Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,864

CVE-2018-6163

chromium-browser: URL spoof in Omnibox

Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.

CVSS 3.0 · 6.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Enterprise Linux Desktop and 3 more
CVE-2018-6162

chromium-browser: Heap buffer overflow in WebGL

Improper deserialization in WebGL in Google Chrome on Mac prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS 1.6% KEV · Not listed
Vendors
Apple Debian Google and 1 more
Products
Macos Debian Linux Chrome and 4 more
CVE-2018-6161

chromium-browser: Same origin policy bypass in WebAudio

Insufficient policy enforcement in Blink in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to bypass same origin policy via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2018-6160

chromium-browser: URL spoof in Chrome on iOS

JavaScript alert handling in Prompts in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2018-6159

chromium-browser: Same origin policy bypass in ServiceWorker

Insufficient policy enforcement in ServiceWorker in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2018-6157

chromium-browser: Type confusion in WebRTC

Type confusion in WebRTC in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted video file.

CVSS 3.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2018-6156

chromium-browser: Heap buffer overflow in WebRTC

Incorect derivation of a packet length in WebRTC in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted video file.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Google Redhat
Products
Ubuntu Linux Chrome Rhel Extras
CVE-2018-6155

chromium-browser: Use after free in WebRTC

Incorrect handling of frames in the VP8 parser in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted video file.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2018-6154

chromium-browser: Heap buffer overflow in WebGL

Insufficient data validation in WebGL in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2018-6153

chromium-browser: Stack buffer overflow in Skia

A precision error in Skia in Google Chrome prior to 68.0.3440.75 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS 1.6% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Enterprise Linux Desktop and 3 more
CVE-2018-6152

chromium-browser: Local file write in DevTools

The implementation of the Page.downloadBehavior backend unconditionally marked downloaded files as safe, regardless of file type in Google Chrome prior to 66.0.3359.117 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted HTML page and user interaction.

CVSS 3.0 · 9.6 Critical EPSS 1.3% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Enterprise Linux Desktop and 3 more
CVE-2018-6151

chromium-browser: Bad cast in DevTools

Bad cast in DevTools in Google Chrome on Win, Linux, Mac, Chrome OS prior to 66.0.3359.117 allowed an attacker who convinced a user to install a malicious extension to perform an out of bounds memory read via a crafted Chrome Extension.

CVSS 3.0 · 8.8 High EPSS 1.2% KEV · Not listed
Vendors
Apple Debian Google and 3 more
Products
Macos Debian Linux Chrome and 7 more
CVE-2018-6150

chromium-browser: Cross origin information disclosure in Service Workers

Incorrect handling of CORS in ServiceWorker in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2018-6149

chromium-browser: Out of bounds write in V8

Type confusion in JavaScript in Google Chrome prior to 67.0.3396.87 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2018-6148

chromium-browser: Incorrect handling of CSP header

Incorrect implementation in Content Security Policy in Google Chrome prior to 67.0.3396.79 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2018-6147

chromium-browser: Password fields not taking advantage of OS protections in Views

Lack of secure text entry mode in Browser UI in Google Chrome on Mac prior to 67.0.3396.62 allowed a local attacker to obtain potentially sensitive information from process memory via a local process.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Debian Google and 1 more
Products
Mac Os X Debian Linux Chrome and 4 more
CVE-2018-6145

chromium-browser: Incorrect escaping of MathML in Blink

Insufficient data validation in HTML parser in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to bypass same origin policy via a crafted HTML page.

CVSS 3.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras