CVE-2022-1477

CVE-2022-1477 is a use-after-free in Vulkan found in Google Chrome prior to 101.0.4951.41, potentially enabling heap corruption via a crafted HTML page. The incident is documented in the Chrome stable-channel release notes and related advisories, which indicate this was part of a broader set of C...

CVE-2020-6433

CVE-2020-6433 describes an insufficient policy enforcement vulnerability in the extensions component of Chromium/Google Chrome, allowing a remote attacker to bypass navigation restrictions via crafted HTML. This is part of a broader set of policy enforcement issues in Chromium 81.x. Debian/Arch/F...

CVE-2020-6459

Affected software: Google Chrome (payments implementation). Issue: a use-after-free in payments leads to potential heap corruption. Root cause: use-after-free in the payments code path as described in CVE-2020-6459. Impact: remote attacker could trigger arbitrary behavior via a crafted HTML page;...

CVE-2020-6479

CVE-2020-6479 affects Chromium/Google Chrome before 83.0.4103.61. Root cause: an inappropriate implementation in the sharing component could allow a remote attacker to spoof the security UI via a crafted HTML page. Impact: spoofed security UI and potential circumvention of security checks, as des...

CVE-2020-6446

CVE-2020-6446 : In Chromium, an insufficient policy enforcement issue in the Trusted Types component allowed bypass of CSP via a crafted HTML page, affecting builds prior to 81.0.4044.92. This is described in multiple sources (Arch Linux ASA-202004-9, Debian DSA-4714-1, Gentoo GLSA-202004-09). Re...

CVE-2021-30535

CVE-2021-30535: A double-free in the ICU component of the Chromium browser (Chromium/Google Chrome) before version 91.0.4472.77. The linked connected documents confirm the root cause as a double-free in ICU, enabling a remote attacker to potentially perform heap corruption and, per the consolidat...

CVE-2022-0972

CVE-2022-0972 affects Google Chrome extensions and is caused by a use-after-free in the Extensions component prior to version 99.0.4844.74, potentially enabling heap corruption via a crafted HTML page if a user installs a malicious extension. The Chrome update (99.0.4844.74) mitigates this by app...

CVE-2022-1478

CVE-2022-1478 is a use-after-free vulnerability in SwiftShader within Google Chrome (Chromium-based) prior to 101.0.4951.41. The issue could allow a remote attacker to potentially cause heap corruption via a crafted HTML page. The Chrome release notes confirm a fix in Chrome 101.0.4951.41 (and Ch...

CVE-2024-7974

CVE-2024-7974 affects Google Chrome/Chromium via Insufficient data validation in the V8 API, enabling potential heap corruption from a crafted Chrome Extension. Affected versions are Chrome before 128.0.6613.84 (Chromium/Chromium-derived builds). Debian security advisory confirms fixed in Chromiu...

CVE-2026-3942

The CVE-2026-3942 issue is a Chrome/Chromium vulnerability where the PictureInPicture security UI could be spoofed by a crafted HTML page. Affected product: Google Chrome/Chromium (Chromium-based browser). Root cause: incorrect security UI in PictureInPicture prior to version 146.0.7680.71. Impac...

CVE-2019-5820

CVE-2019-5820 is a PDFium-based integer overflow in Chromium/Google Chrome prior to 74.0.3729.108 that could allow a remote attacker to potentially trigger heap corruption via a crafted PDF. The issue is documented across multiple advisories (Debian DSA-4500, Arch Linux ASA-201904-12, Gentoo GLSA...

CVE-2020-6392

CVE-2020-6392 describes an insufficient policy enforcement in the Extensions component of Chromium/Google Chrome, allowing an attacker who lures a user to install a crafted malicious extension to bypass navigation restrictions. Public advisories in connected documents indicate the issue affects C...

