CVE-2024-11114

CVE-2024-11114 affects Google Chrome/Chromium on Windows, due to an inappropriate implementation in the Views module that can allow a remote attacker who has compromised the renderer to perform a sandbox escape via a crafted HTML page. Affected product/component: Chrome/Chromium rendering/Views. ...

CVE-2019-5822

CVE-2019-5822 affects Google Chrome/Chromium Blink component; describes bypass of Cross‑Origin Resource Sharing (CORS) via a crafted HTML page, effectively bypassing same-origin policy. Affected scope includes Blink/CORS handling in Chrome prior to 74.0.3729.108. Public advisories (Debian DSA-450...

CVE-2019-5828

CVE-2019-5828 is a use-after-free vulnerability in the ServiceWorker component of the Chromium/Google Chrome stack, reported to be exploitable remotely via a crafted HTML page. The issue affects Chromium/Chrome versions prior to 75.0.3770.80, with multiple sources listing an upgrade to 75.0.3770....

CVE-2020-16027

CVE-2020-16027 affects Chromium/Google Chrome before 87.0.4280.66, specifically the developer tools component where insufficient policy enforcement allowed an attacker to cause information disclosure via a crafted extension. Affected product: Chromium/Chrome; root cause: access restriction bypass...

CVE-2020-6444

CVE-2020-6444 affects Google Chrome/Chromium WebRTC: uninitialized variable in WebRTC implementation could enable heap corruption via a crafted HTML page. Connected advisories confirm the issue in Chrome prior to 81.0.4044.92 and list it alongside related CVEs in Chromium (CVE-2020-6423, CVE-2020...

CVE-2023-5479

CVE-2023-5479 corresponds to an insufficiently secure Extensions API in Google Chrome/Chromium before 118.0.5993.70, enabling a user-assisted bypass of enterprise policy via a crafted HTML page if a malicious extension is installed. Public details across connected documents confirm the affected c...

CVE-2024-6776

CVE-2024-6776 : Use-after-free in the Audio component of Google Chrome/Chromium before 126.0.6478.182 can allow remote heap corruption via a crafted HTML page. Affected software includes Chromium-based Chrome; vulnerable versions are prior to 126.0.6478.182. Remediation is a patch to 126.0.6478.1...

CVE-2024-7979

CVE-2024-7979 is a Chromium-derived issue: Insufficient data validation in the Windows Installer component of Google Chrome prior to version 128.0.6613.84 allows privilege escalation via a crafted symbolic link. Public sources in the connected documents tie this CVE to Chrome/Chromium, with Debia...

CVE-2024-7968

CVE-2024-7968: Affected software is Google Chrome/Chromium. The issue is a Use-after-Free in Autofill leading to potential heap corruption via a crafted HTML page, with High severity. The publicly documented impact states that versions prior to 128.0.6613.84 are vulnerable. Concrete details acros...

CVE-2020-6425

The CVE-2020-6425 entry concerns Chromium/Google Chrome. The vulnerability is a policy enforcement error in extensions that could allow a user-assisted attacker to bypass site isolation via a crafted Chrome extension. Affected product family: Chromium/Chrome browser engines as distributed in Debi...

CVE-2020-6439

CVE-2020-6439 affects Google Chrome/Chromium where an insufficient policy enforcement in navigations permits bypassing the security UI via a crafted HTML page. Affected component is the navigation policy enforcement flow in Chromium/Chrome prior to version 81.0.4044.92. The issue is described as ...

CVE-2024-6774

CVE-2024-6774 refers to a use-after-free in Chrome/Chromium’s Screen Capture feature that could allow heap corruption via a crafted HTML page, triggered by the user through specific UI gestures. Affected software is Google Chrome/Chromium prior to version 126.0.6478.182; the issue is rated High i...

CVE-2019-5811

CVE-2019-5811 : In Chromium-based browsers, a Cross‑Origin Resource Sharing (CORS) bypass was discovered in Blink, allowing a crafted HTML page to bypass the same-origin policy via Service Worker semantics. The issue is associated with Chrome/Chromium builds prior to 74.0.3729.108. Impact is tied...

