CVE-2026-7333

CVE-2026-7333 describes a use-after-free in the GPU component of Google Chrome, leading to a potential sandbox escape via a crafted HTML page on Chromium-based browsers. Affected product: Google Chrome versions earlier than 147.0.7727.138. Root cause: use-after-free in GPU handling. Impact: remot...

CVE-2026-76022

A buffer overflow in the Network component of Google Chrome prior to 151.0.7922.173 allows a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. The vulnerability was reported by 0xAlessandro on 2026-08-07 and is rated High severity by Chromium (CVSS 8.8). The f...

CVE-2026-78896

CVE-2026-78896 is an information leak in the StorageAccessAPI of Google Chrome prior to 152.0.7977.65 . A remote attacker can obtain cross-origin data by serving a crafted HTML page to the victim, requiring user interaction but no prior authentication. Chromium rates the severity as Low ; CVSS 3....

CVE-2026-87491

CVE-2026-87491 is an out of bounds write vulnerability in V8 , the JavaScript engine used by Google Chrome . The flaw allows a remote attacker to execute arbitrary code inside the Chrome sandbox by delivering a crafted HTML page to the user. The issue is fixed in Chrome 153.0.8010.36 . The CNA-as...

CVE-2011-1185

Google Chrome (

CVE-2017-15423

CVE-2017-15423 affects Google Chrome’s BoringSSL SPAKE2 implementation prior to 63.0.3239.84, enabling a remote attacker to leak low-order bits of SHA512(password) by inspecting protocol traffic. The vulnerability is documented in CVE-2017-15423 and corroborated by CNVD-2018-20147 (Google Chrome ...

CVE-2017-5052

CVE-2017-5052 affects Google Chrome/Blink: an incorrect assumption about block structure can allow memory corruption via a crafted HTML page. Affected are Chrome on Mac/Windows/Linux up to 57.0.2987.133 and Android up to 57.0.2987.132. Exploitation may lead to arbitrary code or DoS; a malware pre...

CVE-2017-5091

CVE-2017-5091 is a use-after-free in Chromium’s IndexedDB, affecting Chromium

CVE-2019-5841

CVE-2019-5841 describes an out‑of‑bounds memory access in Google Chrome’s JavaScript engine prior to 75.0.3770.80, enabling a remote attacker to potentially trigger heap corruption via a crafted HTML page. The vulnerability affects Chrome’s JavaScript execution path and is documented with a CVSS ...

CVE-2021-4318

CVE-2021-4318 affects Blink in Google Chrome prior to 94.0.4606.54, where object corruption could be triggered by a crafted HTML page. The vulnerability is described as a remote issue with high severity (CVSS v3.1: 8.8, High) and impacts all three confidentiality, integrity, and availability. The...

CVE-2022-4923

CVE-2022-4923 describes an Inappropriate implementation in Omnibox of Google Chrome before 99.0.4844.51, enabling a privileged network-position attacker to perform a man-in-the-middle via malicious traffic. Affected component: Omnibox within Chrome/Chromium; underlying cause cited as improper Omn...

CVE-2026-11294

CVE-2026-11294 affects Google Chrome (Chromium-based) Passwords UI handling. The issue is described as an inappropriate implementation in Passwords that enables a remote attacker to perform UI spoofing via a crafted HTML page. The vulnerability is associated with versions prior to 149.0.7827.53, ...

CVE-2026-12025

CVE-2026-12025 affects Google Chrome and involves insufficient validation of untrusted input in the Network stack. A malicious actor who had already compromised the renderer process could exfiltrate cross-origin data via a crafted HTML page. The public write-up confirms the impact as data leakage...

CVE-2026-13282

CVE-2026-13282 concerns a use-after-free in the Payments component of Google Chrome on Android prior to version 149.0.7827.201 . The root cause is a heap corruption condition exposed by a local attacker with physical device access, as described in multiple sources. Affected software is Chrome on ...

CVE-2026-17684

CVE-2026-17684 involves Chrome for iOS prior to 151.0.7922.72, where insufficient validation of untrusted input in the renderer could enable a sandbox escape via a crafted HTML page. The issue arises from input handling within Chrome on iOS (renderer process) and is described as a high-severity, ...

CVE-2026-17739

CVE-2026-17739 describes insufficient policy enforcement in Google Chrome Extensions, allowing UXSS when a user installs a malicious extension. Affected software is Google Chrome (desktop/mobile) with the vulnerability present in versions before 151.0.7922.72. The underlying issue is insecure han...

CVE-2026-78946

An incorrect authorization vulnerability in the Select component of Google Chrome prior to version 152.0.7977.65 allowed a remote attacker to bypass the web origin policy via a crafted HTML page. Per Red Hat, this could lead to unauthorized access to sensitive information or actions across differ...

CVE-2011-1305

CVE-2011-1305 : A race condition in Google Chrome prior to 11.0.696.57 on Linux and macOS (linked-list race in database handling) could allow a remote attacker to cause a denial of service or other impact. Chrome 11.0.696.57 patches this issue (and related fixes). The CVSS 2.0 base score is 6.8 (...

