DevTools behavior and enables an attacker to exploit ...

CVE-2025-1923

CVE-2025-1923 concerns Google Chrome (Chromium-based) and is caused by an insecure implementation in the Permission Prompts mechanism. A user convinced to install a crafted Chrome Extension could trigger a UI spoofing scenario, allowing deception without network abuse beyond user interaction. The...

CVE-2026-16413

CVE-2026-16413 is an out-of-bounds write in ANGLE used by Google Chrome (Chromium-based) prior to 150.0.7871.182, potentially enabling a sandbox escape when a renderer process is compromised via a crafted HTML page. Connected sources confirm the issue in ANGLE and identify affected Chrome/Chromiu...

CVE-2026-19558

The CVE-2026-19558 vulnerability is a Use-After-Free in Google Chrome Extensions. Affected software: Google Chrome before version 151.0.7922.137 (and related entries mention 151.0.7922.137/138). Vulnerable component: Chrome Extensions, where a crafted malicious extension could trigger the UAF con...

CVE-2026-5288

CVE-2026-5288 describes a use-after-free in WebView within Google Chrome on Android prior to 146.0.7680.178 that could allow a renderer-compromised attacker to potentially escape the sandbox via a crafted HTML page. The connected sources show Chromium/CEF/chromium package updates around version 1...

CVE-2026-5289

CVE-2026-5289 affects Google Chrome prior to version 146.0.7680.178, describing a use-after-free in the Navigation component that could allow a remote attacker who already compromised the renderer process to escape the sandbox via a crafted HTML page. The vulnerability is categorized as High seve...