Google Chrome vulnerabilities

CVE-2011-5319 [MEDIUM] CWE-264 CVE-2011-5319: content/renderer/device_sensors/device_motion_event_pump.cc in Google Chrome before 41.0.2272.76 doe content/renderer/device_sensors/device_motion_event_pump.cc in Google Chrome before 41.0.2272.76 does not properly restrict access to high-rate accelerometer data, which makes it easier for remote attackers to capture keystrokes via a crafted web site that listens for ondevicemotion events, a different vulnerability than CVE-2015-1231.

CVE-2012-5146 [MEDIUM] CWE-264 CVE-2012-5146: Google Chrome before 24.0.1312.52 allows remote attackers to bypass the Same Origin Policy via a mal Google Chrome before 24.0.1312.52 allows remote attackers to bypass the Same Origin Policy via a malformed URL.

CVE-2013-2872 [MEDIUM] CVE-2013-2872: Google Chrome before 28.0.1500.71 on Mac OS X does not ensure a sufficient source of entropy for ren Google Chrome before 28.0.1500.71 on Mac OS X does not ensure a sufficient source of entropy for renderer processes, which might make it easier for remote attackers to defeat cryptographic protection mechanisms in third-party components via unspecified vectors.

CVE-2019-5779 [MEDIUM] CWE-862 CVE-2019-5779: Insufficient policy validation in ServiceWorker in Google Chrome prior to 72.0.3626.81 allowed a rem Insufficient policy validation in ServiceWorker in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.

CVE-2013-6642 [MEDIUM] CVE-2013-6642: Google Chrome through 32.0.1700.23 on Android allows remote attackers to spoof the address bar via u Google Chrome through 32.0.1700.23 on Android allows remote attackers to spoof the address bar via unspecified vectors.

CVE-2018-6082 [MEDIUM] CWE-200 CVE-2018-6082: Including port 22 in the list of allowed FTP ports in Networking in Google Chrome prior to 65.0.3325 Including port 22 in the list of allowed FTP ports in Networking in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially enumerate internal host services via a crafted HTML page.

CVE-2017-5065 [MEDIUM] CWE-20 CVE-2017-5065: Lack of an appropriate action on page navigation in Blink in Google Chrome prior to 58.0.3029.81 for Lack of an appropriate action on page navigation in Blink in Google Chrome prior to 58.0.3029.81 for Windows and Mac allowed a remote attacker to potentially confuse a user into making an incorrect security decision via a crafted HTML page.

CVE-2015-6779 [MEDIUM] CWE-264 CVE-2015-6779: PDFium, as used in Google Chrome before 47.0.2526.73, does not properly restrict use of chrome: URLs PDFium, as used in Google Chrome before 47.0.2526.73, does not properly restrict use of chrome: URLs, which allows remote attackers to bypass intended scheme restrictions via a crafted PDF document, as demonstrated by a document with a link to a chrome://settings URL.

CVE-2026-11281 [MEDIUM] CWE-472 CVE-2026-11281: Integer overflow in Chromoting in Google Chrome on Windows prior to 149.0.7827.53 allowed a local at Integer overflow in Chromoting in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to obtain potentially sensitive information from process memory via a crafted ETW event. (Chromium security severity: Low)

CVE-2011-3054 [MEDIUM] CWE-269 CVE-2011-3054: The WebUI privilege implementation in Google Chrome before 17.0.963.83 does not properly perform iso The WebUI privilege implementation in Google Chrome before 17.0.963.83 does not properly perform isolation, which allows remote attackers to bypass intended access restrictions via unspecified vectors.

CVE-2020-6437 [MEDIUM] CVE-2020-6437: Inappropriate implementation in WebView in Google Chrome prior to 81.0.4044.92 allowed a remote atta Inappropriate implementation in WebView in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to spoof security UI via a crafted application.

CVE-2015-1281 [MEDIUM] CWE-254 CVE-2015-1281: core/loader/ImageLoader.cpp in Blink, as used in Google Chrome before 44.0.2403.89, does not properl core/loader/ImageLoader.cpp in Blink, as used in Google Chrome before 44.0.2403.89, does not properly determine the V8 context of a microtask, which allows remote attackers to bypass Content Security Policy (CSP) restrictions by providing an image from an unintended source.

CVE-2011-2877 [MEDIUM] CVE-2011-2877: Google Chrome before 14.0.835.202 does not properly handle SVG text, which allows remote attackers t Google Chrome before 14.0.835.202 does not properly handle SVG text, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to "stale font."

CVE-2011-1108 [MEDIUM] CVE-2011-1108: Google Chrome before 9.0.597.107 does not properly implement JavaScript dialogs, which allows remote Google Chrome before 9.0.597.107 does not properly implement JavaScript dialogs, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted HTML document.

CVE-2011-1118 [MEDIUM] CWE-20 CVE-2011-1118: Google Chrome before 9.0.597.107 does not properly handle TEXTAREA elements, which allows remote att Google Chrome before 9.0.597.107 does not properly handle TEXTAREA elements, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted HTML document.

CVE-2020-6527 [MEDIUM] CWE-276 CVE-2020-6527: Insufficient policy enforcement in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attac Insufficient policy enforcement in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy via a crafted HTML page.

CVE-2021-30589 [MEDIUM] CWE-20 CVE-2021-30589: Insufficient validation of untrusted input in Sharing in Google Chrome prior to 92.0.4515.107 allowe Insufficient validation of untrusted input in Sharing in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to bypass navigation restrictions via a crafted click-to-call link.

CVE-2012-2894 [MEDIUM] CWE-399 CVE-2012-2894: Google Chrome before 22.0.1229.79 does not properly handle graphics-context data structures, which a Google Chrome before 22.0.1229.79 does not properly handle graphics-context data structures, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via unknown vectors.

CVE-2011-1448 [MEDIUM] CWE-20 CVE-2011-1448: Google Chrome before 11.0.696.57 does not properly perform height calculations, which allows remote Google Chrome before 11.0.696.57 does not properly perform height calculations, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."

CVE-2011-1441 [MEDIUM] CWE-704 CVE-2011-1441: Google Chrome before 11.0.696.57 does not properly perform a cast of an unspecified variable during Google Chrome before 11.0.696.57 does not properly perform a cast of an unspecified variable during handling of floating select lists, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted HTML document.