CVE-2013-6643

The CVE-2013-6643 issue affects Google Chrome prior to 32.0.1700.76 on Windows and 32.0.1700.77 on macOS/Linux. It stems from improper handling of the closing of an untrusted signin confirmation dialog in OneClickSigninBubbleView::WindowClosing, allowing an attacker to trigger a sync with an arbi...

CVE-2017-15391

CVE-2017-15391 targets the Chromium/Chrome extensions component. The vulnerability arises from insufficient policy enforcement in extensions, allowing a remote attacker to bypass extension limitations and access Extension pages without authorization via a crafted HTML page. Multiple vendor adviso...

CVE-2017-5067

CVE-2017-5067 affects Google Chrome before 58.0.3029.81 on Linux/Windows/Mac. The root cause is an insufficient watchdog timer in navigation, enabling a crafted HTML page to spoof the Omnibox (URL bar). The practical impact is UI spoofing through the address bar, potentially deceiving users. The ...

CVE-2023-4860

CVE-2023-4860 affects Google Chrome (Skia) via an inappropriate Skia implementation in Chromium before 115.0.5790.98, allowing a remote attacker who has compromised the renderer process to potentially escape the sandbox by crafting an HTML page. The vulnerability is rooted in the Skia component a...

CVE-2024-9960

CVE-2024-9960 corresponds to a use-after-free in Dawn within Google Chrome/Chromium prior to version 130.0.6723.58, which can allow remote heap corruption via a crafted HTML page. Multiple connected sources confirm the flaw in Chromium’s Dawn component and reference the same fixed version 130.0.6...

CVE-2026-11174

CVE-2026-11174 describes an insecure Site Isolation implementation in Google Chrome/Chromium, allowing a remote attacker who has compromised the renderer process to bypass site isolation via a crafted HTML page. The issue stems from an inappropriate implementation in Site Isolation, and affects C...

CVE-2026-15776

CVE-2026-15776 affects Google Chrome/V8: an inappropriate implementation in V8 allowed remote code execution inside the sandbox via a crafted HTML page before Chrome 150.0.7871.125. The issue is addressed in the Chrome Stable Channel Update, which upgrades to 150.0.7871.125 (Windows/Mac) and 150....

CVE-2026-17994

CVE-2026-17994 : Affected product: Google Chrome on Android. Vulnerable component: Media handling in Chrome. Root cause: Inappropriate implementation allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Impact: Bypass of navigation restrictions (low severities note...

CVE-2011-1114

CVE-2011-1114 affects Google Chrome prior to 9.0.597.107, where improper handling of tables may lead to a stale node, enabling remote denial of service or potentially other unspecified impact via unknown vectors. No explicit exploitation details or remediation are provided in the connected docume...

CVE-2015-1241

Chromium/Google Chrome vulnerability CVE-2015-1241 (tap-jacking) arises from how page navigation interacts with touch and gesture handling, allowing a crafted site to trigger remote UI actions. Affected product: Chromium-based browsers (Chrome). Root cause: interaction between navigation and touc...

CVE-2017-15387

CVE-2017-15387 affects Chromium/Blink; before 62.0.3202.62 there was insufficient enforcement of Content Security Policy, allowing a remote attacker to open javascript: URLs via a crafted HTML page. Affected software is the Chromium browser (Blink engine) prior to 62.0.3202.62. Remediation is to ...

CVE-2017-15388

CVE-2017-15388 affects Chromium's Skia component; an out-of-bounds read on crafted HTML pages in Chromium versions earlier than 62.0.3202.62. The issue originates in Skia within the browser, enabling remote exploitation. Remediation: upgrade to Chromium 62.0.3202.62 or newer (as reflected by Debi...

CVE-2017-15409

CVE-2017-15409 describes a heap buffer overflow in Skia used by Google Chrome prior to 63.0.3239.84. The vulnerability can allow a remote attacker to potentially exploit heap corruption through a specially crafted HTML page, as indicated by the description. The affected component is Skia within C...

CVE-2017-5063

A numeric overflow in Skia within Google Chrome prior to 58.0.3029.81 for Linux/Windows/macOS and 58.0.3029.83 for Android allows a remote attacker to cause an out-of-bounds memory read via a crafted HTML page. Affected component: Skia in Chrome. Root cause: numeric overflow. Impact: memory read ...

CVE-2017-5073

CVE-2017-5073 is a vulnerability in the Chromium-based Google Chrome browser’s print preview feature (Blink). The issue is a use-after-free in print preview, affecting Chrome up to 59.0.3071.86 on Linux, Windows, and macOS, and 59.0.3071.92 on Android. The underlying fault is a memory-management ...

CVE-2017-5120

CVE-2017-5120 describes a downgrade of HTTPS during redirects in the Chromium/Chrome browser. Affected: Chromium/Chrome before 61.0.3163.79 on desktop (Mac/Windows/Linux) and 61.0.3163.81 on Android, with downstream advisories referencing Chromium builds. Root cause: a misdesign workaround for ww...

