Cross-origin data leakage in Google Chrome's Passwords component (prior to 151.0.7922.72) allows a remote attacker to read credential or password-related data across origin boundaries by enticing a user to visit a crafted HTML page. The flaw stems from an origin validation error (CWE-346) in the Passwords feature, where Chrome fails to properly enforce same-origin constraints. No public exploit code has been identified and SSVC signals no known active exploitation, placing this in the medium-priority tier despite Chrome's ubiquitous deployment footprint.
Cross-origin data leakage in Google Chrome's ReportingAndNEL subsystem (versions prior to 151.0.7922.72) allows a remote attacker to exfiltrate limited cross-origin information by delivering a crafted HTML page to a victim user. The flaw stems from an origin validation error (CWE-346) in the Network Error Logging and Reporting API implementation. No public exploit code has been identified and SSVC confirms exploitation status as none, but the combination of a network attack vector, no privilege requirement, and ubiquitous browser deployment makes patch application a straightforward priority.
Side-channel GPU information leakage in Google Chrome on Android prior to 151.0.7922.72 enables remote attackers to extract cross-origin data by serving a crafted HTML page. The vulnerability exploits the GPU rendering pipeline to observe timing or state artifacts that escape the Same-Origin Policy boundary, allowing partial disclosure of data from other origins loaded in the browser. No active exploitation has been confirmed (not in CISA KEV), and the EPSS score of 0.17% (7th percentile) reflects low observed exploitation probability; a vendor-released patch is available.
Cross-origin data leakage in Google Chrome's Loader component (all versions prior to 151.0.7922.72) enables a remote attacker to read data from a different web origin by inducing a victim to visit a crafted HTML page. The flaw is rooted in an inappropriate implementation of origin validation (CWE-346) within the resource-loading subsystem, undermining the browser's Same-Origin Policy enforcement. No public exploit code has been identified and EPSS sits at 0.17% (7th percentile), indicating low exploitation likelihood at this time; however, the impact class is meaningful for users with active authenticated sessions to sensitive web applications.
Cross-origin data leakage in Google Chrome's MHTML parser prior to version 151.0.7922.72 enables remote attackers to read data from origins they should not have access to, violating the Same-Origin Policy. The vulnerability requires user interaction - a victim must open a crafted MHTML page - and produces a limited confidentiality impact with no integrity or availability exposure. No public exploit code exists and no active exploitation has been identified; EPSS of 0.17% (7th percentile) and Chromium's own 'Low' severity rating confirm this is a low-urgency finding despite broad product deployment.
Navigation restriction bypass in Google Chrome for Android (prior to 151.0.7922.72) stems from insufficient input validation in the Sharing component, enabling a remote attacker to circumvent Chrome's navigation controls via malicious network traffic when a user interacts with the Share feature. The flaw yields limited integrity impact only - no confidentiality or availability compromise - consistent with Chromium's own 'Low' severity classification and an EPSS of 0.17% (7th percentile). No public exploit code exists and no active exploitation has been confirmed; a vendor-released patch is available.
Side-channel information leakage in Google Chrome's Media component (versions prior to 151.0.7922.72) enables a remote attacker to leak cross-origin data by directing a victim to a crafted HTML page, bypassing same-origin policy protections through measurable side effects of media processing. Affected desktop users on all platforms running any Chrome release before 151.0.7922.72 are exposed to limited confidentiality loss. EPSS is 0.16% (6th percentile), SSVC exploitation status is none, and no public exploit has been identified at time of analysis - all signals converge on low real-world risk.
UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to deceive users into believing they are interacting with a legitimate browser interface by serving a crafted HTML page. The root cause is insufficient policy enforcement (CWE-346, origin validation error), allowing the attacker to manipulate rendered UI elements. No public exploit code exists and no active exploitation has been confirmed; EPSS stands at 0.16% (6th percentile) and CISA SSVC classifies exploitation as none, placing this firmly in a patch-and-monitor priority tier rather than an emergency response.
