Sandbox escape in Google Chrome for macOS prior to 151.0.7922.72 lets an attacker who has already compromised the renderer process break out of the sandbox and reach the more-privileged browser process by loading a crafted HTML page that abuses Chrome's MHTML handling. It is rated High by Chromium and carries a CVSS 9.6 (scope-changed) score, but exploitation is a second-stage step that presupposes prior renderer compromise. There is no public exploit identified at time of analysis, and EPSS is low at 0.29% (21st percentile).
Sandbox escape in Google Chrome desktop prior to 151.0.7922.72 lets an attacker who has already compromised the renderer process leverage a use-after-free in the Audio component to break out of the sandbox via a crafted HTML page. Rated High by Chromium and CVSS 9.6 due to scope change, this is a second-stage exploit primitive rather than an initial-access bug; no public exploit has been identified at time of analysis and EPSS is low at 0.29%. A vendor patch is available in Chrome 151.0.7922.72.
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated Chromium severity High with a CVSS 9.6, the flaw is a use-after-free (CWE-416) reported by Google's own Chrome team; a vendor patch is available. There is no public exploit identified at time of analysis and EPSS is low (0.29%), consistent with SSVC showing no known exploitation.
Sandbox escape in Google Chrome's ANGLE graphics layer on macOS (versions prior to 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated High by Chromium and carrying a CVSS 9.6 due to the scope change from renderer to host, it enables full compromise of the browser process. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.29% (21st percentile).
Sandbox escape in Google Chrome on macOS (versions prior to 151.0.7922.72) stems from an inappropriate implementation in ANGLE, Chrome's graphics abstraction layer, allowing a remote attacker to break out of the renderer sandbox via a crafted HTML page after the victim loads it. Rated High by Chromium and carrying a CVSS 9.6 (scope-changed), it enables an attacker to escalate from web content into higher-privilege execution on the host. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.29%, 21st percentile).
Sandbox escape in Google Chrome on Windows before 151.0.7922.72 lets a remote attacker who has already compromised the renderer process leverage a use-after-free in the DataTransfer component (clipboard/drag-and-drop data) to break out of the browser sandbox via a crafted HTML page. Rated High by Chromium with a CVSS 9.6 driven by scope change and full CIA impact, though EPSS is low (0.29%) and there is no public exploit identified at time of analysis. It is not on CISA KEV and requires an existing renderer compromise plus user interaction, making it a second-stage bug in an exploit chain rather than a standalone entry point.
Sandbox escape in Google Chrome on Windows (versions prior to 151.0.7922.72) stems from an out-of-bounds write in ANGLE, Chrome's graphics abstraction layer, letting a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox. Google rates the Chromium severity High and a fix is available in the Stable channel, but there is no public exploit identified at time of analysis and the EPSS probability is low (0.29%, 21st percentile). Exploitation requires user interaction (visiting a page) and, per the CVSS scope-change vector, success would elevate impact beyond the initially compromised component.
Sandbox escape in Google Chrome desktop before 151.0.7922.72 stems from a use-after-free in the browser's Input handling, which an attacker who has already compromised the renderer process can leverage via a crafted HTML page to break out of the renderer sandbox. Rated High by Chromium and CVSS 9.6 due to scope change, it requires user interaction (visiting a malicious page) and a prior renderer foothold. There is no public exploit identified at time of analysis and EPSS is low (0.29%), reflecting a chained, non-trivial exploitation path rather than trivial mass exploitation.
Sandbox escape in Google Chrome for iOS before 151.0.7922.72 lets an attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page, escalating a contained renderer foothold into broader control (CVSS 9.6, scope-changed). Reported internally by the Chrome team under CWE-20 insufficient input validation; no public exploit identified at time of analysis, and EPSS is low at 0.29% (21st percentile), consistent with a chained bug that is not yet weaponized. Vendor-released patch is available in stable channel 151.0.7922.72.
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, gaining high confidentiality, integrity, and availability impact on the host. Rated High by Chromium and CVSS 9.6 due to scope change, it is a second-stage exploitation primitive rather than a standalone initial-access flaw. No public exploit is identified at time of analysis, and EPSS exploitation probability is low at 0.29% (21st percentile).
