Chrome Security Vulnerabilities and Issues — Chrome CVE List

Lucene search

GoogleChrome

154 matches found

CVE•added 2017/10/27 5:29 a.m.•1001 views

CVE-2017-5070

Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

8.8CVSS8.5AI score0.74537EPSS

CVE•added 2017/01/19 5:59 a.m.•986 views

CVE-2016-5198

V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac included incorrect optimisation assumptions, which allowed a remote attacker to perform arbitrary read/write operations, leading to code execution, via a crafted HTML page.

8.8CVSS7.1AI score0.64317EPSS

CVE•added 2017/04/24 11:59 p.m.•979 views

CVE-2017-5030

Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.2987.108 for Android allowed a remote attacker to execute arbitrary code via a crafted HTML page.

8.8CVSS8.2AI score0.60705EPSS

CVE•added 2017/04/24 11:59 p.m.•180 views

CVE-2017-5029

The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android, lacked a check for integer overflow during a size calculation, which allowed a remote attacker to perform an out of bou...

8.8CVSS7.6AI score0.02655EPSS

CVE•added 2017/01/19 5:59 a.m.•113 views

CVE-2016-5199

An off by one error resulting in an allocation of zero size in FFmpeg in Google Chrome prior to 54.0.2840.98 for Mac, and 54.0.2840.99 for Windows, and 54.0.2840.100 for Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted video file.

8.8CVSS8.5AI score0.0072EPSS

CVE•added 2017/10/27 5:29 a.m.•110 views

CVE-2017-5110

Inappropriate implementation of the web payments API on blob: and data: schemes in Web Payments in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to spoof the contents of the Omnibox via a crafted HTML page.

6.5CVSS6.1AI score0.01066EPSS

CVE•added 2017/10/27 5:29 a.m.•109 views

CVE-2017-5089

Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 59.0.3071.104 for Mac allowed a remote attacker to perform domain spoofing via a crafted domain name.

6.5CVSS6.5AI score0.00709EPSS

CVE•added 2017/10/27 5:29 a.m.•109 views

CVE-2017-5094

Type confusion in extensions JavaScript bindings in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to potentially maliciously modify objects via a crafted HTML page.

6.5CVSS6.4AI score0.00985EPSS

CVE•added 2017/02/17 7:59 a.m.•106 views

CVE-2017-5024

FFmpeg in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, failed to perform proper bounds checking, which allowed a remote attacker to potentially exploit heap corruption via a crafted video file.

5.5CVSS6.3AI score0.00354EPSS

CVE•added 2017/10/27 5:29 a.m.•106 views

CVE-2017-5069

Incorrect MIME type of XSS-Protection reports in Blink in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac, and 58.0.3029.83 for Android, allowed a remote attacker to circumvent Cross-Origin Resource Sharing checks via a crafted HTML page.

6.1CVSS6.3AI score0.00522EPSS

CVE•added 2017/10/27 5:29 a.m.•106 views

CVE-2017-5088

Insufficient validation of untrusted input in V8 in Google Chrome prior to 59.0.3071.104 for Mac, Windows, and Linux, and 59.0.3071.117 for Android, allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.

8.8CVSS8AI score0.00911EPSS

CVE•added 2017/02/17 7:59 a.m.•102 views

CVE-2017-5025

5.5CVSS6.3AI score0.0037EPSS

CVE•added 2017/10/27 5:29 a.m.•99 views

CVE-2017-5061

A race condition in navigation in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.

5.3CVSS5.4AI score0.00465EPSS

CVE•added 2017/10/27 5:29 a.m.•96 views

CVE-2017-5062

A use after free in Chrome Apps in Google Chrome prior to 58.0.3029.81 for Mac, Windows, and Linux, and 58.0.3029.83 for Android, allowed a remote attacker to potentially perform out of bounds memory access via a crafted Chrome extension.

8.8CVSS8.3AI score0.00985EPSS

CVE•added 2017/10/27 5:29 a.m.•95 views

CVE-2017-5059

Type confusion in Blink in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac, and 58.0.3029.83 for Android, allowed a remote attacker to potentially obtain code execution via a crafted HTML page.

8.8CVSS8.2AI score0.02491EPSS

CVE•added 2017/10/27 5:29 a.m.•94 views

CVE-2017-5122

Inappropriate use of table size handling in V8 in Google Chrome prior to 61.0.3163.100 for Windows allowed a remote attacker to trigger out-of-bounds access via a crafted HTML page.