UI spoofing in Google Chrome for iOS prior to version 151.0.7922.72 enables a remote unauthenticated attacker to misrepresent critical interface elements - such as the address bar or origin indicators - through a specially crafted HTML page. Classified as CWE-451 (UI Misrepresentation of Critical Information), the impact is limited to integrity: no code execution or data exfiltration is possible directly, but users can be deceived into trusting a malicious page as legitimate. No public exploit code exists, EPSS sits at 0.16% (6th percentile), and Chromium internally rated this as Low severity - consistent with a constrained, social-engineering-dependent attack surface.
UI spoofing in Google Chrome for Android (prior to 151.0.7922.72) enables remote unauthenticated attackers to present misleading interface elements to users through a crafted HTML page. The flaw stems from an inappropriate implementation in Chrome's input handling on Android, classified under CWE-451 (UI Misrepresentation of Critical Information), meaning the browser fails to correctly represent critical UI state to the user. No public exploit code exists and CISA has not listed this in KEV; EPSS is extremely low at 0.16% (6th percentile), consistent with Chromium's own Low severity classification.
UI spoofing via Google Lens in Google Chrome prior to 151.0.7922.72 is achievable by a remote attacker who has already compromised the renderer process, using a crafted HTML page to misrepresent interface elements to the victim. The attack requires a chained exploitation scenario: renderer compromise as a prerequisite, followed by abuse of an inappropriate implementation in the Lens component (CWE-451) to manipulate what the user perceives in the browser UI. No active exploitation is confirmed - CISA KEV does not list this CVE, SSVC assessment shows exploitation status of none, and EPSS sits at 0.16% (6th percentile), indicating very low real-world exploitation probability at time of analysis.
Cross-origin data leakage in Google Chrome's Speech component prior to version 151.0.7922.72 exposes sensitive information to attackers who have already achieved renderer process compromise. The vulnerability stems from insufficient policy enforcement in the Speech API, allowing a crafted HTML page to bypass cross-origin boundaries and exfiltrate data. With no CISA KEV listing, no public POC, and an EPSS of 0.16% (6th percentile), this is a low-probability exploitation scenario best understood as a potential second-stage component in a multi-vulnerability chain rather than a standalone attack.
UI spoofing in Google Chrome's Passwords component before version 151.0.7922.72 allows remote attackers to manipulate credential-related UI elements via malicious network traffic, exploiting insufficient input validation in the password manager subsystem. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-reachable without authentication but requires user interaction, limiting automated mass exploitation. With an EPSS of 0.16% (6th percentile), no KEV listing, and no known POC, real-world exploitation risk is low despite the ubiquitous deployment footprint of Chrome.
Cross-origin data leakage in the Enterprise policy implementation of Google Chrome on Windows (versions prior to 151.0.7922.72) enables a remote attacker to extract data across origin boundaries by delivering a malicious file to a victim user. The CWE-346 (Origin Validation Error) root cause indicates Chrome's Enterprise component fails to enforce same-origin boundaries in this specific code path, exposing data that should be restricted. No public exploit has been identified and EPSS sits at the 6th percentile, with CISA SSVC confirming no current exploitation; this is a low-urgency but real information disclosure risk for enterprise Chrome deployments on Windows.
UI spoofing in Google Chrome's Passwords subsystem (versions prior to 151.0.7922.72) enables remote attackers to manipulate password-related UI elements through malicious network traffic, potentially deceiving users into submitting credentials to unintended destinations. Exploitation requires active user interaction (UI:R per CVSS), and real-world risk is constrained by an EPSS of 0.15% (5th percentile) and SSVC confirmation of no known exploitation and a non-automatable attack path. No public exploit identified at time of analysis; vendor patch is available in Chrome 151.0.7922.72.
UI spoofing in Google Chrome's Passwords component (versions prior to 151.0.7922.72) allows a remote unauthenticated attacker to manipulate how credential-related UI elements are displayed by delivering maliciously crafted network traffic to a browsing user. The root cause is insufficient input validation (CWE-20) in the Passwords subsystem, which fails to sanitize externally sourced data before rendering it in the browser interface. No public exploit code has been identified and CISA has not listed this in KEV; EPSS of 0.15% (5th percentile) confirms low automated exploitation probability, consistent with the SSVC rating of exploitation: none.
