Memory disclosure in Google Chrome's Dawn WebGPU component (prior to 151.0.7922.72) enables an attacker who has already obtained code execution in the renderer process to read sensitive data from process memory via a crafted HTML page. This is a second-stage, chained vulnerability - not a standalone exploit - requiring a prior, separate renderer compromise before this flaw is reachable. Chromium's own severity rating is Low, consistent with the EPSS score of 0.19% and SSVC classification of no active exploitation and partial technical impact; no public exploit or KEV listing exists.
Navigation input validation bypass in Google Chrome prior to 151.0.7922.72 enables a renderer-compromised attacker to circumvent navigation restrictions via a crafted HTML page. The flaw is the second stage of a chained attack - exploitation requires a prior renderer process compromise, substantially raising the practical bar for abuse. No public exploit code or active exploitation has been identified; EPSS sits at 0.18% (8th percentile), consistent with its role as a post-exploitation primitive rather than an initial access vector.
Same-origin policy bypass in Google Chrome's Bluetooth subsystem (prior to 151.0.7922.72) can be triggered by an attacker who has already achieved renderer process compromise, using a crafted HTML page to abuse insufficient policy enforcement in the Web Bluetooth layer. The exploit chain requires a pre-existing foothold in the renderer, which limits real-world risk considerably - Chrome's own security team rated this 'Low' severity. No active exploitation has been confirmed (not listed in CISA KEV), and the EPSS score of 0.18% (8th percentile) reflects negligible observed exploitation activity.
Insufficient policy enforcement in Chrome's Speech component prior to version 151.0.7922.72 enables remote attackers to bypass site isolation - a core security boundary - via a crafted HTML page requiring only user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) signals high integrity impact with no privilege requirement, meaning an unrelated web page can be weaponized as the delivery vehicle. No public exploit code has been identified and EPSS sits at a low 0.18% (8th percentile), consistent with the Chromium team's own 'Low' severity classification despite the NVD medium score; however, the site isolation bypass class of vulnerability is historically sensitive and warrants prompt patching.
Navigation restriction bypass in Google Chrome for Android (via WebView) prior to version 151.0.7922.72 enables a remote attacker to circumvent enforced browsing policies using a crafted HTML page, achieving high integrity impact with no privileges required. The flaw resides specifically in WebView's policy enforcement layer, meaning Android applications that embed Chrome WebView and rely on its navigation restriction mechanisms for security enforcement are also at risk. No public exploit has been identified at time of analysis and EPSS stands at 0.18% (8th percentile), though the vendor has confirmed a patch and the Chromium team internally rated this Low severity - lower than the NVD CVSS 6.5 Medium assignment.
Navigation restriction bypass in Google Chrome's DevTools component (all versions prior to 151.0.7922.72) permits remote attackers to circumvent browser navigation controls when a user is socially engineered into performing specific UI gestures on a crafted HTML page. Despite a CVSS integrity impact of High, the Chromium team internally classifies this as Low severity - a meaningful signal that real-world exploitability is more constrained than the base score implies. No public exploit code or active exploitation has been identified (EPSS: 0.18%, 8th percentile), and a vendor-released patch is available in Chrome 151.0.7922.72.
Navigation restriction bypass in Google Chrome DevTools (all versions prior to 151.0.7922.72) enables a remote attacker to circumvent navigation security controls by directing a user to a crafted HTML page. The flaw stems from an inappropriate implementation within the DevTools component (CWE-693, Protection Mechanism Failure), resulting in high integrity impact with no confidentiality or availability exposure. No public exploit has been identified at time of analysis; EPSS at 0.18% (8th percentile) and SSVC Exploitation status of none collectively indicate low near-term exploitation probability.
Navigation restriction bypass in Google Chrome's DevTools component (versions prior to 151.0.7922.72) enables remote attackers to circumvent Chrome's browsing navigation policies via a crafted HTML page. Exploitation requires convincing a victim to perform specific UI gestures, confining the attack surface to social engineering scenarios. The Chromium team internally rates this Low severity; the CVSS 6.5 score reflects the high integrity impact of policy bypass if interaction is achieved, but EPSS at 0.18% (8th percentile) and no KEV listing confirm low real-world exploitation probability. No public exploit or POC has been identified at time of analysis.