8.8CVSS7.9AI score0.01484EPSS

CVE•added 2017/04/24 11:59 p.m.•93 views

CVE-2017-5045

XSS Auditor in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed detection of a blocked iframe load, which allowed a remote attacker to brute force JavaScript variables via a crafted HTML page.

6.1CVSS4.7AI score0.00854EPSS

CVE•added 2017/10/27 5:29 a.m.•93 views

CVE-2017-5056

A use after free in Blink in Google Chrome prior to 57.0.2987.133 for Linux, Windows, and Mac, and 57.0.2987.132 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

8.8CVSS8.5AI score0.00911EPSS

CVE•added 2017/10/27 5:29 a.m.•93 views

CVE-2017-5093

Inappropriate implementation in modal dialog handling in Blink in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to prevent a full screen warning from being displayed via a crafted HTML page.

6.5CVSS6.3AI score0.01156EPSS

CVE•added 2017/10/27 5:29 a.m.•92 views

CVE-2017-5071

Insufficient validation of untrusted input in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows and Mac, and 59.0.3071.92 for Android allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

6.8CVSS6.3AI score0.00782EPSS

CVE•added 2017/04/24 6:59 a.m.•91 views

CVE-2014-9654

The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before 2014-12-03, as used in Google Chrome before 40.0.2214.91, calculates certain values without ensuring that they can be represented in a 24-bit field, which allows remote attackers to cause a denial of serv...

9.8CVSS9.6AI score0.02277EPSS

CVE•added 2017/10/27 5:29 a.m.•91 views

CVE-2017-5060

Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 58.0.3029.81 for Mac, Windows, and Linux, and 58.0.3029.83 for Android, allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.

6.5CVSS6.5AI score0.00688EPSS

CVE•added 2017/10/27 5:29 a.m.•91 views

CVE-2017-5116

Type confusion in V8 in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

8.8CVSS8.5AI score0.55771EPSS

CVE•added 2017/10/27 5:29 a.m.•91 views

CVE-2017-5119

Use of an uninitialized value in Skia in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

4.3CVSS4.9AI score0.00909EPSS

CVE•added 2017/01/19 5:59 a.m.•90 views

CVE-2016-5200

V8 in Google Chrome prior to 54.0.2840.98 for Mac, and 54.0.2840.99 for Windows, and 54.0.2840.100 for Linux, and 55.0.2883.84 for Android incorrectly applied type rules, which allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

8.8CVSS8.4AI score0.02668EPSS

CVE•added 2017/10/27 5:29 a.m.•90 views

CVE-2017-5121

Inappropriate use of JIT optimisation in V8 in Google Chrome prior to 61.0.3163.100 for Linux, Windows, and Mac allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page, related to the escape analysis phase.

8.8CVSS8.6AI score0.03642EPSS

CVE•added 2017/10/27 5:29 a.m.•89 views

CVE-2017-5058

A use after free in PrintPreview in Google Chrome prior to 58.0.3029.81 for Windows allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.

8.8CVSS8.3AI score0.00985EPSS

CVE•added 2017/10/27 5:29 a.m.•89 views

CVE-2017-5107

A timing attack in SVG rendering in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to extract pixel values from a cross-origin page being iframe'd via a crafted HTML page.

5.3CVSS5.6AI score0.00586EPSS

CVE•added 2017/04/24 11:59 p.m.•88 views

CVE-2017-5046

V8 in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android had insufficient policy enforcement, which allowed a remote attacker to spoof the location object via a crafted HTML page, related to Blink information disclosure.

4.3CVSS4.5AI score0.01156EPSS

CVE•added 2017/10/27 5:29 a.m.•88 views

CVE-2017-5053

An out-of-bounds read in V8 in Google Chrome prior to 57.0.2987.133 for Linux, Windows, and Mac, and 57.0.2987.132 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page, related to Array.prototype.indexOf.

9.6CVSS8.8AI score0.01386EPSS

CVE•added 2017/10/27 5:29 a.m.•88 views

CVE-2017-5054

An out-of-bounds read in V8 in Google Chrome prior to 57.0.2987.133 for Linux, Windows, and Mac, and 57.0.2987.132 for Android, allowed a remote attacker to obtain heap memory contents via a crafted HTML page.

8.8CVSS8AI score0.00543EPSS

CVE•added 2017/10/27 5:29 a.m.•88 views

CVE-2017-5079

Inappropriate implementation in Blink in Google Chrome prior to 59.0.3071.86 for Mac, Windows, and Linux, and 59.0.3071.92 for Android, allowed a remote attacker to display UI on a non attacker controlled tab via a crafted HTML page.

