CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Google » Chrome : Security Vulnerabilities (CVSS score between 4 and 4.99)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2019-5840 264 Bypass 2019-06-27 2019-06-28
4.3
 None Remote Medium Not required None Partial None
Incorrect security UI in popup blocker in Google Chrome on iOS prior to 75.0.3770.80 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
2 CVE-2019-5839 20 Bypass 2019-06-27 2019-07-25
4.3
 None Remote Medium Not required None Partial None
Excessive data validation in URL parser in Google Chrome prior to 75.0.3770.80 allowed a remote attacker who convinced a user to input a URL to bypass website URL validation via a crafted URL.
3 CVE-2019-5838 20 Bypass 2019-06-27 2019-07-25
4.3
 None Remote Medium Not required None Partial None
Insufficient policy enforcement in extensions API in Google Chrome prior to 75.0.3770.80 allowed an attacker who convinced a user to install a malicious extension to bypass restrictions on file URIs via a crafted Chrome Extension.
4 CVE-2019-5837 200 +Info 2019-06-27 2019-07-25
4.3
 None Remote Medium Not required Partial None None
Resource size information leakage in Blink in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
5 CVE-2019-5835 125 2019-06-27 2019-07-25
4.3
 None Remote Medium Not required Partial None None
Object lifecycle issue in SwiftShader in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.
6 CVE-2019-5834 20 2019-06-27 2019-07-25
4.3
 None Remote Medium Not required None Partial None
Insufficient data validation in Blink in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
7 CVE-2019-5833 264 2019-06-27 2019-07-25
4.3
 None Remote Medium Not required None Partial None
Incorrect dialog box scoping in browser in Google Chrome on Android prior to 75.0.3770.80 allowed a remote attacker to display misleading security UI via a crafted HTML page.
8 CVE-2019-5832 284 2019-06-27 2019-07-25
4.3
 None Remote Medium Not required Partial None None
Insufficient policy enforcement in XMLHttpRequest in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
9 CVE-2019-5830 284 2019-06-27 2019-07-25
4.3
 None Remote Medium Not required Partial None None
Insufficient policy enforcement in CORS in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
10 CVE-2019-5819 20 Exec Code 2019-06-27 2019-07-25
4.4
 None Local Medium Not required Partial Partial Partial
Insufficient data validation in developer tools in Google Chrome on OS X prior to 74.0.3729.108 allowed a local attacker to execute arbitrary code via a crafted string copied to clipboard.
11 CVE-2019-5818 200 +Info 2019-06-27 2019-07-25
4.3
 None Remote Medium Not required Partial None None
Uninitialized data in media in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file.
12 CVE-2019-5814 285 2019-06-27 2019-07-25
4.3
 None Remote Medium Not required Partial None None
Insufficient policy enforcement in Blink in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
13 CVE-2019-5812 20 2019-06-27 2019-07-25
4.3
 None Remote Medium Not required None Partial None
Inadequate security UI in iOS UI in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
14 CVE-2019-5810 200 +Info 2019-06-27 2019-07-01
4.3
 None Remote Medium Not required Partial None None
Information leak in autofill in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
15 CVE-2019-5805 416 2019-06-27 2019-07-25
4.3
 None Remote Medium Not required None None Partial
Use-after-free in PDFium in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
16 CVE-2019-5803 20 Bypass 2019-05-23 2019-06-28
4.3
 None Remote Medium Not required None Partial None
Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.
17 CVE-2019-5802 20 2019-05-23 2019-06-28
4.3
 None Remote Medium Not required None Partial None
Incorrect handling of download origins in Navigation in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
18 CVE-2019-5801 20 2019-05-23 2019-06-28
4.3
 None Remote Medium Not required None Partial None
Incorrect eliding of URLs in Omnibox in Google Chrome on iOS prior to 73.0.3683.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
19 CVE-2019-5800 20 Bypass 2019-05-23 2019-06-28
4.3
 None Remote Medium Not required None Partial None
Insufficient policy enforcement in Blink in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.
20 CVE-2019-5799 20 Bypass 2019-05-23 2019-06-28
4.3
 None Remote Medium Not required None Partial None
Incorrect inheritance of a new document's policy in Content Security Policy in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.
21 CVE-2019-5798 125 2019-05-23 2019-06-10
4.3
 None Remote Medium Not required Partial None None
Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
22 CVE-2019-5794 20 2019-05-23 2019-06-28
4.3
 None Remote Medium Not required None Partial None
Incorrect handling of cancelled requests in Navigation in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
23 CVE-2019-5793 20 2019-05-23 2019-06-28
4.3
 None Remote Medium Not required None Partial None
Insufficient policy enforcement in extensions in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to initiate the extensions installation user interface via a crafted HTML page.
24 CVE-2019-5786 416 2019-06-27 2019-07-01
4.3
 None Remote Medium Not required None None Partial
Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.
25 CVE-2019-5785 787 2019-06-27 2019-07-01
4.3
 None Remote Medium Not required None None Partial
Incorrect convexity calculations in Skia in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.
26 CVE-2019-5784 19 2019-06-27 2019-07-01
4.3
 None Remote Medium Not required None None Partial
Incorrect handling of deferred code in V8 in Google Chrome prior to 72.0.3626.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
27 CVE-2019-5781 20 2019-02-19 2019-04-18
4.3
 None Remote Medium Not required None Partial None
Incorrect handling of a confusable character in Omnibox in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.
28 CVE-2019-5780 20 2019-02-19 2019-04-18
4.6
 None Local Low Not required Partial Partial Partial
Insufficient restrictions on what can be done with Apple Events in Google Chrome on macOS prior to 72.0.3626.81 allowed a local attacker to execute JavaScript via Apple Events.
