Credential exposure in CSL 1010 M2M 3G WiFi Module firmware through 2.2.1.4 stems from a trivially reversible single-byte XOR cipher with a hard-coded static key used to 'protect' the Router.cfg configuration backup file. An attacker with local access to the device can decrypt the backup and recover web administration passwords, telnet credentials, WPA/WPA2 pre-shared keys, PPPoE and 3G/APN credentials, and SIM identifiers (IMSI and IMEI) in plaintext. No public exploit has been identified at time of analysis, KEV listing is absent, and no fixed firmware version has been confirmed.
Server-Side Request Forgery in Boruta (malach-it/boruta_auth versions 2.3.2 through 2.3.6) enables unauthenticated remote attackers to force the OAuth/OpenID authorization server to issue outbound HTTP requests to arbitrary attacker-controlled URIs, including cloud metadata endpoints (e.g., AWS IMDS at 169.254.169.254), internal APIs, and RFC 1918 network services. Three distinct code paths - OAuth request_uri handling, OpenID Connect dynamic client registration jwks_uri, and scheduled jwks_uri refresh - all invoke Elixir's Finch HTTP client against caller-supplied URIs with no host allowlist, no private IP rejection, no redirect constraint, and no response size cap. No public exploit has been identified at time of analysis; a vendor patch is available in version 2.3.7.
Session variable injection in Gladinet CentreStack before version 17.4 allows unauthenticated remote attackers to bypass authentication and access management pages without credentials. By embedding newline and tab characters into the AccountName parameter posted to SelectProvider.aspx, attackers exploit the absence of input sanitization in the product's custom session serialization format to inject an arbitrary resellerid session variable, which satisfies the IsValidRSession authentication check and opens management interfaces. No public exploit has been identified at time of analysis, though VulnCheck discovered and reported this issue with sufficient detail to facilitate reproduction.
Credential exfiltration in koku-metrics-operator allows a privileged user with edit access to the CostManagementMetricsConfig custom resource to redirect the operator's OAuth token requests to an attacker-controlled endpoint, exposing the tenant's Red Hat SSO client_id and client_secret. The operator's service-account authentication mode unconditionally forwards these credentials to whatever OAuth token URL is configured in the CR, acting as a confused deputy on behalf of the CR editor. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the CVSS Scope:Changed metric reflects that the operator process holds credentials inaccessible to the CR editor directly, amplifying impact beyond the initial access tier.
Bearer-token disclosure in the Red Hat koku-metrics-operator lets a user with edit rights over the CostManagementMetricsConfig custom resource redirect metric uploads to an attacker-controlled URL, causing the operator to attach the cluster-global Red Hat Cloud pull-secret token to that outbound request and leak it. Because token authentication is the default (authentication.type=token) and the pull secret is shared cluster-wide, a single privileged tenant can harvest credentials that grant access to the organization's Red Hat Cloud/console.redhat.com services. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the issue was reported directly by Red Hat's security team.
Privilege escalation in Google Chrome Enterprise on macOS allows a local attacker with physical device access to bypass enterprise policy controls and gain elevated privileges. Affected are all Chrome versions prior to 151.0.7922.72 in managed Enterprise deployments on Mac. The attack requires physical presence at the target device, substantially limiting the threat surface, though the confidentiality, integrity, and availability impact is rated high once exploited. No public exploit identified at time of analysis.
Capsule's node admission webhook can be crashed cluster-wide by a Cluster Admin who stores a malformed regular expression in CapsuleConfiguration's NodeMetadata fields, causing a Go panic via regexp.MustCompile that blocks all subsequent Node create, update, and patch operations. All Capsule versions prior to 0.13.8 are affected, as confirmed by GitHub Security Advisory GHSA-68cj-mvg9-rgm2. No public exploit has been identified at time of analysis, but the Scope:Changed CVSS designation reflects that the crash cascades beyond the vulnerable Capsule component to impair node admission cluster-wide.
Easy Appointments WordPress plugin through version 3.12.26 exposes all stored customer personal information to any authenticated contributor-level user due to missing per-request capability and nonce validation on a customer-listing handler. Any user holding a contributor role - a low-privilege WordPress role normally limited to drafting posts - can invoke the unprotected endpoint and enumerate the full customer dataset. A publicly available proof-of-concept exists per WPScan, though EPSS places exploitation probability at 0.16% (5th percentile) and the flaw has not been listed in CISA KEV, suggesting limited observed exploitation.
