Google Chrome vulnerabilities

CVE-2021-30543 [HIGH] CWE-416 CVE-2021-30543: Use after free in Tab Strip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced Use after free in Tab Strip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.

CVE-2021-30542 [HIGH] CWE-416 CVE-2021-30542: Use after free in Tab Strip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced Use after free in Tab Strip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.

CVE-2011-1805 [HIGH] CWE-704 CVE-2011-1805: Bad cast in CSS in Google Chrome prior to 11.0.0.0 allowed a remote attacker to potentially exploit Bad cast in CSS in Google Chrome prior to 11.0.0.0 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVE-2020-6419 [HIGH] CWE-787 CVE-2020-6419: Out of bounds write in V8 in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potent Out of bounds write in V8 in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVE-2022-0793 [HIGH] CWE-416 CVE-2022-0793: Use after free in Cast in Google Chrome prior to 99.0.4844.51 allowed an attacker who convinced a us Use after free in Cast in Google Chrome prior to 99.0.4844.51 allowed an attacker who convinced a user to install a malicious extension and engage in specific user interaction to potentially exploit heap corruption via a crafted Chrome Extension.

CVE-2022-1876 [HIGH] CWE-787 CVE-2022-1876: Heap buffer overflow in DevTools in Google Chrome prior to 102.0.5005.61 allowed an attacker who con Heap buffer overflow in DevTools in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.

CVE-2022-0798 [HIGH] CWE-416 CVE-2022-0798: Use after free in MediaStream in Google Chrome prior to 99.0.4844.51 allowed an attacker who convinc Use after free in MediaStream in Google Chrome prior to 99.0.4844.51 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension.

CVE-2022-0980 [HIGH] CWE-416 CVE-2022-0980: Use after free in New Tab Page in Google Chrome prior to 99.0.4844.74 allowed an attacker who convin Use after free in New Tab Page in Google Chrome prior to 99.0.4844.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via specific user interactions.

CVE-2022-1864 [HIGH] CWE-416 CVE-2022-1864: Use after free in WebApp Installs in Google Chrome prior to 102.0.5005.61 allowed an attacker who co Use after free in WebApp Installs in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension and specific user interaction.

CVE-2022-1865 [HIGH] CWE-416 CVE-2022-1865: Use after free in Bookmarks in Google Chrome prior to 102.0.5005.61 allowed an attacker who convince Use after free in Bookmarks in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension and specific user interaction.

CVE-2022-1863 [HIGH] CWE-416 CVE-2022-1863: Use after free in Tab Groups in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinc Use after free in Tab Groups in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension and specific user interaction.

CVE-2023-0474 [HIGH] CWE-416 CVE-2023-0474: Use after free in GuestView in Google Chrome prior to 109.0.5414.119 allowed an attacker who convinc Use after free in GuestView in Google Chrome prior to 109.0.5414.119 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a Chrome web app. (Chromium security severity: Medium)

CVE-2015-6792 [CRITICAL] CVE-2015-6792: The MIDI subsystem in Google Chrome before 47.0.2526.106 does not properly handle the sending of dat The MIDI subsystem in Google Chrome before 47.0.2526.106 does not properly handle the sending of data, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors, related to midi_manager.cc, midi_manager_alsa.cc, and midi_manager_mac.cc, a different vulnerability than CVE-2015-8664.

CVE-2010-1770 [CRITICAL] CWE-94 CVE-2010-1770: WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, Apple Safari before 4.1 WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, Apple Safari before 4.1 on Mac OS X 10.4, and Google Chrome before 5.0.375.70 does not properly handle a transformation of a text node that has the IBM1147 character set, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption

CVE-2026-11158 [HIGH] CWE-20 CVE-2026-11158: Insufficient validation of untrusted input in Downloads in Google Chrome on Mac prior to 149.0.7827. Insufficient validation of untrusted input in Downloads in Google Chrome on Mac prior to 149.0.7827.53 allowed a local attacker to potentially perform a sandbox escape via a crafted AppleScript command. (Chromium security severity: Medium)

CVE-2021-21177 [MEDIUM] CWE-732 CVE-2021-21177: Insufficient policy enforcement in Autofill in Google Chrome prior to 89.0.4389.72 allowed a remote Insufficient policy enforcement in Autofill in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

CVE-2018-6101 [HIGH] CWE-20 CVE-2018-6101: A lack of host validation in DevTools in Google Chrome prior to 66.0.3359.117 allowed a remote attac A lack of host validation in DevTools in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted HTML page, if the user is running a remote DevTools debugging server.

CVE-2024-11114 [HIGH] CVE-2024-11114: Inappropriate implementation in Views in Google Chrome on Windows prior to 131.0.6778.69 allowed a r Inappropriate implementation in Views in Google Chrome on Windows prior to 131.0.6778.69 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

CVE-2016-1633 [CRITICAL] CVE-2016-1633: Use-after-free vulnerability in Blink, as used in Google Chrome before 49.0.2623.75, allows remote a Use-after-free vulnerability in Blink, as used in Google Chrome before 49.0.2623.75, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

CVE-2024-10229 [HIGH] CVE-2024-10229: Inappropriate implementation in Extensions in Google Chrome prior to 130.0.6723.69 allowed a remote Inappropriate implementation in Extensions in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to bypass site isolation via a crafted Chrome Extension. (Chromium security severity: High)