CVE-2019-5824

CVE-2019-5824 affects the Chromium/Chrome media path: a parameter-passing error in the media component could enable heap corruption via a crafted HTML page. Connected advisories corroborate that Chromium/Chrome updates across distributions (e.g., Debian DSA-4500-1, openSUSE/Fedora advisories) add...

CVE-2023-1529

CVE-2023-1529 is an out-of-bounds memory access in WebHID for Google Chrome prior to 111.0.5563.110, enabling a remote attacker to potentially trigger heap corruption via a malicious HID device. Multiple connected sources corroborate the same vulnerability class and affected component: Chromium/W...

CVE-2024-8637

CVE-2024-8637 : Affects Google Chrome/Chromium components with a Use-After-Free in Media Router on Android prior to 128.0.6613.137, potentially allowing heap corruption. Fedora Debian and other feeds indicate a fixed Chromium/Chromium-based package version 128.0.6613.137 (e.g., chromium 128.0.661...

CVE-2019-5829

CVE-2019-5829 is a vulnerability in Google's Chromium/Chrome download manager. The issue is an integer overflow that can trigger an out-of-bounds memory access via a crafted HTML page, potentially enabling remote exploitation. Affected software is Chrome/Chromium released before 75.0.3770.80. Mit...

CVE-2022-1482

CVE-2022-1482 : In Google Chrome, the WebGL implementation contained an inappropriate/unsafe handling that could allow a remote attacker to trigger heap corruption via a crafted HTML page. The vulnerability is associated with Chrome/WebGL prior to version 101.0.4951.41. Public advisories and rele...

CVE-2024-8193

The CVE-2024-8193 entry applies to Google Chrome/Chromium with Skia. Affected: Chrome prior to 128.0.6613.113; vulnerability: heap buffer overflow in Skia, exploitable by a remote attacker who has compromised the renderer process to trigger heap corruption via a crafted HTML page. Impact: high co...

CVE-2017-15412

CVE-2017-15412 is a use-after-free in libxml2 (affected before 2.9.5) used by Chrome and other products, potentially enabling heap corruption via crafted HTML. Connected advisories also reference CVE-2018-14404 (NULL pointer dereference in xmlXPathCompOpEval) affecting libxml2 up to 2.9.8 during ...

CVE-2020-6489

CVE-2020-6489 corresponds to an inappropriately implemented behavior in Google Chrome’s developer tools prior to 83.0.4103.61. The issue is described as an implementation error in the developer tools component, enabling a remote attacker who tricks a user into performing certain actions on a craf...

CVE-2020-6525

CVE-2020-6525 : Heap buffer overflow in Skia used by Google Chrome prior to 84.0.4147.89. The vulnerability could allow remote code execution via a crafted HTML page due to heap corruption in Skia. Affected product/version: Google Chrome (Skia component) before 84.0.4147.89. Mitigation: upgrade C...

CVE-2019-13753

CVE-2019-13753 is an out-of-bounds read in the SQLite component used by Google Chrome/Chromium, fixed in Chrome/Chromium after version 79.0.3945.79. Exploitation via a crafted HTML page could allow a remote attacker to read potentially sensitive data from process memory. Public details in linked ...

CVE-2019-5832

CVE-2019-5832 affects Chromium/Chrome: an error in the Cross-Origin Resource Sharing (CORS) handling exposes cross-origin data when a crafted HTML page is loaded. Root cause: CORS-related flaw in Chromium’s policy enforcement. Impact stated as information disclosure via cross-origin leaks. Remedi...

CVE-2019-5836

CVE-2019-5836 : A heap buffer overflow in ANGLE within Google Chrome prior to 75.0.3770.80 could allow a remote attacker to cause heap corruption via a crafted HTML page. Connected sources corroborate ANGLE/Chrome scope and advise upgrading to a fixed version; Debian advisories list numerous Chro...

