Chromium
by Chromium
Source repositories
CVEs (1,466)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-2135 | Hig | 0.49 | 7.5 | 0.01 | Apr 19, 2023 | Use after free in DevTools in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who convinced a user to enable specific preconditions to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | ||
| CVE-2023-0705 | Hig | 0.49 | 7.5 | 0.01 | Feb 7, 2023 | Integer overflow in Core in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who had one a race condition to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low) | ||
| CVE-2026-91734 | Hig | 0.48 | 7.4 | 0.00 | Sep 15, 2026 | Incorrect authorization in Core in Google Chrome on on Windows prior to 153.0.8010.47 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High) | ||
| CVE-2026-19139 | Hig | 0.48 | 7.4 | 0.00 | Aug 6, 2026 | Race in CredentialProvider in Google Chrome on Windows prior to 151.0.7922.109 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: High) | ||
| CVE-2026-10976 | Hig | 0.48 | 7.4 | 0.00 | Jun 4, 2026 | Uninitialized Use in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High) | ||
| CVE-2026-10973 | Hig | 0.48 | 7.4 | 0.01 | Jun 4, 2026 | Uninitialized Use in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) | ||
| CVE-2026-10968 | Hig | 0.48 | 7.4 | 0.00 | Jun 4, 2026 | Insufficient validation of untrusted input in Dawn in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) | ||
| CVE-2026-78892 | Hig | 0.46 | 7.1 | 0.00 | Aug 25, 2026 | Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 152.0.7977.65 allowed a local attacker to bypass system access restrictions via a local program. (Chromium security severity: Medium) | ||
| CVE-2026-17993 | Hig | 0.46 | 7.0 | 0.00 | Jul 30, 2026 | Race in Updater in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: Low) | ||
| CVE-2026-17888 | Hig | 0.46 | 7.1 | 0.00 | Jul 30, 2026 | Insufficient validation of untrusted input in WebUI in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via malicious network traffic. (Chromium security severity: Medium) | ||
| CVE-2026-17867 | Hig | 0.46 | 7.1 | 0.00 | Jul 30, 2026 | Insufficient validation of untrusted input in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) | ||
| CVE-2026-17744 | Hig | 0.46 | 7.1 | 0.00 | Jul 30, 2026 | Inappropriate implementation in File Input in Google Chrome on Linux prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) | ||
| CVE-2026-17741 | Hig | 0.46 | 7.1 | 0.00 | Jul 30, 2026 | Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) | ||
| CVE-2023-2460 | Hig | 0.46 | 7.1 | 0.01 | May 3, 2023 | Insufficient validation of untrusted input in Extensions in Google Chrome prior to 113.0.5672.63 allowed an attacker who convinced a user to install a malicious extension to bypass file access checks via a crafted HTML page. (Chromium security severity: Medium) | ||
| CVE-2020-6519 | Med | 0.46 | 6.5 | 0.10 | Jul 22, 2020 | Policy bypass in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy via a crafted HTML page. | ||
| CVE-2026-79032 | Med | 0.44 | 6.8 | 0.00 | Aug 25, 2026 | Improper input validation in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) | ||
| CVE-2021-30621 | Med | 0.43 | 6.5 | 0.03 | Sep 3, 2021 | Chromium: CVE-2021-30621 UI Spoofing in Autofill | ||
| CVE-2021-30619 | Med | 0.43 | 6.5 | 0.03 | Sep 3, 2021 | Chromium: CVE-2021-30619 UI Spoofing in Autofill | ||
| CVE-2021-30617 | Med | 0.43 | 6.5 | 0.04 | Sep 3, 2021 | Chromium: CVE-2021-30617 Policy bypass in Blink | ||
| CVE-2021-30615 | Med | 0.43 | 6.5 | 0.06 | Sep 3, 2021 | Chromium: CVE-2021-30615 Cross-origin data leak in Navigation |
- risk 0.49cvss 7.5epss 0.01
Use after free in DevTools in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who convinced a user to enable specific preconditions to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- risk 0.49cvss 7.5epss 0.01
Integer overflow in Core in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who had one a race condition to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)
- risk 0.48cvss 7.4epss 0.00
Incorrect authorization in Core in Google Chrome on on Windows prior to 153.0.8010.47 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)
- risk 0.48cvss 7.4epss 0.00
Race in CredentialProvider in Google Chrome on Windows prior to 151.0.7922.109 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: High)
- risk 0.48cvss 7.4epss 0.00
Uninitialized Use in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
- risk 0.48cvss 7.4epss 0.01
Uninitialized Use in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
- risk 0.48cvss 7.4epss 0.00
Insufficient validation of untrusted input in Dawn in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
- risk 0.46cvss 7.1epss 0.00
Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 152.0.7977.65 allowed a local attacker to bypass system access restrictions via a local program. (Chromium security severity: Medium)
- risk 0.46cvss 7.0epss 0.00
Race in Updater in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: Low)
- risk 0.46cvss 7.1epss 0.00
Insufficient validation of untrusted input in WebUI in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via malicious network traffic. (Chromium security severity: Medium)
- risk 0.46cvss 7.1epss 0.00
Insufficient validation of untrusted input in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
- risk 0.46cvss 7.1epss 0.00
Inappropriate implementation in File Input in Google Chrome on Linux prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
- risk 0.46cvss 7.1epss 0.00
Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
- risk 0.46cvss 7.1epss 0.01
Insufficient validation of untrusted input in Extensions in Google Chrome prior to 113.0.5672.63 allowed an attacker who convinced a user to install a malicious extension to bypass file access checks via a crafted HTML page. (Chromium security severity: Medium)
- risk 0.46cvss 6.5epss 0.10
Policy bypass in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy via a crafted HTML page.
- risk 0.44cvss 6.8epss 0.00
Improper input validation in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
- risk 0.43cvss 6.5epss 0.03
Chromium: CVE-2021-30621 UI Spoofing in Autofill
- risk 0.43cvss 6.5epss 0.03
Chromium: CVE-2021-30619 UI Spoofing in Autofill
- risk 0.43cvss 6.5epss 0.04
Chromium: CVE-2021-30617 Policy bypass in Blink
- risk 0.43cvss 6.5epss 0.06
Chromium: CVE-2021-30615 Cross-origin data leak in Navigation
Page 39 of 74