Path traversal in Apache Zeppelin's FileSystemNotebookRepo backend (versions 0.9.0 through 0.12.0) allows authenticated users with note-rename or folder-operation permissions to escape the configured notebook root directory on the server's filesystem or HDFS. By injecting directory traversal sequences into note or folder path values, an attacker can cause Zeppelin to move, write, or delete files anywhere the server process identity has access - potentially overwriting arbitrary files outside the notebook root. No public exploit has been identified and exploitation requires specific authenticated access plus a non-default storage backend configuration.
Broken access control in IBM Langflow OSS 1.0.0-1.8.4 exposes private flow files through two distinct endpoint flaws: the image retrieval endpoint enforces no authentication whatsoever, allowing unauthenticated remote attackers to access any user's image files given a valid flow ID and filename; separately, the file download endpoint, while requiring authentication, fails to validate resource ownership, enabling any authenticated user to access files belonging to other tenants via IDOR. Both flaws break tenant isolation in multi-user deployments and result in unauthorized disclosure of sensitive data. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor patch is available.
Sequential integer order ID enumeration in Sylius MolliePlugin exposes customer PII across all orders without authentication. The thank-you and QR-code endpoints accept a raw integer orderId query parameter with no ownership or session validation, allowing unauthenticated remote attackers to iterate through all orders, extract non-guessable tokenValue identifiers, and subsequently query the register-after-checkout endpoint to retrieve customer first names, last names, and email addresses. No active exploitation confirmed (not in CISA KEV) and no public proof-of-concept exploit has been identified, but the attack requires zero authentication and minimal skill, making it a realistic threat to any publicly-facing Sylius shop using the Mollie payment gateway.
Uninitialized memory use in Chrome's ANGLE graphics layer (all versions prior to 151.0.7922.72) allows a remote attacker to read potentially sensitive data from the browser's process memory by delivering a crafted HTML page. The CVSS C:H rating reflects the theoretical confidentiality impact, but SSVC rates technical impact as only partial and exploitation as none, and EPSS sits at 0.31% (24th percentile), indicating low observed real-world exploitation probability. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists.
Uninitialized memory disclosure in Google Chrome's Media component on Windows exposes process memory to attackers who have already achieved renderer process compromise. Versions prior to 151.0.7922.72 are affected. A renderer-compromised attacker delivers a crafted HTML page to trigger a CWE-457 uninitialized variable read, potentially leaking sensitive in-memory data such as credentials, tokens, or cryptographic material. No public exploit has been identified at time of analysis, SSVC rates exploitation as none, and EPSS sits at 0.31% - indicating low observed exploitation pressure despite the High CVSS confidentiality impact.
Cross-origin data leakage in Google Chrome's ANGLE graphics engine (versions prior to 151.0.7922.72) allows a remote attacker to read memory from other origins by enticing a victim to visit a specially crafted HTML page. The root cause is use of an uninitialized variable in ANGLE, Chrome's OpenGL ES translation layer, which can expose residual memory contents tied to cross-origin rendering contexts. No public exploit code has been identified and CISA SSVC rates exploitation as 'none' at time of analysis, but the CVSS confidentiality impact is rated High due to the cross-origin data boundary violation.
Cross-origin data leakage in Google Chrome's ANGLE graphics layer (all versions prior to 151.0.7922.72) enables a remote attacker to exfiltrate sensitive data across site isolation boundaries by directing a victim to a crafted HTML page. The root cause is an uninitialized memory use (CWE-457) in ANGLE, Chrome's OpenGL ES translation layer, which may expose residual memory contents from other browser origins to attacker-controlled JavaScript. No public exploit code and no active exploitation have been identified; EPSS places exploitation probability at 0.31% (24th percentile) and SSVC confirms no current exploitation activity, making this a patch-cycle priority rather than an emergency response.
Navigation restriction bypass in Google Chrome on iOS prior to 151.0.7922.72 allows a remote, unauthenticated attacker to circumvent the browser's built-in navigation policy controls by delivering a specially crafted HTML page. Rooted in CWE-602 (Client-Side Enforcement of Server-Side Security), the flaw reflects an iOS-specific policy enforcement gap not present in desktop Chrome builds. The Chromium team rated this High severity internally; however, no confirmed active exploitation exists - CISA KEV is absent, EPSS stands at 0.30%, and SSVC classifies exploitation as none with partial technical impact.