Sandbox escape in Google Chrome's ANGLE graphics layer on Android (versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to break out of the renderer sandbox and gain broader access on the device via a crafted HTML page. Rated High by Chromium and scored CVSS 9.6 largely because of the scope change from a successful escape. There is no public exploit identified at time of analysis, and EPSS is low (0.29%, 21st percentile), consistent with a bug that only becomes useful after a prior renderer compromise.
Sandbox escape in Google Chrome versions prior to 151.0.7922.72 stems from an integer overflow in the QUIC networking stack, allowing an attacker who has already compromised the renderer process to break out of the browser sandbox and gain broader host access via a crafted HTML page. Rated High severity by Chromium (CVSS 9.6, scope-changed), the flaw requires a prior renderer compromise and user interaction (visiting a malicious page). No public exploit is identified at time of analysis, and the EPSS probability is low at 0.29%.
Sandbox escape in Google Chrome's Chromecast component (versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page. Rated High by Chromium and scored CVSS 9.6 due to scope change, it is a classic second-stage browser exploit chained after an initial renderer bug. No public exploit is identified at time of analysis and EPSS is low (0.29%), consistent with a bug requiring a prior renderer foothold rather than a single-shot drive-by.
Sandbox escape in Google Chrome's ANGLE graphics component (versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. Rated High by Chromium with a CVSS 9.6 due to scope change and full CIA impact, though it requires a pre-existing renderer compromise as a chained prerequisite. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.29%).
Sandbox escape in Google Chrome desktop versions prior to 151.0.7922.72 stems from a use-after-free in the Views UI framework, letting a remote attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page. Rated High by Chromium with a CVSS 9.6 due to scope change and total confidentiality/integrity/availability impact, though there is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none. EPSS is low (0.29%, 21st percentile), consistent with a second-stage bug that requires prior renderer compromise rather than a directly weaponizable entry point.
Sandbox escape in Google Chrome for iOS before version 151.0.7922.72 allows a remote attacker to break out of the browser's security boundary when a victim opens a crafted HTML page. Rated High by Chromium and carrying a 9.6 CVSS due to a scope-changing, high-impact outcome requiring only user interaction, though there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.29%, 21st percentile). A vendor-released patch is available and CISA SSVC currently records exploitation status as none.
Sandbox escape in Google Chrome on macOS prior to 151.0.7922.72 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox by exploiting a race condition in the Downloads component through a crafted HTML page. Rated High by Chromium and carrying a CVSS 9.6 due to the scope-changing total impact, it is patched in the July 2026 Stable channel update. There is no public exploit identified at time of analysis, EPSS is low at 0.23%, and CISA SSVC records exploitation as 'none'.
Sandbox escape in Google Chrome on macOS prior to 151.0.7922.72 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page that triggers a race condition in the Downloads component. Chromium rates it High severity and the CVSS is 9.6 (scope-changed). This is no public exploit identified at time of analysis; EPSS is low at 0.23% (14th percentile) and CISA SSVC records exploitation status as none.
Sandbox escape in Google Chrome's Dawn WebGPU implementation (versions prior to 151.0.7922.72) lets a remote attacker corrupt heap memory in the GPU process via a crafted HTML page, potentially breaking out of the renderer sandbox to compromise the host. The CVSS 3.1 vector (AV:N/UI:R/S:C, base 9.6) reflects that exploitation only needs a victim to visit a malicious site but crosses a security boundary; Google rates the Chromium severity as Medium. There is no public exploit identified at time of analysis, EPSS is low (0.22%, 13th percentile), and it is not listed in CISA KEV.
Sandbox escape in Google Chrome desktop prior to 151.0.7922.72 stems from a use-after-free in the Media component, allowing a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page. Chromium rates the underlying bug Medium severity, but the reported CVSS is 9.6 due to the scope-changing sandbox-escape impact; there is no public exploit identified at time of analysis, and EPSS exploitation probability is low at 0.21% (11th percentile). A vendor patch is available.
Sandbox escape in Google Chrome's ANGLE graphics layer allows a remote attacker to corrupt memory via a crafted HTML page in versions prior to 151.0.7922.72. The flaw is an out-of-bounds read and write (CWE-125) that a victim triggers simply by visiting a malicious page, potentially letting attacker-controlled code break out of the renderer sandbox. Google has released a fixed stable channel build; there is no public exploit identified at time of analysis and EPSS risk is currently low (0.21%).
