Google Chrome vulnerabilities, page 4
7,009 vulnerabilities
Known vulnerabilities in Google Chrome, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2018-16075ubuntuchromium-browser+2
EPSS score0.88%
Insufficient file type enforcement in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to obtain local file data via a crafted HTML page.CVE-2018-16068ubuntuchromium-browser+6EPSS score1.94%
Missing validation in Mojo in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.CVE-2018-16081ubuntuchromium-browser+5EPSS score1.04%
Allowing the chrome.debugger API to run on file:// URLs in DevTools in Google Chrome prior to 69.0.3497.81 allowed an attacker who convinced a user to install a malicious extension to access files on the local file system without file access permission via a crafted Chrome Extension.CVE-2018-16070ubuntuchromium-browser+2EPSS score0.88%
Integer overflows in Skia in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.CVE-2018-16083ubuntuchromium-browser+5EPSS score5.26%
An out of bounds read in forward error correction code in WebRTC in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.CVE-2018-16085ubuntuchromium-browser+2EPSS score1.48%
A use after free in ResourceCoordinator in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.CVE-2018-16073ubuntuchromium-browser+2EPSS score0.86%
Insufficient policy enforcement in site isolation in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass site isolation via a crafted HTML page.CVE-2018-16079ubuntuchromium-browser+5EPSS score1.07%
A race condition between permission prompts and navigations in Prompts in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.CVE-2018-16076ubuntuchromium-browser+5EPSS score1.67%
Missing bounds check in PDFium in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file.CVE-2018-16064ubuntuchromium-browser+1EPSS score0.49%
Insufficient data validation in Extensions API in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension.CVE-2018-16080ubuntuchromium-browser+2EPSS score1.36%
A missing check for popup window handling in Fullscreen in Google Chrome on macOS prior to 69.0.3497.81 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.CVE-2018-16072ubuntuchromium-browser+2EPSS score0.78%
A missing origin check related to HLS manifests in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass same origin policy via a crafted HTML page.CVE-2018-20069googlechromeEPSS score0.43%
Failure to prevent navigation to top frame to data URLs in Navigation in Google Chrome on iOS prior to 71.0.3578.80 allowed a remote attacker to confuse the user about the origin of the current page via a crafted HTML page.CVE-2018-20073debianchromium+1EPSS score0.24%
Use of extended attributes in downloads in Google Chrome prior to 72.0.3626.81 allowed a local attacker to read download URLs via the filesystem.CVE-2018-20066debianchromium+2EPSS score0.60%
Incorrect object lifecycle in Extensions in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.CVE-2018-20068debianchromium+2EPSS score0.47%
Incorrect handling of 304 status codes in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to confuse the user about the origin of the current page via a crafted HTML page.CVE-2018-20070debianchromium+2EPSS score0.48%
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.CVE-2018-20065debianchromium+2EPSS score0.57%
Handling of URI action in PDFium in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to initiate potentially unsafe navigations without a user gesture via a crafted PDF file.CVE-2018-20072debianchromium+1EPSS score0.16%
Insufficient data validation in PDF in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform out of bounds memory access via a crafted PDF file. (Chromium security severity: Low)CVE-2018-20067debianchromium+2EPSS score0.47%
A renderer initiated back navigation was incorrectly allowed to cancel a browser initiated one in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to confuse the user about the origin of the current page via a crafted HTML page.