CVE-2010-2298

Google Chrome before 5.0.375.70 on Linux is vulnerable due to improper handling of ViewHostMsg_DatabaseOpenFile in chroot-based sandboxing, allowing sandbox bypass via fchdir/chdir. Root cause: database_dispatcher_host.cc in renderer_host. Affected: Chrome versions prior to 5.0.375.70. Mitigation...

CVE-2011-2881

CVE-2011-2881 corresponds to multiple vulnerability entries affecting Google Chrome before 14.0.835.202 . The issue stems from improper handling of Google V8 hidden objects , allowing a remote attacker to cause a denial of service via memory corruption (and possibly other impact). Public referenc...

CVE-2023-7281

CVE-2023-7281 – Google Chrome/ui spoofing via crafted HTML page . The issue arises from an inappropriate implementation in the Chrome browser’s Compositing feature, allowing a remote attacker to perform UI spoofing. Affected product: Google Chrome (Chromium base) prior to version 119.0.6045.105. ...

CVE-2025-12430

CVE-2025-12430 affects Google Chrome/Chromium where an object lifecycle issue in Media could enable UI spoofing via a crafted HTML page in versions prior to 142.0.7444.59. Connected advisories show updated Chromium/CEF packages: Fedora updates reference chromium/cef builds reaching 142.0.7444.162...

CVE-2025-8578

CVE-2025-8578 relates to a use-after-free in the Cast component of Google Chrome/Chromium before version 139.0.7258.66, allowing a remote attacker to trigger heap corruption via a crafted HTML page. The issue affects Chromium-based builds and is addressed by updating to Chromium 139.0.7258.127 or...

CVE-2025-8581

CVE-2025-8581 affects Google Chrome/Chromium where an inappropriate Extension implementation prior to 139.0.7258.66 can allow a remote attacker—who lures a user into specific UI gestures via a crafted HTML page—to leak cross-origin data. The CVSS 3.1 base score is 4.3 (Medium); impact is limited ...

CVE-2025-8583

CVE-2025-8583 : In Google Chrome/Chromium, an inappropriate permissions implementation allowed a remote UI spoofing via a crafted HTML page. Affected product is Chromium-based Chrome; impact is UI spoofing with low severity (CVSS 3.1 base 4.3). Remediation observed in connected docs: updates to C...

CVE-2025-8881

CVE-2025-8881 relates to an inappropriate implementation in Google Chrome’s File Picker prior to 139.0.7258.127. A remote attacker could coax a user to perform specific UI gestures to cause leakage of cross-origin data via a crafted HTML page. The vulnerability is tied to the Chromium/Chrome File...

CVE-2026-0900

CVE-2026-0900: In Chrome/Chromium, an inappropriate implementation in V8 prior to 144.0.7559.59 could allow a remote attacker to cause object corruption via a crafted HTML page. The issue is rated High (CVSS 8.8). References indicate fixes in Chromium/Chrome updates (e.g., Chromium 144.0.7559.59+...

CVE-2026-12439

CVE-2026-12439 describes a use-after-free in Google Chrome’s Digital Credentials handling, leading to potential heap corruption when processing a crafted HTML page. Affected product: Chrome (Chromium-based) before version 149.0.7827.155. Root cause: use-after-free in Digital Credentials component...

CVE-2026-14411

CVE-2026-14411 describes insufficient validation of untrusted input in ANGLE used by Google Chrome, prior to build 150.0.7871.46. The issue may allow a remote attacker to cause a sandbox escape via a crafted HTML page. Documented impact is a high-severity, likely remote threat affecting ANGLE int...

CVE-2026-14419

CVE-2026-14419 affects Google Chrome where a use-after-free in Skia could allow a remote attacker to escape the sandbox via a crafted HTML page. It targets Skia in Chrome before version 150.0.7871.46. The issue is listed as Critical (CVSS: 9.6, Network) with potential for total impact to confiden...

CVE-2026-5279

CVE-2026-5279 affects Google Chrome (V8) with object corruption in V8 that allowed remote code execution via a crafted HTML page in a sandbox. The Chromium security note lists this as High severity; the Chrome stable update fixes include 146.0.7680.178 (and prior 177/178 variants on different cha...

CVE-2011-1452

CVE-2011-1452 affects Google Chrome prior to 11.0.696.57. The vulnerability allows a user-assisted attacker to spoof the URL bar via a redirect and a manual reload, enabling potential confusion or phishing-like tricks. The issue is explicitly tied to the URL bar spoofing vector in Chrome’s naviga...

CVE-2011-2782

Google Chrome on Linux (pre-13.0.782.107) is affected by CVE-2011-2782 due to a drag-and-drop file permission handling flaw that could allow a user‑assisted remote attacker to bypass access restrictions via unspecified vectors. The issue is addressed in Chrome 13.0.782.107 (Stable Channel update)...

CVE-2011-2793

Google Chrome is vulnerable to a use-after-free in media selectors affecting Chrome up to version 13.0.782.107. The CVE entry CVE-2011-2793 describes that remote attackers could cause a denial of service or potentially induce other unspecified effects. Connected documents corroborate a family of ...

