CVE-2021-4318

CVE-2021-4318 affects Blink in Google Chrome prior to 94.0.4606.54, where object corruption could be triggered by a crafted HTML page. The vulnerability is described as a remote issue with high severity (CVSS v3.1: 8.8, High) and impacts all three confidentiality, integrity, and availability. The...

CVE-2022-2742

This CVE-2022-2742 describes a use-after-free in Exosphere affecting Google Chrome on Chrome OS and Lacros prior to 104.0.5112.79. The issue could allow a remote attacker, who lures a user into specific UI interactions, to potentially trigger heap corruption via crafted UI interactions. Evidence ...

CVE-2022-4912

CVE-2022-4912 describes a type confusion in the MathML parser of Google Chrome/Chromium, prior to version 105.0.5195.52, which could allow a remote attacker to potentially cause heap corruption via a crafted HTML page. The issue is rated High severity with network attack vector and user interacti...

CVE-2024-6999

Affected software: Google Chrome (FedCM implementation). Summary: The vulnerability arises from an inappropriate FedCM implementation in Chrome prior to 127.6533.72, enabling a remote attacker to cause UI spoofing by convincing a user to perform specific UI gestures on a crafted HTML page. Impact...

CVE-2026-17799

CVE-2026-17799 describes insufficient validation of untrusted input in Chrome/Chromium Safe Browsing, allowing a remote attacker to bypass discretionary access control via a malicious file. Affects Chrome/Chromium's Safe Browsing component prior to 151.0.7922.72; upstream issue 514461031 referenc...

CVE-2026-7346

CVE-2026-7346 affects Google Chrome on all platforms prior to 147.0.7727.138, due to an inappropriate implementation in Tint that allows out-of-bounds memory access via a crafted HTML page. The vulnerability enables remote code execution with network access and requires user interaction, per CVSS...

CVE-2026-9919

CVE-2026-9919: Out of bounds read in WebGL in Google Chrome on Android (before 148.0.7778.216) allows a remote attacker to leak cross-origin data via a crafted HTML page. Root cause: WebGL out-of-bounds read. Impact: cross-origin data leakage. Exploitation status is not provided in the linked doc...

CVE-2011-3078

CVE-2011-3078 is a use-after-free vulnerability in the handling of floated elements in Google Chrome/Chromium prior to version 18.0.1025.168. Exploitation could lead to a denial of service or potentially unspecified impact. Connected advisories confirm the issue as part of multiple Chrome/Chromiu...

CVE-2017-15388

CVE-2017-15388 affects Chromium's Skia component; an out-of-bounds read on crafted HTML pages in Chromium versions earlier than 62.0.3202.62. The issue originates in Skia within the browser, enabling remote exploitation. Remediation: upgrade to Chromium 62.0.3202.62 or newer (as reflected by Debi...

CVE-2017-15423

CVE-2017-15423 affects Google Chrome’s BoringSSL SPAKE2 implementation prior to 63.0.3239.84, enabling a remote attacker to leak low-order bits of SHA512(password) by inspecting protocol traffic. The vulnerability is documented in CVE-2017-15423 and corroborated by CNVD-2018-20147 (Google Chrome ...

CVE-2017-5067

CVE-2017-5067 affects Google Chrome before 58.0.3029.81 on Linux/Windows/Mac. The root cause is an insufficient watchdog timer in navigation, enabling a crafted HTML page to spoof the Omnibox (URL bar). The practical impact is UI spoofing through the address bar, potentially deceiving users. The ...

CVE-2017-5131

CVE-2017-5131 is an out-of-bounds write in the Skia component of Chromium/Google Chrome (pre-62.0.3202.62). The vulnerability was used to enable potential remote code execution in the browser via a crafted page. Mitigation: upgrade to Chromium/Chrome version 62.0.3202.62 or newer (Debian Arch Gen...

