CVE-2022-3658

CVE-2022-3658 affects Google Chrome on Chrome OS, specifically the Feedback service. Description: Use-after-free in Feedback service can lead to heap corruption when a user installs a malicious extension via UI interaction. Impact: potential arbitrary code execution or system compromise as noted ...

CVE-2024-9960

CVE-2024-9960 corresponds to a use-after-free in Dawn within Google Chrome/Chromium prior to version 130.0.6723.58, which can allow remote heap corruption via a crafted HTML page. Multiple connected sources confirm the flaw in Chromium’s Dawn component and reference the same fixed version 130.0.6...

CVE-2026-17928

Summary: CVE-2026-17928 concerns an inappropriate implementation in the DataTransfer component of Google Chrome, allowing a remote attacker to leak cross-origin data through a crafted HTML page. The issue is rooted in Chromium’s DataTransfer handling (upstream reference: chromium issue 513762372)...

CVE-2010-1823

CVE-2010-1823 describes a use-after-free vulnerability in WebKit before r65958, exploited via parsing that triggers document API usage (e.g., document.close) and can cause a denial of service. Affected software includes WebKit and Google Chrome prior to 6.0.472.59; the issue is tied to a Cascadin...

CVE-2015-1290

CVE-2015-1290 affects the Google V8 JavaScript engine used by Chrome (pre-44.0.2403.89) and QtWebEngineCore in Qt (pre-5.5.1). The vulnerability allows remote attackers to cause memory corruption or execute arbitrary code via a crafted website, leading to denial of service or code execution. Affe...

CVE-2017-15389

CVE-2017-15389 is a URL-spoofing vulnerability in the Omnibox (URL bar) of Chromium/Google Chrome prior to 62.0.3202.62. The root cause is an insufficient watchdog timer in navigation, enabling a remote attacker to spoof the contents of the Omnibox via a crafted HTML page. Affected software inclu...

CVE-2017-5081

CVE-2017-5081 concerns a Chromium/Chrome extension verification bypass due to lack of validation of an extension’s locale folder. The issue permits a locally privileged attacker (local write access) to modify extension files, bypassing extension verification and potentially manipulating extension...

CVE-2022-3863

CVE-2022-3863 affects Google Chrome on desktop versions prior to 100.0.4896.75. The vulnerability is a Use-after-free in Browser History that can lead to heap corruption when processing a crafted HTML page, enabling a remote attacker to trigger abnormal memory behavior. The reported impact is a h...

CVE-2022-4921

CVE-2022-4921 is a use-after-free in Google Chrome’s Accessibility implementation (Chromium) prior to 99.0.4844.51. The flaw allows a remote attacker to cause arbitrary read/write via a crafted HTML page when a user is convinced to perform specific UI gestures. Root cause is a use-after-free in A...

CVE-2022-4926

Technical details about CVE-2022-4926 are not publicly available in the provided documents; monitor for updates.

CVE-2026-10018

This CVE concerns an integer overflow in the ANGLE component of the Chromium-based Google Chrome browser. Affected versions are before 148.0.7778.216 . The issue could allow a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. The knowledge ba...

CVE-2026-15129

CVE-2026-15129 describes a Use-After-Free in Chrome’s Views component (Chromium) prior to version 150.0.7871.115. A crafted HTML page can trigger heap corruption, enabling a remote attacker to potentially exploit the vulnerability. Affected software: Google Chrome on desktop (Windows, macOS, Linu...

CVE-2026-17670

CVE-2026-17670: In Google Chrome, a Use-after-Free in the Views subsystem could allow a remote attacker, after compromising the renderer process, to potentially escape the sandbox via a crafted HTML page. The issue affects Chrome prior to version 151.0.7922.72.icio The root cause is tied to impro...

CVE-2026-17733

In Chrome on Android, CVE-2026-17733 is tied to an inappropriate QUIC implementation that could allow a remote attacker to leak cross-origin data via a crafted HTML page. Affected product/component: Google Chrome (Android) with QUIC; root cause: insecure QUIC handling leading to cross-origin data...

CVE-2026-17875

CVE-2026-17875 is a use-after-free in PDFium used by Google Chrome (desktop) prior to 151.0.7922.72. The vulnerability allows a remote attacker to execute arbitrary code inside the Chrome sandbox via a crafted PDF file. The description and connected sources confirm the underlying issue as a PDFiu...

CVE-2026-7333

CVE-2026-7333 describes a use-after-free in the GPU component of Google Chrome, leading to a potential sandbox escape via a crafted HTML page on Chromium-based browsers. Affected product: Google Chrome versions earlier than 147.0.7727.138. Root cause: use-after-free in GPU handling. Impact: remot...

CVE-2011-1185

Google Chrome (

CVE-2014-3166

CVE-2014-3166 affects the SPDY information-leak in Google Chrome before 36.0.1985.143 (Windows/macOS/Linux) and before 36.0.1985.135 on Android. The published details in connected sources identify an information disclosure vulnerability in the SPDY protocol implementation that could allow a remot...