Content Security Policy bypass in Google Chrome prior to 151.0.7922.72 enables remote attackers to circumvent site-level script execution restrictions via a specially crafted HTML page. The flaw stems from an inappropriate implementation in Chrome's HTML handling (CWE-693, Protection Mechanism Failure), allowing injected or unauthorized scripts to execute despite CSP directives that should block them. No public exploit code has been identified and EPSS sits at 0.30% (23rd percentile), indicating low observed exploitation probability despite Chrome's ubiquitous deployment footprint.
Remote unauthenticated denial of service and memory disclosure in the Performance Co-Pilot (PCP) pmproxy service affects Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4. An out-of-bounds read (CWE-125) in the pmLogLoadInDom() function can be triggered by a specially crafted network request, causing the pmproxy process to crash and potentially leaking sensitive data from process memory. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Process memory disclosure in Google Chrome's ANGLE graphics subsystem exposes potentially sensitive in-process data to remote attackers via a crafted HTML page. All Chrome releases prior to 151.0.7922.72 are affected across desktop platforms. No public exploit code and no active exploitation have been identified at time of analysis; an EPSS score of 0.29% (21st percentile) reflects low current exploitation probability despite a high confidentiality impact rating.
Cross-origin data leakage in Google Chrome's Print Preview component (prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to exfiltrate cross-origin content via a crafted HTML page. The attack is two-stage - requiring a prior renderer process compromise - substantially constraining real-world exploitability beyond what the base CVSS score suggests. No public exploit code exists and the vulnerability is absent from CISA KEV, with EPSS at a low 0.29% (21st percentile), consistent with SSVC's 'none' exploitation and 'partial' technical impact ratings.
Cross-origin data leak in Google Chrome's Loader component (all versions prior to 151.0.7922.72) enables an attacker who has already compromised the renderer process to exfiltrate sensitive data from other origins via a crafted HTML page. The flaw stems from insufficient input validation (CWE-20) in how Loader processes requests originating from a compromised renderer, bypassing same-origin protections. No public exploit code has been identified and EPSS sits at 0.29% (21st percentile), consistent with this vulnerability's role as a second-stage capability in a chained browser exploit rather than a standalone attack.
LDAP injection in Apache Zeppelin's ActiveDirectoryGroupRealm allows authenticated attackers to manipulate LDAP filter construction through the user-search endpoint, potentially exposing Active Directory user and group information across all versions 0.6.0 through 0.12.0. The role-lookup path following successful LDAP authentication is also vulnerable, broadening the exposure surface within directory-integrated deployments and introducing a secondary risk of authorization bypass by influencing group-membership query results. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; Apache Zeppelin 0.12.1 resolves this issue.
Cross-site scripting in Apache JSPWiki's Markdown renderer error-handling path allows attackers with page-editing access to inject JavaScript that executes in victims' browsers, enabling session data theft and sensitive information exfiltration. All Apache JSPWiki releases through 2.12.3 are affected; the Apache Software Foundation has confirmed version 2.12.4 as the fix. No public exploit code has been identified at time of analysis and this CVE has no CISA KEV listing, but the edit-then-victim-view pattern is a well-understood XSS delivery model that requires minimal technical sophistication once editing access is available.
Second-order SQL Injection in the Improved Save Button WordPress plugin (all versions ≤ 1.2.1) allows authenticated attackers with author-level access or above to exfiltrate sensitive data from the WordPress database. The flaw arises in the 'Save and Duplicate' feature, where a user-supplied 'meta_key' Custom Field value is stored without adequate escaping, then later incorporated into an insufficiently prepared SQL query when the duplicate action is triggered. No public exploit code or active exploitation has been identified at time of analysis, and with a CVSS score of 6.5 the risk is medium - constrained by the authentication barrier but meaningful in multi-author WordPress environments.
LDAP filter injection in Apache Zeppelin's LdapRealm component allows remote attackers to manipulate LDAP search filter expressions by exploiting a wrong escaping scheme applied to user-supplied input during authentication. Versions 0.11.1, 0.11.2, and 0.12.0 incorrectly apply RFC 4514 distinguished-name escaping - which neutralizes DN metacharacters - instead of RFC 4515 filter-value escaping, leaving LDAP filter metacharacters such as parentheses, asterisks, and backslashes unsanitized in constructed search filters. This is an incomplete fix of CVE-2024-31867; no public exploit has been identified at time of analysis.
Same-origin policy bypass in Google Chrome's Media Router component allows a remote attacker to violate cross-origin integrity guarantees by luring a user to a crafted HTML page. Affected are all Chrome versions prior to 151.0.7922.72 across desktop platforms. No public exploit or active exploitation has been identified at time of analysis, and the EPSS score of 0.23% (14th percentile) reflects low observed exploitation activity; however, the high integrity impact (I:H) and no-privilege-required attack path make patching a meaningful priority for browser-fleet administrators.
Same-origin policy bypass in Google Chrome's Permissions subsystem (prior to 151.0.7922.72) allows an unauthenticated remote attacker to violate cross-origin integrity constraints by inducing a user to visit a crafted HTML page. The root cause is an origin validation error (CWE-346) in Chrome's permissions implementation, where the browser incorrectly evaluates the requesting origin, enabling cross-origin integrity manipulation. No public exploit has been identified at time of analysis, and EPSS at 0.23% (14th percentile) signals low observed exploitation activity.
Uninitialized memory use in Google Chrome's codec subsystem allows remote attackers to read potentially sensitive data from process memory by enticing a user to visit a crafted HTML page. Affected are all Chrome desktop builds prior to version 151.0.7922.72 on all supported platforms. No public exploit code has been identified and EPSS sits at a low 0.23%, indicating limited exploitation activity at time of analysis, though the high confidentiality impact (CVSS C:H) means successful exploitation could expose sensitive browser process memory including cached credentials or session tokens.
Navigation restriction bypass in Google Chrome for iOS (prior to 151.0.7922.72) enables a remote attacker to circumvent browser-enforced navigation controls by delivering a crafted HTML page. The root cause is an inappropriate implementation (CWE-284) in Chrome's iOS-specific navigation stack, meaning the flaw is isolated to the iOS platform and does not affect Chrome on Android or desktop. No public exploit code exists and EPSS probability stands at just 0.22% (13th percentile), indicating low real-world exploitation pressure at time of analysis; this vulnerability is not listed in the CISA KEV catalog.
Navigation restriction bypass in Google Chrome for iOS (versions prior to 151.0.7922.72) enables unauthenticated remote attackers to circumvent browser navigation controls by inducing a user to load a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms network-accessible, low-complexity exploitation with no privilege requirements but mandatory user interaction, yielding high integrity impact with no confidentiality or availability consequences. No public exploit identified at time of analysis, and EPSS at 0.22% (13th percentile) indicates limited near-term exploitation likelihood despite the medium severity rating.
Same-origin policy bypass in Google Chrome's DevTools component prior to version 151.0.7922.72 allows an unauthenticated remote attacker to perform unauthorized cross-origin write operations against a victim's browser context. Exploitation requires the victim to visit a specially crafted HTML page (UI:R), making it a socially-engineered threat rather than a purely opportunistic one. EPSS is low at 0.22% (13th percentile) and no CISA KEV listing or public exploit code has been identified, consistent with the Chromium team's own 'Medium' severity rating; however, Chrome's ubiquitous deployment makes even medium-severity findings broadly relevant.
Same Origin Policy bypass in Google Chrome's FedCM (Federated Credential Management) subsystem prior to version 151.0.7922.72 enables remote attackers to achieve high-integrity cross-origin impact by luring victims to a crafted HTML page. The flaw stems from an inappropriate implementation in the FedCM API, which fails to enforce origin boundaries correctly (CWE-693). No active exploitation or public proof-of-concept has been identified at time of analysis, and the EPSS score of 0.22% (13th percentile) reflects low current exploitation probability despite the network-accessible attack vector.
Navigation restriction bypass in Google Chrome's Presentation component (all versions prior to 151.0.7922.72) enables a remote attacker to circumvent enforced browser navigation policies via a specially crafted HTML page. The flaw carries a high integrity impact (I:H) with no privilege requirement on the attacker's side, though victim interaction is mandatory. EPSS sits at 0.22% (13th percentile) and SSVC classifies exploitation as 'none' with a non-automatable profile, placing this in the patch-but-not-emergency tier for most organizations. No public exploit code identified at time of analysis.
