Debian Chromium vulnerabilities

CVE-2023-1217 [MEDIUM] CVE-2023-1217: chromium - Stack buffer overflow in Crash reporting in Google Chrome on Windows prior to 11... Stack buffer overflow in Crash reporting in Google Chrome on Windows prior to 111.0.5563.64 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High) Scope: local bookworm: resolved (fixed in 111.0.5563.64-1) bullseye: resolved (fixed

CVE-2023-0132 [MEDIUM] CVE-2023-0132: chromium - Inappropriate implementation in in Permission prompts in Google Chrome on Window... Inappropriate implementation in in Permission prompts in Google Chrome on Windows prior to 109.0.5414.74 allowed a remote attacker to force acceptance of a permission prompt via a crafted HTML page. (Chromium security severity: Medium) Scope: local bookworm: resolved (fixed in 109.0.5414.74-1) bullseye: resolved (fixed in 109.0.5414.74-2~deb11u1) forky: resolved (f

CVE-2022-3047 [MEDIUM] CVE-2022-3047: chromium - Insufficient policy enforcement in Extensions API in Google Chrome prior to 105.... Insufficient policy enforcement in Extensions API in Google Chrome prior to 105.0.5195.52 allowed an attacker who convinced a user to install a malicious extension to bypass downloads policy via a crafted HTML page. Scope: local bookworm: resolved (fixed in 105.0.5195.52-1) bullseye: resolved (fixed in 105.0.5195.52-1~deb11u1) forky: resolved (fixed in 105.0.5195.5

CVE-2023-1226 [MEDIUM] CVE-2023-1226: chromium - Insufficient policy enforcement in Web Payments API in Google Chrome prior to 11... Insufficient policy enforcement in Web Payments API in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Medium) Scope: local bookworm: resolved (fixed in 111.0.5563.64-1) bullseye: resolved (fixed in 111.0.5563.64-1~deb11u1) forky: resolved (fixed in 111.0.5563.64-

CVE-2022-3314 [MEDIUM] CVE-2022-3314: chromium - Use after free in logging in Google Chrome prior to 106.0.5249.62 allowed a remo... Use after free in logging in Google Chrome prior to 106.0.5249.62 allowed a remote attacker who had compromised a WebUI process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) Scope: local bookworm: resolved (fixed in 106.0.5249.61-1) bullseye: resolved (fixed in 106.0.5249.61-1~deb11u1) forky: resolved (fixed i

CVE-2025-0440 [MEDIUM] CVE-2025-0440: chromium - Inappropriate implementation in Fullscreen in Google Chrome on Windows prior to ... Inappropriate implementation in Fullscreen in Google Chrome on Windows prior to 132.0.6834.83 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) Scope: local bookworm: resolved (fixed in 132.0.6834.83-1~deb12u1) bullseye: open forky: resolved (fixed in 132.0.6834.83-1) sid: resolved (fixed in 132.0.6834.83

CVE-2023-7011 [MEDIUM] CVE-2023-7011: chromium - Inappropriate implementation in Picture in Picture in Google Chrome prior to 119... Inappropriate implementation in Picture in Picture in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium) Scope: local bookworm: resolved (fixed in 119.0.6045.105-1~deb12u1) bullseye: resolved (fixed in 119.0.6045.105-1~deb11u1) forky: resolved (

CVE-2022-2616 [MEDIUM] CVE-2022-2616: chromium - Inappropriate implementation in Extensions API in Google Chrome prior to 104.0.5... Inappropriate implementation in Extensions API in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a malicious extension to spoof the contents of the Omnibox (URL bar) via a crafted Chrome Extension. Scope: local bookworm: resolved (fixed in 104.0.5112.79-1) bullseye: resolved (fixed in 104.0.5112.79-1~deb11u1) forky: resolve

CVE-2023-2314 [MEDIUM] CVE-2023-2314: chromium - Insufficient data validation in DevTools in Google Chrome prior to 111.0.5563.64... Insufficient data validation in DevTools in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low) Scope: local bookworm: resolved (fixed in 111.0.5563.64-1) bullseye: resolved (fixed in 111.0.5563.64-1~deb11u1) forky: resolved (fixed in 111.0.5563.64-1) sid: resolv

CVE-2025-0435 [MEDIUM] CVE-2025-0435: chromium - Inappropriate implementation in Navigation in Google Chrome on Android prior to ... Inappropriate implementation in Navigation in Google Chrome on Android prior to 132.0.6834.83 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: High) Scope: local bookworm: resolved (fixed in 132.0.6834.83-1~deb12u1) bullseye: open forky: resolved (fixed in 132.0.6834.83-1) sid: resolved (fixed in 132.0.6834.83-1

