Vulnerability database

7 results

• Apr 21, 2023Google Chrome Skia Integer Overflow VulnerabilityCVE-2023-2136 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedCritical 9.6

  Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.

  Product

  Chromium Skia

  On CISA’s list since

  Apr 21, 2023 (federal fix deadline May 12, 2023)

  What to do

  Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogchromereleases.googleblog.comcrbug.com

• May 23, 2022Google Chrome Blink Use-After-Free VulnerabilityCVE-2019-5786 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedMedium 6.5

  Google Chrome Blink contains a heap use-after-free vulnerability that allows an attacker to potentially perform out of bounds memory access via a crafted HTML page.

  Product

  Chrome Blink

  On CISA’s list since

  May 23, 2022 (federal fix deadline Jun 13, 2022)

  What to do

  Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogchromereleases.googleblog.comcrbug.com

• May 23, 2022Google Chrome WebAudio Use-After-Free VulnerabilityCVE-2019-13720 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8

  Google Chrome WebAudio contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.

  Product

  Chrome WebAudio

  On CISA’s list since

  May 23, 2022 (federal fix deadline Jun 13, 2022)

  What to do

  Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA cataloglists.opensuse.orgpacketstormsecurity.com

• Jan 10, 2022Google Chrome Media Use-After-Free VulnerabilityCVE-2020-6572 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8

  Google Chrome Media contains a use-after-free vulnerability that allows a remote attacker to execute code via a crafted HTML page.

  Product

  Chrome Media

  On CISA’s list since

  Jan 10, 2022 (federal fix deadline Jul 10, 2022)

  What to do

  Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogchromereleases.googleblog.comcrbug.com

• Nov 3, 2021Google Chrome for Android UI Heap Buffer Overflow VulnerabilityCVE-2020-16010 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedCritical 9.6

  Google Chrome for Android UI contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page.

  Product

  Chrome for Android UI

  On CISA’s list since

  Nov 3, 2021 (federal fix deadline May 3, 2022)

  What to do

  Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogchromereleases.googleblog.comcrbug.com

• Nov 3, 2021Google Chrome FreeType Heap Buffer Overflow VulnerabilityCVE-2020-15999 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedCritical 9.6

  Google Chrome uses FreeType, an open-source software library to render fonts, which contains a heap buffer overflow vulnerability in the function Load_SBit_Png when processing PNG images embedded into fonts. This vulnerability is part of an exploit chain with CVE-2020-17087 on Windows and CVE-2020-16010 on Android.

  Product

  Chrome FreeType

  On CISA’s list since

  Nov 3, 2021 (federal fix deadline Nov 17, 2021)

  What to do

  Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA cataloglists.opensuse.orgseclists.org

• Nov 3, 2021Google Chrome Use-After-Free VulnerabilityCVE-2020-16017 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedCritical 9.6

  Google Chrome contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page.

  Product

  Chrome

  On CISA’s list since

  Nov 3, 2021 (federal fix deadline May 3, 2022)

  What to do

  Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogchromereleases.googleblog.comcrbug.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.