Unauthenticated remote code execution in Gladinet CentreStack before 17.5 stems from a hardcoded cryptographic key (a static SysNumber used as entropy for AccessTicket.Encrypt/Decrypt across all installations), letting attackers forge valid x-glad-auth headers, invoke privileged endpoints like acquiretenantbackuptoken, and escalate to a domain administrator IdentityTicket for full server takeover. Reported by VulnCheck and carrying a CVSS 4.0 base of 9.3, it is remotely exploitable against default configurations with no authentication or user interaction. No public exploit code or CISA KEV listing is confirmed in the provided data, so at time of analysis there is no public exploit identified.
Denial-of-service in an IEC 61850 MMS (Manufacturing Message Specification) protocol implementation allows an attacker with an established MMS session to crash the MMS handling process by sending a malformed BER-encoded confirmed-request message over TCP port 102. The flaw is a heap out-of-bounds read (CWE-125) in the BER decoder's boundary handling. No public exploit or active exploitation is identified at time of analysis; the CVSS 4.0 score of 7.1 reflects a high availability impact with low required privileges and no user interaction.
Discretionary access control bypass in Google Chrome desktop before 151.0.7922.72 lets an adversary in a privileged network position defeat a cryptographic protection and manipulate protected traffic. The flaw stems from a cryptographic weakness (CWE-325) rather than a memory-safety bug, and Google rates the Chromium severity High. No public exploit has been identified, EPSS is low (0.19%), and it is not on CISA KEV, but SSVC scores Technical Impact as total and Automatable as yes.
Denial-of-service in an IEC 61850 GOOSE subscriber component allows an adjacent, unauthenticated attacker on the same Layer-2 network to crash the message-processing process by sending a crafted GOOSE frame (EtherType 0x88B8) with an undersized UTC timestamp field, triggering a heap out-of-bounds read (CWE-125). The flaw was reported by DHS ICS-CERT and documented in CISA ICS advisory ICSA-26-211-10; there is no public exploit identified at time of analysis, and the CVSS 4.0 vector scores availability impact only (VA:H) with no confidentiality or integrity effect.
Denial-of-service in an IEC 61850 GOOSE subscriber implementation allows an attacker with access to the substation process bus to crash the subscriber process using a single unauthenticated Layer-2 multicast frame. An off-by-one boundary error in the GOOSE parser triggers a heap out-of-bounds read (CWE-125) that reliably terminates the process. No public exploit identified at time of analysis; this is not listed in CISA KEV, and no EPSS score was provided.
Heap buffer over-read in MZ Automation GmbH's libiec61850 (versions prior to 1.6.2) allows an unauthenticated adjacent-network attacker to crash the MMS service process by sending a crafted BER-encoded message with an invalid length value in a BOOLEAN or INTEGER field. The MMS BER decoder performs no bounds validation on the attacker-supplied length, causing a read past the end of a heap-allocated buffer and subsequent process termination. CISA ICS-CERT issued advisory ICSA-26-211-10 for this vulnerability; no public exploit code or KEV listing has been identified at time of analysis.
Denial-of-service in MZ Automation's libiec61850 (versions before 1.6.2) allows an unauthenticated attacker on the process bus to crash IEC 61850 subscriber processes with a single crafted GOOSE frame. The GOOSE payload parser mishandles nested length fields, so an inner element length that exceeds its enclosing length forces a one-byte out-of-bounds read (CWE-125) that reliably terminates the subscriber. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the CISA ICS advisory (ICSA-26-211-10) and a vendor patch are available.
Communication-data tampering in Mitsubishi Electric's CC-Link IE TSN product family - spanning MELSEC MX Controllers, motion modules, MELSERVO-J5/JET AC servos, FR-A800/F800/E800 inverters, GOT3000 HMIs, remote I/O modules and TSN communication LSIs/SDKs - allows an attacker on the same CC-Link IE TSN network to forge control input/output values by injecting specially crafted packets under specific timing conditions. Because message integrity is not enforced on the channel (CWE-924), successful tampering can drive incorrect operation of the control function or produce a denial-of-service condition on the affected device. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS was not provided.