CVE-2021-4317

CVE-2021-4317 is a use-after-free in ANGLE within Google Chrome prior to 96.0.4664.93, enabling a remote attacker to perform arbitrary read/write via a crafted HTML page. The affected component is ANGLE in Chrome; root cause is a use-after-free vulnerability. The CVSS v3.1 base score is 8.8 (High...

CVE-2022-3842

CVE-2022-3842 refers to a use-after-free in the Passwords component of Google Chrome on Chromium-based engines, with the underlying issue described as heap corruption. The publicly documented impact states that a remote attacker who has compromised the renderer process could potentially exploit t...

CVE-2023-4860

CVE-2023-4860 affects Google Chrome (Skia) via an inappropriate Skia implementation in Chromium before 115.0.5790.98, allowing a remote attacker who has compromised the renderer process to potentially escape the sandbox by crafting an HTML page. The vulnerability is rooted in the Skia component a...

CVE-2026-17866

CVE-2026-17866 affects Google Chrome on Android (before 151.0.7922.72): Type Confusion in Tab can be exploited by a malicious crafted HTML page after renderer compromise to potentially escape the sandbox. Impact per sources: sandbox escape risk with Low/Low-Impact confidentiality/integrity/availa...

CVE-2026-17925

CVE-2026-17925 affects Google Chrome on Android, specifically the Cast component. An inappropriate implementation in Cast allows a remote attacker to bypass the same-origin policy via a crafted HTML page, as described in upstream Chromium issue 513719671. The vulnerability is tied to Chrome versi...

CVE-2026-18002

CVE-2026-18002 concerns insufficient validation of untrusted input in Google Lens within Chromium-based Google Chrome. The vulnerability, described across multiple feeds, occurs when a renderer process is compromised and a crafted HTML page could enable a sandbox escape through Google Lens compon...

CVE-2026-19171

CVE-2026-19171 is a use-after-free in Media for Google Chrome on Windows, prior to version 151.0.7922.109. The issue could allow a remote attacker to escape the sandbox via a crafted HTML page. The vulnerability is tied to the Media component in Chromium, affecting Chrome on Windows; the publishe...

CVE-2026-6919

CVE-2026-6919 is a use-after-free in Google Chrome’s DevTools prior to 147.0.7727.117 that could allow a remote attacker who already compromised the renderer process to escape the Chrome sandbox via a crafted HTML page. Documents from NVD/NVD mirrors and Debian/EU data confirm the vulnerability d...

CVE-2026-7347

CVE-2026-7347 affects Google Chrome (Chromoting component) prior to 147.0.7727.138. Description from connected sources indicates a use-after-free in Chromoting that could allow a remote attacker to execute arbitrary code via malicious network traffic. The Chrome update 147.0.7727.137/138 for Wind...

CVE-2015-1241

Chromium/Google Chrome vulnerability CVE-2015-1241 (tap-jacking) arises from how page navigation interacts with touch and gesture handling, allowing a crafted site to trigger remote UI actions. Affected product: Chromium-based browsers (Chrome). Root cause: interaction between navigation and touc...

CVE-2016-5194

CVE-2016-5194 is listed among multiple Chromium/Chromium-derivative vulnerabilities (Google Chrome) with no public technical details provided in the initial description. Debian and Debian-based advisories (DSA-3731-1) associate CVE-2016-5194 with chromium-browser and indicate remediation in Jessi...

CVE-2017-5066

CVE-2017-5066 : Google Chrome (Mac/Windows/Linux) affected up to 58.0.3029.81 and Android up to 58.0.3029.83. The root cause is insufficient consistency checks in the networking stack’s signature handling, allowing a remote attacker to incorrectly accept a badly formed X.509 certificate via a cra...

CVE-2017-5073

CVE-2017-5073 is a vulnerability in the Chromium-based Google Chrome browser’s print preview feature (Blink). The issue is a use-after-free in print preview, affecting Chrome up to 59.0.3071.86 on Linux, Windows, and macOS, and 59.0.3071.92 on Android. The underlying fault is a memory-management ...