CVE-2015-1211

CVE-2015-1211 affects Google Chrome prior to 40.0.2214.111 on Windows/macOS/Linux (and prior to 40.0.2214.109 on Android). The OriginCanAccessServiceWorkers function in content/browser/service_worker/service_worker_dispatcher_host.cc did not properly restrict the URI scheme during ServiceWorker r...

CVE-2017-5120

CVE-2017-5120 describes a downgrade of HTTPS during redirects in the Chromium/Chrome browser. Affected: Chromium/Chrome before 61.0.3163.79 on desktop (Mac/Windows/Linux) and 61.0.3163.81 on Android, with downstream advisories referencing Chromium builds. Root cause: a misdesign workaround for ww...

CVE-2022-3444

CVE-2022-3444 : Insufficient data validation in Chrome’s File System API allows remote bypass of file system restrictions via a crafted HTML page and malicious file. Affected: Google Chrome pre-106.0.5249.62 (Chromium engine). Impact: bypass of File System restrictions (privacy/mi) with no confid...

CVE-2022-4911

CVE-2022-4911 : A vulnerability in Google Chrome’s DevTools involves insufficient data validation, allowing a remote attacker to bypass the Content Security Policy via a crafted HTML page. Affected product: Google Chrome (DevTools component); affected versions are prior to 106.0.5249.62. Underlyi...

CVE-2022-4922

CVE-2022-4922 affects Google Chrome (Blink) prior to 99.0.4844.51. Description: In Blink, an inappropriate implementation allowed a remote attacker to spoof the UI via a crafted HTML page, with CVSS:3.1 base score 6.5 (UI: REQUIRED, C:I=HIGH). The connected documents confirm the same description ...

CVE-2024-7005

CVE-2024-7005 concerns Google Chrome/Chromium where insufficient validation of untrusted input in Safe Browsing allowed a remote attacker to bypass discretionary access control by convincing a user to perform specific UI gestures with a malicious file. The vulnerability affects Chrome/Chromium pr...

CVE-2026-13038

Use-after-free in Chrome’s Autofill on Windows exploited via a crafted HTML page could allow remote code execution. Affected versions are Chrome on Windows before 149.0.7827.197. If exploiting, attacker could take arbitrary code execution; impact is severe (CVE-2026-13038). The cited sources indi...

CVE-2026-14092

CVE-2026-14092 affects Google Chrome (Chromium-based privacy policy enforcement). It describes insufficient policy enforcement in Privacy in Chrome prior to 150.0.7871.47, enabling an attacker in a privileged network position to leak cross-origin data via malicious network traffic. The CVSS base ...

CVE-2026-17694

CVE-2026-17694: Use-after-free in the DOM of Google Chrome before 151.0.7922.72 allows remote code execution inside the sandbox via a crafted HTML page. Affected software: Google Chrome (desktop). Root cause: use-after-free in DOM handling. Impact: arbitrary code execution in sandboxed context wi...

CVE-2026-17695

CVE-2026-17695 (ANGLE in Google Chrome on macOS) involves an inappropriate ANGLE implementation that allowed a remote attacker to potentially escape Chrome’s sandbox via a crafted HTML page. Affected software is Google Chrome on macOS with ANGLE prior to version 151.0.7922.72. The issue is descri...

CVE-2026-17719

CVE-2026-17719 is a Use-after-free in Chrome’s Input handling (Chromium) affecting Google Chrome prior to 151.0.7922.72. The vulnerability allows a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page. The confirmed impact is remote code execution with high...

CVE-2026-17984

CVE-2026-17984 affects Google Chrome on Android (before 151.0.7922.72). The issue is an inappropriate implementation that allows a local attacker to leak cross-origin data via a crafted HTML page. CVSS shows Low impact (C/L, I/N, A/N) with local access and user interaction required. Remediation i...

CVE-2011-3880

CVE-2011-3880 affects Google Chrome (and Chromium in related advisories) by not preventing use of an unspecified special character as a delimiter in HTTP headers. The initial entry notes unknown impact and remote attack vectors. OpenVAS/Gentoo GLSA entries corroborate the vulnerability family acr...

CVE-2012-1521

CVE-2012-1521: A use-after-free in the XML parser affected Google Chrome prior to 18.0.1025.168, enabling remote denial of service or other impact via unknown vectors. The vulnerability is addressed by the Chrome update to 18.0.1025.168 or newer.

CVE-2017-5118

CVE-2017-5118 describes a CSP bypass in Blink used by Google Chrome (Mac/Win/Linux) and Chromium builds, where CSP restrictions were not correctly propagated to javascript: scheme pages. The underlying issue allowed a remote attacker to bypass the Content Security Policy via a crafted HTML page. ...

CVE-2018-20072

CVE-2018-20072 affects Google Chrome/Chromium (PDF handling) via insufficient data validation in the PDF parser, enabling out-of-bounds memory access when processing a crafted PDF file. The issue is tied to Chromium-based builds prior to 73.0.3683.75. Associated references in the connected docume...