Navigation restriction bypass in Google Chrome prior to 151.0.7922.72 enables a remote attacker who has already compromised the renderer process to circumvent navigation controls via a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) records high integrity impact with no confidentiality or availability loss, reflecting the attacker's ability to redirect or manipulate navigation to otherwise restricted contexts. No public exploit identified at time of analysis; the EPSS score of 0.18% (8th percentile) and Chromium's own internal severity rating of Low collectively indicate minimal real-world exploitation probability despite the Medium NVD score.
Insufficient policy enforcement in Google Chrome for iOS prior to version 151.0.7922.72 enables a remote attacker to bypass discretionary access controls (CWE-284) by delivering a crafted HTML page to a victim, resulting in high integrity impact with no confidentiality or availability consequence. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network reachability with no attacker privileges needed, though user interaction is required. With EPSS at 0.18% (8th percentile), SSVC exploitation classified as none, and no public exploit identified at time of analysis, real-world mass exploitation risk is low despite the meaningful integrity bypass potential on a widely-used mobile browser.
Insufficient policy enforcement in the Passwords component of Google Chrome on Android prior to version 151.0.7922.72 allows a remote attacker to bypass discretionary access control by luring a user to a crafted HTML page. The integrity impact is rated High (CVSS I:H), indicating an attacker can manipulate or circumvent password-related access controls without needing any prior privileges. No public exploit code has been identified and EPSS sits at 0.18% (8th percentile), suggesting exploitation remains theoretical at time of analysis, though the low attack complexity and no-privilege requirement make it attractive if a reliable technique is developed.
Same-origin policy bypass in Google Chrome's WebXR subsystem prior to 151.0.7922.72 allows a remote attacker to violate cross-origin integrity boundaries by luring a victim to a crafted HTML page. The flaw arises from insufficient policy enforcement (CWE-346: Origin Validation Error) in the WebXR API, enabling cross-origin write or manipulation operations that Chrome's SOP should prevent. No active exploitation is confirmed and EPSS is low at 0.18% (8th percentile), but a vendor patch is available and deployment is recommended given Chrome's ubiquitous footprint.
Navigation restriction bypass in Google Chrome for iOS prior to 151.0.7922.72 enables remote attackers to circumvent browser-enforced navigation policies by delivering a crafted HTML page to a victim. The flaw originates from insufficient client-side policy enforcement (CWE-602), where the iOS-specific Chrome policy engine fails to prevent unauthorized navigation actions triggered by attacker-controlled content. No public exploit has been identified at time of analysis, and an EPSS score of 0.18% (8th percentile) indicates minimal current exploitation activity; vendor-released patch 151.0.7922.72 is available.
Navigation restriction bypass in the Glic component of Google Chrome for Android (versions prior to 151.0.7922.72) allows unauthenticated remote attackers to circumvent browser policy enforcement by directing victims to a crafted HTML page. The integrity-only impact (I:H) reflects the ability to navigate users past enforced restrictions, though confidentiality and availability are unaffected. No public exploit has been identified at time of analysis, EPSS sits at 0.18% (8th percentile), and the vulnerability is not listed in CISA KEV - vendor-released patch is available in Chrome 151.0.7922.72.
Cross-origin data leakage in Google Chrome's PDF component on Android (prior to 151.0.7922.72) exposes sensitive data from one web origin to an attacker-controlled page due to insufficient input validation in PDF processing. A local attacker who can direct a victim to a crafted HTML page triggers the flaw, allowing confidentiality impact with no integrity or availability consequence. No public exploit code exists and EPSS sits at 0.18% (8th percentile), indicating low real-world exploitation probability at time of analysis despite a High Chromium severity rating.
Memory disclosure in Google Chrome's WebXR implementation allows remote attackers to read sensitive data from process memory by directing a victim to a crafted HTML page. Affected versions are all Chrome releases prior to 151.0.7922.72 on desktop platforms. No public exploit code has been identified at time of analysis, and SSVC assessment indicates no current exploitation activity, making this a moderate-priority patching item despite the High confidentiality impact in the CVSS score.
Domain spoofing via incorrect security UI in Google Chrome's built-in Passwords feature affects all Chrome versions prior to 151.0.7922.72. Remote unauthenticated attackers can serve a crafted HTML page that causes Chrome to misrepresent the origin domain within the password management UI, enabling deception of users into associating saved credentials with an attacker-controlled domain. No public exploit code has been identified at time of analysis, and EPSS at 0.18% (8th percentile) signals very low automated exploitation probability, though Chrome's ubiquitous deployment makes even low-probability credential phishing scenarios broadly impactful.
