apk package
wolfi/chromium
pkg:apk/wolfi/chromium
Vulnerabilities (1,378)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2025-13226 | — | < 142.0.7444.59-r0 | 142.0.7444.59-r0 | Nov 17, 2025 | Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | ||
| CVE-2025-13223 | — | KEV | < 142.0.7444.175-r0 | 142.0.7444.175-r0 | Nov 17, 2025 | Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | |
| CVE-2024-7021 | — | < 124.0.6367.60-r0 | 124.0.6367.60-r0 | Nov 14, 2025 | Inappropriate implementation in Autofill in Google Chrome on Windows prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) | ||
| CVE-2024-13178 | — | < 128.0.6613.84-r0 | 128.0.6613.84-r0 | Nov 14, 2025 | Inappropriate implementation in Fullscreen in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) | ||
| CVE-2024-7017 | — | < 126.0.6478.182-r0 | 126.0.6478.182-r0 | Nov 14, 2025 | Inappropriate implementation in DevTools in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | ||
| CVE-2024-11919 | — | < 129.0.6668.58-r0 | 129.0.6668.58-r0 | Nov 14, 2025 | Inappropriate implementation in Intents in Google Chrome on Android prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) | ||
| CVE-2024-11920 | — | < 130.0.6723.92-r0 | 130.0.6723.92-r0 | Nov 14, 2025 | Inappropriate implementation in Dawn in Google Chrome on Mac prior to 130.0.6723.92 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High) | ||
| CVE-2024-13983 | — | < 136.0.7103.59-r0 | 136.0.7103.59-r0 | Nov 14, 2025 | Inappropriate implementation in Lens in Google Chrome on iOS prior to 136.0.7103.59 allowed a remote attacker to perform UI spoofing via a crafted QR code. (Chromium security severity: Low) | ||
| CVE-2025-9479 | — | < 133.0.6943.141-r0 | 133.0.6943.141-r0 | Nov 14, 2025 | Out of bounds read in V8 in Google Chrome prior to 133.0.6943.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) | ||
| CVE-2025-13097 | — | < 136.0.7103.48-r0 | 136.0.7103.48-r0 | Nov 14, 2025 | Inappropriate implementation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) | ||
| CVE-2025-13042 | — | < 142.0.7444.175-r0 | 142.0.7444.175-r0 | Nov 12, 2025 | Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.166 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | ||
| CVE-2025-12729 | — | < 142.0.7444.137-r0 | 142.0.7444.137-r0 | Nov 10, 2025 | Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) | ||
| CVE-2025-12728 | — | < 142.0.7444.137-r0 | 142.0.7444.137-r0 | Nov 10, 2025 | Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) | ||
| CVE-2025-12727 | — | < 142.0.7444.137-r0 | 142.0.7444.137-r0 | Nov 10, 2025 | Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | ||
| CVE-2025-12726 | — | < 142.0.7444.137-r0 | 142.0.7444.137-r0 | Nov 10, 2025 | Inappropriate implementation in Views in Google Chrome on Windows prior to 142.0.7444.137 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: High) | ||
| CVE-2025-12725 | — | < 142.0.7444.137-r0 | 142.0.7444.137-r0 | Nov 10, 2025 | Out of bounds read in WebGPU in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High) | ||
| CVE-2025-12447 | — | < 142.0.7444.59-r0 | 142.0.7444.59-r0 | Nov 10, 2025 | Incorrect security UI in Omnibox in Google Chrome on Android prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) | ||
| CVE-2025-12446 | — | < 142.0.7444.59-r0 | 142.0.7444.59-r0 | Nov 10, 2025 | Incorrect security UI in SplitView in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted domain name. (Chromium security severity: Low) | ||
| CVE-2025-12445 | — | < 142.0.7444.59-r0 | 142.0.7444.59-r0 | Nov 10, 2025 | Policy bypass in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. (Chromium security severity: Low) | ||
| CVE-2025-12444 | — | < 142.0.7444.59-r0 | 142.0.7444.59-r0 | Nov 10, 2025 | Incorrect security UI in Fullscreen UI in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) |
- CVE-2025-13226Nov 17, 2025affected < 142.0.7444.59-r0fixed 142.0.7444.59-r0
Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- affected < 142.0.7444.175-r0fixed 142.0.7444.175-r0
Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- CVE-2024-7021Nov 14, 2025affected < 124.0.6367.60-r0fixed 124.0.6367.60-r0
Inappropriate implementation in Autofill in Google Chrome on Windows prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
- CVE-2024-13178Nov 14, 2025affected < 128.0.6613.84-r0fixed 128.0.6613.84-r0
Inappropriate implementation in Fullscreen in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
- CVE-2024-7017Nov 14, 2025affected < 126.0.6478.182-r0fixed 126.0.6478.182-r0
Inappropriate implementation in DevTools in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
- CVE-2024-11919Nov 14, 2025affected < 129.0.6668.58-r0fixed 129.0.6668.58-r0
Inappropriate implementation in Intents in Google Chrome on Android prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
- CVE-2024-11920Nov 14, 2025affected < 130.0.6723.92-r0fixed 130.0.6723.92-r0
Inappropriate implementation in Dawn in Google Chrome on Mac prior to 130.0.6723.92 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
- CVE-2024-13983Nov 14, 2025affected < 136.0.7103.59-r0fixed 136.0.7103.59-r0
Inappropriate implementation in Lens in Google Chrome on iOS prior to 136.0.7103.59 allowed a remote attacker to perform UI spoofing via a crafted QR code. (Chromium security severity: Low)
- CVE-2025-9479Nov 14, 2025affected < 133.0.6943.141-r0fixed 133.0.6943.141-r0
Out of bounds read in V8 in Google Chrome prior to 133.0.6943.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
- CVE-2025-13097Nov 14, 2025affected < 136.0.7103.48-r0fixed 136.0.7103.48-r0
Inappropriate implementation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
- CVE-2025-13042Nov 12, 2025affected < 142.0.7444.175-r0fixed 142.0.7444.175-r0
Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.166 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- CVE-2025-12729Nov 10, 2025affected < 142.0.7444.137-r0fixed 142.0.7444.137-r0
Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
- CVE-2025-12728Nov 10, 2025affected < 142.0.7444.137-r0fixed 142.0.7444.137-r0
Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
- CVE-2025-12727Nov 10, 2025affected < 142.0.7444.137-r0fixed 142.0.7444.137-r0
Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- CVE-2025-12726Nov 10, 2025affected < 142.0.7444.137-r0fixed 142.0.7444.137-r0
Inappropriate implementation in Views in Google Chrome on Windows prior to 142.0.7444.137 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: High)
- CVE-2025-12725Nov 10, 2025affected < 142.0.7444.137-r0fixed 142.0.7444.137-r0
Out of bounds read in WebGPU in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)
- CVE-2025-12447Nov 10, 2025affected < 142.0.7444.59-r0fixed 142.0.7444.59-r0
Incorrect security UI in Omnibox in Google Chrome on Android prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
- CVE-2025-12446Nov 10, 2025affected < 142.0.7444.59-r0fixed 142.0.7444.59-r0
Incorrect security UI in SplitView in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted domain name. (Chromium security severity: Low)
- CVE-2025-12445Nov 10, 2025affected < 142.0.7444.59-r0fixed 142.0.7444.59-r0
Policy bypass in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. (Chromium security severity: Low)
- CVE-2025-12444Nov 10, 2025affected < 142.0.7444.59-r0fixed 142.0.7444.59-r0
Incorrect security UI in Fullscreen UI in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
Page 53 of 69