CVE-2021-4317

CVE-2021-4317 is a use-after-free in ANGLE within Google Chrome prior to 96.0.4664.93, enabling a remote attacker to perform arbitrary read/write via a crafted HTML page. The affected component is ANGLE in Chrome; root cause is a use-after-free vulnerability. The CVSS v3.1 base score is 8.8 (High...

CVE-2022-2415

CVE-2022-2415 : The vulnerability is a heap buffer overflow in WebGL within Google Chrome before 103.0.5060.53. This allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. The provided documents identify Chrome/WebGL as the affected component and note a patch/ver...

CVE-2022-2742

This CVE-2022-2742 describes a use-after-free in Exosphere affecting Google Chrome on Chrome OS and Lacros prior to 104.0.5112.79. The issue could allow a remote attacker, who lures a user into specific UI interactions, to potentially trigger heap corruption via crafted UI interactions. Evidence ...

CVE-2024-6989

CVE-2024-6989 is a use-after-free in the Loader path of Google Chrome/Chromium. The flaw could allow remote code execution via a crafted HTML page by triggering heap corruption. Affected software is Chromium/Chrome before version 127.6533.72; remediation is a patch released in Chromium updates (e...

CVE-2026-16805

CVE-2026-16805 is a use-after-free in Blink affecting Google Chrome prior to 150.0.7871.186, allowing a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The Chrome Stable Channel update mirrors this fix, upgrading to 150.0.7871.186 (Windows/Mac) or 150.0.7871....

CVE-2026-17750

CVE-2026-17750 describes a use-after-free in ANGLE used by Google Chrome, enabling a remote attacker to potentially escape the browser sandbox via a crafted HTML page. The vulnerability is tied to the ANGLE component within Chrome and is triggered in Chrome versions prior to 151.0.7922.72. The de...

CVE-2026-17758

CVE-2026-17758: Heap buffer overflow in Dawn component of Google Chrome. The vulnerability affects Chrome builds prior to 151.0.7922.72, enabling a remote attacker to potentially perform a sandbox escape through a crafted HTML page. This entry is supported by multiple sources in the connected doc...

CVE-2026-17817

CVE-2026-17817 concerns an inappropriate implementation in Chrome/Chromium’s ReportingAndNEL component that allowed a remote attacker to leak cross-origin data via a crafted HTML page. Affected are Google Chrome versions prior to 151.0.7922.72; the upstream fix is in 151.0.7922.72. Citations from...

CVE-2026-17901

CVE-2026-17901 affects Google Chrome on Android (Sharing component). The flaw is insufficient validation of untrusted input that could bypass navigation restrictions via malicious network traffic, previously fixed in Chrome update to 151.0.7922.72+. Downstream advisories (Red Hat, Debian, EU/OSV,...

CVE-2026-17956

CVE-2026-17956 details (NORMAL mode) : In Google Chrome, an inappropriate implementation in the Scheduling component allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Affected family: Chrome releases prior to 151.0.7922.72. The root cause is tied to th...

CVE-2026-19155

CVE-2026-19155 affects Google Chrome (Payments component) and is due to a use-after-free in Payments prior to Chrome 151.0.7922.109. An attacker who can compromise the renderer could potentially escape the sandbox via a crafted HTML page. The Chrome security update (151.0.7922.108/109 for Windows...

CVE-2026-76023

CVE-2026-76023 is an improper resource control vulnerability in Linux Toolkit Theming in Google Chrome prior to 151.0.7922.173 . An attacker who has already compromised the renderer process can leverage a crafted HTML page to execute arbitrary code outside the sandbox , escalating from a sandboxe...

CVE-2011-2358

CVE-2011-2358 concerns Google Chrome prior to 13.0.782.107, where extension installations were not required to show a browser confirmation dialog. This weakness could allow a Trojan horse extension to modify the browser’s functionality without user consent. Affected software: Google Chrome (pre-1...

CVE-2011-3078

CVE-2011-3078 is a use-after-free vulnerability in the handling of floated elements in Google Chrome/Chromium prior to version 18.0.1025.168. Exploitation could lead to a denial of service or potentially unspecified impact. Connected advisories confirm the issue as part of multiple Chrome/Chromiu...

CVE-2014-1731

CVE-2014-1731 affects Blink’s DOM implementation (HTMLSelectElement) in Google Chrome prior to 34.0.1847.131 on Windows/OS X and before 34.0.1847.132 on Linux. The vulnerability arises from insufficient renderer state checking during a focus event, enabling a remote attacker to trigger denial of ...

CVE-2014-3166

CVE-2014-3166 affects the SPDY information-leak in Google Chrome before 36.0.1985.143 (Windows/macOS/Linux) and before 36.0.1985.135 on Android. The published details in connected sources identify an information disclosure vulnerability in the SPDY protocol implementation that could allow a remot...