Open redirect in Leantime 3.6.2's Login controller lets unauthenticated attackers craft login URLs where the `redirectUrl` POST parameter bypasses PHP's `FILTER_SANITIZE_URL` validation - which strips illegal characters but never performs origin-validation - to redirect authenticated users to external attacker-controlled sites. Affected are all deployments of Leantime 3.6.2 with a web-accessible login endpoint, the primary use case being phishing and credential theft by abusing the trusted Leantime domain as a delivery vehicle. No public exploit is confirmed in CISA KEV, but publicly available exploit code exists per VulnCheck and a GitHub Security Advisory (GHSA-wprg-q8m6-jhp9).
Authentication bypass via JWT assertion replay in malach-it Boruta (an Elixir OAuth 2.0/OpenID Connect provider) from 2.3.0 before 2.3.7 lets an attacker who captures any previously valid client assertion re-authenticate as that OAuth client indefinitely, because the token endpoint never checks the assertion's expiry. An attacker who harvests a signed client_secret_jwt or private_key_jwt assertion from logs, proxies, or browser tooling can mint access tokens carrying the victim client's privileges. No public exploit identified at time of analysis, though the fix commits and regression tests publicly demonstrate both the flawed and corrected behavior.
Account takeover in osTicket (the open-source support ticketing system) before v1.17.8 and v1.18.4 stems from an inverted logic check (CWE-640) in the password-reset token validation routine, where the expiry check runs only when the token's timestamp lookup fails - so any token with a valid timestamp bypasses expiration entirely. An attacker who obtains a valid reset token can replay it after it should have expired to hijack the associated account. Rated CVSS 4.0 9.1 (Critical); no public exploit identified at time of analysis and not listed in CISA KEV.
Authentication bypass in Outstatic CMS versions 2.1.9 and earlier lets an unauthenticated remote attacker forge valid administrative session tokens because the application ships a hardcoded JWT signing secret that is used whenever the OST_TOKEN_SECRET environment variable is left unset. Since the fallback secret is published in the project's public source repository, any attacker can self-sign a JWT granting arbitrary identity and full admin permissions with no credentials. There is no public exploit identified at time of analysis, but the technique is trivial and requires only the publicly-visible secret.
Memory disclosure and denial of service in SQLite 3.41 arise from a use-after-free in the btree module's shared-cache lock management, where a BtLock structure is freed but never unlinked from its linked list. Applications that enable SQLite shared-cache mode can have subsequent list traversals read freed memory, leaking sensitive process memory (CVSS C:H) or crashing the process (A:H). No public exploit identified at time of analysis, and SSVC lists exploitation status as none, though the flaw is assessed as automatable.
OS command injection in Phoenix Contact CHARX SEC EV charging controllers allows an unauthenticated remote attacker who controls the OCPP backend (reached via a firewall-bypass) to execute arbitrary commands as the limited charx-oa user, potentially interrupting vehicle charging. It affects CHARX SEC-3000, SEC-3100, SEC-3050 and SEC-3150 versions 1.0.0 up to but not including 1.9.1, and is fixed in 1.9.1. There is no public exploit identified at time of analysis, and the CVSS 4.0 base score is 8.8 (High).
Out-of-bounds read in mz-automation/lib60870 allows unauthenticated remote attackers to leak one byte of heap memory and potentially crash the parsing process by sending a crafted IEC 60870-5-104 I-frame. The vulnerability triggers when a declared ASDU object count exceeds the actual data present in the message buffer, causing `InformationObject_ParseObjectAddress` to read one byte beyond the allocated heap region. Disclosed via CISA ICS Advisory ICSA-26-211-11 with no public exploit identified at time of analysis.
Out-of-bounds heap read in mz-automation's lib60870 library exposes ICS/SCADA systems to unauthenticated remote exploitation via a crafted IEC 60870-5-104 I-frame. An attacker sending a C_TS_NA_1 ASDU with an inflated object count triggers `TestCommand_getFromBuffer` to read one byte past the end of a heap-allocated buffer, producing partial heap memory disclosure and potential availability disruption. CISA ICS-CERT has published advisory ICSA-26-211-11; no active exploitation is confirmed and no public exploit code has been identified at time of analysis.