4.3CVSS4.9AI score0.00709EPSS

CVE•added 2017/10/27 5:29 a.m.•88 views

CVE-2017-5092

Insufficient validation of untrusted input in PPAPI Plugins in Google Chrome prior to 60.0.3112.78 for Windows allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.

8.8CVSS8.2AI score0.01484EPSS

CVE•added 2017/04/24 11:59 p.m.•87 views

CVE-2017-5031

A use after free in ANGLE in Google Chrome prior to 57.0.2987.98 for Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

8.8CVSS8.2AI score0.00878EPSS

CVE•added 2017/04/24 11:59 p.m.•87 views

CVE-2017-5033

Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android failed to correctly propagate CSP restrictions to local scheme pages, which allowed a remote attacker to bypass content security policy via a crafted HTML page, related to the unsafe-inline keywor...

4.3CVSS4.8AI score0.00606EPSS

CVE•added 2017/04/24 11:59 p.m.•87 views

CVE-2017-5037

An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to perform an out of bounds memory write via a crafted video file, related to ChunkDemuxer.

7.8CVSS7.6AI score0.00279EPSS

CVE•added 2017/10/27 5:29 a.m.•87 views

CVE-2017-5109

Inappropriate implementation of unload handler handling in permission prompts in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to display UI on a non attacker controlled tab via a crafted HTML page.

4.3CVSS5AI score0.01156EPSS

CVE•added 2017/10/27 5:29 a.m.•86 views

CVE-2017-5068

Incorrect handling of picture ID in WebRTC in Google Chrome prior to 58.0.3029.96 for Mac, Windows, and Linux allowed a remote attacker to trigger a race condition via a crafted HTML page.

7.5CVSS7.1AI score0.00415EPSS

CVE•added 2017/10/27 5:29 a.m.•85 views

CVE-2017-5108

Type confusion in PDFium in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to potentially maliciously modify objects via a crafted PDF file.

8.8CVSS7.8AI score0.00839EPSS

CVE•added 2017/01/19 5:59 a.m.•84 views

CVE-2016-5203

A use after free in PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.

8.8CVSS8.8AI score0.00543EPSS

CVE•added 2017/04/24 11:59 p.m.•84 views

CVE-2017-5044

Heap buffer overflow in filter processing in Skia in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

6.8CVSS6.6AI score0.01061EPSS

CVE•added 2017/10/27 5:29 a.m.•84 views

CVE-2017-5087

A use after free in Blink in Google Chrome prior to 59.0.3071.104 for Mac, Windows, and Linux, and 59.0.3071.117 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page, aka an IndexedDB sandbox escape.

8.8CVSS8.4AI score0.00911EPSS

CVE•added 2017/02/17 7:59 a.m.•83 views

CVE-2017-5026

Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, failed to prevent alerts from being displayed by swapped out frames, which allowed a remote attacker to show alerts on a page they don't control via a crafted HTML page.

4.3CVSS5.1AI score0.00584EPSS

CVE•added 2017/10/27 5:29 a.m.•83 views

CVE-2017-5083

4.3CVSS4.9AI score0.00709EPSS

CVE•added 2017/04/24 11:59 p.m.•82 views

CVE-2017-5043

Chrome Apps in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac had a use after free bug in GuestView, which allowed a remote attacker to perform an out of bounds memory read via a crafted Chrome extension.

8.8CVSS8.2AI score0.01098EPSS

CVE•added 2017/10/27 5:29 a.m.•82 views

CVE-2017-5055

A use after free in printing in Google Chrome prior to 57.0.2987.133 for Linux and Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

9.3CVSS8.5AI score0.00705EPSS

CVE•added 2017/10/27 5:29 a.m.•82 views

CVE-2017-5111

A use after free in PDFium in Google Chrome prior to 61.0.3163.79 for Linux, Windows, and Mac allowed a remote attacker to potentially exploit memory corruption via a crafted PDF file.

8.8CVSS8.5AI score0.01484EPSS

CVE•added 2017/04/24 11:59 p.m.•81 views

CVE-2017-5035

Google Chrome prior to 57.0.2987.98 for Windows and Mac had a race condition, which could cause Chrome to display incorrect certificate information for a site.

8.1CVSS7.7AI score0.00435EPSS

CVE•added 2017/04/24 11:59 p.m.•81 views

CVE-2017-5038

6.8CVSS6.7AI score0.00942EPSS

CVE•added 2017/10/27 5:29 a.m.•81 views

CVE-2017-5117

Use of an uninitialized value in Skia in Google Chrome prior to 61.0.3163.79 for Linux and Windows allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

6.5CVSS6.3AI score0.00765EPSS

Total number of security vulnerabilities154