Google Chrome vulnerabilities

CVE-2019-13690 [CRITICAL] CWE-269 CVE-2019-13690: Inappropriate implementation in OS in Google Chrome on ChromeOS prior to 75.0.3770.80 allowed a remo Inappropriate implementation in OS in Google Chrome on ChromeOS prior to 75.0.3770.80 allowed a remote attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: High)

CVE-2018-6120 [HIGH] CWE-190 CVE-2018-6120: An integer overflow that could lead to an attacker-controlled heap out-of-bounds write in PDFium in An integer overflow that could lead to an attacker-controlled heap out-of-bounds write in PDFium in Google Chrome prior to 66.0.3359.170 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file.

CVE-2018-6088 [HIGH] CWE-20 CVE-2018-6088: An iterator-invalidation bug in PDFium in Google Chrome prior to 66.0.3359.117 allowed a remote atta An iterator-invalidation bug in PDFium in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file.

CVE-2024-7024 [CRITICAL] CWE-787 CVE-2024-7024: Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

CVE-2019-25154 [CRITICAL] CVE-2019-25154: Inappropriate implementation in iframe in Google Chrome prior to 77.0.3865.75 allowed a remote attac Inappropriate implementation in iframe in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-9875 [CRITICAL] CWE-125 CVE-2026-9875: Out of bounds read in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote att Out of bounds read in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVE-2021-4057 [HIGH] CWE-416 CVE-2021-4057: Use after free in file API in Google Chrome prior to 96.0.4664.93 allowed a remote attacker who had Use after free in file API in Google Chrome prior to 96.0.4664.93 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.

CVE-2010-0646 [CRITICAL] CWE-189 CVE-2010-0646: Multiple integer signedness errors in factory.cc in Google V8 before r3560, as used in Google Chrome Multiple integer signedness errors in factory.cc in Google V8 before r3560, as used in Google Chrome before 4.0.249.89, allow remote attackers to execute arbitrary code in the Chrome sandbox via crafted use of JavaScript arrays.

CVE-2021-30601 [HIGH] CWE-416 CVE-2021-30601: Use after free in Extensions API in Google Chrome prior to 92.0.4515.159 allowed an attacker who con Use after free in Extensions API in Google Chrome prior to 92.0.4515.159 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.

CVE-2021-21203 [HIGH] CWE-416 CVE-2021-21203: Use after free in Blink in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to potentia Use after free in Blink in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVE-2018-17457 [HIGH] CWE-416 CVE-2018-17457: An object lifecycle issue in Blink could lead to a use after free in WebAudio in Google Chrome prior An object lifecycle issue in Blink could lead to a use after free in WebAudio in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

CVE-2021-30556 [HIGH] CWE-416 CVE-2021-30556: Use after free in WebAudio in Google Chrome prior to 91.0.4472.114 allowed a remote attacker to pote Use after free in WebAudio in Google Chrome prior to 91.0.4472.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVE-2021-30578 [HIGH] CWE-908 CVE-2021-30578: Uninitialized use in Media in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to perf Uninitialized use in Media in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.

CVE-2021-30566 [HIGH] CWE-787 CVE-2021-30566: Stack buffer overflow in Printing in Google Chrome prior to 92.0.4515.107 allowed a remote attacker Stack buffer overflow in Printing in Google Chrome prior to 92.0.4515.107 allowed a remote attacker who had compromised the renderer process to potentially exploit stack corruption via a crafted HTML page.

CVE-2022-0797 [HIGH] CWE-787 CVE-2022-0797: Out of bounds memory access in Mojo in Google Chrome prior to 99.0.4844.51 allowed a remote attacker Out of bounds memory access in Mojo in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.

CVE-2021-30575 [HIGH] CWE-787 CVE-2021-30575: Out of bounds write in Autofill in Google Chrome prior to 92.0.4515.107 allowed a remote attacker wh Out of bounds write in Autofill in Google Chrome prior to 92.0.4515.107 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.

CVE-2020-6537 [HIGH] CWE-843 CVE-2020-6537: Type confusion in V8 in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to execute ar Type confusion in V8 in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

CVE-2023-2934 [HIGH] CWE-787 CVE-2023-2934: Out of bounds memory access in Mojo in Google Chrome prior to 114.0.5735.90 allowed a remote attacke Out of bounds memory access in Mojo in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2014-1568 [HIGH] CWE-310 CVE-2014-1568: Mozilla Network Security Services (NSS) before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.1 Mozilla Network Security Services (NSS) before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozilla Firefox before 32.0.3, Mozilla Firefox ESR 24.x before 24.8.1 and 31.x before 31.1.1, Mozilla Thunderbird before 24.8.1 and 31.x before 31.1.2, Mozilla SeaMonkey before 2.29.1, Google Chrome before 37.0.2062.124 on Windows and OS X

CVE-2023-5218 [HIGH] CWE-416 CVE-2023-5218: Use after free in Site Isolation in Google Chrome prior to 118.0.5993.70 allowed a remote attacker t Use after free in Site Isolation in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)