CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Google » Chrome : Security Vulnerabilities (CVSS score between 4 and 4.99)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2018-20070 20 2019-01-09 2019-01-16
4.3
 None Remote Medium Not required None Partial None
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.
2 CVE-2018-20069 254 2019-01-09 2019-01-16
4.3
 None Remote Medium Not required None Partial None
Failure to prevent navigation to top frame to data URLs in Navigation in Google Chrome on iOS prior to 71.0.3578.80 allowed a remote attacker to confuse the user about the origin of the current page via a crafted HTML page.
3 CVE-2018-20068 20 2019-01-09 2019-01-16
4.3
 None Remote Medium Not required None Partial None
Incorrect handling of 304 status codes in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to confuse the user about the origin of the current page via a crafted HTML page.
4 CVE-2018-20067 254 2019-01-09 2019-01-16
4.3
 None Remote Medium Not required None Partial None
A renderer initiated back navigation was incorrectly allowed to cancel a browser initiated one in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to confuse the user about the origin of the current page via a crafted HTML page.
5 CVE-2018-18357 20 2018-12-11 2018-12-19
4.3
 None Remote Medium Not required None Partial None
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.
6 CVE-2018-18355 20 2018-12-11 2018-12-19
4.3
 None Remote Medium Not required None Partial None
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.
7 CVE-2018-18353 18 2018-12-11 2018-12-20
4.3
 None Remote Medium Not required None Partial None
Failure to dismiss http auth dialogs on navigation in Network Authentication in Google Chrome on Android prior to 71.0.3578.80 allowed a remote attacker to confuse the user about the origin of an auto dialog via a crafted HTML page.
8 CVE-2018-18352 264 Bypass 2018-12-11 2018-12-20
4.3
 None Remote Medium Not required Partial None None
Service works could inappropriately gain access to cross origin audio in Media in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass same origin policy for audio content via a crafted HTML page.
9 CVE-2018-18351 20 Bypass 2018-12-11 2018-12-26
4.3
 None Remote Medium Not required Partial None None
Lack of proper validation of ancestor frames site when sending lax cookies in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass SameSite cookie policy via a crafted HTML page.
10 CVE-2018-18350 19 Bypass 2018-12-11 2018-12-26
4.3
 None Remote Medium Not required None Partial None
Incorrect handling of CSP enforcement during navigations in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to bypass content security policy via a crafted HTML page.
11 CVE-2018-18349 264 2018-12-11 2019-01-10
4.3
 None Remote Medium Not required Partial None None
Remote frame navigations was incorrectly permitted to local resources in Blink in Google Chrome prior to 71.0.3578.80 allowed an attacker who convinced a user to install a malicious extension to access files on the local file system via a crafted Chrome Extension.
12 CVE-2018-18348 20 2018-12-11 2018-12-20
4.3
 None Remote Medium Not required None Partial None
Incorrect handling of bidirectional domain names with RTL characters in Omnibox in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.
13 CVE-2018-18346 20 2018-12-11 2018-12-13
4.3
 None Remote Medium Not required None Partial None
Incorrect handling of alert box display in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to present confusing browser UI via a crafted HTML page.
14 CVE-2018-18345 254 Bypass 2018-12-11 2018-12-29
4.3
 None Remote Medium Not required Partial None None
Incorrect handling of blob URLS in Site Isolation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker who had compromised the renderer process to bypass site isolation protections via a crafted HTML page.
15 CVE-2018-18344 20 2018-12-11 2019-01-10
4.3
 None Remote Medium Not required Partial None None
Inappropriate allowance of the setDownloadBehavior devtools protocol feature in Extensions in Google Chrome prior to 71.0.3578.80 allowed a remote attacker with control of an installed extension to access files on the local file system via a crafted Chrome Extension.
16 CVE-2018-17477 20 2018-11-14 2018-12-21
4.3
 None Remote Medium Not required None Partial None
Incorrect dialog placement in Extensions in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of extension popups via a crafted HTML page.
17 CVE-2018-17476 20 2018-11-14 2018-12-21
4.3
 None Remote Medium Not required None Partial None
Incorrect dialog placement in Cast UI in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to obscure the full screen warning via a crafted HTML page.
18 CVE-2018-17475 20 2018-11-14 2018-12-19
4.3
 None Remote Medium Not required None Partial None
Incorrect handling of history on iOS in Navigation in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
19 CVE-2018-17473 20 2018-11-14 2018-12-18
4.3
 None Remote Medium Not required None Partial None
Incorrect handling of confusable characters in Omnibox in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.
20 CVE-2018-17471 20 2018-11-14 2018-12-21
4.3
 None Remote Medium Not required None Partial None
Incorrect dialog placement in WebContents in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to obscure the full screen warning via a crafted HTML page.
21 CVE-2018-17470 119 Overflow 2019-01-09 2019-01-15
4.3
 None Remote Medium Not required None None Partial
A heap buffer overflow in GPU in Google Chrome prior to 70.0.3538.67 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
22 CVE-2018-17468 200 +Info 2018-11-14 2018-12-19
4.3
 None Remote Medium Not required Partial None None
Incorrect handling of timer information during navigation in Blink in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to obtain cross origin URLs via a crafted HTML page.
