CVE-2019-5787

CVE-2019-5787 is a use-after-free in the Canvas component of Chromium-based Chrome/Blink (pre-73.0.3683.75). The issue allows a remote attacker to potentially trigger heap corruption via a crafted HTML page. Connected sources also describe related CVEs (5788–5799) in FileAPI, WebMIDI, V8, PDFium,...

CVE-2019-5799

CVE-2019-5799 is a CSP bypass in Chromium/Google Chrome via blob URLs, affecting versions before 73.0.3683.75. Root cause: content security policy bypass in CSP handling for blob URLs. Impact: remote attacker could bypass CSP and access restricted content. Remediation: upgrade to Chromium/Chrome ...

CVE-2019-5836

CVE-2019-5836 : A heap buffer overflow in ANGLE within Google Chrome prior to 75.0.3770.80 could allow a remote attacker to cause heap corruption via a crafted HTML page. Connected sources corroborate ANGLE/Chrome scope and advise upgrading to a fixed version; Debian advisories list numerous Chro...

CVE-2019-5869

CVE-2019-5869 : Use-after-free in Blink in Google Chrome/Chromium before 76.0.3809.132 allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. Mitigation endorsed by multiple vendors: update to patched Chrome/Chromium builds (e.g., Chrome 76.0.3809.132 or later; D...

CVE-2019-5795

CVE-2019-5795 is an integer overflow in the PDFium component of Google Chrome/Chromium prior to 73.0.3683.75. A crafted PDF file could trigger out-of-bounds memory access. Public sources confirm the PDFium overflow issue; Debian and Arch advisories indicate the fix is in 73.0.3683.75. Remediation...

CVE-2020-6451

CVE-2020-6451 is a use-after-free vulnerability in Chrome/Chromium’s WebAudio implementation, prior to version 80.0.3987.162. The issue can allow a remote attacker to potentially cause heap corruption and execute arbitrary code through a crafted HTML page. Public reports across multiple feeds (Ar...

CVE-2022-1477

CVE-2022-1477 is a use-after-free in Vulkan found in Google Chrome prior to 101.0.4951.41, potentially enabling heap corruption via a crafted HTML page. The incident is documented in the Chrome stable-channel release notes and related advisories, which indicate this was part of a broader set of C...

CVE-2019-5813

CVE-2019-5813 is an out-of-bounds read vulnerability in the V8 JavaScript engine of Chromium/Google Chrome, present in versions prior to 74.0.3729.108. The issue is rooted in the V8 component and could enable information disclosure or heap-related effects as described in vendor advisories. Remedi...

CVE-2019-5842

CVE-2019-5842: Use-after-free in Blink within Google Chrome prior to 75.0.3770.90 (Chrome/Chromium). Affected component is Blink/WebKit; underlying issue reported as a memory handling bug leading to potential heap corruption. Public details across connected documents indicate fixed/updated Chromi...

CVE-2021-30535

CVE-2021-30535: A double-free in the ICU component of the Chromium browser (Chromium/Google Chrome) before version 91.0.4472.77. The linked connected documents confirm the root cause as a double-free in ICU, enabling a remote attacker to potentially perform heap corruption and, per the consolidat...

CVE-2022-0972

CVE-2022-0972 affects Google Chrome extensions and is caused by a use-after-free in the Extensions component prior to version 99.0.4844.74, potentially enabling heap corruption via a crafted HTML page if a user installs a malicious extension. The Chrome update (99.0.4844.74) mitigates this by app...

CVE-2020-6441

CVE-2020-6441 affects Chromium/Google Chrome prior to version 81.0.4044.92 and is described as an insufficient policy enforcement issue in the omnibox component, allowing a remote, crafted HTML page to bypass the security UI. Public advisories confirm the vulnerability as a policy‑enforcement err...

CVE-2022-0809

CVE-2022-0809: Out-of-bounds memory access in WebXR on Chromium-based browsers (Chrome/Chromium) before version 99.0.4844.51 can enable heap corruption via a crafted HTML page. The vulnerability affects WebXR-related code paths in Chromium/WebKit/Blink. Impact is remote code execution/compromise ...

