CVE-2026-5289

CVE-2026-5289 affects Google Chrome prior to version 146.0.7680.178, describing a use-after-free in the Navigation component that could allow a remote attacker who already compromised the renderer process to escape the sandbox via a crafted HTML page. The vulnerability is categorized as High seve...

CVE-2026-9999

The CVE-2026-9999 entry describes an inappropriately implemented ANGLE component in Google Chrome on macOS prior to 148.0.7778.216, enabling a remote attacker to execute arbitrary code inside the Chrome sandbox via a crafted HTML page. The risk is tied to the ANGLE implementation in Chrome/Chromi...

CVE-2017-5093

CVE-2017-5093 describes an issue in Blink’s modal dialog handling in Google Chrome prior to 60.0.3112.78 across Mac, Windows, Linux and Android. A crafted HTML page could cause the browser to fail to display a full-screen warning, potentially affecting user attention for critical UI prompts. The ...

CVE-2017-5111

CVE-2017-5111 is a use-after-free vulnerability in the PDFium component of Chromium/Google Chrome prior to 61.0.3163.79. It allows remote memory corruption via a crafted PDF file. Connected advisories confirm the issue affects Chromium/Chromium-derived packages and that the fix was introduced in ...

CVE-2017-5119

CVE-2017-5119 concerns the Skia component of Chromium. The initial description notes an uninitialized value in Skia on Chromium before 61.0.3163.79 (and Android 61.0.3163.81), enabling a remote attacker to read potentially sensitive process-memory data via a crafted HTML page (information disclos...

CVE-2018-6038

CVE-2018-6038 describes a heap buffer overflow in WebGL on Google Chrome, allowing a remote attacker to cause an out-of-bounds read via a crafted HTML page. Affected product: Google Chrome (WebGL component). Root cause: heap overflow in WebGL leading to memory corruption. Impact: information disc...

CVE-2018-6097

CVE-2018-6097 describes an issue in Google Chrome for macOS where improper handling of asynchronous methods in the Fullscreen UI could allow a remote attacker to enter full screen without showing a warning via a crafted HTML page. The root cause is an incorrect handling of asynchronous fullscreen...

CVE-2018-6117

CVE-2018-6117 affects Google Chrome prior to 66.0.3359.117, where confusing Autofill settings could allow a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Public references in the CVE indicate Chrome/Chromium impact and that fixes were rel...

CVE-2020-16045

CVE-2020-16045 : A use-after-free in the Payments component of Google Chrome on Android (before 87.0.4280.66) allowed a remote attacker who had compromised the renderer process to potentially escape the Chrome sandbox via a crafted HTML page. The issue is documented in multiple feeds (including R...

CVE-2022-0105

The CVE-2022-0105 entry corresponds to a Use-after-Free in PDF Accessibility in Google Chrome/Chromium prior to 97.0.4692.71, allowing remote attackers to potentially exploit heap corruption via a crafted HTML page. Public references show affected software as Google Chrome/Chromium components, wi...

CVE-2022-2587

CVE-2022-2587 refers to an out-of-bounds write in the ChromeOS CRAS (Chrome OS Audio Server) component of Google Chrome on ChromeOS before 102.0.5005.125. The underlying cause is an unsafe strcpy-based copy of a user-controlled identity string, allocated as 128 bytes on the heap, allowing a remot...

CVE-2022-4916

Affected software: Google Chrome (Media component) with Chromium-based engine. Vulnerability: Use-after-free in Media leading to arbitrary read/write via a crafted HTML page. Root cause: use-after-free condition in Chrome’s media handling prior to version 103.0.5060.53. Impact: remote attacker co...

CVE-2026-12034

The CVE-2026-12034 entry describes an issue in Google Chrome on Linux where Linux Toolkit Theming mishandles untrusted input, allowing a renderer process in a compromised sandbox to escape via a malicious file. Affected software: Google Chrome on Linux (pre-149.0.7827.115). Root cause: insufficie...

CVE-2026-13912

The CVE-2026-13912 affects Google Chrome on iOS prior to 150.0.7871.47, due to an Inappropriate implementation in Safe Browsing. This design issue enables a remote attacker to perform UI spoofing by presenting a crafted HTML page. The vulnerability description and connected records consistently i...

CVE-2026-13991

CVE-2026-13991 describes insufficient validation of untrusted input in Chrome for iOS / Google Chrome on iOS prior to version 150.0.7871.47 , enabling a remote attacker to perform UI spoofing via a crafted HTML page. The root cause is input validation weaknesses in the iOS Chrome rendering path. ...

CVE-2026-13995

CVE-2026-13995 : Insufficient validation of untrusted input in Autofill for Google Chrome on Android allows a remote attacker to perform UI spoofing via a crafted HTML page. Affected are Chrome builds prior to 150.0.7871.47; remediation is to update to 150.0.7871.47 or a later version once releas...

CVE-2026-17957

The CVE-2026-17957 entry concerns Google Chrome with an improper CORS implementation in the renderer prior to version 151.0.7922.72. The issue could allow a remote attacker who has compromised the renderer process to leak cross-origin data via a crafted HTML page. According to the provided data, ...