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 arises from the linux_sockets module exposing an unsecured internal connection. An attacker who already holds low-level code execution on the host can leverage this leaked/unprotected socket to run arbitrary commands as root. No public exploit has been identified at time of analysis and the flaw is not in CISA KEV, so exploitation would require an existing foothold rather than remote unauthenticated access.
Insufficient session expiration in the MikroTik RouterOS API allows authenticated users whose permissions have been reduced to retain their prior, elevated access rights for the duration of the stale session. Specifically, when a user's group membership or permission set is downgraded, or when an inactivity timeout is expected to expire a session, the RouterOS API fails to re-evaluate or invalidate the existing session token - exposing confidential routing, firewall, or credential data the user should no longer reach. No public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog; however, ICS-CERT's publication of ICSA-26-211-01 signals elevated concern for operational technology networks where MikroTik devices are used for segmentation and industrial network management.
Denial-of-service in MZ Automation GmbH libiec61850 (all versions before 1.6.2) allows an adjacent unauthenticated attacker to crash the MMS server process by sending a crafted BER-encoded confirmed request PDU containing an extended BER tag over an established MMS session. The missing bounds check in the buffer decoder causes a one-byte heap out-of-bounds read, terminating the MMS service and disrupting IEC 61850-based industrial control communications. No active exploitation is confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.
Out-of-bounds heap read in MZ Automation GmbH libiec61850 (all versions before 1.6.2) allows an unauthenticated adjacent-network attacker to crash an MMS server by sending a crafted AARQ PDU with a zero or one-byte length value in the calling AP title field during connection establishment. The ACSE parser fails to bounds-check the attacker-controlled length, reading past the end of a heap buffer and causing availability loss - a significant concern in IEC 61850 substation automation environments where device availability underpins grid protection and monitoring. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; a vendor patch (version 1.6.2) is available per CISA ICS advisory ICSA-26-211-10.
Improper input neutralization in Phoenix Contact CHARX SEC electric-vehicle charging controllers lets a remote, unauthenticated attacker inject malicious data through MQTT that the bundled ModbusServer application processes without validation, corrupting Modbus data and disrupting service. All CHARX SEC-3000/3050/3100/3150 units running firmware 1.0.0 through 1.9.0 are affected, with impact limited to integrity and availability (no data disclosure). No public exploit identified at time of analysis; the flaw was coordinated-disclosure reported through CERT@VDE and a fixed firmware (1.9.1) is available.
Stored cross-site scripting in OpenClaw Dashboard 1.1.0 lets unauthenticated remote attackers plant JavaScript in agent transcript messages that later executes in the administrator's authenticated browser session. Because the malicious message is submitted through the unauthenticated sessions API and rendered unsanitized via innerHTML on the default landing page, an attacker can steal admin session tokens and invoke privileged endpoints, including modifying agent instruction files. Publicly available exploit details exist in a dedicated advisory writeup; there is no evidence of active exploitation (not in CISA KEV), and the CVSS 4.0 base score is 8.8.
Remote code execution in Google Chrome desktop versions prior to 151.0.7922.72 lets a remote attacker run arbitrary code within the browser's renderer sandbox by luring a victim to a crafted HTML page that triggers an integer overflow in the bundled libxml component. Google rated the flaw High severity and a vendor patch is available; there is no public exploit identified at time of analysis, and the low EPSS score (0.35%) alongside CISA SSVC 'Exploitation: none' indicates no observed exploitation yet. Because the bug is contained to the sandboxed renderer, a successful attacker would still need a separate sandbox-escape to reach the host.
Remote code execution in Google Chrome desktop versions prior to 151.0.7922.72 arises from a use-after-free in the DOM implementation, letting a remote attacker who lures a victim to a crafted HTML page run arbitrary code within the renderer sandbox. The flaw was reported internally by the Chrome team, rated High by Chromium, and carries CVSS 8.8; there is no public exploit identified at time of analysis and EPSS is low at 0.35% (28th percentile). Because execution is confined to the sandbox (Scope: Unchanged), full host compromise would additionally require a separate sandbox-escape chain.
Remote code execution in Google Chrome desktop before 151.0.7922.72 stems from a use-after-free in the Autofill component, letting a remote attacker who lures a victim to a crafted HTML page run arbitrary code within the renderer sandbox. Rated High by Chromium and CVSS 8.8, it requires user interaction (visiting a malicious page) but no authentication. No public exploit identified at time of analysis, and EPSS is low (0.35%, 28th percentile), consistent with a freshly patched browser bug not yet weaponized.
Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium with a CVSS of 8.8, but there is no public exploit identified at time of analysis, EPSS is low (0.35%, 28th percentile), and CISA SSVC marks exploitation as none. Because code execution is confined to the sandbox, full host compromise would require chaining with a separate sandbox-escape.
Remote code execution in Google Chrome's Loader component before 151.0.7922.72 allows a remote attacker to execute arbitrary code inside the browser's renderer sandbox by luring a victim to a crafted HTML page (CWE-416 use-after-free). The flaw carries a High Chromium severity and CVSS 8.8, but code execution is confined to the sandbox and requires user interaction (visiting the page); a full-system compromise would need an additional sandbox-escape bug. No public exploit identified at time of analysis, and EPSS is low at 0.35% (28th percentile).
Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code within the browser's renderer sandbox by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium and CVSS 8.8, requiring user interaction (visiting a page) but no authentication. There is no public exploit identified at time of analysis and EPSS is low (0.35%, 28th percentile), consistent with a freshly patched, vendor-reported bug rather than one under active exploitation.
Unauthenticated configuration injection in Phoenix Contact CHARX SEC-3000/3050/3100/3150 EV charging controllers (versions 1.0.0 through 1.9.0) lets a remote attacker POST a malicious ID to the device's MQTT broker and thereby create a new entry in the system configuration, causing integrity and availability loss. Reported by CERT@VDE (advisory VDE-2026-008), the flaw carries a CVSS 4.0 base score of 8.8 and requires no authentication or user interaction. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Out-of-bounds read in Chrome's ANGLE graphics abstraction layer (versions prior to 151.0.7922.72) can be leveraged by an attacker who has already compromised the renderer process to potentially escape the browser sandbox via a crafted HTML page. Google rates the Chromium severity High and has shipped a fixed Stable-channel build; no public exploit identified at time of analysis, and the EPSS score is low (0.29%, 21st percentile), consistent with a second-stage bug rather than a standalone drive-by. Because it requires a pre-compromised renderer, it is typically one link in an exploit chain rather than a single-shot RCE.
Sandbox escape in Google Chrome for Android (versions prior to 151.0.7922.72) stems from an inappropriate implementation in ANGLE, Chrome's graphics abstraction layer, allowing a remote attacker to break out of the renderer sandbox using a crafted HTML page. Rated High severity by Chromium with a CVSS of 8.8, the flaw requires the victim to visit a malicious page (user interaction) but no authentication. There is no public exploit identified at time of analysis, and the EPSS score is low (0.29%, 21st percentile), consistent with a recently disclosed browser bug fixed before weaponization.
Sandboxed remote code execution in Google Chrome for macOS before 151.0.7922.72 stems from a race condition in the Skia graphics library that a crafted HTML page can trigger to run arbitrary code within the renderer sandbox. Google (Chrome team) reported the flaw and rated it High severity; a stable-channel patch is available. There is no public exploit identified and EPSS is low (0.28%, 21st percentile), and CISA SSVC currently marks exploitation status as none.
Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code within the renderer sandbox by luring a victim to a crafted HTML page. Rated High by Chromium with a CVSS of 8.8, the flaw requires only that the user visit a malicious site; no authentication is needed but user interaction is. There is no public exploit identified at time of analysis, and the low EPSS score (0.28%, 20th percentile) suggests exploitation is not yet widespread.