29 CVE-2019-5779 264 Bypass 2019-02-19 2019-04-18
4.3
 None Remote Medium Not required Partial None None
Insufficient policy validation in ServiceWorker in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
30 CVE-2019-5778 79 XSS Bypass 2019-02-19 2019-04-18
4.3
 None Remote Medium Not required None Partial None
A missing case for handling special schemes in permission request checks in Extensions in Google Chrome prior to 72.0.3626.81 allowed an attacker who convinced a user to install a malicious extension to bypass extension permission checks for privileged pages via a crafted Chrome Extension.
31 CVE-2019-5777 20 2019-02-19 2019-04-18
4.3
 None Remote Medium Not required None Partial None
Incorrect handling of a confusable character in Omnibox in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.
32 CVE-2019-5776 20 2019-02-19 2019-04-18
4.3
 None Remote Medium Not required None Partial None
Incorrect handling of a confusable character in Omnibox in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.
33 CVE-2019-5775 20 2019-02-19 2019-04-18
4.3
 None Remote Medium Not required None Partial None
Incorrect handling of a confusable character in Omnibox in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.
34 CVE-2019-5773 20 Bypass 2019-02-19 2019-04-18
4.3
 None Remote Medium Not required None Partial None
Insufficient origin validation in IndexedDB in Google Chrome prior to 72.0.3626.81 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page.
35 CVE-2019-5768 254 2019-02-19 2019-04-18
4.3
 None Remote Medium Not required Partial None None
DevTools API not correctly gating on extension capability in DevTools in Google Chrome prior to 72.0.3626.81 allowed an attacker who convinced a user to install a malicious extension to read local files via a crafted Chrome Extension.
36 CVE-2019-5767 275 2019-02-19 2019-04-18
4.3
 None Remote Medium Not required Partial None None
Insufficient protection of permission UI in WebAPKs in Google Chrome on Android prior to 72.0.3626.81 allowed an attacker who convinced the user to install a malicious application to access privacy/security sensitive web APIs via a crafted APK.
37 CVE-2019-5766 264 2019-02-19 2019-04-18
4.3
 None Remote Medium Not required Partial None None
Incorrect handling of origin taint checking in Canvas in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
38 CVE-2019-5765 200 +Info 2019-02-19 2019-04-18
4.3
 None Remote Medium Not required Partial None None
An exposed debugging endpoint in the browser in Google Chrome on Android prior to 72.0.3626.81 allowed a local attacker to obtain potentially sensitive information from process memory via a crafted Intent.
39 CVE-2019-5754 310 2019-02-19 2019-04-17
4.3
 None Remote Medium Not required Partial None None
Implementation error in QUIC Networking in Google Chrome prior to 72.0.3626.81 allowed an attacker running or able to cause use of a proxy server to obtain cleartext of transport encryption via malicious network proxy.
40 CVE-2018-20070 20 2019-01-09 2019-01-16
4.3
 None Remote Medium Not required None Partial None
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.
41 CVE-2018-20069 254 2019-01-09 2019-01-16
4.3
 None Remote Medium Not required None Partial None
Failure to prevent navigation to top frame to data URLs in Navigation in Google Chrome on iOS prior to 71.0.3578.80 allowed a remote attacker to confuse the user about the origin of the current page via a crafted HTML page.
42 CVE-2018-20068 20 2019-01-09 2019-01-16
4.3
 None Remote Medium Not required None Partial None
Incorrect handling of 304 status codes in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to confuse the user about the origin of the current page via a crafted HTML page.
43 CVE-2018-20067 254 2019-01-09 2019-01-16
4.3
 None Remote Medium Not required None Partial None
A renderer initiated back navigation was incorrectly allowed to cancel a browser initiated one in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to confuse the user about the origin of the current page via a crafted HTML page.
44 CVE-2018-18357 20 2018-12-11 2019-08-17
4.3
 None Remote Medium Not required None Partial None
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.
45 CVE-2018-18355 20 2018-12-11 2019-08-17
4.3
 None Remote Medium Not required None Partial None
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.
46 CVE-2018-18353 2018-12-11 2019-10-02
4.3
 None Remote Medium Not required None Partial None
Failure to dismiss http auth dialogs on navigation in Network Authentication in Google Chrome on Android prior to 71.0.3578.80 allowed a remote attacker to confuse the user about the origin of an auto dialog via a crafted HTML page.
47 CVE-2018-18352 732 Bypass 2018-12-11 2019-10-02
4.3
 None Remote Medium Not required Partial None None
Service works could inappropriately gain access to cross origin audio in Media in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass same origin policy for audio content via a crafted HTML page.
48 CVE-2018-18351 20 Bypass 2018-12-11 2019-08-17
4.3
 None Remote Medium Not required Partial None None
Lack of proper validation of ancestor frames site when sending lax cookies in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass SameSite cookie policy via a crafted HTML page.
49 CVE-2018-18350 Bypass 2018-12-11 2019-10-02
4.3
 None Remote Medium Not required None Partial None
Incorrect handling of CSP enforcement during navigations in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass content security policy via a crafted HTML page.
50 CVE-2018-18349 732 2018-12-11 2019-10-02
4.3
 None Remote Medium Not required Partial None None
Remote frame navigations was incorrectly permitted to local resources in Blink in Google Chrome prior to 71.0.3578.80 allowed an attacker who convinced a user to install a malicious extension to access files on the local file system via a crafted Chrome Extension.
Total number of vulnerabilities : 419   Page : 1 (This Page)2 3 4 5 6 7 8 9
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.