CVE-2026-17734

CVE-2026-17734 affects Google Chrome’s Autofill on all platforms. The root cause is an inappropriate Autofill implementation that allows a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. Impact is limited to a UXSS scenario with Medium severity; no exploit deta...

CVE-2026-17885

CVE-2026-17885 affects Google Chrome’s Paint component. The issue arises from an inappropriate implementation that allows a remote attacker to leak cross-origin data via a crafted HTML page, reported for Chrome versions prior to 151.0.7922.72. The provided sources indicate a Medium severity impac...

CVE-2026-17910

CVE-2026-17910 concerns Google Chrome on Android. The issue is described as insufficient policy enforcement in the NFC component, present in Chrome on Android versions prior to 151.0.7922.72, which could allow a remote attacker to leak cross-origin data via a crafted HTML page. The CVSS v3.1 base...

CVE-2010-4203

CVE-2010-4203 affects WebM libvpx (VP8 Codec SDK) before 0.9.5 used in Google Chrome prior to 7.0.517.44. An input frame with invalid data can trigger memory corruption, leading to a crash or potential code execution. Multiple advisories (RHSA-2010:0999, ELSA-2010-0999, OpenVAS entries) document ...

CVE-2011-1305

CVE-2011-1305 : A race condition in Google Chrome prior to 11.0.696.57 on Linux and macOS (linked-list race in database handling) could allow a remote attacker to cause a denial of service or other impact. Chrome 11.0.696.57 patches this issue (and related fixes). The CVSS 2.0 base score is 6.8 (...

CVE-2015-1209

CVE-2015-1209 is a use-after-free in Blink’s DOM implementation (VisibleSelection::nonBoundaryShadowTreeRootNode) affecting Google Chrome prior to 40.0.2214.111 (Windows/macOS/Linux) and prior to 40.0.2214.109 on Android. Exploitation could cause denial of service or other unspecified impact via ...

CVE-2017-5076

CVE-2017-5076 affects the Omnibox (address bar) in Chromium/Google Chrome prior to 59.0.3071.86 (Desktop) and 59.0.3071.92 (Android); a domain spoofing vulnerability via IDN homographs is disclosed, enabling a remote attacker to misrepresent a domain. Connected sources confirm this as a content s...

CVE-2017-5080

CVE-2017-5080 is a use-after-free in the chromium credit card autofill component. The initial description states an out-of-bounds memory read on a crafted HTML page could be triggered, affecting Chromium on Linux and Windows before version 59.0.3071.86. Connected documents corroborate that this C...

CVE-2018-16080

CVE-2018-16080 : A missing check for popup window handling in Fullscreen mode in Google Chrome on macOS before 69.0.3497.81 allowed a crafted HTML page to spoof the Omnibox (URL bar). The vulnerability is documented with this description and is referenced in multiple OS-specific advisories (e.g.,...

CVE-2018-6147

CVE-2018-6147 affects Google Chrome on macOS (pre-67.0.3396.62). Root cause: lack of secure text entry mode in the Browser UI password fields. Impact: a local attacker could obtain potentially sensitive data from process memory via a local process. Remediation: update to a fixed Chromium/Chrome r...

CVE-2022-0292

Google Chrome: CVE-2022-0292 involves an Inappropriate implementation in Fenced Frames prior to 97.0.4692.99 that allows a remote attacker who has compromised the renderer process to bypass navigation restrictions via a crafted HTML page. The Chrome release notes confirm a security fix in 97.0.46...

CVE-2026-11287

CVE-2026-11287 : Google Chrome on Android is affected (before 149.0.7827.53). The issue is insufficient policy enforcement in Navigation, allowing a renderer-compromised page to bypass navigation restrictions via a crafted HTML page. Root cause: policy enforcement gap in navigation. Impact per CV...