UI spoofing in Google Chrome's Settings component (versions prior to 151.0.7922.72) enables remote attackers to misrepresent critical interface elements to victims via malicious network traffic, requiring user interaction to trigger. EPSS at 0.15% (5th percentile) and CISA SSVC exploitation rating of none align with the Chromium team's own Low severity classification, making this a low-urgency issue despite its network-accessible attack vector. Google has released a patch in stable channel version 151.0.7922.72; no public exploits are identified at time of analysis.
Cross-origin data leakage in Google Chrome's Extensions subsystem prior to version 151.0.7922.72 enables a crafted extension to bypass same-origin policy protections and read data from cross-origin browser contexts. Exploitation requires convincing a target user to install a malicious Chrome Extension, placing this firmly in the social-engineering-dependent threat category. No active exploitation is confirmed (not in CISA KEV), no public POC has been identified, and an EPSS of 0.13% at the 3rd percentile reflects minimal real-world exploitation probability at time of analysis.
UI spoofing in Google Chrome's Extensions component enables an attacker who persuades a victim to install a malicious extension to misrepresent browser security indicators, affecting all Chrome desktop versions prior to 151.0.7922.72. The flaw (CWE-451) stems from incorrect rendering of security UI elements within the Extensions subsystem, granting a crafted extension the ability to deceive users about their browser's security state or extension permissions. No public exploit identified at time of analysis, and EPSS at 0.13% (3rd percentile) reflects very low exploitation probability; this CVE is not listed in CISA KEV.
Cross-Site Request Forgery in the FuseWP WordPress plugin (all versions ≤ 1.1.24.2) allows unauthenticated attackers to toggle email-marketing sync rule states by tricking an authenticated administrator into triggering a forged request. The root cause is missing nonce verification on the toggle_sync_status() AJAX handler in AjaxHandler.php (line 149), meaning WordPress's built-in CSRF protection is entirely absent for that state-changing action. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; CVSS 4.3 Medium correctly reflects the limited impact scope - the attacker can only enable or disable sync rules, not read data or execute code.
Insufficient policy enforcement in the Extensions subsystem of Google Chrome prior to 151.0.7922.72 allows an attacker to bypass discretionary access controls by deploying a malicious extension that uses a specially crafted domain name. The attack is fully dependent on social engineering - the victim must be convinced to install the malicious extension, which significantly constrains opportunistic exploitation. With a CVSS score of 4.3, EPSS at 0.12% (2nd percentile), no CISA KEV listing, and a 'Low' Chromium-internal severity rating, no public exploit identified at time of analysis, this represents a minimal real-world priority for most organizations, particularly those with enterprise extension management controls in place.
Cross-origin data leakage in Google Chrome's Cast component allows an unauthenticated attacker positioned on the same local network segment to read data from origins they should not have access to via maliciously crafted network traffic. All Chrome versions prior to 151.0.7922.72 are affected. No public exploit code exists and CISA has not listed this in the KEV catalog, placing real-world risk at low-to-moderate despite the unauthenticated attack vector.
Cross-origin data leakage in Google Chrome's Cast subsystem (versions prior to 151.0.7922.72) allows unauthenticated attackers on the same local network segment to extract sensitive cross-origin browser data via crafted network traffic. The insufficient input validation in the Cast component bypasses browser isolation boundaries, exposing data from origins the victim is actively browsing. No public exploit code or active exploitation (CISA KEV) has been identified, and an EPSS of 0.12% (2nd percentile) reflects very low near-term exploitation probability.
UI spoofing in Google Chrome's Passwords component allows an attacker occupying a privileged network position (man-in-the-middle) to manipulate password-related interface elements via malicious network traffic. All Chrome releases prior to 151.0.7922.72 on desktop are affected. Exploitation requires both a privileged network position and user interaction, substantially constraining real-world risk; no public exploit code exists and EPSS sits at the 2nd percentile, consistent with no observed exploitation in the wild.
DevTools policy enforcement failure in Google Chrome prior to 151.0.7922.72 enables cross-origin data leakage through a malicious Chrome Extension that a victim is socially engineered into installing. The vulnerability is classified as information disclosure only (C:L/I:N/A:N), requires active user participation to exploit, and carries Chromium's lowest internal severity rating. No public exploit code exists and no active exploitation has been identified; EPSS places this at the 2nd percentile, and SSVC confirms exploitation status as none with non-automatable delivery.
UI spoofing in Google Chrome's Extensions subsystem (all versions prior to 151.0.7922.72) allows an attacker who tricks a user into installing a crafted malicious extension to misrepresent critical security indicators within the browser interface. The flaw stems from incorrect security UI rendering in the Extensions component (CWE-451), enabling deceptive presentation of extension trust signals or permissions. No public exploit has been identified at time of analysis and EPSS is 0.10% (1st percentile), aligning with Chromium's own internal 'Low' severity rating; however, the ubiquitous deployment footprint of Chrome elevates the aggregate exposure.
Site isolation bypass in Google Chrome allows a remote attacker who has already compromised the renderer process to escape cross-origin boundaries via a crafted HTML page, potentially accessing data from other open origins within the browser. All Chrome desktop versions prior to 151.0.7922.72 are affected. The CVSS 4.2 (Medium) with AC:H reflects that this is a second-stage exploitation primitive requiring prior renderer compromise, not a standalone initial access vector; no public exploit or CISA KEV listing has been identified at time of analysis.
UI spoofing in Google Chrome's Payments component on Android allows a remote attacker who has already achieved renderer process compromise to deceive victims through manipulated payment dialogs via a crafted HTML page. All Chrome for Android versions prior to 151.0.7922.72 are affected. No public exploit code exists and CISA SSVC confirms no active exploitation, placing this firmly in the lower-priority tier despite its network-accessible attack vector.
DFIR-IRIS web application version 2.4.26 implements logout without server-side session invalidation, leaving session cookies valid indefinitely after a user believes they have signed out. Classified as CWE-613 (Insufficient Session Expiration), this flaw means any attacker who obtains a valid session cookie - through XSS, network interception, shoulder-surfing, or physical device access - retains unauthorized access to the IRIS incident response platform even after the legitimate user logs out. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Universal Cross-Site Scripting (UXSS) in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to inject arbitrary scripts or HTML across origin boundaries by exploiting a race condition triggered through a crafted HTML page. The vulnerability requires user interaction and benefits from high attack complexity due to race-condition timing, placing real-world exploitation difficulty well above typical web vulnerabilities. No public exploit code exists and no active exploitation has been identified; SSVC assessment confirms exploitation status as none at time of analysis.
Script injection in Spring Tools for Eclipse's New Spring Starter Project wizard allows arbitrary JavaScript execution inside the IDE's embedded SWT browser when a developer hovers over dependency checkboxes rendered from a compromised or attacker-controlled Initializr endpoint. Affected are all versions through 5.2.0, per the vendor (VMware/Spring) advisory. Despite the 'RCE' tag in associated intelligence, the vendor explicitly bounds the impact to in-IDE UI spoofing and outbound network beaconing - not host-level code execution. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Insufficient policy enforcement in Google Chrome's Extensions subsystem prior to version 151.0.7922.72 enables Universal Cross-Site Scripting (UXSS), allowing an attacker who socially engineers a user into installing a malicious extension to inject arbitrary scripts or HTML across web origins. CVSS scores this at 4.2 (Medium) with high attack complexity reflecting the required social engineering; EPSS is negligible at 0.13% (3rd percentile). No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA KEV, suggesting it has not seen widespread or automated exploitation.
UI spoofing in the Google Chrome Updater component on Windows (prior to 151.0.7922.72) enables a local attacker to present a falsified interface to users by placing a malicious file in a location the Updater processes. Chromium's own team rates this 'Low' severity, consistent with the 4.0 CVSS score, EPSS of 0.10% (1st percentile), and SSVC exploitation status of 'none'. No public exploit exists at time of analysis, and a vendor-confirmed patch is available in Chrome 151.0.7922.72.
Insufficient audit logging in VMware ESX and related Broadcom virtualization platforms allows a malicious administrator to perform certain privileged operations without generating corresponding log entries. Affected products span the VMware ecosystem including Cloud Foundation, vSphere Foundation, ESX, and Telco Cloud Platform. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the insider-threat and post-compromise forensic evasion implications are meaningful for organizations relying on audit logs for compliance and incident response.
Cross-origin data leakage in Google Chrome on Linux (prior to 151.0.7922.72) stems from an inappropriate implementation in the browser's Editing subsystem, enabling a remote attacker to exfiltrate limited cross-origin information when a victim interacts with a crafted HTML page. The CVSS vector (PR:L/UI:R) confirms exploitation requires both some authenticated context and active victim interaction, materially reducing opportunistic risk. No public exploit has been identified and EPSS sits at the 7th percentile, consistent with the vendor's own 'Low' severity classification.
Cross-origin data leakage in Google Chrome for Android (prior to 151.0.7922.72) allows a local attacker to read clipboard contents belonging to a different browsing origin by luring a victim to a crafted HTML page. The flaw arises from insufficient input validation in Chrome's Clipboard component on Android, classified under CWE-20. No public exploit code exists and no active exploitation has been confirmed; EPSS of 0.13% at the 3rd percentile reflects a minimal real-world exploitation probability at this time.
Cross-origin data leakage in Google Chrome on Android prior to 151.0.7922.72 enables a local attacker to read data from a different origin by directing a victim user to a crafted HTML page. The flaw stems from an inappropriate browser implementation (CWE-346 Origin Validation Error), undermining the Same-Origin Policy's isolation guarantees on the Android platform. No public exploit code exists and no active exploitation has been observed; SSVC assessment confirms exploitation status as none, making this a low-urgency but noteworthy information-disclosure defect.
Omnibox spoofing in Google Chrome for Android prior to 151.0.7922.72 allows a local attacker to display falsified URLs in the browser's address bar by delivering a malicious file to the target device. The flaw stems from insufficient validation of untrusted input in the Mobile component, classified under CWE-20. With EPSS at 0.11% (2nd percentile) and no CISA KEV listing, real-world exploitation risk is low, though successful exploitation could undermine user trust in the displayed URL and facilitate phishing on compromised or shared devices.
Spring Tools language server exposes proxy Basic-auth credentials in cleartext log files, affecting Spring Tools for Eclipse 5.2.0 and earlier and Spring Tools for VSCode/Cursor/Theia 2.2.0 and earlier. When no explicit http.proxy workspace setting is configured, the language server reads the HTTP_PROXY/HTTPS_PROXY (and lowercase variants) environment variables and writes their raw values-including embedded credentials in the form http://user:pass@proxy:8080-to its log at INFO level without redaction. Because language server logs are often shared in bug reports or are readable by other local users and processes, this results in proxy credential disclosure. No public exploit has been identified at time of analysis, and CISA KEV listing is absent.
Cross-origin data leakage in Google Chrome's Passwords feature prior to version 151.0.7922.72 allows a remote attacker to read cross-origin data by convincing a victim to perform specific UI gestures on a crafted HTML page. Rated High severity by the Chromium security team - higher than the NVD CVSS base score of 3.1 suggests - reflecting the sensitivity of credential-adjacent cross-origin boundary violations. No public exploit identified at time of analysis, and SSVC assessment confirms no current exploitation activity.
Cross-origin data leakage in Google Chrome's Skia graphics library (all versions prior to 151.0.7922.72) enables a remote attacker who has already achieved renderer process compromise to exfiltrate cross-origin data via a crafted HTML page. The flaw is a CWE-346 Origin Validation Error within Skia's rendering pipeline and is constrained to an information-disclosure impact with no integrity or availability consequence. No public exploit or CISA KEV listing exists, and EPSS at 0.29% (21st percentile) alongside SSVC Exploitation: none signal this is a low-probability exploitation scenario requiring a multi-stage attack chain.
Cross-origin data leakage in Google Chrome for iOS (versions prior to 151.0.7922.72) allows remote attackers to read cross-origin data by delivering a crafted HTML page that socially engineers the victim into performing specific UI gestures. The root cause is an inappropriate implementation classified under CWE-346 (Origin Validation Error), meaning Chrome's iOS-specific code fails to correctly enforce same-origin policy boundaries under particular interaction sequences. No active exploitation has been confirmed - CISA KEV status is absent, SSVC exploitation rating is 'none', and EPSS sits at 0.21% (11th percentile) - placing this firmly in the low-priority tier despite its network delivery vector.