Unauthenticated reconfiguration of Phoenix Contact CHARX SEC EV charging controllers is possible through the JupiCore service, which exposes charging-point management functions without any authentication (CWE-306). Remote attackers reachable on the network can rewrite charging-point configuration to disclose charging-point UIDs, tamper with files, and cause a Denial-of-Service against affected SEC-3000/3050/3100/3150 units running firmware 1.0.0 up to (but not including) 1.9.1. No public exploit identified at time of analysis, but the vendor (via CERT@VDE) has released a fixed firmware and the flaw is trivially exploitable given the missing authentication.
Full account takeover in the FleekDash V2 WordPress plugin (versions ≤ 2.6.2.2) lets a low-privileged Subscriber overwrite the email address and password of any user, including administrators, via a missing authorization check (CWE-862). The impact is amplified because the public /wp-json/fleekdash/v1/register REST endpoint auto-provisions a Subscriber account and returns a valid REST nonce regardless of the site's users_can_register setting, so an attacker needs no pre-existing credentials - one prior request bootstraps everything needed for the takeover. Reported by Wordfence with a CVSS of 8.8; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in Google Chrome desktop versions prior to 151.0.7922.72 allows a remote attacker to run arbitrary code within the browser by luring a victim to a crafted HTML page. The flaw stems from an inappropriate implementation in the Enterprise component and is classed as CWE-94 code injection. No public exploit identified at time of analysis, exploitation requires user interaction (visiting a malicious page), and EPSS risk is low at 0.26% (17th percentile).
Sandboxed arbitrary code execution in Google Chrome's AdFilter component (versions prior to 151.0.7922.72 on desktop) allows a remote attacker to run code inside the renderer sandbox by luring a victim to a crafted HTML page. Rated Medium by Chromium and CVSS 8.8 by NVD, the flaw requires user interaction (visiting a malicious site) but no authentication; execution is confined to the sandbox rather than achieving full host compromise. There is no public exploit identified at time of analysis, and EPSS is low at 0.26% (17th percentile).
Remote code execution in Google Chrome desktop before version 151.0.7922.72 stems from a use-after-free in the browser's Input component (Chromium severity High, CVSS 8.8), permitting a remote attacker to run arbitrary code inside the renderer sandbox by luring a victim to a crafted HTML page. Exploitation requires user interaction (visiting the malicious page) but no authentication or prior privileges. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.26% (17th percentile), consistent with a freshly patched browser bug not yet weaponized publicly.
Server-side request forgery in the Eclipse CSI PIA `POST /v1/upload/sbom` endpoint lets remote attackers coerce the server into connecting to an arbitrary host, port, and scheme of their choosing. By exploiting a parser-differential between Python's `urlparse` (used for the issuer allowlist check) and `requests`/`urllib3`/`urllib` (used for OIDC discovery and JWKS retrieval), an attacker crafts a JWT `iss` claim containing a backslash that passes validation but resolves to a different host during the actual fetch. The `iss` claim is only checked in its unverified form, so no legitimate token is needed; no public exploit has been identified at time of analysis and the issue is not listed in CISA KEV.
Remote code execution in Google Chrome desktop before 151.0.7922.72 arises from a heap buffer overflow in the browser's media Codecs component (CWE-122), letting a remote attacker who serves a crafted HTML page corrupt heap memory and run arbitrary code - though execution is confined inside the renderer sandbox rather than the host OS. Google rates the Chromium severity as Low despite the NVD-style 8.8 CVSS, and there is no public exploit identified at time of analysis; EPSS is low at 0.24% (15th percentile) and CISA SSVC lists exploitation as none. A vendor patch is available in the 151.0.7922.72 stable channel release.
Sandbox-confined remote code execution in Google Chrome's Extensions component (versions prior to 151.0.7922.72) lets a remote attacker run arbitrary code inside the browser sandbox by getting a victim to load a crafted Chrome Extension, exploiting a use-after-free (CWE-416). Chromium rated the severity Medium because execution is contained within the sandbox rather than achieving full host compromise, though the NVD-style CVSS is 8.8. There is no public exploit identified at time of analysis, and EPSS is low at 0.24% (15th percentile).