CVE-2024-7536

CVE-2024-7536 affects Chromium-based browsers (Google Chrome/Chromium) via a use-after-free in the WebAudio module, enabling potential heap corruption from a crafted HTML page. Affected versions are Chrome/Chromium before 127.0.6533.99; impact is high (C/H, I/H, A/H) with network access and user ...

CVE-2024-7973

CVE-2024-7973 is a reported heap buffer overflow in PDFium used by Google Chrome/Chromium, enabling a remote attacker to trigger an out-of-bounds memory read via a crafted PDF file. Affected software includes Chrome/Chromium prior to the 128.0.6613.84 fix (Linux, Windows, macOS). The underlying i...

CVE-2024-7974

CVE-2024-7974 affects Google Chrome/Chromium via Insufficient data validation in the V8 API, enabling potential heap corruption from a crafted Chrome Extension. Affected versions are Chrome before 128.0.6613.84 (Chromium/Chromium-derived builds). Debian security advisory confirms fixed in Chromiu...

CVE-2019-5792

CVE-2019-5792 : An integer overflow in the PDFium component of Chromium/Google Chrome before 73.0.3683.75 allows remote attackers to potentially cause out-of-bounds memory access via a crafted PDF file. Affected product: Chromium/Chrome (PDFium). Root cause: integer overflow in PDFium. Impact: re...

CVE-2019-5809

CVE-2019-5809 is a use-after-free in Blink/WebKit affecting Chromium-based browsers, specifically in the file chooser path. The vulnerability allows a remote attacker who has already compromised the renderer process to escalate privileges via a crafted HTML page. Technical details across connecte...

CVE-2019-5838

CVE-2019-5838 : Insufficient policy enforcement in Chrome extensions API allowed a user-went-through-a-malicious-extension attack to bypass file URI restrictions. Affected: Google Chrome/Chromium prior to 75.0.3770.80. Impact is that a crafted extension could enable access to file URIs that shoul...

CVE-2020-6526

CVE-2020-6526 affects Google Chrome before 84.0.4147.89. An inappropriate implementation in the iframe sandbox could allow a remote attacker to bypass navigation restrictions via a crafted HTML page. Public references in Debian and FreeBSD advisories align with a fixed version around 84.0.4147.89...

CVE-2022-0796

CVE-2022-0796 affects Google Chrome/Chromium via a Use-after-free in Media vulnerability present before version 99.0.4844.51 . The issue could allow a remote attacker to exploit a heap corruption condition through a crafted HTML page. Affected platforms include Chromium-based packages across dist...

CVE-2022-1478

CVE-2022-1478 is a use-after-free vulnerability in SwiftShader within Google Chrome (Chromium-based) prior to 101.0.4951.41. The issue could allow a remote attacker to potentially cause heap corruption via a crafted HTML page. The Chrome release notes confirm a fix in Chrome 101.0.4951.41 (and Ch...

CVE-2019-13686

CVE-2019-13686 affects Chromium/Google Chrome in offline page handling. The issue is a Use-after-Free in offline mode that can lead to heap corruption, exploitable via a crafted HTML page. Affected product family: Chromium/Chrome browsers; root cause: use-after-free in offline pages flow. Impact:...

CVE-2024-7534

Summary: CVE-2024-7534 describes a heap buffer overflow in the Layout component of Google Chrome/Chromium, exploitable through a crafted HTML page. The vulnerability affects Chromium-based Chrome before version 127.0.6533.99 and is listed with High severity (CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/...

CVE-2026-12457

CVE-2026-12457 affects Google Chrome extensions in the renderer prior to version 149.0.7827.155. The underlying issue is an inappropriate extension implementation that lets a remote attacker, who has already compromised the renderer process, bypass Chrome’s site isolation via a crafted HTML page....