CVE-2011-2798

CVE-2011-2798 affects Google Chrome before 13.0.782.107, where access to internal schemes is not properly restricted, enabling remote attackers to influence the browser via a crafted website. The available documents confirm the affected product and the root cause (improper restriction of internal...

CVE-2011-3875

CVE-2011-3875 affects Google Chrome prior to 15.0.874.102. The vulnerability stems from improper handling of drag-and-drop operations on URL strings, enabling a user-assisted attacker to spoof the URL bar via unspecified vectors. The OpenVAS entries corroborate multiple Chrome-related CVEs around...

CVE-2011-3911

Technical details for CVE-2011-3911 are not provided in the connected documents. The initial description notes a PDF handling issue in Chrome prior to 16.0.912.63 and an out-of-bounds read; monitor for updates.

CVE-2017-15402

CVE-2017-15402 affects Google Chrome on Chrome OS prior to 62.0.3202.74. A compromised renderer could control an ID used across frames, allowing any frame to overwrite another frame’s page_state within the same process, potentially enabling a sandbox escape via a crafted HTML page. The issue is c...

CVE-2026-13781

CVE-2026-13781 concerns an issue in Skia used by Google Chrome before 150.0.7871.47. The vulnerability stems from insufficient validation of untrusted input, which could enable a remote attacker who has already compromised the renderer process to potentially escape the browser sandbox via a craft...

CVE-2026-13789

CVE-2026-13789 is a vulnerability in Google Chrome’s GPU process (GPU) caused by a use-after-free condition, allowing a remote attacker who has compromised the renderer process to potentially escape the browser sandbox via a crafted HTML page. Affected product: Google Chrome (Chromium-based) prio...

CVE-2026-14077

The CVE-2026-14077 entry describes an issue in Google Chrome on macOS (before version 150.0.7871.47) where an inappropriate implementation in the Select control allows a remote attacker to spoof the Omnibox (URL bar) contents via a crafted HTML page. Affected component: Select in the browser; roo...

CVE-2026-3920

CVE-2026-3920 describes an out-of-bounds memory access in WebML within Google Chrome/Chromium, enabling potential heap corruption via a crafted HTML page. The flaw affects Chrome before version 146.0.7680.71 and is described with a High severity. According to connected sources, the issue arises f...

CVE-2026-7941

CVE-2026-7941 affects Google Chrome on Android (mobile) prior to 148.0.7778.96. The root cause is insufficient validation of untrusted input in the mobile Chrome, enabling UXSS: a local attacker could inject arbitrary scripts or HTML via a crafted Chrome Extension. Remediation is to update to ver...

CVE-2026-8554

CVE-2026-8554 is a type confusion flaw in the ANGLE component of the Chromium-based Google Chrome browser on Windows. The issue allows a remote attacker who has compromised a renderer process to trigger an out-of-bounds memory write via a crafted HTML page, due to a flaw in ANGLE’s handling of da...

CVE-2026-9887

CVE-2026-9887 is a use-after-free vulnerability in the Chromium-based Proxy component of Google Chrome, exploitable via a crafted PAC script to achieve remote code execution. The flaw affects Chrome before version 148.0.7778.216, and Google released a stable-channel fix in 148.0.7778.216/217 (Win...

CVE-2010-4041

CVE-2010-4041 : Google Chrome on Linux prior to 7.0.517.41 contains a sandbox flaw in the worker process isolation, which may allow remote attackers to bypass access restrictions via unspecified vectors. The issue affects the Chrome sandbox implementation and is described as potentially enabling ...

CVE-2011-1816

CVE-2011-1816 is a use-after-free vulnerability in Google Chrome’s Developer Tools , affecting Chrome versions before 12.0.742.91 . Exploitation could allow a remote attacker to cause a denial of service or potentially other impact via unknown vectors. The vulnerability stems from use-after-free ...

CVE-2011-3873

The CVE-2011-3873 entry concerns Google Chrome (Oct 2011 era). Description: Chrome before 14.0.835.202 may fail to correctly translate shader code, enabling a remote attacker to execute arbitrary code or cause memory corruption via unspecified vectors. Connected documents confirm Chrome/Chromium-...

CVE-2011-3882

CVE-2011-3882: A use-after-free in Google Chrome before 15.0.874.102 affects media buffers, enabling remote DoS and possibly other impact. Affected product: Google Chrome; vulnerable component is the media buffer handling. Remediation: upgrade to Chrome 15.0.874.102 or later (per Gentoo GLSA 2011...

CVE-2017-15405

Summary: CVE-2017-15405 describes a local code execution risk in Chrome OS’s cryptohomed due to improper symlink handling and a race in the stateful recovery feature, allowing a local attacker to run arbitrary code via a crafted HTML page on Chrome OS versions prior to 61.0.3163.113. The Chrome O...

CVE-2023-3497

CVE-2023-3497 affects Google Chrome on ChromeOS with the Google Security Processor firmware (Titan C). The issue is an out-of-bounds read in the firmware that enables a local attacker with physical access to cause a denial of service. The vulnerability is documented in ChromeOS-related advisories...