CVE-2017-5113

CVE-2017-5113 describes a buffer overflow in the Skia component of Chromium/Chrome that could allow a remote attacker to execute arbitrary code via a crafted HTML page. Affected products include Chromium/Chrome before version 61.0.3163.79 (Chrome desktop/mac/win/linux) and 61.0.3163.81 (Android),...

CVE-2019-13768

Use-after-free in Chrome's FileAPI (CVE-2019-13768) affects Google Chrome

CVE-2022-2399

CVE-2022-2399 : Affected software is Google Chrome with WebGPU; the issue is a use-after-free in WebGPU that allows a remote attacker to cause heap corruption via a crafted HTML page. Product: Chrome (WebGPU component); root cause: use-after-free in WebGPU implementation; impact: potential heap c...

CVE-2022-3042

Use-after-free in PhoneHub within Google Chrome on Chrome OS (CVE-2022-3042) allows heap corruption via a crafted HTML page on versions prior to 105.0.5195.52. Affected software is Google Chrome/Chromium with PhoneHub integration; root cause is use-after-free in the PhoneHub component. Impact is ...

CVE-2022-3050

CVE-2022-3050 describes a heap buffer overflow in Chrome/Chrome OS WebUI prior to 105.0.5195.52. The root cause is a boundary error when handling untrusted UI input, exploitable via crafted UI interactions that lead to heap corruption. Affected software is Google Chrome/WebUI on Chrome OS; impact...

CVE-2022-3312

CVE-2022-3312 affects Google Chrome on ChromeOS, where VPN input handling had insufficient validation of untrusted input before version 106.0.5249.62. The underlying issue is in VPN-related code, enabling a local attacker with physical access to bypass managed device restrictions. The evidence co...

CVE-2022-4919

CVE-2022-4919 is a use-after-free in Base Internals of Google Chrome (Chromium) prior to 101.0.4951.41, allowing a remote attacker to cause arbitrary read/write via a crafted HTML page. The issue affects Chrome/Chromium components as described in multiple connected sources; the vulnerability is s...

CVE-2024-6989

CVE-2024-6989 is a use-after-free in the Loader path of Google Chrome/Chromium. The flaw could allow remote code execution via a crafted HTML page by triggering heap corruption. Affected software is Chromium/Chrome before version 127.6533.72; remediation is a patch released in Chromium updates (e...

CVE-2024-7003

CVE-2024-7003 affects Google Chrome/Chromium FedCM: an inappropriate FedCM implementation allowed UI spoofing via a crafted HTML page after a user gesture. The issue is limited to the FedCM UI flow and requires user interaction. Remediation: upgrade to Chromium/Chrome version 127.0.6533.72 or lat...

CVE-2025-10200

CVE-2025-10200 corresponds to a use-after-free in Chrome’s ServiceWorker on Desktop before 140.0.7339.127, enabling heap corruption via a crafted HTML page. Affected product: Google Chrome (Desktop). Root cause: use-after-free in ServiceWorker. Impact: potential remote exploitation with heap corr...

CVE-2025-1922

CVE-2025-1922 affects Google Chrome on Android prior to 134.0.6998.35. Inappropriate implementation in Selection allows UI spoofing when a user engages in specific UI gestures on a crafted HTML page. The CVSS v3.1 base score is 4.3 (Medium). Remediation: upgrade to Chrome 134.0.6998.35 or newer (...

CVE-2025-3070

CVE-2025-3070 affects Google Chrome/Chromium extensions, where insufficient validation of untrusted input in Extensions enables privilege escalation via a crafted HTML page. Affected product surface is Chromium-based Extensions code prior to 135.0.7049.52. The vulnerability’s root cause is input ...

