CVE-2026-19143

CVE-2026-19143 affects Google Chrome on Android WebAPKs, with insufficient validation of untrusted input in WebAPKs leading to potential local sandbox escape via a malicious file. The vulnerability is associated with a high severity (CVSS v3.1 base score 8.6) and is tied to Chrome versions prior ...

CVE-2026-78946

An incorrect authorization vulnerability in the Select component of Google Chrome prior to version 152.0.7977.65 allowed a remote attacker to bypass the web origin policy via a crafted HTML page. Per Red Hat, this could lead to unauthorized access to sensitive information or actions across differ...

CVE-2026-79181

An observable discrepancy in Glic within Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. The flaw requires user interaction and has a high attack complexity , reflected in the CVSS 3.1 base score of 5.3 (Medium) with no impac...

CVE-2010-1823

CVE-2010-1823 describes a use-after-free vulnerability in WebKit before r65958, exploited via parsing that triggers document API usage (e.g., document.close) and can cause a denial of service. Affected software includes WebKit and Google Chrome prior to 6.0.472.59; the issue is tied to a Cascadin...

CVE-2011-3046

CVE-2011-3046 affects Google Chrome’s extension subsystem prior to 17.0.963.78, where history navigation handling enables a Universal XSS (UXSS) that could allow remote code execution. Connected sources corroborate the vulnerability in Chrome/Chromium (UXSS and bad history navigation) and note pa...

CVE-2017-15409

CVE-2017-15409 describes a heap buffer overflow in Skia used by Google Chrome prior to 63.0.3239.84. The vulnerability can allow a remote attacker to potentially exploit heap corruption through a specially crafted HTML page, as indicated by the description. The affected component is Skia within C...

CVE-2017-5066

CVE-2017-5066 : Google Chrome (Mac/Windows/Linux) affected up to 58.0.3029.81 and Android up to 58.0.3029.83. The root cause is insufficient consistency checks in the networking stack’s signature handling, allowing a remote attacker to incorrectly accept a badly formed X.509 certificate via a cra...

CVE-2017-5131

CVE-2017-5131 is an out-of-bounds write in the Skia component of Chromium/Google Chrome (pre-62.0.3202.62). The vulnerability was used to enable potential remote code execution in the browser via a crafted page. Mitigation: upgrade to Chromium/Chrome version 62.0.3202.62 or newer (Debian Arch Gen...

CVE-2021-4317

CVE-2021-4317 is a use-after-free in ANGLE within Google Chrome prior to 96.0.4664.93, enabling a remote attacker to perform arbitrary read/write via a crafted HTML page. The affected component is ANGLE in Chrome; root cause is a use-after-free vulnerability. The CVSS v3.1 base score is 8.8 (High...

CVE-2022-3842

CVE-2022-3842 refers to a use-after-free in the Passwords component of Google Chrome on Chromium-based engines, with the underlying issue described as heap corruption. The publicly documented impact states that a remote attacker who has compromised the renderer process could potentially exploit t...

CVE-2023-4860

CVE-2023-4860 affects Google Chrome (Skia) via an inappropriate Skia implementation in Chromium before 115.0.5790.98, allowing a remote attacker who has compromised the renderer process to potentially escape the sandbox by crafting an HTML page. The vulnerability is rooted in the Skia component a...

CVE-2025-13224

CVE-2025-13224 is a Type Confusion in V8 affecting Google Chrome prior to 142.0.7444.175, leading to potential heap corruption via a crafted HTML page. The issue affects Chrome’s V8 and was addressed in the 142.0.7444.175+ stable channel releases (Windows/macOS/Linux). Debian/Alpine security advi...

CVE-2026-16805

CVE-2026-16805 is a use-after-free in Blink affecting Google Chrome prior to 150.0.7871.186, allowing a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The Chrome Stable Channel update mirrors this fix, upgrading to 150.0.7871.186 (Windows/Mac) or 150.0.7871....

CVE-2026-17686

CVE-2026-17686 : In Google Chrome, insufficient validation of untrusted input in Passwords (Chromium-based) before version 151.0.7922.72 allowed a renderer-compromised, remote attacker to bypass site isolation via a crafted HTML page. This vulnerability is rated High (CVSS v3.1 base score 8.1) an...

CVE-2026-17712

CVE-2026-17712 refers to a race condition in the Skia graphics library used by the Chromium-based Google Chrome browser. The upstream flaw allows a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page, with the impact described as high severity. Affected pr...

CVE-2026-17758

CVE-2026-17758: Heap buffer overflow in Dawn component of Google Chrome. The vulnerability affects Chrome builds prior to 151.0.7922.72, enabling a remote attacker to potentially perform a sandbox escape through a crafted HTML page. This entry is supported by multiple sources in the connected doc...

CVE-2026-17860

CVE-2026-17860 corresponds to an insufficient validation of untrusted input in the Mobile component of Google Chrome on Android. A local attacker could spoof the Omnibox (URL bar) by leveraging a malicious file, with impact described as: bypassing input validation in Chromium/Chrome Mobile prior ...