Sandbox escape in Google Chrome desktop prior to 151.0.7922.72 lets an attacker who has already compromised the renderer process break out of the browser sandbox via insufficient input validation in the WebSockets implementation, triggered by a crafted HTML page. This is a second-stage exploitation primitive rather than an initial-access bug: it requires a pre-existing renderer compromise plus user navigation to attacker content. No public exploit identified at time of analysis; EPSS is low at 0.21% (11th percentile) and it is not on CISA KEV, though Google has shipped a fixed Stable channel build.
Sandbox escape in Google Chrome's Payments component before 151.0.7922.72 lets a remote attacker who has already compromised the renderer process break out of the sandbox by serving a crafted HTML page, driven by insufficient validation of untrusted input (CWE-20). Google rates the Chromium security severity as Medium, but the assigned CVSS is 9.6 due to the scope-changing sandbox escape. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low at 0.21%.
Sandbox escape in Google Chrome's WebGL implementation on Android (versions before 151.0.7922.72) lets a remote attacker corrupt memory via an out-of-bounds write triggered by a crafted HTML page, potentially breaking out of the renderer sandbox. Rated Chromium 'High' and CVSS 9.6 due to scope change and full confidentiality/integrity/availability impact, it requires the victim to visit a malicious page (UI:R). No public exploit is identified at time of analysis, EPSS is low (0.21%), and CISA SSVC records exploitation as 'none'.
Sandbox escape in Google Chrome for Android before 151.0.7922.72 stems from an integer overflow in the WebGL component, letting a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox and gain broader access on the device. Google rates the Chromium severity as High and the CVSS is 9.6 due to the scope change and full CIA impact, though EPSS is low (0.21%, 11th percentile) and no public exploit is identified at time of analysis. Exploitation requires user interaction (visiting a malicious page) and is currently assessed by CISA SSVC as not actively exploited.
Sandbox escape in Google Chrome's ANGLE graphics component affects all Desktop builds prior to 151.0.7922.72, where an out-of-bounds write (CWE-787) can be triggered by a crafted HTML page to corrupt memory in the GPU process and cross the sandbox boundary. Chromium rates the flaw High and the CVSS 3.1 score is 9.6 owing to the scope change (S:C) and full CIA impact, though it requires the victim to load attacker-controlled content (UI:R). There is no public exploit identified at time of analysis, and the low EPSS score (0.21%, 11th percentile) suggests no observed weaponization yet.
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) allows a remote attacker to break out of the renderer sandbox via a crafted HTML page, leveraging a use-after-free memory-corruption bug. Google rates the Chromium severity High and the CVSS is 9.6 due to the scope change from sandboxed renderer to host. There is no public exploit identified at time of analysis and the EPSS exploitation probability is low (0.21%, 11th percentile), consistent with CISA SSVC recording no known exploitation.
Sandbox escape in Google Chrome's ANGLE graphics layer before 151.0.7922.72 lets a remote attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page, achieving code execution at higher privilege on Windows, macOS, and Linux desktops. Rated High severity by Chromium with a CVSS 9.6 due to scope change and full CIA impact, though the EPSS probability is only 0.21% (11th percentile). There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, but the bug was reported internally by the Chrome team and a fixed build is already shipping.
Sandbox escape in Google Chrome's "Save to Drive" feature (prior to 151.0.7922.72) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox by supplying a crafted PDF file. The flaw stems from insufficient validation of untrusted input (CWE-20) and, while scored CVSS 9.6, is rated only Medium by Chromium because it is a second-stage bug requiring a prior renderer compromise. There is no public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), consistent with a chained, non-trivial exploitation path rather than mass exploitation.
Sandbox escape in Google Chrome for macOS before 151.0.7922.72 lets an attacker who has already compromised the renderer process break out of the browser sandbox using a crafted HTML page, escalating a contained renderer foothold toward the host. The flaw sits in Chrome's Crypto component and is a second-stage bug that must be chained with an initial renderer compromise. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 8th percentile), and Google rates the Chromium security severity as Medium despite the high CVSS.
Sandbox escape in Google Chrome on macOS before 151.0.7922.72 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, escalating a contained renderer exploit into broader access on the host. The flaw stems from an inappropriate implementation in Chrome's Network component and is fixed in the stable channel update. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 8th percentile), and Chromium rated the underlying severity Medium despite the NVD-style CVSS 9.6.