Process memory leakage in Google Chrome's IME (Input Method Editor) implementation on macOS allows remote unauthenticated attackers to obtain potentially sensitive data from Chrome's process memory by luring a user to a specially crafted HTML page. The flaw affects all Chrome for Mac versions prior to 151.0.7922.72, is platform-scoped to macOS only, and carries a CVSS 6.5 (Medium) despite Chromium's own 'Low' severity designation. No public exploit code exists and EPSS sits at 0.17% (7th percentile), indicating very low current exploitation probability.
UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to misrepresent browser interface elements - such as the address bar or security indicators - by delivering a crafted HTML page, potentially deceiving users into believing they are interacting with a trusted site or legitimate browser chrome. The vulnerability maps to CWE-451 (UI Misrepresentation of Critical Information) and carries a High integrity impact despite no direct confidentiality or availability loss, because successful spoofing can facilitate credential theft or social engineering at scale. No public exploit identified at time of analysis, and EPSS at 0.17% (7th percentile) reflects low current opportunistic exploitation probability.
Domain spoofing in Google Chrome on iOS prior to 151.0.7922.72 allows a remote unauthenticated attacker to misrepresent the displayed origin in the browser's security UI by delivering a crafted HTML page to a victim. The flaw (CWE-451) enables phishing-class attacks where the address bar or site identity indicator shows a trusted domain while content is served from a different origin. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), indicating low automated exploitation likelihood, but the integrity impact is high for targeted phishing campaigns against iOS Chrome users.
UI spoofing in Google Chrome for iOS prior to version 151.0.7922.72 enables remote attackers to misrepresent critical browser interface elements - such as the address bar or security indicators - by delivering a crafted HTML page to a victim. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms the attack is network-reachable with no attacker authentication, though it requires the victim to interact with a malicious page. No public exploit code or active exploitation has been identified; EPSS sits at 0.17% (7th percentile), indicating low current exploitation interest despite the vendor-confirmed patch.
UI spoofing in Google Chrome for iOS prior to version 151.0.7922.72 enables a remote attacker to misrepresent critical browser interface elements - such as the address bar or security indicators - by delivering a crafted HTML page to the victim (CWE-451). The CVSS vector assigns high integrity impact (I:H) with no privileges required from the attacker, but mandates user interaction (UI:R), meaning the victim must visit the malicious page. No public exploit identified at time of analysis, and an EPSS score of 0.17% at the 7th percentile indicates very low observed exploitation interest; Chromium's own severity rating of Medium aligns with this assessment.
UI spoofing via race condition in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to deceive users about page origin or security context by serving a crafted HTML page. The vulnerability stems from CWE-362 (concurrent execution with improper synchronization), allowing an attacker to manipulate browser UI elements - such as the address bar or security indicators - during a timing window. No active exploitation is confirmed (EPSS 0.17%, 7th percentile; not listed in CISA KEV), and Google has released a patch in the stable channel update.
UI spoofing in Google Chrome's WebAppInstalls component (all versions prior to 151.0.7922.72) allows a remote attacker to misrepresent critical interface elements through a crafted HTML page, deceiving users into interacting with fraudulent Chrome UI. The flaw stems from inappropriate implementation in the Progressive Web App installation flow, rated CVSS 6.5 with high integrity impact reflecting the attacker's ability to manipulate perceived interface state. No public exploit identified at time of analysis, and an EPSS of 0.17% (7th percentile) confirms negligible observed exploitation activity.
Navigation restriction bypass in Google Chrome's DevTools component prior to version 151.0.7922.72 allows a remote attacker to subvert browser navigation controls by delivering a malicious file that triggers insufficient input validation. Exploitation requires user interaction (opening the crafted file), limits opportunistic mass exploitation, and impact is confined to high integrity loss with no confidentiality or availability effects. No active exploitation is confirmed - EPSS stands at 0.17% (7th percentile), and no CISA KEV listing is present - indicating low observed threat activity at time of analysis.