CVE-2019-13680

This CVE affects Chromium/Google Chrome where an improper TLS implementation in Chrome prior to 77.0.3865.75 allowed an attacker to spoof the client’s IP address to websites via crafted TLS connections. The issue’s public fixes are reflected in Chromium/Chrome updates; Debian lists a security upd...

CVE-2019-5803

CVE-2019-5803 affects Google Chrome/Chromium prior to 73.0.3683.75. The issue is an insufficent Content Security Policy enforcement in Chrome’s CSP implementation, enabling a CSP bypass via crafted HTML content (including CSP bypass with Javascript URLs and related vectors cited in connected sour...

CVE-2020-6407

CVE-2020-6407 : Affected chromium-based browsers (Chromium/Google Chrome) before 80.0.3987.122 suffer an out-of-bounds memory access in streams , enabling a remote attacker to potentially cause heap corruption via a crafted HTML page. The related CVE-2020-6418 is a separate issue in V8 (type conf...

CVE-2020-6408

CVE-2020-6408 : The connected sources confirm an insufficient policy enforcement in CORS within Google Chrome/Chromium before version 80.0.3987.87. A local attacker could obtain potentially sensitive information by presenting a crafted HTML page, as described in multiple advisories (Debian, Arch ...

CVE-2023-5475

The CVE-2023-5475 issue is an Inappropriate implementation in DevTools of Google Chrome up to version 118.0.5993.70, allowing a user-assisted attacker who installs a crafted malicious extension to bypass discretionary access control. Impact: potential high integrity via extension-based bypass; ex...

CVE-2019-5818

CVE-2019-5818 affects Chromium/Google Chrome’s media reader component before version 74.0.3729.108. The root cause is an uninitialized value in media processing, which can allow a remote attacker to obtain potentially sensitive information from process memory via a crafted video file. Public advi...

CVE-2020-6479

CVE-2020-6479 affects Chromium/Google Chrome before 83.0.4103.61. Root cause: an inappropriate implementation in the sharing component could allow a remote attacker to spoof the security UI via a crafted HTML page. Impact: spoofed security UI and potential circumvention of security checks, as des...

CVE-2022-1641

CVE-2022-1641 is a use-after-free in Web UI Diagnostics affecting Google Chrome/Chromium on Chrome OS and related Chromium builds. The underlying issue permits heap corruption via specific user interactions, with a High severity (CVSS v3.1 base score 8.8; Privileges None; User interaction require...

CVE-2022-2295

The CVE-2022-2295 issue is a type confusion in V8 affecting Google Chrome/Chromium, prior to version 103.0.5060.114, enabling a remote attacker to potentially trigger heap corruption via a crafted HTML page. Public details across connected sources confirm the affected component as Chromium’s V8 e...

CVE-2023-5218

CVE-2023-5218: Use-after-free in Chrome/Chromium Site Isolation before 118.0.5993.70 can allow a remote attacker to cause heap corruption via a crafted HTML page. Affected: Google Chrome/Chromium (Chromium-derived). Impact as stated: high/critical. Root cause: use-after-free in Site Isolation log...

CVE-2019-13661

CVE-2019-13661 describes a UI spoofing vulnerability in Chromium-based Google Chrome prior to 77.0.3865.75, enabling a remote attacker to spoof notifications via a crafted HTML page. The initial description confirms the affected software (Chromium/Chrome) and the impact (notification spoofing in ...

CVE-2020-6456

CVE-2020-6456 affects the chromium/chrome browser family. The vulnerability is caused by insufficient validation of untrusted input in the clipboard, enabling a local attacker to bypass site isolation via crafted clipboard contents in affected builds prior to 81.0.4044.92. Public records in multi...

CVE-2022-0610

CVE-2022-0610 : Google Chrome before 98.0.4758.102 is affected by an Inappropriate implementation in the Gamepad API, enabling a remote attacker to potentially trigger heap corruption via a crafted HTML page. Technical details in connected documents confirm the vulnerability is tied to the Gamepa...