Same-origin policy bypass in Google Chrome's Blink rendering engine (versions prior to 151.0.7922.72) allows a remote attacker to violate cross-origin isolation boundaries by luring a user to visit a specially crafted HTML page. The CVSS vector assigns High integrity impact with no privilege requirement, meaning successful exploitation could enable an attacker to inject or manipulate cross-origin content within the victim's browser session. No public exploit has been identified at time of analysis and EPSS sits at 0.22% (13th percentile), with SSVC confirming no observed exploitation - placing this in the patch-on-schedule rather than emergency-response tier.
Site isolation bypass in Google Chrome's Extensions subsystem before version 151.0.7922.72 allows an attacker who has already compromised the renderer process to cross origin boundaries via a crafted HTML page, enabling access to or modification of data from other loaded origins. This is a chained exploit primitive - it depends on prior renderer compromise - making it a significant escalation step rather than a standalone entry point. No public exploit code has been identified and CISA SSVC rates exploitation status as none, consistent with the low EPSS score of 0.22% (13th percentile).
Same-origin policy bypass in Google Chrome's ControlledFrame component prior to version 151.0.7922.72 enables a remote attacker to violate cross-origin isolation by delivering a crafted HTML page to an unsuspecting user. The root cause is insufficient policy enforcement (CWE-346) within the ControlledFrame API, allowing an attacker to subvert origin boundaries and achieve high-integrity cross-origin impact. No active exploitation is confirmed - CISA KEV is not triggered, SSVC reports exploitation as none, and EPSS sits at a low 0.22% (13th percentile) - indicating this is a meaningful but currently theoretical browser integrity risk.
UI spoofing in Google Chrome's Passwords component prior to version 151.0.7922.72 enables a remote attacker who has already compromised the renderer process to manipulate the browser's password-related interface via a crafted HTML page. The vulnerability stems from insufficient input validation (CWE-20) in the Passwords subsystem, allowing integrity-impacting spoofing of security-sensitive UI elements such as password prompts or save/fill dialogs. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.21% (11th percentile), consistent with the elevated prerequisite of a prior renderer compromise.
Memory disclosure in Google Chrome's MediaRecording subsystem allows remote attackers to read sensitive data from the browser process by enticing a user to visit a crafted HTML page. All Chrome desktop versions prior to 151.0.7922.72 are affected across supported platforms. No public exploit exists and EPSS probability stands at only 0.21% (11th percentile); SSVC also assesses exploitation as none and the attack as non-automatable, making this a patch-track rather than emergency-response priority despite the CVSS 6.5 base score.
Side-channel information leakage in Chrome's WebXR implementation allows remote attackers to read potentially sensitive data from process memory by luring a user to a crafted HTML page. Affected are all Google Chrome desktop versions prior to 151.0.7922.72. No active exploitation has been identified (not in CISA KEV), EPSS sits at the 11th percentile, and SSVC rates this as non-automatable with partial technical impact, indicating limited real-world threat despite the high confidentiality CVSS sub-score.
UI spoofing in Google Chrome's Messages component on Android allows remote unauthenticated attackers to misrepresent critical interface information to victims via crafted HTML pages. Affects all Chrome for Android versions prior to 151.0.7922.72; desktop Chrome is not listed as affected. No public exploit identified at time of analysis, and EPSS at 0.21% (11th percentile) signals low current exploitation probability consistent with the mandatory user-interaction requirement.
UI spoofing via Chrome's Credential Management component (versions prior to 151.0.7922.72) enables a remote attacker to misrepresent credential-related browser UI to a user who visits a crafted HTML page. The flaw stems from an inappropriate implementation of the Credential Management API (CWE-451), which can cause the browser to render misleading prompts that mimic legitimate credential dialogs. No public exploit code or active exploitation (CISA KEV) has been identified, and EPSS probability is very low at 0.21%, consistent with SSVC's 'Exploitation: none' classification.
UI spoofing in Google Chrome's Payments component (versions prior to 151.0.7922.72) can be achieved by a remote attacker who has already compromised the renderer process, enabling deceptive payment interfaces via a crafted HTML page. The CVSS vector scores integrity impact as High (I:H) with no confidentiality or availability impact, reflecting the ability to mislead users through falsified UI elements in a sensitive financial context. No public exploit code has been identified at time of analysis, and EPSS is very low at 0.21% (11th percentile), indicating this vulnerability is not yet being actively targeted at scale.