Arbitrary code execution in Google Chrome's V8 JavaScript engine allows a remote attacker to run code inside the renderer sandbox when a victim visits a crafted HTML page, affecting all desktop builds prior to 151.0.7922.72. The flaw is a CWE-843 type confusion in V8 and carries a CVSS 8.8 due to network reach and high CIA impact, though execution is confined to the sandbox and Chromium rates the security severity as Low. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but a vendor patch is available.
Sandboxed remote code execution in Google Chrome's WebXR implementation (all channels prior to 151.0.7922.72) lets a remote attacker run arbitrary code within the renderer sandbox when a victim visits a crafted HTML page. Google rates the Chromium security severity as Medium, though the CVSS 8.8 reflects high impact contingent on user interaction; no public exploit identified at time of analysis and EPSS is low (0.22%, 13th percentile). Note a source conflict: the description cites an integer overflow while the CWE and tags indicate use-after-free/memory corruption.
Cross-site request forgery in IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 enables server-side request forgery with elevated privileges when the collectiveController-1.0 feature is active. An attacker who lures an authenticated Liberty administrator to a malicious web page can trigger forged requests that the server executes with the victim's elevated privileges, allowing the attacker to reach internal services ordinarily inaccessible from the network perimeter. No public exploit code exists and no confirmed active exploitation is recorded, though the SSVC framework rates the technical impact as total should exploitation occur.
Use-after-free in the V8 JavaScript engine within Google Chrome versions prior to 151.0.7922.72 enables a remote attacker who has already compromised the renderer process to perform out-of-bounds memory access via a crafted HTML page. Despite a CVSS score of 8.8, this is not a standalone remote code execution path - it requires a pre-existing renderer compromise as an explicit precondition, placing it firmly in the category of a second-stage chained exploit. No public exploit code has been identified, CISA has not added this to the KEV catalog, and EPSS sits at 0.22% (13th percentile), consistent with targeted rather than mass exploitation risk. A vendor-released patch is available in Chrome 151.0.7922.72.
Privilege escalation in Google Chrome's USB subsystem prior to 151.0.7922.72 allows a remote attacker who lures a victim to a crafted HTML page to escalate privileges within the browser through insufficient policy enforcement. Google rates the Chromium security severity as Medium, though the associated CVSS 3.1 score of 8.8 reflects high confidentiality, integrity, and availability impact contingent on user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Google confirms a fixed build is available.
Remote code execution within the browser's renderer sandbox affects Google Chrome desktop builds prior to 151.0.7922.72, stemming from an inappropriate implementation in the Passwords component (CWE-269). A remote attacker who lures a victim to a crafted HTML page can execute arbitrary code, but execution is confined to the sandbox - which is why Chromium rated the underlying issue Low severity despite the CVSS 8.8. No public exploit identified at time of analysis, and the fix is already shipping in the Stable channel.
Sandboxed remote code execution in Google Chrome desktop before 151.0.7922.72 lets a remote attacker run arbitrary code within the renderer sandbox when a victim opens a crafted HTML page. The flaw stems from an inappropriate implementation in Chrome's Scheduling component; Google rated it Chromium-Low severity and no public exploit has been identified, though the NVD CVSS of 8.8 reflects the high per-system impact once triggered. Exploitation requires user interaction (visiting a malicious page) and, because code executes inside the sandbox rather than escaping it, real-world impact is constrained absent a chained sandbox-escape bug.
Remote code execution in Google Chrome's Sync component (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code within the renderer sandbox when a victim visits a crafted HTML page. The flaw is a CWE-416 use-after-free reported internally by the Chrome team; it carries a CVSS 8.8 but Chromium rated the security severity as Low, and code execution is confined to the sandbox rather than the host OS. No public exploit has been identified at time of analysis, and EPSS is low at 0.21% (12th percentile).
Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The flaw is a CWE-416 use-after-free memory corruption issue; Google has released a fixed stable-channel build, and there is no public exploit identified at time of analysis. Despite a CVSS of 8.8, Chromium rated the security severity Medium and EPSS is low (0.21%, 12th percentile), and the impact is constrained to code execution within the sandbox rather than full host compromise.