CVE-2024-3839

CVE-2024-3839 describes an out-of-bounds read in Fonts in Google Chrome/Chromium, allowing a remote attacker to potentialy read sensitive data from process memory via a crafted HTML page. Connected sources corroborate the issue across Chromium-based products (Astra Linux, Debian chromium security...

CVE-2024-4950

CVE-2024-4950 pertains to Chromium/Google Chrome prior to 125.0.6422.60, where an inappropriate implementation in Downloads could let a remote attacker lure a user into specific UI gestures to spoof UI via a crafted HTML page. Affected products are Chrome/Chromium browsers; the underlying issue i...

CVE-2019-13750

CVE-2019-13750 affects Google Chrome (Chromium) where the SQLite component used by Chrome allowed insufficient data validation, enabling a remote attacker to bypass defense-in-depth via a crafted HTML page. Affected product: Chrome/Chromium with the SQLite library integrated; root cause: data val...

CVE-2024-6772

CVE-2024-6772 affects Google Chrome/Chromium and is tied to the V8 engine. A crafted HTML page can trigger an out-of-bounds memory access, allowing a remote attacker to potentially achieve arbitrary behavior. Affected versions are Chrome/Chromium before 126.0.6478.182. Public docs in Debian/FreeB...

CVE-2024-5846

CVE-2024-5846 is a documented use-after-free in PDFium used by Google Chrome, leading to potential heap corruption via a crafted PDF file. Affected software is Google Chrome (PDFium component) prior to Chrome 126.0.6478.54. The Chrome security update (Stable Channel) 126.x includes fixes for this...

CVE-2023-4430

CVE-2023-4430 is a use-after-free in Vulkan within Google Chrome/Chromium prior to 116.0.5845.110, enabling remote heap corruption via a crafted HTML page. Affected: Chrome/Chromium; root cause: use-after-free in Vulkan handling. Impact: high (remote code execution risk, heap corruption). Remedia...

CVE-2024-4331

CVE-2024-4331 affects Chromium-based browsers (Google Chrome/Chromium) with use-after-free in Picture-in-Picture prior to 124.0.6367.118. The vulnerability could allow a remote attacker to induce heap corruption via a crafted HTML page, with high impact across confidentiality, integrity, and avai...

CVE-2022-2603

The CVE-2022-2603 entry describes a use-after-free in Chrome/Chromium’s Omnibox that could allow a remote attacker to trigger heap corruption via a crafted HTML page. Affected software is Google Chrome/Chromium (prior to version 104.0.5112.79). The vulnerability’s impact is described as possible ...

CVE-2024-5493

CVE-2024-5493 describes a heap buffer overflow in WebRTC within Google Chrome/Chromium before version 125.0.6422.141. The issue allows a remote attacker to potentially corrupt the heap via a crafted HTML page, with high-severity impact. Public advisories across multiple vendors corroborate this C...

CVE-2024-3841

Google Chrome versions prior to 124.0.6367.60 are vulnerable to a medium-severity security issue (CWE-20, CWE-79) caused by insufficient data validation in the Browser Switcher component. A remote attacker can exploit this flaw to inject scripts or HTML into a privileged page by providing a malic...

CVE-2025-0436

An integer overflow in the Skia graphics library within Google Chrome (prior to version 132.0.6834.83) allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability is rated as High severity by Chromium. Affected systems include versions of webkit2gtk...

CVE-2024-4060

A use after free vulnerability exists in Dawn within Google Chrome versions prior to 124.0.6367.78 . This flaw allows a remote attacker to potentially trigger heap corruption by navigating to a crafted HTML page . The vulnerability is classified with a High security severity. No specific exploit ...

CVE-2024-5831

CVE-2024-5831 is a use-after-free in Dawn affecting Google Chrome/Chromium prior to 126.0.6478.54, which could enable remote heap corruption via a crafted HTML page. Connected advisories confirm the issue in Chrome’s Dawn component with high impact (C/H/I/A = 8.8) and note that fixes were release...

CVE-2024-5160

CVE-2024-5160 describes a heap buffer overflow in Chrome’s Dawn (Chromium/Dawn) prior to 125.0.6422.76, allowing a remote attacker to cause an out-of-bounds write via a crafted HTML page. The CVSS vector indicates network access with low attack complexity and user interaction required, resulting ...

CVE-2023-4069

CVE-2023-4069 is a Type Confusion in V8 affecting Google Chrome prior to 115.0.5790.170. The vulnerability could allow a remote attacker to potentially trigger heap corruption via a crafted HTML page. Connected sources indicate Chrome/Chromium updates addressing this class of issue (e.g., the 115...

CVE-2024-10827

CVE-2024-10827 affects Chromium/Google Chrome prior to version 130.0.6723.116. The issue is a use-after-free in Serial, enabling remote heap corruption via a crafted HTML page. The vulnerability is rated High severity (CVSS v3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Public advisories confirm a f...

CVE-2024-3840

CVE-2024-3840 affects Google Chrome/Chromium where insufficient policy enforcement in Site Isolation could allow a remote attacker to bypass navigation restrictions via a crafted HTML page. The issue is mitigated in Chrome/Chromium 124.0.6367.60 (and newer); Debian security advisory lists 124.0.6...