CVE-2022-1483

CVE-2022-1483 concerns a heap buffer overflow in WebGPU within Google Chrome/Chromium prior to 101.0.4951.41. The issue could allow a remote attacker who gains renderer process access to trigger heap corruption via a crafted HTML page. Affected software includes Chrome/Chromium and related builds...

CVE-2014-0497

CVE-2014-0497 is an Adobe Flash Player integer underflow vulnerability affecting multiple platforms (Windows/macOS/Linux) that enables remote code execution via unspecified vectors. The initial description confirms the affected version ranges (pre-11.7.700.261/11.8.x–12.x pre-12.0.0.44 on Windows...

CVE-2020-6392

CVE-2020-6392 describes an insufficient policy enforcement in the Extensions component of Chromium/Google Chrome, allowing an attacker who lures a user to install a crafted malicious extension to bypass navigation restrictions. Public advisories in connected documents indicate the issue affects C...

CVE-2023-0472

CVE-2023-0472 is a Chrome/WebRTC use-after-free vulnerability affecting Google Chrome prior to 109.0.5414.119. The issue, described as a use-after-free in WebRTC that could enable a remote attacker to cause heap corruption via a crafted HTML page, is rated High severity (CVSS 3.1: 8.8). The Chrom...

CVE-2025-5280

CVE-2025-5280 is a Google Chrome/Chromium vulnerability: an out-of-bounds write in V8 could enable heap corruption via a crafted HTML page, impacting Chrome versions prior to 137.0.7151.55. The Chrome security note confirms the fix in 137.0.7151.55 (Linux/Windows/Mac) and Debian security advisori...

CVE-2019-5820

CVE-2019-5820 is a PDFium-based integer overflow in Chromium/Google Chrome prior to 74.0.3729.108 that could allow a remote attacker to potentially trigger heap corruption via a crafted PDF. The issue is documented across multiple advisories (Debian DSA-4500, Arch Linux ASA-201904-12, Gentoo GLSA...

CVE-2020-6433

CVE-2020-6433 describes an insufficient policy enforcement vulnerability in the extensions component of Chromium/Google Chrome, allowing a remote attacker to bypass navigation restrictions via crafted HTML. This is part of a broader set of policy enforcement issues in Chromium 81.x. Debian/Arch/F...

CVE-2022-0807

CVE-2022-0807 refers to an inappropriate Autofill implementation in Google Chrome before 99.0.4844.51. A remote attacker could bypass navigation restrictions via a crafted HTML page. Public sources corroborate a Chrome/Chromium family impact and cite the fix in 99.0.4844.51 (Chromium-based browse...

CVE-2022-2156

CVE-2022-2156 is a Google Chrome vulnerability: Use-after-free in Core leading to potential heap corruption via a crafted HTML page, affecting Chrome before 103.0.5060.53. Debian reports the fix in chromium 103.0.5060.53-1~deb11u1, and Fedora updates Chromium to 103.0.5060.114-1.fcXX, indicating ...

CVE-2022-2852

CVE-2022-2852: Use-after-free in FedCM in Google Chrome before 104.0.5112.101 allows remote attackers to potentially exploit heap corruption via a crafted HTML page. Connected sources confirm the issue in Chrome’s FedCM code path and cite affected versions, with Debian noting fixes in 104.0.5112....

CVE-2020-6446

CVE-2020-6446 : In Chromium, an insufficient policy enforcement issue in the Trusted Types component allowed bypass of CSP via a crafted HTML page, affecting builds prior to 81.0.4044.92. This is described in multiple sources (Arch Linux ASA-202004-9, Debian DSA-4714-1, Gentoo GLSA-202004-09). Re...

CVE-2020-6459

Affected software: Google Chrome (payments implementation). Issue: a use-after-free in payments leads to potential heap corruption. Root cause: use-after-free in the payments code path as described in CVE-2020-6459. Impact: remote attacker could trigger arbitrary behavior via a crafted HTML page;...