CVE-2019-5839

CVE-2019-5839 affects Google Chrome (Chromium) prior to 75.0.3770.80. The issue is excessive data validation in the URL parser, enabling a remote attacker who lures a user to input a crafted URL to bypass website URL validation. Root cause: improper validation in the URL parsing logic. Impact, pe...

CVE-2019-5844

CVE-2019-5844 involves an out-of-bounds access in SwiftShader within Google Chrome/Chromium before 73.0.3683.75, enabling a remote attacker to potentially trigger heap corruption via a crafted HTML page. The entry does not indicate exploitation status. Affected tier: Chrome/Chromium in prior vers...

CVE-2020-6493

CVE-2020-6493: A use-after-free in Chrome’s WebAuthentication component (older than 83.0.4103.97) could allow a remote attacker who compromises the renderer to escape the sandbox via a crafted HTML page. Affected product is Google Chrome. The issue is fixed in 83.0.4103.97 (upstream); Debian/Arch...

CVE-2022-1853

CVE-2022-1853 involves a use-after-free in IndexedDB in Google Chrome, prior to version 102.0.5005.61. The underlying issue allowed a remote attacker to potentially escape the Chrome sandbox via a crafted HTML page. Connected sources confirm the flaw affects Chrome’s IndexedDB handling and was ad...

CVE-2024-8908

Affected software: Google Chrome (Autofill component).Root cause: Inappropriate implementation in Autofill.Vulnerability: Enables a remote attacker to perform UI spoofing via a crafted HTML page.Impact: UI spoofing possible without explicit exploit details beyond the description; no additional ri...

CVE-2026-3942

The CVE-2026-3942 issue is a Chrome/Chromium vulnerability where the PictureInPicture security UI could be spoofed by a crafted HTML page. Affected product: Google Chrome/Chromium (Chromium-based browser). Root cause: incorrect security UI in PictureInPicture prior to version 146.0.7680.71. Impac...

CVE-2019-5787

CVE-2019-5787 is a use-after-free in the Canvas component of Chromium-based Chrome/Blink (pre-73.0.3683.75). The issue allows a remote attacker to potentially trigger heap corruption via a crafted HTML page. Connected sources also describe related CVEs (5788–5799) in FileAPI, WebMIDI, V8, PDFium,...

CVE-2020-6438

CVE-2020-6438 : A policy enforcement error in Chrome extensions prior to 81.0.4044.92 could allow a user-assisted attacker to obtain potentially sensitive information from process memory by convincing a user to install a crafted malicious extension. Affected software: Google Chrome (extensions su...

CVE-2025-5063

CVE-2025-5063 is a use-after-free in Chromes’s Compositing component, exploitable via a crafted HTML page on Google Chrome before version 137.0.7151.55. The issue could lead to heap corruption and is addressed in the Chrome 137 stable update (Linux/Windows/macOS). Affected product: Google Chrome ...

CVE-2020-6475

CVE-2020-6475 concerns Google Chrome/Chromium: an incorrect implementation in full screen mode allowed a remote attacker to spoof the security UI via a crafted HTML page. Affected versions prior to the fix were Chrome/Chromium releases up to 83.0.4103.61. The issue is categorized under content sp...

CVE-2022-2158

CVE-2022-2158 is a type confusion in V8 affecting Google Chrome/Chromium prior to 103.0.5060.53, enabling potential heap corruption via a crafted HTML page. The CVE entry is supported by multiple connected notices: Debian/DSA-5168-1 fixes Chromium up to 103.0.5060.53; Fedora package updates refer...

CVE-2024-11112

CVE-2024-11112 is a use-after-free in Media in Google Chrome (Chromium) on Windows, allowing potential heap corruption via a crafted HTML page. Connected advisories confirm affected Chromium/Chrome packages across distros and provide patches: Debian fixed chromium at 131.0.6778.85-1~deb12u1; Fedo...