Navigation restriction bypass in Google Chrome Enterprise (versions prior to 151.0.7922.72) enables a remote attacker to circumvent administrator-configured policy controls by supplying a crafted domain name, fully defeating enterprise navigation enforcement with high integrity impact. The vulnerability is Enterprise-specific, requiring user interaction to trigger (UI:R), and is limited to deployments using Chrome managed policies for domain-level access control. No public exploit has been identified at time of analysis, and no active exploitation is confirmed; EPSS is 0.17% (7th percentile) and SSVC rates exploitation as none, consistent with low urgency despite the CVSS 6.5 Medium score.
Navigation restriction bypass in Google Chrome for iOS prior to 151.0.7922.72 allows remote attackers to circumvent browser navigation controls by delivering maliciously crafted network traffic to a victim device. The flaw stems from insufficient input validation (CWE-20) in the iOS-specific implementation of Chrome, resulting in an Integrity:High impact - enabling unauthorized navigation, redirect manipulation, or security-boundary evasion - with no confidentiality or availability consequences. No public exploit has been identified and EPSS places exploitation probability at just 0.17% (7th percentile), indicating low active exploitation risk at time of analysis.
Information disclosure in Google Chrome's WebXR subsystem prior to version 151.0.7922.72 allows unauthenticated remote attackers to read potentially sensitive process memory contents by luring a victim to a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) indicates a network-accessible, low-complexity path to high confidentiality impact, though Chromium's internal severity rating of Low and an EPSS of 0.16% (6th percentile) reflect limited real-world exploitation risk. No public exploit code exists and CISA SSVC rates exploitation as none, making this a watch-and-patch item rather than an emergency response trigger.
Process memory disclosure in Google Chrome's WebGL implementation allows a remote attacker to read potentially sensitive data from the browser's memory by luring a user to a specially crafted HTML page. Affected versions are all Chrome releases prior to 151.0.7922.72 across desktop platforms. No public exploit code has been identified and EPSS sits at 0.16% (6th percentile), indicating low real-world exploitation probability despite the High confidentiality rating in the CVSS vector.
Domain spoofing in Google Chrome on Android (all versions prior to 151.0.7922.72) results from a race condition in the PictureInPicture component, enabling a remote attacker to misrepresent the origin domain shown to a user when they interact with a crafted HTML page. The integrity impact is limited to the browser UI trust indicator - no code execution or data exfiltration occurs directly - but successful spoofing can be chained with credential phishing against a falsely trusted domain. No active exploitation has been confirmed (not listed in CISA KEV), and the EPSS score of 0.16% at the 6th percentile reflects very low exploitation probability, consistent with Chromium's own 'Low' severity classification.
Navigation restriction bypass in Google Chrome DevTools prior to version 151.0.7922.72 enables remote attackers to circumvent browser navigation controls by luring a user into opening a specially crafted malicious file. The flaw stems from CWE-20 insufficient input validation within the DevTools component, resulting in high integrity impact per CVSS. No public exploit has been identified and EPSS exploitation probability is very low at 0.16% (6th percentile); notably, the Chromium security team internally rated this 'Low' severity despite the medium NVD CVSS score of 6.5.
UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to deceive users about the origin or content of a web page by exploiting a race condition via a crafted HTML page. The vulnerability requires the victim to visit the attacker-controlled page (UI:R), but no authentication or elevated privileges are needed. No public exploit code or CISA KEV listing exists at time of analysis; EPSS places exploitation probability at 0.14% (4th percentile), indicating low observed exploitation activity despite medium CVSS severity.
Server-Side Request Forgery and local file read in SGLang's multimodal inference endpoint allows authenticated API users to exfiltrate cloud metadata, internal service responses, and secrets. The `/v1/chat/completions` endpoint accepts an `image_url` parameter that the server fetches without sanitization, enabling pivot to internal networks and cloud IMDS endpoints. Affecting all SGLang releases through v0.5.15, this is a high-confidentiality-impact flaw with no public exploit or CISA KEV listing identified at time of analysis, and an EPSS of 0.14% (4th percentile) suggesting limited opportunistic exploitation to date.
foreUP's customer REST API exposes cleartext payment-processor merchant credentials - such as API keys or secrets - directly in response bodies to any authenticated user. All foreUP versions are affected per the wildcard CPE (cpe:2.3:a:foreup:foreup:*). An attacker with any valid authenticated session can harvest these credentials and use them to interact directly with the downstream payment processor, creating potential for financial fraud or account takeover at the payment-processing layer. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Policy bypass in the Extensions subsystem of Google Chrome (all versions prior to 151.0.7922.72) allows site isolation circumvention when a user is convinced to install a crafted malicious extension. The CVSS vector (I:H, S:U) and CWE-693 indicate this is a protection mechanism failure that undermines Chrome's cross-origin boundary enforcement, potentially enabling manipulation of content across isolated sites. No public exploit has been identified at time of analysis; EPSS at 0.12% (3rd percentile) reflects low current exploitation probability, and CISA KEV listing is absent.