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) allows a remote attacker who lures a victim to a crafted HTML page to potentially break out of the renderer sandbox, undermining the browser's core containment boundary. The flaw stems from insufficient validation of untrusted input (CWE-20) in ANGLE, Chrome's WebGL/OpenGL-to-native translation layer. It was reported internally by the Chrome team; there is no public exploit identified at time of analysis, and the EPSS score is low at 0.18% (8th percentile).
Sandbox escape in Google Chrome desktop before 151.0.7922.72 lets an attacker who has already compromised the renderer process break out to higher-privileged browser context via a crafted HTML page, rooted in insufficient validation of untrusted input in the AI component (CWE-20). NVD rates it CVSS 9.6 while Google labels the Chromium security severity 'Low', reflecting that renderer compromise is a hard prerequisite; there is no public exploit identified at time of analysis and EPSS is low at 0.17%. A vendor patch is available and CISA SSVC records exploitation as none.
Sandbox escape in Google Chrome's WebSockets implementation (versions prior to 151.0.7922.72) allows a remote attacker to potentially break out of the renderer sandbox when a victim visits a crafted HTML page. The flaw is a use-after-free (CWE-416) rated CVSS 9.6 due to a scope-changing sandbox escape, though Google's own Chromium severity rating is only Low and EPSS exploitation probability is minimal (0.17%). No public exploit has been identified and CISA SSVC lists exploitation status as none.
Sandbox escape in Google Chrome for Android before 151.0.7922.72 lets an attacker who has already compromised the renderer process break out of the sandbox via crafted HTML delivered through the Picture-in-Picture feature. Chromium rates the severity Low and CISA SSVC exploitation is 'none', making this a second-stage bug in an exploit chain rather than a standalone entry point. No public exploit identified at time of analysis, and EPSS is low at 0.17% (7th percentile).
Sandbox escape in Google Chrome desktop before 151.0.7922.72 lets an attacker who already controls a compromised renderer process break out of the sandbox by triggering a use-after-free in the browser's DNS handling via a crafted HTML page. Chromium rated the issue Low severity, and while the NVD CVSS is 9.6, SSVC records no observed exploitation and it is not automatable; there is no public exploit identified at time of analysis and it is not in CISA KEV. EPSS is low at 0.17% (7th percentile), consistent with a second-stage chaining bug rather than a mass-exploited entry point.
Sandbox escape in Google Chrome's DevTools (versions prior to 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the sandbox and gain broader host access via a crafted HTML page. It stems from insufficient validation of untrusted input (CWE-20) and requires user interaction plus a pre-existing renderer foothold, so it functions as a second-stage exploit rather than a standalone entry point. There is no public exploit identified at time of analysis, and EPSS is low (0.17%), consistent with Chromium's internal 'Medium' severity rating despite the high NVD CVSS score.
Sandbox escape in Google Chrome desktop versions prior to 151.0.7922.72 lets a remote attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page, chaining into the higher-privileged browser process. The flaw stems from insufficient validation of untrusted input in the Passwords component (CWE-20) and is rated Medium by Chromium despite an NVD CVSS of 9.6. There is no public exploit identified at time of analysis, and EPSS is low at 0.17% (7th percentile).
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) allows an attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page, exploiting a use-after-free (CWE-416) memory corruption. Google rated the underlying Chromium severity as Medium, and while the NVD CVSS is 9.6, exploitation is gated behind a pre-existing renderer compromise. There is no public exploit identified at time of analysis and EPSS probability is low (0.17%, 7th percentile), indicating this is a second-stage bug rather than a directly weaponizable entry point.
Sandbox escape in Google Chrome's media codec handling affects all Chrome desktop builds prior to 151.0.7922.72, where an integer overflow while parsing a maliciously crafted video file can let a remote attacker break out of the renderer sandbox. Exploitation requires the victim to load attacker-controlled media (UI:R), and there is no public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and the flaw is not on CISA KEV. Notably, Chromium's own triage rated this 'Medium' severity, which conflicts with the NVD-style 9.6 Critical score.
Sandbox escape in Google Chrome on macOS (versions prior to 151.0.7922.72) stems from an inappropriate implementation in the Tint component and lets a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox. Google rated the Chromium severity as Low, though the reported CVSS is 9.6; there is no public exploit identified at time of analysis and the EPSS score is only 0.16% (6th percentile), pointing to low near-term exploitation likelihood. The flaw is Mac-specific and requires user interaction (visiting a malicious page).
Sandbox escape in Google Chrome's Google Lens component (versions prior to 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the browser sandbox using a crafted HTML page. The flaw is a second-stage privilege boundary bypass rather than an initial-access bug: it requires a pre-existing renderer compromise to reach, and Google's own Chromium team rated its security severity as Low despite the 9.6 CVSS. No public exploit identified at time of analysis, and EPSS is very low at 0.16% (6th percentile).
Sandbox escape in Google Chrome desktop before 151.0.7922.72 lets an attacker who has already compromised the renderer process abuse insufficient input validation in the WebAuthn implementation, using a crafted PDF file to break out of the renderer sandbox and gain higher-privilege code execution. Google's Chrome team reported the flaw internally and rated it 'Low' severity within Chromium, even though NVD scores it 9.6 (Critical); there is no public exploit identified at time of analysis and CISA SSVC lists exploitation status as none. EPSS is very low at 0.16% (6th percentile), consistent with a second-stage bug that requires a pre-existing renderer compromise rather than a directly weaponizable entry point.
Sandbox escape in Google Chrome before 151.0.7922.72 lets an attacker who has already compromised the renderer process break out of the sandbox by feeding a crafted PDF through the Notifications component, which insufficiently validates untrusted input (CWE-20). Full technical impact (SSVC: total) means a successful escape yields code execution outside the constrained renderer. Despite a 9.6 CVSS, Chromium rated this Low severity, EPSS is 0.16%, and there is no public exploit identified at time of analysis.
Sandbox escape in Google Chrome for macOS (versions before 151.0.7922.72) can be achieved by an attacker who has already compromised the renderer process, chaining a DevTools race condition via a crafted HTML page to break out of the renderer sandbox. Reported internally by the Chrome team and rated Medium by Chromium, it carries an NVD CVSS of 9.6 due to the scope change, though EPSS is very low (0.14%, 4th percentile). No public exploit identified at time of analysis and it is not on CISA KEV, indicating no confirmed active exploitation.
Sandbox escape in Google Chrome desktop prior to 151.0.7922.72 allows an attacker who tricks a user into installing a malicious extension to break out of the renderer/extension sandbox via a crafted extension exploiting insufficient input validation. The flaw was reported internally by the Chrome team and carries an NVD CVSS of 9.6, though Chromium rates the security severity only Medium and SSVC shows no known exploitation; no public exploit identified at time of analysis. A vendor patch is available, and exploitation hinges on the significant precondition of the victim installing an attacker-controlled extension.
Full system compromise of Phoenix Contact CHARX SEC EV charging controllers (SEC-3000/3050/3100/3150, versions 1.0.0 through 1.9.0) is possible because an incorrect script execution order tears down the firewall too early during system shutdown, briefly exposing internal-only services to the network. During this transient window a remote unauthenticated attacker can reach services that are normally firewalled off and gain complete control of the device. No public exploit identified at time of analysis, but the flaw is vendor-confirmed (CERT@VDE / advisory VDE-2026-008) and carries a CVSS 4.0 base score of 9.3.
Unauthenticated API access in Spikster (all versions through commit e1cdf8c) lets remote attackers reach roughly 50 backend endpoints because the CipiAuth middleware is registered but never bound to any route group, leaving the entire API open. Attackers can provision and enumerate servers, reset root passwords, read and write arbitrary files on the host, and create database users without any credentials. No public exploit identified at time of analysis, though a public GitHub issue and a VulnCheck advisory document the flaw in detail.
Remote code execution in Phoenix Contact CHARX SEC series EV charging controllers (SEC-3000/3050/3100/3150, versions 1.0.0 through before 1.9.1) allows an unauthenticated network attacker to inject commands into the system configuration that are subsequently executed with root privileges. The CVSS 4.0 base score of 9.3 reflects network-reachable, no-privilege, no-interaction exploitation with full confidentiality, integrity, and availability impact on the device. No public exploit identified at time of analysis, but the vendor (via CERT@VDE) has released a patched version.
Backend reconfiguration in Phoenix Contact CHARX SEC EV charging controllers is possible without any authentication because the CHARX OCPP Agent service exposes management functionality to unauthenticated remote callers (CWE-306). Any network-adjacent attacker can repoint the charger's OCPP backend connection, causing denial-of-service and disclosure of confidential data routed to an attacker-controlled backend. No public exploit is identified at time of analysis, but the CVSS 4.0 base score of 9.3 and full unauthenticated network reach make this a high priority for operators of affected charge controllers (firmware below 1.9.1).