CVE-2026-17901

CVE-2026-17901 affects Google Chrome on Android (Sharing component). The flaw is insufficient validation of untrusted input that could bypass navigation restrictions via malicious network traffic, previously fixed in Chrome update to 151.0.7922.72+. Downstream advisories (Red Hat, Debian, EU/OSV,...

CVE-2026-17956

CVE-2026-17956 details (NORMAL mode) : In Google Chrome, an inappropriate implementation in the Scheduling component allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Affected family: Chrome releases prior to 151.0.7922.72. The root cause is tied to th...

CVE-2026-17984

CVE-2026-17984 affects Google Chrome on Android (before 151.0.7922.72). The issue is an inappropriate implementation that allows a local attacker to leak cross-origin data via a crafted HTML page. CVSS shows Low impact (C/L, I/N, A/N) with local access and user interaction required. Remediation i...

CVE-2026-17994

CVE-2026-17994 : Affected product: Google Chrome on Android. Vulnerable component: Media handling in Chrome. Root cause: Inappropriate implementation allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Impact: Bypass of navigation restrictions (low severities note...

CVE-2026-78896

CVE-2026-78896 is an information leak in the StorageAccessAPI of Google Chrome prior to 152.0.7977.65 . A remote attacker can obtain cross-origin data by serving a crafted HTML page to the victim, requiring user interaction but no prior authentication. Chromium rates the severity as Low ; CVSS 3....

CVE-2014-1731

CVE-2014-1731 affects Blink’s DOM implementation (HTMLSelectElement) in Google Chrome prior to 34.0.1847.131 on Windows/OS X and before 34.0.1847.132 on Linux. The vulnerability arises from insufficient renderer state checking during a focus event, enabling a remote attacker to trigger denial of ...

CVE-2014-3166

CVE-2014-3166 affects the SPDY information-leak in Google Chrome before 36.0.1985.143 (Windows/macOS/Linux) and before 36.0.1985.135 on Android. The published details in connected sources identify an information disclosure vulnerability in the SPDY protocol implementation that could allow a remot...

CVE-2016-5194

CVE-2016-5194 is listed among multiple Chromium/Chromium-derivative vulnerabilities (Google Chrome) with no public technical details provided in the initial description. Debian and Debian-based advisories (DSA-3731-1) associate CVE-2016-5194 with chromium-browser and indicate remediation in Jessi...

CVE-2017-5081

CVE-2017-5081 concerns a Chromium/Chrome extension verification bypass due to lack of validation of an extension’s locale folder. The issue permits a locally privileged attacker (local write access) to modify extension files, bypassing extension verification and potentially manipulating extension...

CVE-2022-3312

CVE-2022-3312 affects Google Chrome on ChromeOS, where VPN input handling had insufficient validation of untrusted input before version 106.0.5249.62. The underlying issue is in VPN-related code, enabling a local attacker with physical access to bypass managed device restrictions. The evidence co...

CVE-2022-3658

CVE-2022-3658 affects Google Chrome on Chrome OS, specifically the Feedback service. Description: Use-after-free in Feedback service can lead to heap corruption when a user installs a malicious extension via UI interaction. Impact: potential arbitrary code execution or system compromise as noted ...

CVE-2022-4926

Technical details about CVE-2022-4926 are not publicly available in the provided documents; monitor for updates.

CVE-2024-6989

CVE-2024-6989 is a use-after-free in the Loader path of Google Chrome/Chromium. The flaw could allow remote code execution via a crafted HTML page by triggering heap corruption. Affected software is Chromium/Chrome before version 127.6533.72; remediation is a patch released in Chromium updates (e...

CVE-2024-9960

CVE-2024-9960 corresponds to a use-after-free in Dawn within Google Chrome/Chromium prior to version 130.0.6723.58, which can allow remote heap corruption via a crafted HTML page. Multiple connected sources confirm the flaw in Chromium’s Dawn component and reference the same fixed version 130.0.6...

CVE-2025-10201

The CVE-2025-10201 entry concerns an Inappropriate implementation in Mojo within Google Chrome on Android, Linux, and ChromeOS prior to version 140.0.7339.127. The root cause is a Mojo implementation flaw that allowed a remote attacker to bypass site isolation via a crafted HTML page, per connect...

CVE-2025-13229

CVE-2025-13229 is a type confusion in V8 affecting Google Chrome before 142.0.7444.59. The vulnerability allows a remote attacker to potentially trigger heap corruption via a crafted HTML page, with a high severity (CVSS v3.1: 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Affected product/stack: Goo...

CVE-2026-11174

CVE-2026-11174 describes an insecure Site Isolation implementation in Google Chrome/Chromium, allowing a remote attacker who has compromised the renderer process to bypass site isolation via a crafted HTML page. The issue stems from an inappropriate implementation in Site Isolation, and affects C...

