CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   

Google » Chrome : Security Vulnerabilities (Execute Code)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2021-30599 843 Exec Code 2021-08-26 2021-11-30
6.8
 None Remote Medium Not required Partial Partial Partial
Type confusion in V8 in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
2 CVE-2021-30598 843 Exec Code 2021-08-26 2021-11-30
6.8
 None Remote Medium Not required Partial Partial Partial
Type confusion in V8 in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
3 CVE-2021-21224 843 Exec Code 2021-04-26 2021-06-01
6.8
 None Remote Medium Not required Partial Partial Partial
Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
4 CVE-2020-6572 416 Exec Code 2021-01-14 2021-01-21
9.3
 None Remote Medium Not required Complete Complete Complete
Use after free in Media in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
5 CVE-2020-6537 843 Exec Code 2020-09-21 2021-03-16
6.8
 None Remote Medium Not required Partial Partial Partial
Type confusion in V8 in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
6 CVE-2020-6443 345 Exec Code 2020-04-13 2022-10-07
6.8
 None Remote Medium Not required Partial Partial Partial
Insufficient data validation in developer tools in Google Chrome prior to 81.0.4044.92 allowed a remote attacker who had convinced the user to use devtools to execute arbitrary code via a crafted HTML page.
7 CVE-2020-6417 Exec Code 2020-02-11 2020-02-17
4.6
 None Local Low Not required Partial Partial Partial
Inappropriate implementation in installer in Google Chrome prior to 80.0.3987.87 allowed a local attacker to execute arbitrary code via a crafted registry entry.
8 CVE-2019-13735 787 Exec Code 2019-12-10 2023-01-30
6.8
 None Remote Medium Not required Partial Partial Partial
Out of bounds write in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
9 CVE-2019-13726 119 Exec Code Overflow 2019-12-10 2023-01-30
6.8
 None Remote Medium Not required Partial Partial Partial
Buffer overflow in password manager in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
10 CVE-2019-13725 416 Exec Code 2019-12-10 2023-02-03
6.8
 None Remote Medium Not required Partial Partial Partial
Use-after-free in Bluetooth in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
11 CVE-2019-13693 416 Exec Code 2019-11-25 2019-11-26
6.8
 None Remote Medium Not required Partial Partial Partial
Use after free in IndexedDB in Google Chrome prior to 77.0.3865.120 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page.
12 CVE-2019-5790 190 Exec Code Overflow 2019-05-23 2022-10-11
6.8
 None Remote Medium Not required Partial Partial Partial
An integer overflow leading to an incorrect capacity of a buffer in JavaScript in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
13 CVE-2019-5789 190 Exec Code Overflow 2019-05-23 2022-10-11
9.3
 None Remote Medium Not required Complete Complete Complete
An integer overflow that leads to a use-after-free in WebMIDI in Google Chrome on Windows prior to 73.0.3683.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page.
14 CVE-2019-5788 190 Exec Code Overflow 2019-05-23 2022-10-11
9.3
 None Remote Medium Not required Complete Complete Complete
An integer overflow that leads to a use-after-free in Blink Storage in Google Chrome on Linux prior to 73.0.3683.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page.
15 CVE-2019-5782 20 Exec Code 2019-02-19 2021-07-21
6.8
 None Remote Medium Not required Partial Partial Partial
Incorrect optimization assumptions in V8 in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
16 CVE-2019-5771 Exec Code 2019-02-19 2020-08-24
6.8
 None Remote Medium Not required Partial Partial Partial
An incorrect JIT of GLSL shaders in SwiftShader in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
17 CVE-2019-5762 119 Exec Code Overflow 2019-02-19 2019-04-18
6.8
 None Remote Medium Not required Partial Partial Partial
Inappropriate memory management when caching in PDFium in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file.
18 CVE-2019-5756 416 Exec Code 2019-02-19 2019-04-17
6.8
 None Remote Medium Not required Partial Partial Partial
Inappropriate memory management when caching in PDFium in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file.
19 CVE-2018-20346 190 Exec Code Overflow 2018-12-21 2021-07-31
6.8
 None Remote Medium Not required Partial Partial Partial
SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases), aka Magellan.
