Input Validation and Logic

Every one of the 1,755 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.CVE-2021-38003Google · CVSS 8.8 · 39% likelycovered by CyberSIXT

   CWE-755UNC35692 articles

2. Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafte…CVE-2025-6558Google · CVSS 8.8 · 11% likely

   CWE-20

3. Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox e…CVE-2022-3075Google · CVSS 9.6 · 5.8% likely

   CWE-20

4. Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 104.0.5112.101 allowed a remote attacker to arbitrarily browse to a malicious website vi…CVE-2022-2856Google · CVSS 6.5 · 4.6% likely

   CWE-20

5. there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interacti…CVE-2024-32896Google · CVSS 8.1 · 3.0% likely

   CWE-783

6. Insufficient validation of untrusted input in XML in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to bypass file access restrictions via a crafted HTML page. (Ch…CVE-2023-4357Google · CVSS 8.8 · 47% likely

   CWE-20

7. Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly implement the WebView class, which allows remote attackers to…CVE-2013-4710Google · 43% likely

   CWE-201 bounty report

8. The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code or cause…CVE-2016-0801Google · 33% likely

   CWE-20

9. Integer overflow in V8 in Google Chrome prior to 137.0.7151.119 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium sec…CVE-2025-6191Google · CVSS 8.8 · 12% likely

   CWE-472

10. Integer overflow in V8 in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severi…CVE-2025-7656Google · CVSS 8.8 · 11% likely

    CWE-472

11. Insufficient data validation in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page.CVE-2021-21123Google · 11% likely

    CWE-20

12. Integer overflow in Skia in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory…CVE-2026-8510Google · CVSS 7.5 · 10.0% likelycovered by CyberSIXT

    CWE-472

13. Insufficient policy enforcement in extensions in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass site isolation via a crafted Chrome Extension.CVE-2021-21126Google · 9.4% likely

    CWE-20

14. Incorrect security UI in Split View in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity:…CVE-2026-0907Google · CVSS 9.8 · 8.8% likely

    CWE-451

15. Integer overflow in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severi…CVE-2025-10891Google · CVSS 8.8 · 8.7% likely

    CWE-472

16. In transportDec_OutOfBandConfig of tpdec_lib.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additiona…CVE-2022-20130Google · 8.5% likely

    CWE-754

17. The Browser application in Android 4.0.3 allows remote attackers to cause a denial of service (application crash) via a crafted market: URI in the SRC attribute of an IFRAME eleme…CVE-2012-6301Google · 6.4% likely

    CWE-20

18. In reassemble_and_dispatch of packet_fragmenter.cc, there is possible out of bounds write due to an incorrect bounds calculation. This could lead to remote code execution over Blu…CVE-2020-0022Google · CVSS 8.8 · 6.1% likely

    CWE-682

19. Inappropriate use of JIT optimisation in V8 in Google Chrome prior to 61.0.3163.100 for Linux, Windows, and Mac allowed a remote attacker to execute arbitrary code inside a sandbo…CVE-2017-5121Google · 5.3% likely

    CWE-20

20. Cross-application scripting vulnerability in the Browser URL loading functionality in Android 2.3.4 and 3.1 allows local applications to bypass the sandbox and execute arbitrary J…CVE-2011-2357Google · 4.6% likely

    CWE-20

21. The IDAPython plugin before 1.5.2.3 in IDA Pro allows user-assisted remote attackers to execute arbitrary code via a crafted IDB file, related to improper handling of certain swig…CVE-2011-4783Google · 4.4% likely

    CWE-20

22. Google Chrome 0.2.149.29 and 0.2.149.30 allows remote attackers to cause a denial of service (memory consumption) via an HTML document containing a carriage return ("\r\n\r\n") ar…CVE-2008-4340Google · 4.2% likely

    CWE-20

23. Tunnelblick 3.3beta20 and earlier relies on argv[0] to determine the name of an appropriate (1) kernel module pathname or (2) executable file pathname, which allows local users to…CVE-2012-3485Google · 3.8% likely

    CWE-20

24. Google Chrome before 14.0.835.163 does not properly perform garbage collection during the processing of PDF documents, which allows remote attackers to cause a denial of service o…CVE-2011-2841Google · 3.7% likely

    CWE-20

25. Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 do not properly handle speech data, which allows remote attackers to execute arbitrary code via unspecified vecto…CVE-2011-0485Google · 3.4% likely

    CWE-20

26. libutils in Android through 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted metadata in a (1) MP3 or (2) MP4 file, as demonstrated by an attack against…CVE-2015-6602Google · 3.4% likely

    CWE-20

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.