23 CVE-2018-17467 20 2018-11-14 2018-12-19
4.3
 None Remote Medium Not required None Partial None
Insufficiently quick clearing of stale rendered content in Navigation in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
24 CVE-2018-17464 20 2018-11-14 2018-12-18
4.3
 None Remote Medium Not required None Partial None
Incorrect handling of history on iOS in Navigation in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
25 CVE-2018-16082 125 2019-01-09 2019-01-15
4.3
 None Remote Medium Not required None None Partial
An out of bounds read in Swiftshader in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.
26 CVE-2018-16080 20 2019-01-09 2019-01-18
4.3
 None Remote Medium Not required None Partial None
A missing check for popup window handling in Fullscreen in Google Chrome on macOS prior to 69.0.3497.81 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
27 CVE-2018-16072 284 Bypass 2019-01-09 2019-01-18
4.3
 None Remote Medium Not required Partial None None
A missing origin check related to HLS manifests in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass same origin policy via a crafted HTML page.
28 CVE-2018-16067 416 2019-01-09 2019-01-15
4.3
 None Remote Medium Not required None None Partial
A use after free in WebAudio in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
29 CVE-2018-16066 416 2019-01-09 2019-01-15
4.3
 None Remote Medium Not required None None Partial
A use after free in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
30 CVE-2018-6179 200 +Info 2019-01-09 2019-01-16
4.3
 None Remote Medium Not required Partial None None
Insufficient enforcement of file access permission in the activeTab case in Extensions in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced a user to install a malicious extension to access files on the local file system via a crafted Chrome Extension.
31 CVE-2018-6178 254 2019-01-09 2019-01-16
4.3
 None Remote Medium Not required None Partial None
Eliding from the wrong side in an infobar in DevTools in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced a user to install a malicious extension to Hide Chrome Security UI via a crafted Chrome Extension.
32 CVE-2018-6175 19 2019-01-09 2019-01-14
4.3
 None Remote Medium Not required None Partial None
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
33 CVE-2018-6173 19 2019-01-09 2019-01-14
4.3
 None Remote Medium Not required None Partial None
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
34 CVE-2018-6172 19 2019-01-09 2019-01-14
4.3
 None Remote Medium Not required None Partial None
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
35 CVE-2018-6169 20 2019-01-09 2019-01-15
4.3
 None Remote Medium Not required None Partial None
Lack of timeout on extension install prompt in Extensions in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to trigger installation of an unwanted extension via a crafted HTML page.
36 CVE-2018-6167 19 2019-01-09 2019-01-14
4.3
 None Remote Medium Not required None Partial None
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
37 CVE-2018-6166 19 2019-01-09 2019-01-14
4.3
 None Remote Medium Not required None Partial None
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
38 CVE-2018-6165 19 2019-01-09 2019-01-14
4.3
 None Remote Medium Not required None Partial None
Incorrect handling of reloads in Navigation in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
39 CVE-2018-6164 200 +Info 2019-01-09 2019-01-14
4.3
 None Remote Medium Not required Partial None None
Insufficient origin checks for CSS content in Blink in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
40 CVE-2018-6163 19 2019-01-09 2019-01-14
4.3
 None Remote Medium Not required None Partial None
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
41 CVE-2018-6160 20 2019-01-09 2019-01-14
4.3
 None Remote Medium Not required None Partial None
JavaScript alert handling in Prompts in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
42 CVE-2018-6143 125 2019-01-09 2019-01-15
4.3
 None Remote Medium Not required None None Partial
Insufficient validation in V8 in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
43 CVE-2018-6137 200 +Info 2019-01-09 2019-01-14
4.3
 None Remote Medium Not required Partial None None
CSS Paint API in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
44 CVE-2018-6135 254 2019-01-09 2019-01-15
4.3
 None Remote Medium Not required None Partial None
Lack of clearing the previous site before loading alerts from a new one in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
45 CVE-2018-6123 416 2019-01-09 2019-01-14
4.3
 None Remote Medium Not required None None Partial
A use after free in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
46 CVE-2018-6119 20 2018-09-25 2018-11-20
4.3
 None Remote Medium Not required None Partial None
Incorrect security UI in Omnibox in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
47 CVE-2018-6117 200 +Info 2019-01-09 2019-01-15
4.3
 None Remote Medium Not required Partial None None
Confusing settings in Autofill in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
48 CVE-2018-6116 476 2018-12-04 2019-01-09
4.3
 None Remote Medium Not required None None Partial
A nullptr dereference in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.
49 CVE-2018-6115 20 Bypass 2018-12-04 2019-01-09
4.3
 None Remote Medium Not required None Partial None
Inappropriate setting of the SEE_MASK_FLAG_NO_UI flag in file downloads in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to potentially bypass OS malware checks via a crafted HTML page.
50 CVE-2018-6114 20 Bypass 2019-01-09 2019-01-16
4.3
 None Remote Medium Not required None Partial None
Incorrect enforcement of CSP for <object> tags in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass content security policy via a crafted HTML page.
Total number of vulnerabilities : 355   Page : 1 (This Page)2 3 4 5 6 7 8
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.