20 CVE-2018-18342 787 Exec Code 2018-12-11 2020-08-24
6.8
 None Remote Medium Not required Partial Partial Partial
Execution of user supplied Javascript during object deserialization can update object length leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
21 CVE-2018-17480 787 Exec Code 2018-12-11 2019-08-17
6.8
 None Remote Medium Not required Partial Partial Partial
Execution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
22 CVE-2018-17463 Exec Code 2018-11-14 2020-08-24
6.8
 None Remote Medium Not required Partial Partial Partial
Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
23 CVE-2018-17458 129 Exec Code 2019-01-09 2020-08-24
6.8
 None Remote Medium Not required Partial Partial Partial
An improper update of the WebAssembly dispatch table in WebAssembly in Google Chrome prior to 69.0.3497.92 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
24 CVE-2018-17457 416 Exec Code 2019-01-09 2019-01-29
6.8
 None Remote Medium Not required Partial Partial Partial
An object lifecycle issue in Blink could lead to a use after free in WebAudio in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
25 CVE-2018-16065 416 Exec Code 2019-01-09 2019-01-16
6.8
 None Remote Medium Not required Partial Partial Partial
A Javascript reentrancy issues that caused a use-after-free in V8 in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
26 CVE-2018-6174 190 Exec Code Overflow 2019-01-09 2019-01-14
6.8
 None Remote Medium Not required Partial Partial Partial
Integer overflows in Swiftshader in Google Chrome prior to 68.0.3440.75 potentially allowed a remote attacker to execute arbitrary code via a crafted HTML page.
27 CVE-2018-6140 20 Exec Code 2019-01-09 2019-01-16
9.3
 None Remote Medium Not required Complete Complete Complete
Allowing the chrome.debugger API to attach to Web UI pages in DevTools in Google Chrome prior to 67.0.3396.62 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension.
28 CVE-2018-6139 20 Exec Code 2019-01-09 2019-01-16
6.8
 None Remote Medium Not required Partial Partial Partial
Insufficient target checks on the chrome.debugger API in DevTools in Google Chrome prior to 67.0.3396.62 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension.
29 CVE-2018-6120 787 Exec Code Overflow 2019-01-09 2020-08-24
6.8
 None Remote Medium Not required Partial Partial Partial
An integer overflow that could lead to an attacker-controlled heap out-of-bounds write in PDFium in Google Chrome prior to 66.0.3359.170 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file.
30 CVE-2018-6118 416 Exec Code 2019-06-27 2019-06-28
6.8
 None Remote Medium Not required Partial Partial Partial
A double-eviction in the Incognito mode cache that lead to a user-after-free in cache in Google Chrome prior to 66.0.3359.139 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page.
31 CVE-2018-6111 20 Exec Code 2019-01-09 2019-01-16
6.8
 None Remote Medium Not required Partial Partial Partial
An object lifetime issue in the developer tools network handler in Google Chrome prior to 66.0.3359.117 allowed a local attacker to execute arbitrary code via a crafted HTML page.
32 CVE-2018-6101 20 Exec Code 2018-12-04 2019-03-01
5.1
 None Remote High Not required Partial Partial Partial
A lack of host validation in DevTools in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted HTML page, if the user is running a remote DevTools debugging server.
33 CVE-2018-6092 190 Exec Code Overflow 2018-12-04 2019-03-01
6.8
 None Remote Medium Not required Partial Partial Partial
An integer overflow on 32-bit systems in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
34 CVE-2018-6090 190 Exec Code Overflow 2018-12-04 2019-03-01
6.8
 None Remote Medium Not required Partial Partial Partial
An integer overflow that lead to a heap buffer-overflow in Skia in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
35 CVE-2018-6088 20 Exec Code 2018-12-04 2019-03-01
6.8
 None Remote Medium Not required Partial Partial Partial
An iterator-invalidation bug in PDFium in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file.