CVE-2026-12025

CVE-2026-12025 affects Google Chrome and involves insufficient validation of untrusted input in the Network stack. A malicious actor who had already compromised the renderer process could exfiltrate cross-origin data via a crafted HTML page. The public write-up confirms the impact as data leakage...

CVE-2026-17684

CVE-2026-17684 involves Chrome for iOS prior to 151.0.7922.72, where insufficient validation of untrusted input in the renderer could enable a sandbox escape via a crafted HTML page. The issue arises from input handling within Chrome on iOS (renderer process) and is described as a high-severity, ...

CVE-2011-1196

The CVE-2011-1196 issue affects the OGG container handling in Google Chrome prior to 10.0.648.127. Root cause: out-of-bounds write in the OGG container implementation. Impact: remote denial of service and possible unspecified impact via crafted inputs. Remediation: upgrade to Google Chrome 10.0.6...

CVE-2011-3970

CVE-2011-3970 affects libxslt as used in Google Chrome prior to 17.0.963.46, enabling a remote attacker to cause a denial of service via an out-of-bounds read (vectors not specified in the entry). The issue has been addressed in downstream advisories and Chrome updates; Chrome/SUSE/Fedora advisor...

CVE-2015-1211

CVE-2015-1211 affects Google Chrome prior to 40.0.2214.111 on Windows/macOS/Linux (and prior to 40.0.2214.109 on Android). The OriginCanAccessServiceWorkers function in content/browser/service_worker/service_worker_dispatcher_host.cc did not properly restrict the URI scheme during ServiceWorker r...

CVE-2015-1290

CVE-2015-1290 affects the Google V8 JavaScript engine used by Chrome (pre-44.0.2403.89) and QtWebEngineCore in Qt (pre-5.5.1). The vulnerability allows remote attackers to cause memory corruption or execute arbitrary code via a crafted website, leading to denial of service or code execution. Affe...

CVE-2017-5073

CVE-2017-5073 is a vulnerability in the Chromium-based Google Chrome browser’s print preview feature (Blink). The issue is a use-after-free in print preview, affecting Chrome up to 59.0.3071.86 on Linux, Windows, and macOS, and 59.0.3071.92 on Android. The underlying fault is a memory-management ...

CVE-2017-5113

CVE-2017-5113 describes a buffer overflow in the Skia component of Chromium/Chrome that could allow a remote attacker to execute arbitrary code via a crafted HTML page. Affected products include Chromium/Chrome before version 61.0.3163.79 (Chrome desktop/mac/win/linux) and 61.0.3163.81 (Android),...

CVE-2017-5120

CVE-2017-5120 describes a downgrade of HTTPS during redirects in the Chromium/Chrome browser. Affected: Chromium/Chrome before 61.0.3163.79 on desktop (Mac/Windows/Linux) and 61.0.3163.81 on Android, with downstream advisories referencing Chromium builds. Root cause: a misdesign workaround for ww...

CVE-2018-6100

CVE-2018-6100 : Google Chrome on macOS prior to 66.0.3359.117 is affected by an issue in the URL Formatter/Omnibox where confusable characters were mishandled, enabling domain spoofing via IDN homographs with a crafted domain name. Connected sources corroborate the CVE as a URL spoofing vulnerabi...

CVE-2019-13768

Use-after-free in Chrome's FileAPI (CVE-2019-13768) affects Google Chrome

CVE-2022-3444

CVE-2022-3444 : Insufficient data validation in Chrome’s File System API allows remote bypass of file system restrictions via a crafted HTML page and malicious file. Affected: Google Chrome pre-106.0.5249.62 (Chromium engine). Impact: bypass of File System restrictions (privacy/mi) with no confid...

CVE-2022-4921

CVE-2022-4921 is a use-after-free in Google Chrome’s Accessibility implementation (Chromium) prior to 99.0.4844.51. The flaw allows a remote attacker to cause arbitrary read/write via a crafted HTML page when a user is convinced to perform specific UI gestures. Root cause is a use-after-free in A...

CVE-2024-9955

CVE-2024-9955 affects Google Chrome/Chromium’s WebAuthentication in all builds prior to 130.0.6723.58. The vulnerability is a use-after-free that could enable a remote attacker to cause heap corruption via a crafted HTML page. Public advisories indicate that fixed versions exist (e.g., Chromium 1...

CVE-2026-13914

The CVE-2026-13914 entry concerns Google Chrome on macOS with an insecure implementation in Password handling that could allow a local attacker to read potentially sensitive data from process memory via a malicious file. Affected software is Chrome for macOS; the issue is tied to versions prior t...

CVE-2026-17887

CVE-2026-17887 is a Use-After-Free in Chrome's TabStrip prior to 151.0.7922.72 that could allow a remote attacker to trigger heap corruption by convincing a user to perform specific UI gestures on a crafted HTML page. Affected product: Google Chrome (Chromium-based); root cause is use-after-free ...