CVE-2025-8580

CVE-2025-8580 involves an inappropriate implementation in Chrome/Chromium’s Filesystems prior to version 139.0.7258.66 , allowing a remote attacker to perform UI spoofing via a crafted HTML page. The reported impact is low (as per Chromium’s security metrics) with network attack vector, requiring...

CVE-2026-11070

CVE-2026-11070 affects Chromoting in Google Chrome on Windows, where insufficient validation of untrusted input could allow a sandbox escape via malicious network traffic, if an attacker compromised the network process. The vulnerability is triggered by untrusted network data in Chromoting prior ...

CVE-2026-1220

Summary: CVE-2026-1220 is a race in V8 in Google Chrome prior to 144.0.7559.99 that could allow a remote attacker to trigger type confusion via a crafted HTML page. The vulnerability affects Chromium-based Chrome and stems from the V8 engine; exploitation could lead to arbitrary code execution or...

CVE-2026-13031

CVE-2026-13031 is a use-after-free in Blink (Chrome) prior to 149.0.7827.197, allowing a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Affected component: Blink in Google Chrome. Root cause: use-after-free in the browser’s rendering engine. Impact: high (arbi...

CVE-2026-14402

CVE-2026-14402 describes an uninitialized use in ANGLE within Google Chrome on Windows, prior to version 150.0.7871.46. The issue allows a remote attacker to potentially read sensitive data from a process's memory via a crafted HTML page. Affected component is ANGLE in Chrome’s Windows build; und...

CVE-2026-15905

CVE-2026-15905 is a local-use-after-free vulnerability in the Aura component of Google Chrome (Chromium-based) prior to 150.0.7871.128, allowing a local attacker to potentially cause heap corruption via a malicious file. The issue is confirmed in multiple sources and is addressed by an update to ...

CVE-2026-9994

CVE-2026-9994 affects Google Chrome on Windows due to a use-after-free in Chrome’s Core, allowing a renderer-compromised attacker to potentially escape the sandbox via a crafted HTML page. The vulnerability is triggered by an issue in Core that existed prior to version 148.0.7778.216. Impact is h...

CVE-2026-9997

CVE-2026-9997 corresponds to a use-after-free in the Chrome Input component (Chromium-based) that affects Chrome versions prior to 148.0.7778.216. A renderer process compromise could enable a remote attacker to attempt a sandbox escape via a crafted HTML page. The issue is described across multip...

CVE-2011-1120

The CVE-2011-1120 entry concerns Google Chrome’s WebGL implementation. The vulnerability arises in WebGL prior to version 9.0.597.107 and allows remote attackers to trigger an out-of-bounds read, leading to a denial of service (Issue 71717). Exploitation vectors are not specified in the provided ...

CVE-2011-2796

The CVE-2011-2796 entry concerns a Use-after-free vulnerability in Skia used by Google Chrome prior to version 13.0.782.107. The underlying issue is in Skia, and the impact is described as a remote cause for a denial of service or possibly other unspecified effects via unknown vectors. The affect...

CVE-2026-10003

CVE-2026-10003: Use-after-free in Chrome’s Views (Chromium) prior to 148.0.7778.216 permits a remote attacker to run arbitrary code via a crafted HTML page after the user engages specific UI gestures. Root cause is a flaw in the Views component of Chromium/Blink; affected software is Google Chrom...

CVE-2026-10931

Summary: CVE-2026-10931 is a use-after-free in Chrome’s FileSystem that could allow a remote sandbox escape via a crafted HTML page. Affected product/area: Google Chrome (Chromium-based) prior to version 149.0.7827.53. Impact: high severity with potential sandbox escape; attacker could trigger ne...

CVE-2026-11167

CVE-2026-11167 affects WebView in Google Chrome on Android, prior to version 149.0.7827.53. The issue is described as an “inappropriate implementation in WebView” that could allow a remote attacker who has compromised the renderer process to achieve a sandbox escape via a crafted HTML page. The r...

CVE-2026-13774

CVE-2026-13774: Use-after-free in Chrome Extensions allows arbitrary code execution when a user installs a malicious extension. Affected: Google Chrome (Extensions). Root cause: use-after-free in Extensions. Impact: potential arbitrary code execution. Mitigation: update to Chrome 150.0.7871.47 or...

CVE-2026-14392

CVE-2026-14392 describes an out-of-bounds write in the Tint component of Google Chrome, affecting Chrome prior to 150.0.7871.46. The issue could allow a remote attacker to escape the Chrome sandbox via a crafted HTML page, as indicated by the description and cross-referenced Chrome security advis...

CVE-2026-14410

CVE-2026-14410 affects Google Chrome’s Skia rendering pipeline. The issue arises from an inappropriate implementation in Skia that, if a renderer process is compromised, enables UI spoofing via a crafted HTML page. Impact is limited to remote UI spoofing with no broader exploit chain described; b...

CVE-2026-14414

CVE-2026-14414 — Insufficient validation of untrusted input in Skia within Google Chrome prior to 150.0.7871.46 allows a remote attacker who has already compromised the renderer process to exfiltrate potentially sensitive data from process memory via a crafted HTML page. The issue is tied to Skia...