36 CVE-2018-6087 416 Exec Code 2018-12-04 2019-03-01
6.8
 None Remote Medium Not required Partial Partial Partial
A use-after-free in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
37 CVE-2018-6086 416 Exec Code 2018-12-04 2019-03-01
6.8
 None Remote Medium Not required Partial Partial Partial
A double-eviction in the Incognito mode cache that lead to a user-after-free in Networking Disk Cache in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
38 CVE-2018-6085 416 Exec Code 2018-12-04 2019-03-01
6.8
 None Remote Medium Not required Partial Partial Partial
Re-entry of a destructor in Networking Disk Cache in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
39 CVE-2018-6056 704 Exec Code 2019-01-09 2019-01-29
6.8
 None Remote Medium Not required Partial Partial Partial
Type confusion could lead to a heap out-of-bounds write in V8 in Google Chrome prior to 64.0.3282.168 allowing a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
40 CVE-2017-15428 125 Exec Code 2019-01-09 2019-01-30
6.8
 None Remote Medium Not required Partial Partial Partial
Insufficient data validation in V8 builtins string generator could lead to out of bounds read and write access in V8 in Google Chrome prior to 62.0.3202.94 and allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
41 CVE-2017-15407 787 Exec Code 2018-08-28 2018-11-20
6.8
 None Remote Medium Not required Partial Partial Partial
Out-of-bounds Write in the QUIC networking stack in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to gain code execution via a malicious server.
42 CVE-2017-15405 362 Exec Code 2019-01-09 2019-02-15
6.9
 None Local Medium Not required Complete Complete Complete
Inappropriate symlink handling and a race condition in the stateful recovery feature implementation could lead to a persistance established by a malicious code running with root privileges in cryptohomed in Google Chrome on Chrome OS prior to 61.0.3163.113 allowed a local attacker to execute arbitrary code via a crafted HTML page.
43 CVE-2017-15401 125 Exec Code Mem. Corr. 2019-01-09 2019-01-17
6.8
 None Remote Medium Not required Partial Partial Partial
A memory corruption bug in WebAssembly could lead to out of bounds read and write through V8 in WebAssembly in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
44 CVE-2017-15398 119 Exec Code Overflow 2018-08-28 2018-11-07
7.5
 None Remote Low Not required Partial Partial Partial
A stack buffer overflow in the QUIC networking stack in Google Chrome prior to 62.0.3202.89 allowed a remote attacker to gain code execution via a malicious server.
45 CVE-2017-5133 787 Exec Code +Info 2018-02-07 2018-12-11
6.8
 None Remote Medium Not required Partial Partial Partial
Off-by-one read/write on the heap in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to corrupt memory and possibly leak information and potentially execute code via a crafted PDF file.
46 CVE-2017-5020 79 Exec Code XSS 2017-02-17 2018-01-05
4.3
 None Remote Medium Not required None Partial None
Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to require a user gesture for powerful download operations, which allowed a remote attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted HTML page.
47 CVE-2016-9651 94 Exec Code 2019-01-09 2019-01-16
6.8
 None Remote Medium Not required Partial Partial Partial
A missing check for whether a property of a JS object is private in V8 in Google Chrome prior to 55.0.2883.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
48 CVE-2016-5207 79 Exec Code XSS 2017-01-19 2018-01-05
4.3
 None Remote Medium Not required None Partial None
In Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android, corruption of the DOM tree could occur during the removal of a full screen element, which allowed a remote attacker to achieve arbitrary code execution via a crafted HTML page.
49 CVE-2016-5198 125 Exec Code 2017-01-19 2018-01-05
6.8
 None Remote Medium Not required Partial Partial Partial
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac included incorrect optimisation assumptions, which allowed a remote attacker to perform arbitrary read/write operations, leading to code execution, via a crafted HTML page.
50 CVE-2016-5157 119 Exec Code Overflow 2016-09-11 2018-10-30
6.8
 None Remote Medium Not required Partial Partial Partial
Heap-based buffer overflow in the opj_dwt_interleave_v function in dwt.c in OpenJPEG, as used in PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allows remote attackers to execute arbitrary code via crafted coordinate values in JPEG 2000 data.
Total number of vulnerabilities : 116   Page : 1 (This Page)2 3
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.