CVE-2022-1483

CVE-2022-1483 concerns a heap buffer overflow in WebGPU within Google Chrome/Chromium prior to 101.0.4951.41. The issue could allow a remote attacker who gains renderer process access to trigger heap corruption via a crafted HTML page. Affected software includes Chrome/Chromium and related builds...

CVE-2023-5475

The CVE-2023-5475 issue is an Inappropriate implementation in DevTools of Google Chrome up to version 118.0.5993.70, allowing a user-assisted attacker who installs a crafted malicious extension to bypass discretionary access control. Impact: potential high integrity via extension-based bypass; ex...

CVE-2024-7536

CVE-2024-7536 affects Chromium-based browsers (Google Chrome/Chromium) via a use-after-free in the WebAudio module, enabling potential heap corruption from a crafted HTML page. Affected versions are Chrome/Chromium before 127.0.6533.99; impact is high (C/H, I/H, A/H) with network access and user ...

CVE-2025-4372

CVE-2025-4372: Use-after-free in WebAudio of Google Chrome before 136.0.7103.92 can allow a remote attacker to potentially trigger heap corruption via a crafted HTML page. The cited CVSSv3.1 metrics indicate a high impact (CVSS: 8.8; AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Chrome has addressed this...

CVE-2019-5800

CVE-2019-5800 affects Chromium/Google Chrome prior to 73.0.3683.75. The issue is an access restriction bypass: a CSP bypass via blob URLs in the Content Security Policy, enabling crafted pages to bypass CSP protections. Affected component areas are CSP enforcement mechanisms related to blob URLs ...

CVE-2024-7973

CVE-2024-7973 is a reported heap buffer overflow in PDFium used by Google Chrome/Chromium, enabling a remote attacker to trigger an out-of-bounds memory read via a crafted PDF file. Affected software includes Chrome/Chromium prior to the 128.0.6613.84 fix (Linux, Windows, macOS). The underlying i...

CVE-2019-5770

CVE-2019-5770 affects Google Chrome WebGL: insufficient input validation leads to an out-of-bounds memory read via a crafted HTML page. Vulnerable in Chrome up to version 72.0.3626.81; fixes shipped in later Chrome updates (e.g., 72.0.3626.81+). Debian/Fedora advisories and vendor advisories refe...

CVE-2019-5842

CVE-2019-5842: Use-after-free in Blink within Google Chrome prior to 75.0.3770.90 (Chrome/Chromium). Affected component is Blink/WebKit; underlying issue reported as a memory handling bug leading to potential heap corruption. Public details across connected documents indicate fixed/updated Chromi...

CVE-2020-6470

CVE-2020-6470 affects Chromium/Google Chrome clipboard handling. The root cause is insufficient validation of untrusted input in the clipboard, enabling a local attacker to inject arbitrary scripts or HTML (UXSS) via crafted clipboard content. Connected advisories confirm upstream fixes in the 83...

CVE-2019-5834

CVE-2019-5834 involves insufficient data validation in Blink used by Google Chrome, enabling domain spoofing via a crafted HTML page in Chrome versions older than 75.0.3770.80. The vulnerability is attributed to the Blink component and affects Chrome before the fixed release. Debian advisories li...

CVE-2020-6408

CVE-2020-6408 : The connected sources confirm an insufficient policy enforcement in CORS within Google Chrome/Chromium before version 80.0.3987.87. A local attacker could obtain potentially sensitive information by presenting a crafted HTML page, as described in multiple advisories (Debian, Arch ...

CVE-2020-6458

CVE-2020-6458 is an out-of-bounds read/write in PDFium used by Google Chrome, allowing heap corruption via a crafted PDF file in Chrome before 81.0.4044.122. Remediation: upgrade Chrome to 81.0.4044.122 or newer (as reflected in Debian/Fedora advisories). Ensure affected systems are updated to ve...