Navigation restriction bypass in Google Chrome's DevTools component (versions prior to 151.0.7922.72) allows a local attacker to circumvent browser navigation policies via a crafted HTML page. The insufficient policy enforcement within DevTools produces an integrity-high impact (CVSS I:H) without requiring attacker privileges. No public exploit code or CISA KEV listing exists; an EPSS score of 0.12% (2nd percentile) and Google's internal 'Low' Chromium severity rating together confirm this as a low immediate exploitation priority.
Navigation restriction bypass in Google Chrome's Extensions subsystem affects all desktop versions prior to 151.0.7922.72, enabling an attacker who convinces a user to install a crafted malicious extension to circumvent Chrome's navigation enforcement policies. The CWE-602 root cause indicates client-side policy logic can be subverted by a malicious extension actor, resulting in a high integrity impact with no confidentiality or availability exposure. No public exploit has been identified at time of analysis, and the EPSS score of 0.12% (2nd percentile) indicates very low exploitation probability, despite the CVSS 6.5 medium-severity rating.
Code injection in Amazon's @aws-amplify/codegen-ui-react before 2.20.6 lets a remote authenticated Amplify Studio user embed attacker-controlled code into generated React components by supplying crafted component or theme schema values (CWE-94). The malicious code executes wherever the generated artifacts run - end-user browsers, developer machines, CI/CD pipelines, and server-side rendering contexts - giving broad code-execution reach. This is a bypass of the input validation added for CVE-2025-4318, which proved insufficient in coverage and effectiveness; no public exploit has been identified at time of analysis, though a vendor patch (v2.20.6) is available.
Server-side request forgery in WACRM 0.7.0 and earlier allows any authenticated user holding automation privileges to coerce the application server into fetching arbitrary internal URLs, including cloud instance metadata endpoints such as 169.254.169.254. The send_webhook automation action in src/lib/automations/engine.ts was missing a call to the existing isDeliverableUrl SSRF guard that already protected the webhook_endpoints delivery path, creating an inconsistent and exploitable gap. No public exploit code has been independently identified and the vulnerability is not listed in CISA KEV; however, the fix commit and GitHub security advisory are publicly available, substantially lowering the bar for any attacker who has read the diff.
Navigation restriction bypass in Google Chrome's Isolated Web Apps (IWA) subsystem allows remote unauthenticated attackers to circumvent sandboxing controls by luring a user to a crafted HTML page. Versions prior to 151.0.7922.72 are affected. No public exploit exists and SSVC confirms no active exploitation; with an EPSS of 0.22% at the 13th percentile, this is a medium-priority defect addressed by Chrome's stable-channel update released in July 2026.
Tier authorization bypass in Tigera Calico's apiserver allows an authenticated high-privileged user to bulk-delete NetworkPolicy, GlobalNetworkPolicy, and their staged variants across restricted tiers without authorization. The `DeleteCollection` Kubernetes verb was not routed through `AuthorizeTierOperation` - the per-tier enforcement gate that governs all other write operations - meaning any principal holding `deletecollection` or wildcard verbs on tier-scoped policy resources could silently collapse network enforcement boundaries in tiers they have no legitimate access to. No public exploit or CISA KEV listing exists at time of analysis; four upstream patches have been merged and a vendor advisory (TTA-2026-006) has been published.
The ansible-collection-redhat-leapp package exposes Ansible controller-side sensitive files to attacker-controlled managed nodes through a manipulated Leapp upgrade report. An attacker who has already obtained privileged write access to a managed node's Leapp report can craft malicious report content that, when an operator executes a specific remediation task, causes the Ansible controller to read and copy its own local files - including private keys and credentials - to the attacker-controlled managed node. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the CVSS 3.1 score of 6.2 reflects real-world risk limited by the high privilege prerequisite and required operator interaction.
