Google Chrome vulnerabilities

CVE-2018-6119 [MEDIUM] CWE-20 CVE-2018-6119: Incorrect security UI in Omnibox in Google Chrome prior to 64.0.3282.119 allowed a remote attacker t Incorrect security UI in Omnibox in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.

CVE-2018-16069 [MEDIUM] CWE-125 CVE-2018-16069: Unintended floating-point error accumulation in SwiftShader in Google Chrome prior to 69.0.3497.81 a Unintended floating-point error accumulation in SwiftShader in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

CVE-2019-5802 [MEDIUM] CVE-2019-5802: Incorrect handling of download origins in Navigation in Google Chrome prior to 73.0.3683.75 allowed Incorrect handling of download origins in Navigation in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page.

CVE-2018-6159 [MEDIUM] CWE-200 CVE-2018-6159: Insufficient policy enforcement in ServiceWorker in Google Chrome prior to 68.0.3440.75 allowed a re Insufficient policy enforcement in ServiceWorker in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

CVE-2018-6168 [MEDIUM] CWE-200 CVE-2018-6168: Information leak in media engine in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to Information leak in media engine in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

CVE-2020-6503 [MEDIUM] CWE-209 CVE-2020-6503: Inappropriate implementation in accessibility in Google Chrome prior to 74.0.3729.108 allowed a remo Inappropriate implementation in accessibility in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

CVE-2019-13678 [MEDIUM] CVE-2019-13678: Incorrect data validation in downloads in Google Chrome prior to 77.0.3865.75 allowed a remote attac Incorrect data validation in downloads in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page.

CVE-2017-5066 [MEDIUM] CWE-347 CVE-2017-5066: Insufficient consistency checks in signature handling in the networking stack in Google Chrome prior Insufficient consistency checks in signature handling in the networking stack in Google Chrome prior to 58.0.3029.81 for Mac, Windows, and Linux, and 58.0.3029.83 for Android, allowed a remote attacker to incorrectly accept a badly formed X.509 certificate via a crafted HTML page.

CVE-2019-5857 [MEDIUM] CWE-787 CVE-2019-5857: Inappropriate implementation in JavaScript in Google Chrome prior to 76.0.3809.87 allowed a remote a Inappropriate implementation in JavaScript in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page.

CVE-2018-6155 [MEDIUM] CWE-416 CVE-2018-6155: Incorrect handling of frames in the VP8 parser in Google Chrome prior to 68.0.3440.75 allowed a remo Incorrect handling of frames in the VP8 parser in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted video file.

CVE-2017-5019 [MEDIUM] CWE-416 CVE-2017-5019: A use after free in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 A use after free in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVE-2013-6659 [MEDIUM] CWE-310 CVE-2013-6659: The SSLClientSocketNSS::Core::OwnAuthCertHandler function in net/socket/ssl_client_socket_nss.cc in The SSLClientSocketNSS::Core::OwnAuthCertHandler function in net/socket/ssl_client_socket_nss.cc in Google Chrome before 33.0.1750.117 does not prevent changes to server X.509 certificates during renegotiations, which allows remote SSL servers to trigger use of a new certificate chain, inconsistent with the user's expectations, by initiating a TLS rene

CVE-2019-5754 [MEDIUM] CWE-327 CVE-2019-5754: Implementation error in QUIC Networking in Google Chrome prior to 72.0.3626.81 allowed an attacker r Implementation error in QUIC Networking in Google Chrome prior to 72.0.3626.81 allowed an attacker running or able to cause use of a proxy server to obtain cleartext of transport encryption via malicious network proxy.

CVE-2019-5848 [MEDIUM] CWE-312 CVE-2019-5848: Incorrect font handling in autofill in Google Chrome prior to 75.0.3770.142 allowed a remote attacke Incorrect font handling in autofill in Google Chrome prior to 75.0.3770.142 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

CVE-2018-20070 [MEDIUM] CWE-20 CVE-2018-20070: Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.

CVE-2017-5090 [MEDIUM] CWE-20 CVE-2017-5090: Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 59.0.3071.115 for Mac allowed a Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 59.0.3071.115 for Mac allowed a remote attacker to perform domain spoofing via a crafted domain name containing a U+0620 character, aka Apple rdar problem 32458012.

CVE-2024-3847 [MEDIUM] CWE-79 CVE-2024-3847: Insufficient policy enforcement in WebUI in Google Chrome prior to 124.0.6367.60 allowed a remote at Insufficient policy enforcement in WebUI in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)

CVE-2013-6802 [MEDIUM] CVE-2013-6802: Google Chrome before 31.0.1650.57 allows remote attackers to bypass intended sandbox restrictions by Google Chrome before 31.0.1650.57 allows remote attackers to bypass intended sandbox restrictions by leveraging access to a renderer process, as demonstrated during a Mobile Pwn2Own competition at PacSec 2013, a different vulnerability than CVE-2013-6632.

CVE-2026-17966 [MEDIUM] CWE-200 CVE-2026-17966: Inappropriate implementation in Views in Google Chrome on Mac prior to 151.0.7922.72 allowed a local Inappropriate implementation in Views in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-17996 [MEDIUM] CWE-284 CVE-2026-17996: Inappropriate implementation in Browser in Google Chrome on Mac prior to 151.0.7922.72 allowed a loc Inappropriate implementation in Browser in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to bypass navigation restrictions via a malicious file. (Chromium security severity: Low)