Export limit exceeded: 30247 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 30,247

Export CSV
CVE-2018-6150

chromium-browser: Cross origin information disclosure in Service Workers

Incorrect handling of CORS in ServiceWorker in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2018-6147

chromium-browser: Password fields not taking advantage of OS protections in Views

Lack of secure text entry mode in Browser UI in Google Chrome on Mac prior to 67.0.3396.62 allowed a local attacker to obtain potentially sensitive information from process memory via a local process.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Debian Google and 1 more
Products
Mac Os X Debian Linux Chrome and 4 more
CVE-2018-6140

chromium-browser: Restrictions bypass in the debugger extension API

Allowing the chrome.debugger API to attach to Web UI pages in DevTools in Google Chrome prior to 67.0.3396.62 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension.

CVSS 3.0 · 8.8 High EPSS 2.6% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Enterprise Linux Desktop and 3 more
CVE-2018-6139

chromium-browser: Restrictions bypass in the debugger extension API

Insufficient target checks on the chrome.debugger API in DevTools in Google Chrome prior to 67.0.3396.62 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension.

CVSS 3.0 · 8.8 High EPSS 1.9% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Enterprise Linux Desktop and 3 more
CVE-2018-6138

chromium-browser: Overly permissive policy in Extensions

Insufficient policy enforcement in Extensions API in Google Chrome prior to 67.0.3396.62 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension.

CVSS 3.0 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2018-6134

chromium-browser: Referrer Policy bypass in Blink

Information leak in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to bypass no-referrer policy via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2018-6121

chromium-browser: Privilege Escalation in extensions

Insufficient validation of input in Blink in Google Chrome prior to 66.0.3359.170 allowed a remote attacker to perform privilege escalation via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2018-6119

chromium-browser: Spoof of contents of the Omnibox (URL bar) via a crafted HTML page

Incorrect security UI in Omnibox in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2018-6117

chromium-browser: Confusing autofill settings

Confusing settings in Autofill in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 1.9% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Enterprise Linux Desktop and 3 more
CVE-2018-6115

chromium-browser: SmartScreen bypass in downloads

Inappropriate setting of the SEE_MASK_FLAG_NO_UI flag in file downloads in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to potentially bypass OS malware checks via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 1.0% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2018-6113

chromium-browser: URL spoof in Navigation

Improper handling of pending navigation entries in Navigation in Google Chrome on iOS prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Apple Debian Google and 1 more
Products
Macos Debian Linux Chrome and 4 more
CVE-2018-6111

chromium-browser: Heap-use-after-free in DevTools

An object lifetime issue in the developer tools network handler in Google Chrome prior to 66.0.3359.117 allowed a local attacker to execute arbitrary code via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS 2.6% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Enterprise Linux Desktop and 3 more
CVE-2018-6110

chromium-browser: Incorrect handling of plaintext files via file://

Parsing documents as HTML in Downloads in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to cause Chrome to execute scripts via a local non-HTML page.

CVSS 3.0 · 5.4 Medium EPSS 1.2% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Enterprise Linux Desktop and 3 more
CVE-2018-6109

chromium-browser: Incorrect handling of files by FileAPI

readAsText() can indefinitely read the file picked by the user, rather than only once at the time the file is picked in File API in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to access data on the user file system without explicit consent via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Enterprise Linux Desktop and 3 more
CVE-2018-6102

chromium-browser: URL spoof in Omnibox

Missing confusable characters in Internationalization in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.

CVSS 3.0 · 4.3 Medium EPSS 1.2% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Linux Desktop and 3 more
CVE-2018-6101

chromium-browser: Insufficient protection of remote debugging prototol in DevTools

A lack of host validation in DevTools in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted HTML page, if the user is running a remote DevTools debugging server.

CVSS 3.0 · 7.5 High EPSS 2.7% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Linux Desktop and 3 more
CVE-2018-6099

chromium-browser: CORS bypass in ServiceWorker

A lack of CORS checks in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak limited cross-origin data via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 1.6% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Linux Desktop and 3 more
CVE-2018-6096

chromium-browser: Fullscreen UI spoof

A JavaScript focused window could overlap the fullscreen notification in Fullscreen in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to obscure the full screen warning via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Enterprise Linux Desktop and 3 more