CVE-2026-1862

CVE-2026-1862 is a Type Confusion in V8 affecting Google Chrome before 144.0.7559.132. The vulnerability arises from a V8 type-confusion in the JIT/optimized path (via JSObject::GetProperty) that can lead to heap corruption, enabling a remote attacker to achieve arbitrary read/write and potential...

CVE-2026-19176

The CVE-2026-19176 entry concerns Google Chrome’s use-after-free in Skia prior to version 151.0.7922.109. The vulnerability could allow a remote attacker who has already compromised the renderer process to execute arbitrary code inside the browser sandbox via a crafted HTML page. The root cause i...

CVE-2026-8560

CVE-2026-8560 describes a heap buffer overflow in SwiftShader used by Google Chrome on macOS and iOS, prior to Chrome 148.0.7778.168. The vulnerability allows a remote attacker to perform an out-of-bounds memory read via a crafted HTML page. Affected component: SwiftShader within Chrome; impact i...

CVE-2017-5079

CVE-2017-5079 affects Blink in Chromium/Chrome on Mac, Windows and Linux (desktop) and Android, allowing a remote attacker to spoof UI by crafting HTML in a non-attacker tab. Desktop impact reported as UI spoofing; affected Chrome versions before 59.0.3071.86 (and Android before 59.0.3071.92). Re...

CVE-2017-5109

CVE-2017-5109 affects Chromium before version 60.0.3112.78, where a UI spoofing vulnerability was identified in the browser’s UI components (per Arch/Debian advisories). The issue is fixed in 60.0.3112.78 (upstream) with the Debian/Arch advisories confirming remediation. Affected product: Chromiu...

CVE-2020-6453

CVE-2020-6453 affects Google Chrome’s V8 engine. An inappropriate implementation allowed a remote attacker to potentially trigger heap corruption with a crafted HTML page. This is tied to Chrome versions prior to 80.0.3987.162. The vulnerability is addressed by upgrading to 80.0.3987.162 or later...

CVE-2024-6996

CVE-2024-6996 describes a race in Chrome/Chromium's Frames that enables UI spoofing when a user is induced to perform specific UI gestures on a crafted HTML page. Affected software is Google Chrome/Chromium prior to version 127.0.6533.72. The underlying issue is a race condition in Frames; exploi...

CVE-2025-7656

CVE-2025-7656 affects Google Chrome’s V8 engine prior to 138.0.7204.157, where an integer overflow can lead to heap corruption via a crafted HTML page. The vulnerability is categorized as High severity with network attack potential and user interaction required. Chrome’s stable release 138.0.7204...

CVE-2026-15112

CVE-2026-15112: Use-after-free in Chrome's Ozone component leading to potential heap corruption via a crafted HTML page. Affected product: Google Chrome prior to 150.0.7871.115. Root cause: use-after-free in Ozone. Impact: remote attacker could exploit heap corruption; Chromium severity is Critic...

CVE-2026-17753

CVE-2026-17753 involves an insecure Autofill implementation in Google Chrome before 151.0.7922.72, which could allow a remote attacker to leak cross-origin data via a crafted HTML page. The issue is described as a Chromium security medium severity (base CVSS 4.3, AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A...

CVE-2026-17879

CVE-2026-17879 affects Google Chrome Autofill. The vulnerability stems from an inappropriate implementation in Autofill prior to version 151.0.7922.72, allowing a remote attacker to leak cross-origin data via a crafted HTML page. The CVSS 3.1 base score is 4.3 (Medium) with network attack vector,...

CVE-2026-5272

CVE-2026-5272 is a heap buffer overflow in Chrome’s GPU code, allowing remote execution of code via a crafted HTML page. Affected product: Google Chrome; vulnerable component: GPU/ Heap handling in Chrome’s rendering pipeline; root cause per CNVD/CNNVD items: GPU heap failing to validate input le...

CVE-2012-0724

CVE-2012-0724 affects Adobe Flash Player prior to 11.2.202.229 in Google Chrome prior to 18.0.1025.151. The vulnerability enables memory corruption leading to a possible denial of service or other unspecified impact via unknown vectors (distinct from CVE-2012-0725). Connected advisories corrobora...

CVE-2015-1212

CVE-2015-1212 affects Google Chrome before 40.0.2214.111 on Windows/macOS/Linux and before 40.0.2214.109 on Android, with multiple unspecified vulnerabilities that can cause a denial of service or other impact via unknown vectors. The connected documents corroborate a specific issue described as ...

CVE-2017-15417

The CVE-2017-15417 issue affects Google Chrome (Chromium) involving Skia canvas operations. The flaw is described as an inappropriate implementation in Skia canvas composite operations that allowed a remote attacker to disclose cross-origin data via a crafted HTML page. CNVD-2018-20145 confirms t...

CVE-2017-5108

CVE-2017-5108 is a type-confusion vulnerability in the PDFium component of Chromium, affecting Google Chrome/Chromium before 60.0.3112.78 on Mac, Windows, Linux and Android. The connected documents corroborate an arbitrary code execution risk via a crafted PDF file due to PDFium weaknesses, with ...