Information disclosure in Google Chrome's Views UI framework on macOS prior to version 151.0.7922.72 exposes potentially sensitive data from browser process memory to local attackers. The flaw is triggered by an inappropriate implementation in the Views rendering layer, reachable via a specially crafted HTML page. No public exploit code exists and the EPSS score sits at the 2nd percentile, indicating very low observed exploitation probability; Chrome's own severity rating of 'Low' is consistent with the local-only attack vector and read-only confidentiality impact.
Navigation restriction bypass in Google Chrome on macOS (versions prior to 151.0.7922.72) permits a local attacker to circumvent the browser's navigation controls by delivering a crafted malicious file. The CVSS vector (AV:L/I:H) confirms the impact is limited to integrity - an attacker who achieves local access can subvert Chrome's navigation security model without requiring elevated privileges or user interaction beyond obtaining local system access. With an EPSS score of 0.10% (1st percentile), no CISA KEV listing, and Chromium's own classification of Low severity, real-world exploitation risk is low despite the 6.2 CVSS base score.
Universal Cross-Site Scripting (UXSS) in Google Chrome's CSS implementation enables a remote attacker to inject arbitrary scripts or HTML across origin boundaries by directing a victim to a crafted HTML page. All Chrome desktop versions prior to 151.0.7922.72 are affected. No public exploit has been identified at time of analysis and CISA SSVC rates exploitation as none, but the cross-origin scope change makes this meaningfully more impactful than a standard reflected XSS, warranting timely patching given Chrome's ubiquitous deployment footprint.
Reflected XSS in AdonisJS HTTP Server (versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2) enables remote unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by crafting a malicious 404 URL containing an embedded HTML payload. The framework's default exception handler interpolates the unescaped request path directly into the HTML error response when debug mode is disabled and no custom error handler is configured. No public exploit has been identified at time of analysis, but the fix commit includes a working proof-of-concept test demonstrating a cookie-exfiltration attack using `fetch('/dashboard',{credentials:'include'})`, confirming practical exploitability.
Script and HTML injection into privileged DevTools pages in Google Chrome prior to 151.0.7922.72 is enabled when an attacker has already compromised the renderer process, exploiting an inappropriate implementation in DevTools (CWE-79). The vulnerability requires chaining with a prior renderer exploit: alone it cannot be triggered by a remote unauthenticated attacker without that precondition, making it a sandbox-escape amplifier rather than a standalone remote attack. EPSS is 0.18% (8th percentile), no public exploit has been identified, and it does not appear in CISA KEV, reflecting low observed exploitation pressure despite the Medium CVSS rating.
Universal Cross-Site Scripting (UXSS) in Google Chrome's CSS implementation allows remote attackers to inject arbitrary scripts or HTML across origin boundaries via a crafted HTML page. All Chrome versions prior to 151.0.7922.72 on all platforms are affected. An unauthenticated remote attacker can bypass the browser's same-origin policy, enabling script execution in the context of third-party origins visited by the victim. No public exploit identified at time of analysis and EPSS sits at 0.18% (8th percentile), suggesting limited active exploitation pressure despite the broad attack surface of a ubiquitous browser.
Universal Cross-Site Scripting (UXSS) in Google Chrome prior to 151.0.7922.72 enables remote attackers to inject arbitrary scripts or HTML across origin boundaries by luring a victim to a crafted HTML page that exploits an inappropriate CSS implementation. Because this is a UXSS class vulnerability - not ordinary reflected or stored XSS - exploitation bypasses the browser's same-origin policy entirely, potentially exposing authenticated sessions, cookies, and DOM content from any tab open in the browser. No public exploit has been identified at time of analysis, and EPSS at 0.18% (8th percentile) indicates low current exploitation probability, though UXSS flaws in dominant browsers remain high-value targets.
Universal Cross-Site Scripting (UXSS) in Google Chrome's Blink rendering engine prior to version 151.0.7922.72 enables remote attackers to inject arbitrary scripts or HTML that execute across origin boundaries via a crafted HTML page. Unlike conventional XSS constrained to a single origin, this flaw bypasses the Same-Origin Policy enforced by Blink, potentially allowing script execution in the context of unrelated sites visited by the victim. No active exploitation is confirmed (absent from CISA KEV), EPSS exploitation probability is 0.17% (7th percentile), and the vendor itself classifies this as Low severity - all signals converging on low current real-world risk.