Cross-origin data leakage in Google Chrome's SVG implementation (all versions prior to 151.0.7922.72) enables remote attackers to read data from cross-origin resources by luring a victim to a crafted HTML page. The flaw, rooted in an origin validation error (CWE-346) in Chrome's SVG rendering engine, breaks same-origin policy protections. No public exploit identified at time of analysis; EPSS at 0.21% (11th percentile) and SSVC exploitation status of 'none' collectively indicate low near-term exploitation probability.
Cross-origin data leakage in Google Chrome's Passwords component (versions prior to 151.0.7922.72) enables a remote attacker who has already compromised the renderer process to exfiltrate password data across origin boundaries via a crafted HTML page. The root cause is insufficient policy enforcement (CWE-346: Origin Validation Error), meaning the browser's same-origin policy is not correctly applied within the Passwords subsystem when the renderer is already under attacker control. No public exploit code exists and no confirmed active exploitation has been observed; EPSS sits at 0.21% (11th percentile), and SSVC rates exploitation as none with non-automatable impact, making this a low-urgency but architecturally significant renderer sandbox concern.
Cross-origin data leakage in Google Chrome for Android (prior to 151.0.7922.72) stems from insufficient policy enforcement in the USB component, exploitable only after the attacker has already compromised the renderer process. Exploitation requires luring a victim to a crafted HTML page in a pre-compromised renderer context, making this a secondary-stage vulnerability in a chained attack rather than a standalone threat. EPSS sits at 0.19% (9th percentile), SSVC records no exploitation activity, and the vulnerability is not listed in CISA KEV - consistent with its low severity rating and demanding prerequisite.
Cross-origin data leakage in Google Chrome on Android (prior to 151.0.7922.72) results from an inappropriate UI implementation that allows a remote attacker to extract data from a different web origin when a user is socially engineered into performing specific UI gestures on a crafted HTML page. Rated CVSS 3.1 (Low) with EPSS at 0.17% (7th percentile) and SSVC exploitation status of 'none,' this vulnerability presents minimal immediate operational risk. No public exploit code exists and the issue is not listed in CISA KEV; a vendor-released patch is available in the stable channel update.
Cross-origin data leakage in Google Chrome's CORS implementation enables a post-exploitation information disclosure step for attackers who have already compromised the renderer process. All Chrome versions prior to 151.0.7922.72 are affected, with exploitation requiring both a pre-existing renderer compromise and user interaction with a crafted HTML page. No public exploit code exists and no CISA KEV listing; EPSS at 0.17% (7th percentile) and SSVC Exploitation: none confirm this is a low-priority, chained-attack-only vulnerability in practice.
Cross-origin data leakage in Google Chrome's Passwords component (versions prior to 151.0.7922.72) exposes password-related data to attackers who have already compromised the renderer process and can deliver a crafted HTML page. The flaw stems from an inappropriate implementation that fails to enforce proper origin validation within the Passwords subsystem, making it a second-stage element in a chained attack rather than a standalone threat. No public exploit has been identified, EPSS is 0.16% (6th percentile), SSVC records no known exploitation, and Chromium internally rates this Low severity - consistent with the high prerequisite bar of prior renderer compromise.
Chrome for iOS prior to 151.0.7922.72 exposes potentially sensitive process memory contents to an attacker with physical access to the device through an inappropriate implementation flaw. The vulnerability is classified CWE-200 (Information Disclosure) and is iOS-platform-specific, not affecting Chrome on other operating systems. No public exploit code exists and CISA SSVC confirms no active exploitation, placing this firmly in the low-urgency tier despite requiring prompt patching for high-assurance mobile environments.
SFTPGo versions prior to 2.7.4 expose a permission bypass allowing authenticated users holding the create_symlinks permission to circumvent per-directory access controls by creating symbolic links that bridge permitted and restricted directories. Authorization is evaluated against the symlink's parent directory rather than the dereferenced target, so read and write operations succeed against paths the user should not be able to reach. No public exploit or CISA KEV listing has been identified; the CVSS 4.0 score of 2.3 reflects the combined effect of high attack complexity and low privilege requirements.