CVE-2024-7967

CVE-2024-7967 is a heap buffer overflow in Google Chrome’s Fonts implementation (Chromium) prior to 128.0.6613.84. The vulnerability could permit remote exploitation via a crafted HTML page, with impact described as high confidentiality/integrity/availability. Several connected documents corrobor...

CVE-2024-9603

Summary: CVE-2024-9603 is a Type Confusion in V8 used by Google Chrome/Chromium, prior to version 129.0.6668.100. The vulnerability could allow a remote attacker to cause heap corruption via a crafted HTML page. Affected software is Chromium-based (Chrome/Chromium); root cause is type confusion i...

CVE-2020-6451

CVE-2020-6451 is a use-after-free vulnerability in Chrome/Chromium’s WebAudio implementation, prior to version 80.0.3987.162. The issue can allow a remote attacker to potentially cause heap corruption and execute arbitrary code through a crafted HTML page. Public reports across multiple feeds (Ar...

CVE-2020-6476

The CVE-2020-6476 entry concerns Google Chrome prior to 83.0.4103.61, where an insufficient policy enforcement in the tab strip could allow an attacker—who convinces a user to install a malicious extension—to bypass navigation restrictions via that extension. Affected component: tab strip policy ...

CVE-2024-6775

CVE-2024-6775 describes a use-after-free in Media Stream within Google Chrome, before version 126.0.6478.182, that could allow a remote attacker to trigger heap corruption via a crafted HTML page when a user engages in specific UI gestures. Affected product: Google Chrome (Chromium base). Root ca...

CVE-2019-5795

CVE-2019-5795 is an integer overflow in the PDFium component of Google Chrome/Chromium prior to 73.0.3683.75. A crafted PDF file could trigger out-of-bounds memory access. Public sources confirm the PDFium overflow issue; Debian and Arch advisories indicate the fix is in 73.0.3683.75. Remediation...

CVE-2019-5799

CVE-2019-5799 is a CSP bypass in Chromium/Google Chrome via blob URLs, affecting versions before 73.0.3683.75. Root cause: content security policy bypass in CSP handling for blob URLs. Impact: remote attacker could bypass CSP and access restricted content. Remediation: upgrade to Chromium/Chrome ...

CVE-2020-6441

CVE-2020-6441 affects Chromium/Google Chrome prior to version 81.0.4044.92 and is described as an insufficient policy enforcement issue in the omnibox component, allowing a remote, crafted HTML page to bypass the security UI. Public advisories confirm the vulnerability as a policy‑enforcement err...

CVE-2019-5813

CVE-2019-5813 is an out-of-bounds read vulnerability in the V8 JavaScript engine of Chromium/Google Chrome, present in versions prior to 74.0.3729.108. The issue is rooted in the V8 component and could enable information disclosure or heap-related effects as described in vendor advisories. Remedi...

CVE-2020-6526

CVE-2020-6526 affects Google Chrome before 84.0.4147.89. An inappropriate implementation in the iframe sandbox could allow a remote attacker to bypass navigation restrictions via a crafted HTML page. Public references in Debian and FreeBSD advisories align with a fixed version around 84.0.4147.89...

CVE-2023-5478

Chromium/Google Chrome Autofill vulnerability CVE-2023-5478: Inappropriate Autofill implementation allowed a remote attacker to leak cross-origin data via a crafted HTML page. Affects Chrome/Chromium prior to 118.0.5993.70. Impact per sources: data leakage with low severity; no exploitation detai...

CVE-2024-6777

CVE-2024-6777 affects Google Chrome (Chromium-based browser). The issue is a use-after-free in Navigation that could allow heap corruption when a user is convinced to install a crafted malicious Chrome Extension. Affected version range is Chrome prior to 126.0.6478.182. The description indicates ...

CVE-2019-5809

CVE-2019-5809 is a use-after-free in Blink/WebKit affecting Chromium-based browsers, specifically in the file chooser path. The vulnerability allows a remote attacker who has already compromised the renderer process to escalate privileges via a crafted HTML page. Technical details across connecte...