CVE-2022-2852

CVE-2022-2852: Use-after-free in FedCM in Google Chrome before 104.0.5112.101 allows remote attackers to potentially exploit heap corruption via a crafted HTML page. Connected sources confirm the issue in Chrome’s FedCM code path and cite affected versions, with Debian noting fixes in 104.0.5112....

CVE-2020-6464

CVE-2020-6464 describes a type confusion in Blink/WebKit used by Google Chrome before 81.0.4044.138, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. Public disclosures in multiple advisories confirm this Chromium vulnerability, with affected rel...

CVE-2020-6478

CVE-2020-6478 is an implementation error in Chrome/Chromium’s full screen mode that could allow a remote attacker to spoof the security UI via a crafted HTML page. Public advisories (e.g., Debian DSA-4714-1, Arch security, Gentoo GLSA) confirm the issue affects Chromium/Chrome before version 83.0...

CVE-2022-2156

CVE-2022-2156 is a Google Chrome vulnerability: Use-after-free in Core leading to potential heap corruption via a crafted HTML page, affecting Chrome before 103.0.5060.53. Debian reports the fix in chromium 103.0.5060.53-1~deb11u1, and Fedora updates Chromium to 103.0.5060.114-1.fcXX, indicating ...

CVE-2024-7534

Summary: CVE-2024-7534 describes a heap buffer overflow in the Layout component of Google Chrome/Chromium, exploitable through a crafted HTML page. The vulnerability affects Chromium-based Chrome before version 127.0.6533.99 and is listed with High severity (CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/...

CVE-2020-6429

CVE-2020-6429 refers to a use-after-free in Google Chrome’s audio path that could allow remote heap corruption via a crafted HTML page. Public references in Debian and Alpine security advisories confirm the flaw affects Chromium/Chrome up to version 80.0.3987.149, with fixed versions pushed in th...

CVE-2020-6521

CVE-2020-6521 affects Google Chrome prior to 84.0.4147.89, describing a side-channel information leakage in autofill that could let a remote attacker read potentially sensitive data from process memory via a crafted HTML page. Public details consistently identify Chrome/Chromium as the affected s...

CVE-2019-13679

CVE-2019-13679 is a PDFium-related issue in Google Chrome/Chromium where insufficient policy enforcement allowed a crafted PDF to trigger print dialogs without user activation. Connected advisories (Fedora/Debian/Nessus) confirm the vulnerability and show remediation through upgrading Chromium/Ch...

CVE-2019-5870

CVE-2019-5870 is a use-after-free vulnerability in Chrome’s media handling, allowing a remote attacker to potentially escape the sandbox via a crafted HTML page. The issue affects Google Chrome prior to version 77.0.3865.75, where an object in the media path could be freed while still in use, ena...

CVE-2020-6510

CVE-2020-6510 describes a heap buffer overflow in Chrome/Chromium’s background fetch path (prior to 84.0.4147.89). A remote attacker could exploit this via a crafted HTML page to achieve heap corruption. The issue is publicly acknowledged across multiple advisories; remediation is to upgrade to C...

CVE-2020-6530

CVE-2020-6530 affects Google Chrome (Chromium-based) with an out-of-bounds memory access in Developer Tools prior to 84.0.4147.89. A user-assisted exploit via a crafted malicious extension could potentially cause heap corruption. The connected advisories indicate fixes in Chrome/Chromium branches...

CVE-2019-13697

CVE-2019-13697 is a cross-origin size leak in Google Chrome/Chromium prior to 77.0.3865.120. Connected sources confirm a fix in the 77.0.3865.120 release (and security advisories from Debian, Mageia, Arch Linux) for Chromium/Chrome, addressing the cross-origin information disclosure. Affected com...

CVE-2020-6482

CVE-2020-6482 describes an insufficient policy enforcement vulnerability in Chrome’s developer tools. The root cause is improper access control in the developer tools component, allowing a user who installs a crafted malicious extension to bypass navigation restrictions. This could enable a remot...

CVE-2022-0799

Technical details for CVE-2022-0799 are not publicly provided in the connected documents. Please monitor for updates from official advisories.