CVE-2025-0438

A stack buffer overflow vulnerability exists in the Tracing component of Google Chrome and Microsoft Edge browsers prior to version 132.0.6834.83. This flaw allows a remote attacker to potentially exploit stack corruption by serving a crafted HTML page . According to the provided documents, this ...

CVE-2024-4948

A use after free vulnerability exists in the Dawn component of Google Chrome prior to version 125.0.6422.60 . This flaw is caused by memory usage after it has been freed, which could allow a remote attacker to exploit heap corruption via a specially crafted HTML page. The impact may include unaut...

CVE-2021-30513

CVE-2021-30513 corresponds to a type confusion in V8 of the Chromium browser (pre-90.0.4430.212). The issue affects Chromium/Chrome’s V8 engine and is described as a type confusion vulnerability in the JavaScript engine, potentially enabling heap-related corruption via crafted HTML pages. Connect...

CVE-2023-2937

CVE-2023-2937 is an issue in Google Chrome’s Picture-in-Picture (PiP) component where an insecure PiP implementation in Chrome/Chromium allowed a remote attacker with a compromised renderer to spoof the Omnibox (URL bar) via a crafted HTML page. The vulnerability is described as an Inappropriate ...

CVE-2010-1205

CVE-2010-1205 is a buffer overflow in libpng (pngpread.c) that could allow remote code execution via a crafted PNG image. Affected libpng versions are prior to 1.2.44 and prior to 1.4.3. The overflow is tied to the internal copy in pngpread.c and is described across advisories mentioning memory c...

CVE-2024-5159

CVE-2024-5159 is a heap buffer overflow in ANGLE within Google Chrome (and Chromium-based products) prior to 125.0.6422.76. The vulnerability allows a remote attacker to cause an out-of-bounds memory read via a crafted HTML page. Affected component: ANGLE (graphics/shader translation layer) used ...

CVE-2024-5498

CVE-2024-5498 : The connected sources confirm a use-after-free in the Presentation API of Google Chrome/Chromium before version 125.0.6422.141, allowing a remote attacker to potentially exploit heap corruption via a crafted HTML page. Affected product: Google Chrome/Chromium browsers. Root cause:...

CVE-2026-7340

Google Chrome on Windows is vulnerable to an integer overflow in the ANGLE component. This flaw allows a remote attacker to perform an out-of-bounds memory read by viewing a crafted HTML page. The issue is present in versions prior to 147.0.7727.138 . Remediation is available in version 147.0.772...

CVE-2024-5494

CVE-2024-5494 is a vulnerability described as a “Use after free in Dawn” in Google Chrome before 125.0.6422.141, which could enable a remote attacker to trigger heap corruption via a crafted HTML page. The connected documents confirm affected software is Chrome’s Dawn component with the underlyin...

CVE-2024-6102

CVE-2024-6102 affects Google Chrome/Chromium Dawn: an out-of-bounds memory access in Dawn could enable heap corruption via a crafted HTML page. The principal affected component is Dawn within Chrome/Chromium (tracked under Chrome’s 126.0.6478.114 stable release). The known remediation is upgradin...

CVE-2024-12695

This CVE affects Google Chrome/Chromium’s V8 engine. Out-of-bounds write in V8 allows remote code execution inside the sandbox via a crafted HTML page. Affects Chrome versions prior to 131.0.6778.204. Remediation: upgrade to 131.0.6778.204 or later (Debian: 131.0.6778.204-1~deb12u1). Exploitation...

CVE-2025-0447

Google Chrome versions prior to 132.0.6834.83 are vulnerable to a privilege escalation flaw in the Navigation component. This issue stems from an inappropriate implementation that allows a remote attacker to execute the escalation via a crafted HTML page . While the Chromium security severity is ...

CVE-2021-30588

The CVE-2021-30588 entry maps to a Chrome/Chromium V8 issue, where a type confusion in V8 prior to 92.0.4515.107 could allow a remote attacker to trigger heap corruption via a crafted HTML page, potentially enabling arbitrary code execution or content spoofing. Connected advisories corroborate th...

CVE-2025-0437

**CVE-2025-0437 is a Chrome/Chromium security issue describing an out-of-bounds read in Metrics that could enable remote heap corruption via a crafted HTML page. Affected product stack is Google Chrome (Chromium Metrics); impact is high with network access and user interaction required. Public fi...

CVE-2025-0440

An inappropriate implementation in Fullscreen within Google Chrome on Windows (versions prior to 132.0.6834.83 ) allows a remote attacker to perform UI spoofing via a crafted HTML page. The vulnerability is categorized as having Medium security severity. While specific exploit details are not pro...

CVE-2018-18335

CVE-2018-18335 is a heap/buffer overflow in the Skia component of Chromium/Google Chrome before 71.0.3578.80, exploitable via a crafted HTML page to achieve remote code execution or heap corruption. The linked advisories confirm this CVE as part of a set affecting Chromium/Chromium-based products...