CVE-2026-8572

CVE-2026-8572 : In Google Chrome on Android, versions prior to 148.0.7778.168 suffer from insufficient policy enforcement in the Network component. A renderer-process compromise could leak cross-origin data via a crafted HTML page. This is supported by multiple vendors: Upstream Chromium report (...

CVE-2026-8576

CVE-2026-8576 concerns an inappropriate CORS implementation in Google Chrome on Linux and ChromeOS, traced to the Chromium CORS component. Upstream bug reference points to a chromium issue (496231853). The vulnerability allows a remote attacker to leak cross-origin data via a crafted HTML page; i...

CVE-2013-6632

Google Chrome/Chromium affected: Chrome versions prior to 31.0.1650.57 (Chromium-based) show multiple memory corruption issues, including CVE-2013-6632. The initial entry cites an integer overflow as a trigger vector that could lead to remote code execution or memory corruption (DoS), demonstrate...

CVE-2017-15398

Chromium (Chrome) before version 62.0.3202.89 is affected by CVE-2017-15398 and CVE-2017-15399 per the connected Arch Linux advisory. The issue for CVE-2017-15398 is a stack-based buffer overflow in the QUIC component, enabling remote code execution. CVE-2017-15399 is a use-after-free in the V8 J...

CVE-2017-15424

Google Chrome Omnibox vulnerability CVE-2017-15424: insufficient policy enforcement allows domain spoofing via IDN homographs in crafted domain names, affecting versions prior to 63.0.3239.84. Debian and other advisories indicate fix to 63.0.3239.84-1~deb9u1 and related patches; upgrade to 63.0.3...

CVE-2017-15428

CVE-2017-15428 affects Google Chrome’s V8 engine, specifically the builtins string generator, where insufficient data validation can lead to out-of-bounds read/write. A crafted HTML page could allow a remote attacker to execute arbitrary code inside the browser sandbox on versions prior to 62.0.3...

CVE-2017-5052

CVE-2017-5052 affects Google Chrome/Blink: an incorrect assumption about block structure can allow memory corruption via a crafted HTML page. Affected are Chrome on Mac/Windows/Linux up to 57.0.2987.133 and Android up to 57.0.2987.132. Exploitation may lead to arbitrary code or DoS; a malware pre...

CVE-2017-5129

CVE-2017-5129 is a use-after-free vulnerability in the WebAudio component of the Chromium Blink stack used by Google Chrome, present in versions prior to 62.0.3202.62. A crafted HTML page can trigger a use-after-free that allows an out-of-bounds memory read. Multiple connected sources (including ...

CVE-2024-7001

CVE-2024-7001 affects Google Chrome/Chromium: an inappropriate HTML implementation could enable UI spoofing when a user is induced to perform specific UI gestures on a crafted HTML page. Affected component is the Chromium HTML/UI layer; root cause is improper handling of UI gestures in HTML rende...

CVE-2026-17724

CVE-2026-17724 describes a race condition in Chrome for iOS (Chrome on iOS) prior to version 151.0.7922.72 that allows a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. The impact, as stated, is exploitation from a remote site with a network attack vector and u...

CVE-2026-17958

CVE-2026-17958 involves an inappropriate implementation in the Views component of Google Chrome before 151.0.7922.72, enabling a remote attacker to perform UI spoofing via a crafted HTML page. The referenced impact level is Chromium security severity: Low, with CVSS‑3.1 metrics showing Network ac...

CVE-2026-17964

CVE-2026-17964 affects Google Chrome on Android prior to version 151.0.7922.72, where an incorrect security UI could allow a remote attacker to perform domain spoofing via a crafted HTML page. The vulnerability is categorized with a Chromium-based, low-severity impact (CVSSv3.1 base score 4.3; sc...

CVE-2017-15391

CVE-2017-15391 targets the Chromium/Chrome extensions component. The vulnerability arises from insufficient policy enforcement in extensions, allowing a remote attacker to bypass extension limitations and access Extension pages without authorization via a crafted HTML page. Multiple vendor adviso...