CVE-2020-6422

CVE-2020-6422 is a use-after-free vulnerability in WebGL of Google Chrome before 80.0.3987.149, enabling a remote attacker to potentially cause heap corruption via a crafted HTML page. Mitigation: upgrade Chromium/Chrome to 80.0.3987.149 or newer (reported in Debian/Fedora advisories and Gentoo/G...

CVE-2020-6469

CVE-2020-6469 concerns Google Chrome/Chromium's developer tools. The connected sources explicitly describe an "insufficient policy enforcement" issue in the developer tools before Chrome 83.0.4103.61, which could allow an attacker to persuade a user to install a malicious extension and potentiall...

CVE-2020-6487

CVE-2020-6487 corresponds to an access-restriction bypass in the downloads component of the Chromium/Google Chrome browser prior to version 83.0.4103.61. The issue is described as insufficient policy enforcement in downloads that allowed a remote attacker to bypass navigation restrictions via a c...

CVE-2020-6488

CVE-2020-6488 affects Google Chrome prior to 83.0.4103.61, with an insufficient policy enforcement in downloads that allows a remote attacker to bypass navigation restrictions via a crafted HTML page. Impact: navigation restriction bypass in downloads; attacker could potentially influence downloa...

CVE-2020-6495

CVE-2020-6495 refers to an insufficient policy enforcement vulnerability in Google Chrome’s Developer Tools prior to 83.0.4103.97. The issue, identified in multiple sources (CNVD-2020-32320; Arch Linux ASA-202006-3; Debian/ Gentoo advisories), enables a threat actor to exploit a crafted Chrome ex...

CVE-2023-4572

CVE-2023-4572 is a use-after-free vulnerability in Chrome/Chromium's MediaStream that could allow remote code execution via a crafted HTML page, caused by heap corruption. The CVE affects Chrome/Chromium browsers before the referenced fix version 116.0.5845.140. Public updates released by Debian ...

CVE-2025-5063

CVE-2025-5063 is a use-after-free in Chromes’s Compositing component, exploitable via a crafted HTML page on Google Chrome before version 137.0.7151.55. The issue could lead to heap corruption and is addressed in the Chrome 137 stable update (Linux/Windows/macOS). Affected product: Google Chrome ...

CVE-2019-5817

CVE-2019-5817 is a heap buffer overflow in ANGLE used by Google Chrome on Windows, prior to Chrome 74.0.3729.108. The issue could allow a remote attacker to cause heap corruption via a crafted HTML page. Affected component: ANGLE in Chrome (Windows). Root cause per the linked records is a heap bu...

CVE-2022-1641

CVE-2022-1641 is a use-after-free in Web UI Diagnostics affecting Google Chrome/Chromium on Chrome OS and related Chromium builds. The underlying issue permits heap corruption via specific user interactions, with a High severity (CVSS v3.1 base score 8.8; Privileges None; User interaction require...

CVE-2019-13676

CVE-2019-13676 affects Chromium/Google Chrome and is described as an error in a certificate warning, contributing to domain spoofing scenarios. Public sources in the connected docs tie this to the Chromium/Chrome 78 updates that fixed this issue (e.g., CVEs tracked in Fedora/Debian advisories). T...

CVE-2019-5776

CVE-2019-5776 affects Google Chrome’s Omnibox (URL bar): a correctness flaw in handling confusable characters in domain names allows a remote attacker to spoof the displayed URL. Affected software: Chrome before 72.0.3626.81. Impact: spoofed Omnibox content (phishing risk). Remediation: upgrade t...

CVE-2020-6378

CVE-2020-6378 affects Google Chrome/Chromium’s speech recognition components, where a use-after-free in the speech recognizer can enable remote code execution. The vulnerability exists in Chromium/Chrome builds prior to version 79.0.3945.130, as indicated by the CVE description and multiple vendo...