CVE-2022-3318

CVE-2022-3318 is a use-after-free in ChromeOS Notifications affecting Google Chrome on ChromeOS prior to 106.0.5249.62. Exploitation would require user interaction (a reboot lure) and could enable heap corruption via UI. Remediation: update to Chrome/Chromium 106.0.5249.61 or later (as reflected ...

CVE-2022-3659

CVE-2022-3659 refers to a use-after-free vulnerability in Chrome OS Accessibility in Google Chrome, prior to version 107.0.5304.62, allowing a remote attacker to potentially trigger heap corruption via specific UI interactions. Connected sources confirm the issue is categorized as a Chrome/Chromi...

CVE-2022-4924

CVE-2022-4924 is a use-after-free in WebRTC in Google Chrome, prior to 97.0.4692.71. The renderer must be compromised to potentially escape the sandbox via a crafted HTML page. Affected product: Google Chrome before 97.0.4692.71. Root cause: use-after-free in WebRTC. Impact stated: high/critical,...

CVE-2023-2457

The CVE-2023-2457 issue is an out-of-bounds/write condition in the ChromeOS Audio Server on ChromeOS, linked to heap corruption via a crafted audio file. Affected product: ChromeOS Audio Server within Google Chrome on ChromeOS, with the vulnerability described as present in versions prior to 113....

CVE-2024-9961

CVE-2024-9961 corresponds to a Use after Free in ParcelTracking in Google Chrome on iOS prior to 130.0.6723.58, potentially enabling heap corruption through a crafted HTML page after a user interaction. Public advisories and Debian security trackers confirm that this family of Chromium/Chrome CVE...

CVE-2010-2302

CVE-2010-2302 is a use-after-free in WebKit’s WebCore affecting Google Chrome prior to 5.0.375.70. The flaw involves remote fonts used with shadow DOM trees and can cause memory corruption, leading to a denial of service or potential arbitrary code execution. Affected component: WebKit/WebCore in...

CVE-2011-3640

CVE-2011-3640 describes an untrusted search path vulnerability in Mozilla Network Security Services (NSS) as used in Google Chrome

CVE-2017-15427

CVE-2017-15427 is a Chrome Omnibox cross-site scripting vulnerability reported as: insufficient policy enforcement in Omnibox allowed a user to XSS themselves by dragging and dropping a javascript: URL into the URL bar, affecting Chrome versions before 63.0.3239.84. Connected sources confirm the ...

CVE-2017-5078

CVE-2017-5078 is listed in Arch Linux ASA-201707-4 as a vulnerability in qt5-webengine (Chromium-based) before 5.9.1-1, described as an arbitrary command execution via a possible command injection in the mailto handling component of the Chromium browser. The advisory indicates multiple issues in ...

CVE-2017-5096

CVE-2017-5096 affects Google Chrome for Android. The issue is described as insufficient policy enforcement during navigation between schemes, enabling a remote attacker to cause a cross-origin content download via a crafted HTML page and is associated with Android intents. The Chrome 60 release (...

CVE-2018-6128

CVE-2018-6128 concerns the WebKit component in Google Chrome on iOS. The issue arises from incorrect URL parsing, which could allow a remote attacker to perform domain spoofing via a crafted HTML page. Affected software is Chrome on iOS with WebKit parsing behavior before version 67.0.3396.62. Th...

CVE-2024-9955

CVE-2024-9955 affects Google Chrome/Chromium’s WebAuthentication in all builds prior to 130.0.6723.58. The vulnerability is a use-after-free that could enable a remote attacker to cause heap corruption via a crafted HTML page. Public advisories indicate that fixed versions exist (e.g., Chromium 1...

CVE-2025-13224

CVE-2025-13224 is a Type Confusion in V8 affecting Google Chrome prior to 142.0.7444.175, leading to potential heap corruption via a crafted HTML page. The issue affects Chrome’s V8 and was addressed in the 142.0.7444.175+ stable channel releases (Windows/macOS/Linux). Debian/Alpine security advi...

CVE-2026-14382

CVE-2026-14382 affects Chrome’s ANGLE component. The issue is insufficient validation of untrusted input in ANGLE, enabling a remote sandbox-escape via a crafted HTML page. Product/versions: Google Chrome prior to 150.0.7871.46. Impact: sandbox escape potential with high severity (per Chromium ad...

CVE-2026-15110

The CVE-2026-15110 entry concerns Google Chrome: a use-after-free in the Extensions component that can lead to heap corruption. Affected software is Chrome prior to version 150.0.7871.115; the underlying cause is use-after-free within the Extensions handling, exploitable when a user is convinced ...

CVE-2026-17731

The CVE-2026-17731 entry describes an Inappropriate implementation in Autofill in Google Chrome on Android, prior to version 151.0.7922.72, that allowed a remote attacker to leak cross-origin data via a crafted HTML page. The underlying issue is the Autofill implementation, with a security impact...