CVE-2017-5057

CVE-2017-5057 affects Google Chrome components that use PDFium. The vulnerability is a type confusion in PDFium, allowing a crafted PDF file to trigger an out-of-bounds memory read in Chrome on Mac, Windows, Linux (before 58.0.3029.81) and Android (before 58.0.3029.83). Reported impact (per CVSS)...

CVE-2017-5075

CVE-2017-5075 is a CSP reporting information-disclosure flaw in the Blink/Chromium CSP reporting code. The vulnerability allows a remote attacker to obtain the value of URL fragments through a crafted HTML page. Affected component is the CSP reporting in Blink within Chromium-based QtWebEngine bu...

CVE-2017-5114

CVE-2017-5114 affects chromium-browser via an improper use of partition alloc in PDFium, enabling memory corruption through a crafted PDF. The Debian advisories note multiple Chromium CVEs (including 5114) and state fixes are available in the Chromium package by version 61.0.3163.100-1~deb9u1 for...

CVE-2022-4925

CVE-2022-4925 describes insufficient validation of untrusted input in QUIC handling in Google Chrome before 97.0.4692.71, allowing a remote attacker to perform header splitting via malicious network traffic. Affected product: Google Chrome (Chromium QUIC stack). Root cause: inadequate input valid...

CVE-2025-14372

CVE-2025-14372 is a Use-after-Free in Chrome/Chromium Password Manager that could enable a sandbox escape via a crafted HTML page. Affected component is Password Manager within Chrome/Chromium; root cause described as use-after-free. Impact per sources: remote attacker could escape sandbox; base ...

CVE-2025-1921

CVE-2025-1921 affects Google Chrome (Chromium-based) via the Media Stream component. The root cause is an inappropriate implementation that allows a remote attacker to obtain information about a peripheral through a crafted HTML page. The vulnerability is fixed in Chrome/Chromium 134.0.6998.35 an...

CVE-2026-13775

CVE-2026-13775: In Google Chrome, a use-after-free in the GPU component (prior to 150.0.7871.47) could be triggered by a crafted HTML page by a renderer-compromised attacker to potentially escape the sandbox. Impact is a remote, sandbox-escape risk with high severity. Remediation: update Chrome t...

CVE-2026-17697

CVE-2026-17697 is a Type Confusion in ANGLE within the Chromium-based Google Chrome browser, enabling a remote sandbox-escape via a crafted HTML page. Affected software: ANGLE in Google Chrome/Chromium prior to 151.0.7922.72. Impact: high/critical (sandbox escape potential) as described in the se...

CVE-2026-17944

CVE-2026-17944 : In Chrome for iOS (Google Chrome on iOS), an inappropriate implementation allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. The issue is described as present in versions prior to 151.0.7922.72. Root cause: flawed navigation restriction handling ...

CVE-2014-1713

CVE-2014-1713 is a use-after-free in the AttributeSetter function of bindings/templates/attributes.cpp within Blink used by Google Chrome. The flaw affects Chrome prior to 33.0.1750.152 on OS X/Linux and prior to 33.0.1750.154 on Windows, allowing a remote attacker to cause a denial of service or...

CVE-2014-1730

CVE-2014-1730 concerns Google V8 type confusion in i18n.js/runtime.cc used by Chrome/Chromium. The vulnerability allows remote attackers to bypass access restrictions by reading property values, via crafted content. Affected software includes Chromium/Chrome builds prior to 34.0.1847.132 (Linux) ...

CVE-2016-5202

CVE-2016-5202 affects Google Chrome/Chromium before versions around 54.x on various platforms. The issue involves browser/extensions/api/dial/dial_registry.cc failing to copy a device ID before an erase() call, which allows the erase to access data it will destroy. The Debian advisory confirms a ...