CVE-2017-5126

CVE-2017-5126: A use-after-free in PDFium found in the Chromium/Chrome PDF rendering path prior to 62.0.3202.62 allows a remote attacker to cause heap corruption via a crafted PDF file, enabling arbitrary code execution. Affected software/component: PDFium inside Chromium/Chrome on versions

CVE-2018-6115

CVE-2018-6115 affects Google Chrome (and Chromium) prior to 66.0.3359.117. The issue is an inappropriate setting of the SEE_MASK_FLAG_NO_UI flag in file downloads, which could allow a remote, crafted HTML page to bypass operating system malware checks. Public advisories and vendor updates indicat...

CVE-2022-0309

CVE-2022-0309 corresponds to an insecure implementation in Chrome’s Autofill feature that allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. The issue affects Google Chrome prior to version 97.0.4692.99. The referenced advisories indicate this vulnerability is ad...

CVE-2022-2859

CVE-2022-2859: Use-after-free in Chrome OS Shell within Google Chrome prior to 104.0.5112.101 can be triggered by a user-engaged UI interaction, potentially leading to heap corruption and remote code execution. Debian security advisory confirms a fix in Chromium 104.0.5112.101-1~deb11u1; updating...

CVE-2023-2313

CVE-2023-2313 concerns Google Chrome on Windows with an insecure Sandbox implementation in the Chromium-based renderer before version 112.0.5615.49. The vulnerability allows a remote attacker who has already compromised the renderer process to perform arbitrary read/write via a malicious file, in...

CVE-2024-5500

CVE-2024-5500 affects Google Chrome prior to 1.3.36.351, due to an inappropriate Sign-In implementation that could allow a remote attacker to bypass navigation restrictions via a crafted HTML page. The vulnerability impacts Chrome across platforms and is documented in the Chrome release notes and...

CVE-2025-3073

CVE-2025-3073 concerns Google Chrome’s Autofill implementation prior to 135.0.7049.52. The issue arises from an inappropriate Autofill UI handling that a crafted HTML page could trigger after user interaction, enabling UI spoofing. Affected component: Chrome/Chromium Autofill logic. Impact as doc...

CVE-2026-0899

CVE-2026-0899 : Out-of-bounds memory access in V8 within Google Chrome prior to 144.0.7559.59, allowing a remote attacker to potentially cause object corruption via a crafted HTML page. Connected sources show Chromium/Chrome updates addressing this with Chromium 144.0.7559.59+ (e.g., Chromium/CEF...

CVE-2026-17700

The CVE-2026-17700 entry affects Google Chrome (Chromium component: Actor) with insufficient validation of untrusted input in the Actor, allowing a remote attacker who has compromised the renderer process to leak cross-origin data via a crafted HTML page. The issue’s impact is limited to leakage ...

CVE-2026-1861

CVE-2026-1861 is a heap buffer overflow in libvpx used by Google Chrome/Chromium prior to version 144.0.7559.132. The vulnerability allows a remote attacker to potentially trigger heap corruption via a crafted HTML page (attack vector: network; user interaction typically required as per CVSS). Th...

CVE-2026-19138

CVE-2026-19138 (Google Chrome) : A heap buffer overflow in the CrashReporting component allows a remote attacker who has compromised the renderer process to potentially escape the sandbox via a crafted HTML page, affecting Chrome builds prior to 151.0.7922.109. The Chrome update notes indicate th...

CVE-2026-8535

CVE-2026-8535 describes an out-of-bounds read in the Media component of Google Chrome on Linux and ChromeOS, exploitable when a renderer process is compromised and a crafted JPEG is processed. The issue could allow a remote attacker to read potentially sensitive data from process memory. Affected...

CVE-2026-8561

The CVE-2026-8561 entry concerns Google Chrome (Chromium-based) and its Fullscreen UI: an incorrect security UI in Fullscreen allowed a remote attacker to spoof UI via a crafted HTML page. Transcripted details across sources confirm the vulnerable component is the fullscreen security UI, with the...

CVE-2009-2816

Technical details for CVE-2009-2816 are not provided in the connected documents. The materials mention WebKit/CORS context and related products, but no concrete exploit specifics, impacted versions, or fixes are included. Monitor for updates.

CVE-2017-15411

CVE-2017-15411 affects Google Chrome’s PDFium component. A use-after-free/memory misreference in PDFium prior to 63.0.3239.84 can allow a remote attacker to trigger heap corruption via a crafted PDF file. The exploit could be remotely triggered with no user interaction (per CVSS metrics), leading...

CVE-2017-15415

Google Chrome IPC Pointer Information Disclosure vulnerability (CVE-2017-15415) stems from incorrect serialization in the IPC component, allowing a remote attacker to leak a pointer value via a crafted HTML page on affected builds prior to 63.0.3239.84. Public descriptions in CNVD-2018-22403 corr...

CVE-2017-5068

CVE-2017-5068: In Google Chrome (Chromium-based) prior to 58.0.3029.96, WebRTC’s handling of picture IDs could trigger a race condition via a crafted HTML page on Mac/Windows/Linux. This is the concrete vulnerability: the race condition could be exploited remotely by a crafted page. Affected soft...