CVE-2024-12693

CVE-2024-12693 is a Chrome/Chromium vulnerability in V8: out-of-bounds memory access that could allow remote code execution via a crafted HTML page. It affects Chrome before 131.0.6778.204 and was addressed in the Stable Channel update (131.0.6778.204/205). Affected software is the Chromium-based...

CVE-2026-76042

Google Chrome versions prior to 151.0.7922.169 are vulnerable to a memory disclosure issue caused by the use of uninitialized resources in the GPU . A remote attacker who has already compromised the renderer process can exploit this by using a crafted HTML page to read memory outside the sandbox ...

CVE-2024-11117

CVE-2024-11117 involves an inappropriate FileSystem implementation in Google Chrome/Chromium before version 131.0.6778.69, allowing a remote attacker to bypass filesystem restrictions via a crafted HTML page. The vulnerability is reported with a Low severity and a network attack vector with user ...

CVE-2024-3844

Summary: CVE-2024-3844 corresponds to an incomplete/incorrect implementation in Chrome/Chromium extensions that enables UI spoofing via a crafted extension. The connected documents corroborate a Chromium-based vulnerability with the same description, affecting Chrome/Chromium releases prior to th...

CVE-2024-5495

CVE-2024-5495 affects Google Chrome/Chromium Dawn code, with a use-after-free vulnerability that can lead to heap corruption via a crafted HTML page on pre-125.0.6422.141 versions. The connected sources corroborate the issue across multiple advisories (CVE listing, CNVD/CNNVD, Debian/Fedora updat...

CVE-2023-5487

CVE-2023-5487 affects Google Chrome/Chromium’s Fullscreen implementation prior to 118.0.5993.70. An attacker could exploit a crafted Chrome Extension to bypass navigation restrictions by convincing a user to install the malicious extension. Severity is Medium; impact involves bypassing navigation...

CVE-2024-6103

CVE-2024-6103 is a concrete Chrome/Chromium vulnerability in Dawn: a use-after-free that could lead to heap corruption via a crafted HTML page. The connected sources confirm the issue resides in Dawn within Chromium, with the Chrome security release noting Dawn-related fixes and the Stable Channe...

CVE-2025-0441

An inappropriate implementation in the Fenced Frames privacy feature of Google Chrome prior to version 132.0.6834.83 allows a remote attacker to obtain potentially sensitive information from the system. This vulnerability is triggered via a crafted HTML page , resulting in a Medium security sever...

CVE-2024-6779

CVE-2024-6779 : Out-of-bounds memory access in the V8 component of Google Chrome prior to 126.0.6478.182 may allow a remote attacker to potentially escape the sandbox via a crafted HTML page. Multiple connected sources confirm the issue exists in Chromium/Chrome up to the 126.0.6478.182 update an...

CVE-2023-4078

The CVE-2023-4078 entry concerns Google Chrome/Chromium extensions. Insecure/crafted Extension handling before 115.0.5790.170 allowed an attacker to persuade a user to install a malicious extension, enabling script/HTML injection into a privileged page via the Extension. Impact is high (arising f...

CVE-2024-11116

CVE-2024-11116 affects Google Chrome (Blink) prior to version 131.0.6778.69. The issue arises from an inappropriate implementation in Blink that allows a remote attacker to induce UI spoofing via a crafted HTML page when a user is guided to perform specific UI gestures. Exploitation details or in...

CVE-2023-4076

CVE-2023-4076 is a use-after-free in WebRTC in Google Chrome/Chromium, leading to potential heap corruption. Public details in connected sources confirm the vulnerability affects Chrome/Chromium prior to version 115.0.5790.170, with the Debian/FreeBSD/Fedora advisories noting fixes in 115.0.5790....

CVE-2023-5483

CVE-2023-5483 affects Google Chrome/Chromium: Insecure implementation in Intents allows a remote attacker to bypass content security policy via a crafted HTML page. Impact is limited to CSP bypass (as described in the connected advisories); no exploitation details are provided beyond the bypass p...

CVE-2024-11111

CVE-2024-11111 affects Google Chrome/Chromium through an Inappropriate implementation in Autofill that enables UI spoofing via a crafted HTML page. The vulnerability requires user interaction (UI gestures) and could enable a remote attacker to spoof UI. Affected component: Autofill in Chrome/Chro...

CVE-2026-19137

A use-after-free vulnerability exists in WebGL within Google Chrome on Android (prior to version 151.0.7922.109 ) and Chromium . A remote attacker who has already compromised the renderer process can exploit this flaw via a crafted HTML page to potentially achieve a sandbox escape . The Chromium ...

CVE-2024-10488

CVE-2024-10488 describes a use-after-free in WebRTC within Google Chrome, exploitable via a crafted HTML page to trigger heap corruption. Affected: Google Chrome (Chromium-based) before version 130.0.6723.92. Impact: potential remote code execution or corruption with high severity; exploitation r...

CVE-2024-3843

The CVE-2024-3843 entry concerns Google Chrome/Chromium where insufficient data validation in Downloads allows a remote attacker to perform UI spoofing via a crafted HTML page. The connected documents corroborate that Chromium-based Chrome is affected and that the vulnerability enables a UI spoof...