CVE-2026-12011

Concisely: CVE-2026-12011 is a use-after-free in Chrome’s WebMIDI on Windows prior to 149.0.7827.115. This weakness could allow a renderer-compromised remote attacker to escape the sandbox via a crafted HTML page. The Chromium update (149.0.7827.114/115) fixes this issue; users should upgrade to ...

CVE-2026-17673

CVE-2026-17673: An integer overflow in QUIC within Google Chrome’s renderer can, via a crafted HTML page, potentially allow a sandbox escape. Affected: Google Chrome (desktop) prior to 151.0.7922.72. Root cause: integer overflow in QUIC handling. Impact: remote code execution with sandbox escape ...

CVE-2026-17717

CVE-2026-17717 : Integer overflow in ANGLE within Google Chrome leads to a potential sandbox escape via a crafted HTML page. Affected software is Google Chrome (ANGLE component in Chromium). The described impact is high/critical, with exploitation described as remote and requiring a crafted HTML ...

CVE-2026-17939

CVE-2026-17939 affects Google Chrome (Passwords component in Chromium). The upstream description cites insufficient validation of untrusted input in Passwords, enabling a remote attacker to perform UI spoofing via malicious network traffic (Chromium severity: Low). Affected versions are prior to ...

CVE-2026-17945

CVE-2026-17945 affects Google Chrome’s Navigation in versions prior to 151.0.7922.72. The issue arises from insufficient validation of untrusted input, allowing a renderer-compromised attacker to perform UI spoofing via a crafted HTML page. The reported impact is UI spoofing with low severity; ex...

CVE-2011-1196

The CVE-2011-1196 issue affects the OGG container handling in Google Chrome prior to 10.0.648.127. Root cause: out-of-bounds write in the OGG container implementation. Impact: remote denial of service and possible unspecified impact via crafted inputs. Remediation: upgrade to Google Chrome 10.0.6...

CVE-2011-2358

CVE-2011-2358 concerns Google Chrome prior to 13.0.782.107, where extension installations were not required to show a browser confirmation dialog. This weakness could allow a Trojan horse extension to modify the browser’s functionality without user consent. Affected software: Google Chrome (pre-1...

CVE-2011-3970

CVE-2011-3970 affects libxslt as used in Google Chrome prior to 17.0.963.46, enabling a remote attacker to cause a denial of service via an out-of-bounds read (vectors not specified in the entry). The issue has been addressed in downstream advisories and Chrome updates; Chrome/SUSE/Fedora advisor...

CVE-2013-6643

The CVE-2013-6643 issue affects Google Chrome prior to 32.0.1700.76 on Windows and 32.0.1700.77 on macOS/Linux. It stems from improper handling of the closing of an untrusted signin confirmation dialog in OneClickSigninBubbleView::WindowClosing, allowing an attacker to trigger a sync with an arbi...

CVE-2014-1731

CVE-2014-1731 affects Blink’s DOM implementation (HTMLSelectElement) in Google Chrome prior to 34.0.1847.131 on Windows/OS X and before 34.0.1847.132 on Linux. The vulnerability arises from insufficient renderer state checking during a focus event, enabling a remote attacker to trigger denial of ...

CVE-2017-15409

CVE-2017-15409 describes a heap buffer overflow in Skia used by Google Chrome prior to 63.0.3239.84. The vulnerability can allow a remote attacker to potentially exploit heap corruption through a specially crafted HTML page, as indicated by the description. The affected component is Skia within C...

CVE-2018-6100

CVE-2018-6100 : Google Chrome on macOS prior to 66.0.3359.117 is affected by an issue in the URL Formatter/Omnibox where confusable characters were mishandled, enabling domain spoofing via IDN homographs with a crafted domain name. Connected sources corroborate the CVE as a URL spoofing vulnerabi...

CVE-2022-2415

CVE-2022-2415 : The vulnerability is a heap buffer overflow in WebGL within Google Chrome before 103.0.5060.53. This allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. The provided documents identify Chrome/WebGL as the affected component and note a patch/ver...