CVE-2024-6777 [MEDIUM] CVE-2024-6777: chromium - Use after free in Navigation in Google Chrome prior to 126.0.6478.182 allowed an... Use after free in Navigation in Google Chrome prior to 126.0.6478.182 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High) Scope: local bookworm: resolved (fixed in 126.0.6478.182-1~deb12u1) bullseye: open forky: resolved (fixed in 126.0.64

CVE-2024-0814 [MEDIUM] CVE-2024-0814: chromium - Incorrect security UI in Payments in Google Chrome prior to 121.0.6167.85 allowe... Incorrect security UI in Payments in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially spoof security UI via a crafted HTML page. (Chromium security severity: Medium) Scope: local bookworm: resolved (fixed in 121.0.6167.85-1~deb12u1) bullseye: open forky: resolved (fixed in 121.0.6167.85-1) sid: resolved (fixed in 121.0.6167.85-1) trixie

CVE-2020-36765 [MEDIUM] CVE-2020-36765: chromium - Insufficient policy enforcement in Navigation in Google Chrome prior to 85.0.418... Insufficient policy enforcement in Navigation in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) Scope: local bookworm: resolved (fixed in 87.0.4280.88-0.1) bullseye: resolved (fixed in 87.0.4280.88-0.1) forky: resolved (fixed in 87.0.4280.88-0.1) sid: resolved (

CVE-2024-11110 [MEDIUM] CVE-2024-11110: chromium - Inappropriate implementation in Extensions in Google Chrome prior to 131.0.6778.... Inappropriate implementation in Extensions in Google Chrome prior to 131.0.6778.69 allowed a remote attacker to bypass site isolation via a crafted Chrome Extension. (Chromium security severity: High) Scope: local bookworm: resolved (fixed in 131.0.6778.85-1~deb12u1) bullseye: open forky: resolved (fixed in 131.0.6778.85-1) sid: resolved (fixed in 131.0.6778.85-1

CVE-2024-5500 [MEDIUM] CVE-2024-5500: chromium - Inappropriate implementation in Sign-In in Google Chrome prior to 1.3.36.351 all... Inappropriate implementation in Sign-In in Google Chrome prior to 1.3.36.351 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium) Scope: local bookworm: resolved (fixed in 122.0.6261.57-1~deb12u1) bullseye: open forky: resolved (fixed in 122.0.6261.57-1) sid: resolved (fixed in 122.0.6261.57-1) tr

CVE-2025-0439 [MEDIUM] CVE-2025-0439: chromium - Race in Frames in Google Chrome prior to 132.0.6834.83 allowed a remote attacker... Race in Frames in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) Scope: local bookworm: resolved (fixed in 132.0.6834.83-1~deb12u1) bullseye: open forky: resolved (fixed in 132.0.6834.83-1) sid: resolved (fixed

CVE-2024-2884 [MEDIUM] CVE-2024-2884: chromium - Out of bounds read in V8 in Google Chrome prior to 121.0.6167.139 allowed a remo... Out of bounds read in V8 in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium) Scope: local bookworm: resolved (fixed in 121.0.6167.139-1~deb12u1) bullseye: open forky: resolved (fixed in 121.0.6167.139-1) sid: resolved (fixed in 121.0.6167.

CVE-2022-4909 [MEDIUM] CVE-2022-4909: chromium - Inappropriate implementation in XML in Google Chrome prior to 107.0.5304.62 allo... Inappropriate implementation in XML in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to potentially perform an ASLR bypass via a crafted HTML page. (Chromium security severity: Low) Scope: local bookworm: resolved (fixed in 107.0.5304.68-1) bullseye: resolved (fixed in 107.0.5304.68-1~deb11u1) forky: resolved (fixed in 107.0.5304.68-1) sid: resolve

CVE-2023-1235 [MEDIUM] CVE-2023-1235: chromium - Type confusion in DevTools in Google Chrome prior to 111.0.5563.64 allowed a rem... Type confusion in DevTools in Google Chrome prior to 111.0.5563.64 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted UI interaction. (Chromium security severity: Low) Scope: local bookworm: resolved (fixed in 111.0.5563.64-1) bullseye: resolved (fixed in 111.0.5563.64-1~deb11u1) forky: resolved (

CVE-2025-12436 [MEDIUM] CVE-2025-12436: chromium - Policy bypass in Extensions in Google Chrome prior to 142.0.7444.59 allowed an a... Policy bypass in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Chrome Extension. (Chromium security severity: Medium) Scope: local bookworm: resolved (fixed in 142.0.7444.59-1~deb12u1) bullseye: open forky: r