Google Chrome vulnerabilities

CVE-2023-3737 [MEDIUM] CVE-2023-3737: Inappropriate implementation in Notifications in Google Chrome prior to 115.0.5790.98 allowed a remo Inappropriate implementation in Notifications in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to spoof the contents of media notifications via a crafted HTML page. (Chromium security severity: Medium)

CVE-2022-4182 [MEDIUM] CVE-2022-4182: Inappropriate implementation in Fenced Frames in Google Chrome prior to 108.0.5359.71 allowed a remo Inappropriate implementation in Fenced Frames in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass fenced frame restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVE-2022-2611 [MEDIUM] CVE-2022-2611: Inappropriate implementation in Fullscreen API in Google Chrome on Android prior to 104.0.5112.79 al Inappropriate implementation in Fullscreen API in Google Chrome on Android prior to 104.0.5112.79 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.

CVE-2020-6504 [MEDIUM] CWE-276 CVE-2020-6504: Insufficient policy enforcement in notifications in Google Chrome prior to 74.0.3729.108 allowed a r Insufficient policy enforcement in notifications in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to bypass notification restrictions via a crafted HTML page.

CVE-2022-3053 [MEDIUM] CVE-2022-3053: Inappropriate implementation in Pointer Lock in Google Chrome on Mac prior to 105.0.5195.52 allowed Inappropriate implementation in Pointer Lock in Google Chrome on Mac prior to 105.0.5195.52 allowed a remote attacker to restrict user navigation via a crafted HTML page.

CVE-2021-4316 [MEDIUM] CVE-2021-4316: Inappropriate implementation in Cast UI in Google Chrome prior to 96.0.4664.45 allowed a remote atta Inappropriate implementation in Cast UI in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to spoof browser UI via a crafted HTML page. (Chromium security severity: Low)

CVE-2023-1236 [MEDIUM] CVE-2023-1236: Inappropriate implementation in Internals in Google Chrome prior to 111.0.5563.64 allowed a remote a Inappropriate implementation in Internals in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to spoof the origin of an iframe via a crafted HTML page. (Chromium security severity: Low)

CVE-2024-7978 [MEDIUM] CWE-346 CVE-2024-7978: Insufficient policy enforcement in Data Transfer in Google Chrome prior to 128.0.6613.84 allowed a r Insufficient policy enforcement in Data Transfer in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2024-7975 [MEDIUM] CVE-2024-7975: Inappropriate implementation in Permissions in Google Chrome prior to 128.0.6613.84 allowed a remote Inappropriate implementation in Permissions in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

CVE-2022-4186 [MEDIUM] CWE-20 CVE-2022-4186: Insufficient validation of untrusted input in Downloads in Google Chrome prior to 108.0.5359.71 allo Insufficient validation of untrusted input in Downloads in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install a malicious extension to bypass Downloads restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVE-2024-7981 [MEDIUM] CWE-290 CVE-2024-7981: Inappropriate implementation in Views in Google Chrome prior to 128.0.6613.84 allowed a remote attac Inappropriate implementation in Views in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

CVE-2025-13634 [MEDIUM] CWE-290 CVE-2025-13634: Inappropriate implementation in Downloads in Google Chrome on Windows prior to 143.0.7499.41 allowed Inappropriate implementation in Downloads in Google Chrome on Windows prior to 143.0.7499.41 allowed a local attacker to bypass mark of the web via a crafted HTML page. (Chromium security severity: Medium)

CVE-2022-4189 [MEDIUM] CVE-2022-4189: Insufficient policy enforcement in DevTools in Google Chrome prior to 108.0.5359.71 allowed an attac Insufficient policy enforcement in DevTools in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. (Chromium security severity: Medium)

CVE-2024-0805 [MEDIUM] CWE-451 CVE-2024-0805: Inappropriate implementation in Downloads in Google Chrome prior to 121.0.6167.85 allowed a remote a Inappropriate implementation in Downloads in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to perform domain spoofing via a crafted domain name. (Chromium security severity: Medium)

CVE-2019-15684 [MEDIUM] CVE-2019-15684: Kaspersky Protection extension for web browser Google Chrome prior to 30.112.62.0 was vulnerable to Kaspersky Protection extension for web browser Google Chrome prior to 30.112.62.0 was vulnerable to unauthorized access to its features remotely that could lead to removing other installed extensions.

CVE-2022-2619 [MEDIUM] CWE-116 CVE-2022-2619: Insufficient validation of untrusted input in Settings in Google Chrome prior to 104.0.5112.79 allow Insufficient validation of untrusted input in Settings in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted HTML page.

CVE-2026-7941 [MEDIUM] CWE-20 CVE-2026-7941: Insufficient validation of untrusted input in Mobile in Google Chrome on Android prior to 148.0.7778 Insufficient validation of untrusted input in Mobile in Google Chrome on Android prior to 148.0.7778.96 allowed a local attacker to inject arbitrary scripts or HTML (UXSS) via a crafted Chrome Extension. (Chromium security severity: Medium)

CVE-2023-1225 [MEDIUM] CVE-2023-1225: Insufficient policy enforcement in Navigation in Google Chrome on iOS prior to 111.0.5563.64 allowed Insufficient policy enforcement in Navigation in Google Chrome on iOS prior to 111.0.5563.64 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVE-2023-1233 [MEDIUM] CVE-2023-1233: Insufficient policy enforcement in Resource Timing in Google Chrome prior to 111.0.5563.64 allowed a Insufficient policy enforcement in Resource Timing in Google Chrome prior to 111.0.5563.64 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from API via a crafted Chrome Extension. (Chromium security severity: Low)

CVE-2024-0810 [MEDIUM] CWE-284 CVE-2024-0810: Insufficient policy enforcement in DevTools in Google Chrome prior to 121.0.6167.85 allowed an attac Insufficient policy enforcement in DevTools in Google Chrome prior to 121.0.6167.85 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. (Chromium security severity: Medium)