Same-Origin Policy bypass in Google Chrome's Headless component prior to version 151.0.7922.72 allows remote attackers to perform unauthorized cross-origin integrity violations via a specially crafted HTML page. The flaw (CWE-346, Origin Validation Error) is specific to Chrome's Headless rendering mode and requires the victim to interact with attacker-controlled HTML (UI:R per CVSS). No public exploit code or CISA KEV listing has been identified; EPSS at 0.19% (9th percentile) reflects low near-term exploitation probability, though the zero-authentication requirement and low attack complexity elevate the concern for environments where Headless Chrome processes untrusted input.
Discretionary access control bypass in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to violate iOS access control boundaries by enticing a user to visit a specially crafted HTML page. The flaw stems from insufficient policy enforcement unique to the iOS version of Chrome, meaning desktop Chrome is not affected by this specific variant. No public exploit code has been identified and EPSS signals low exploitation probability, but the integrity-only CVSS impact and user-interaction requirement make this a realistic phishing-assisted attack path.
Same-origin policy bypass in Google Chrome's WebMCP component (prior to 151.0.7922.72) enables a remote attacker to violate cross-origin integrity boundaries through a crafted HTML page, requiring only that a victim visit the malicious page. The root cause is insufficient policy enforcement in the WebMCP subsystem, classified by Chromium's security team as Medium severity (CWE-346: Origin Validation Error). No public exploit code or active exploitation has been identified at time of analysis, and the low EPSS score of 0.19% (9th percentile) corroborates low current threat activity.
Same-origin policy bypass in Google Chrome for Windows (prior to 151.0.7922.72) allows a remote attacker who has already compromised the Chrome renderer process to circumvent cross-origin isolation controls via a crafted HTML page exploiting an origin validation flaw (CWE-346) in the Media component. This is a second-stage, chained exploitation capability - not a standalone entry point - requiring a prior renderer compromise to weaponize, which substantially constrains its independent risk. No public exploit code has been identified and EPSS sits at 0.19% (9th percentile); the vendor patch is available in Chrome 151.0.7922.72.
Same-origin policy bypass in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to violate cross-origin isolation by luring a user into performing specific UI gestures on a crafted HTML page. The flaw stems from CWE-346 (Origin Validation Error) in an iOS-specific Chrome implementation, granting unauthorized write-level access to cross-origin content. No public exploit code has been identified and no active exploitation is confirmed; with an EPSS of 0.19% (9th percentile), real-world exploitation probability remains low but the integrity impact is high if successfully triggered.
ServiceWorker policy enforcement in Google Chrome prior to 151.0.7922.72 is insufficiently enforced, enabling a remote attacker to bypass the browser's same-origin policy (SOP) by delivering a crafted HTML page to a victim. Classified under CWE-284 (Improper Access Control), the flaw carries high integrity impact - cross-origin resource manipulation without data exfiltration - and is exploitable with no attacker privileges, though user interaction is mandatory. EPSS stands at 0.19% (9th percentile) with no CISA KEV listing, placing active exploitation as unconfirmed; however, the low attack complexity and ubiquitous deployment of Chrome make it a realistic target in browser-based phishing campaigns.
Uninitialized memory use in Skia, Chrome's 2D graphics rendering engine, exposes process memory contents to remote attackers on Windows via crafted HTML pages in Google Chrome versions prior to 151.0.7922.72. The flaw is strictly an information disclosure issue (CWE-457), with no integrity or availability impact, affecting only the Windows platform per the vulnerability description. No public exploit code has been identified, EPSS places exploitation probability at 0.19% (9th percentile), and SSVC classifies exploitation as none with partial technical impact - collectively suggesting limited real-world risk despite the CVSS C:H rating.
Uninitialized memory access in Google Chrome's WebXR implementation on Android exposes potentially sensitive browser process memory contents to remote attackers who can direct a victim to a crafted HTML page. All Chrome for Android versions prior to 151.0.7922.72 are affected by this information disclosure weakness (CWE-457). No public exploit identified at time of analysis and SSVC confirms no active exploitation, placing this in routine patch-cycle priority despite the high confidentiality impact rating in the CVSS base score.