CVE-2017-15387

CVE-2017-15387 affects Chromium/Blink; before 62.0.3202.62 there was insufficient enforcement of Content Security Policy, allowing a remote attacker to open javascript: URLs via a crafted HTML page. Affected software is the Chromium browser (Blink engine) prior to 62.0.3202.62. Remediation is to ...

CVE-2017-15394

CVE-2017-15394 affects the Chromium/Google Chrome extensions UI prior to 62.0.3202.62. The issue is described as a URL spoofing/domain spoofing vulnerability in permission dialogs caused by insufficient policy enforcement and IDN homographs in a crafted extension. The known remediation is to upgr...

CVE-2017-5063

A numeric overflow in Skia within Google Chrome prior to 58.0.3029.81 for Linux/Windows/macOS and 58.0.3029.83 for Android allows a remote attacker to cause an out-of-bounds memory read via a crafted HTML page. Affected component: Skia in Chrome. Root cause: numeric overflow. Impact: memory read ...

CVE-2017-5091

CVE-2017-5091 is a use-after-free in Chromium’s IndexedDB, affecting Chromium

CVE-2017-5115

CVE-2017-5115 concerns Chromium/Chrome before 61.0.3163.79 on Windows, with a type confusion issue in the V8 JavaScript engine. The Arch Linux advisory confirms the class of defects across Chromium components (V8 type confusion) and notes the upstream fix in 61.0.3163.79, upgrading mitigates the ...

CVE-2017-5117

CVE-2017-5117 relates to an uninitialized value in the Skia library used by Chromium/Chrome. The initial entry notes a remote attacker could obtain potentially sensitive information from process memory via a crafted HTML page in Chrome prior to 61.0.3163.79 (Linux/Windows). Connected Debian advis...

CVE-2021-4318

CVE-2021-4318 affects Blink in Google Chrome prior to 94.0.4606.54, where object corruption could be triggered by a crafted HTML page. The vulnerability is described as a remote issue with high severity (CVSS v3.1: 8.8, High) and impacts all three confidentiality, integrity, and availability. The...

CVE-2025-10891

CVE-2025-10891 relates to an integer overflow in V8 of Google Chrome, prior to Chromium 140.0.7339.207, which could allow remote heap corruption via a crafted HTML page. The connected Fedora advisories show Chromium/CEF package updates shipping Chromium 140.0.7339.207 across FC41/FC42/FC43 editio...

CVE-2026-16804

Google Chrome prior to 150.0.7871.186 is affected by a use-after-free in Input that, if the renderer process is compromised, could permit a sandbox escape via a crafted HTML page (high severity; CVSSv3.1: 8.3). The issue is addressed in the Stable Channel update to 150.0.7871.186/187, with four r...

CVE-2026-17899

CVE-2026-17899 refers to insufficient policy enforcement in Chrome DevTools before version 151.0.7922.72, enabling privilege escalation if a user installs a crafted malicious Chrome extension. Affected software is Google Chrome (DevTools component) with the root cause described as weak policy enf...

CVE-2026-17972

The CVE-2026-17972 entry describes an inappropriate implementation in Chrome for iOS (Google Chrome on iOS) before version 151.0.7922.72 that allows a remote attacker to perform UI spoofing via a crafted HTML page. The vulnerability impacts Chrome on iOS and is categorized with a Chromium-based r...

CVE-2010-4577

CVE-2010-4577 affects WebKit/WebKitGTK+ in the CSSParser::parseFontFaceSrc path, enabling an out-of-bounds read and denial of service via a crafted local font. Affected products include WebKit-based browsers (e.g., Google Chrome before 8.0.552.224; webkitgtk before 1.2.6). Remediation noted acros...

CVE-2017-15416

CVE-2017-15416 describes a heap-based out-of-bounds read/overflow in Chrome’s Blob API that could allow remote exploitation via a crafted HTML page, triggering heap corruption. Affected product: Google Chrome (Blink) prior to 63.0.3239.84. Root cause: out-of-bounds read in Blob API handling. Impa...