Remote code execution in VMware vCenter Server (and bundled distributions including Cloud Foundation, vSphere Foundation, Telco Cloud Infrastructure, and Telco Cloud Platform) arises from a directory traversal flaw in the Syslog server component, enabling any actor with network reach to vCenter to run arbitrary code. The CVSS 9.8 vector indicates unauthenticated, low-complexity network exploitation with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not yet listed in CISA KEV, but the vCenter management plane's central role makes this a top-priority patch.
Remote code execution in Somta Juggle through version 1.6.0 lets unauthenticated network attackers run arbitrary OS commands by reaching the bundled H2 database web console, which ships exposed at /h2-console with default credentials. Because the stock Docker image runs as root, successful exploitation via the classic H2 CREATE ALIAS Runtime.exec() technique yields root-level code execution on the host container. No public exploit identified at time of analysis, though the VulnCheck advisory provides a detailed exploitation path.
PHP object injection in the Remote API WordPress plugin (all versions through 0.2) lets unauthenticated attackers deserialize attacker-supplied input, and when a suitable gadget chain is available it escalates to remote code execution on the host. The flaw stems from the plugin processing serialized user input before any authentication check. Publicly available exploit code exists (WPScan), though EPSS remains low (0.25%, 17th percentile) and it is not listed in CISA KEV.
Authentication bypass in VMware vCenter's Directory Service (vmdir) lets an attacker with network reachability to vCenter defeat the authentication algorithm and obtain unauthorized access without valid credentials. Because vCenter is the central management plane for vSphere environments, this exposes control over the entire virtual estate; the flaw is remotely exploitable with no privileges or user interaction (CVSS 9.8). At time of analysis there is no public exploit identified and it is not listed in CISA KEV, but the reporting vendor (VMware/Broadcom) rates it critical.
Guest-to-host escape in VMware ESX (and the ESX component of Cloud Foundation, vSphere Foundation, and Telco Cloud Platform) lets an attacker with administrative privileges inside a virtual machine execute code on the underlying hypervisor host via an out-of-bounds write in the VMXNET3 virtual network adapter. Only VMs configured with the VMXNET3 adapter are affected; other virtual NIC types are not. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor-issued Broadcom/VMware advisory and the CVSS 9.3 score reflect a critical host-compromise impact.
Remote code execution in Microsoft Azure Cosmos DB allows an unauthorized, unauthenticated attacker to execute code over a network by abusing an improper access control (authentication bypass) flaw. Microsoft rates it CVSS 10.0 with a scope change, meaning a successful attack against the managed database service can impact resources beyond the initially vulnerable component. No public exploit has been identified at time of analysis (CVSS exploit maturity is Unproven), and it is not on the CISA KEV list, but the maximum severity and network-reachable, no-privilege profile make it a top-priority fix.
Root-level command injection in the net.set_wan interface of multiple Cudy router models (TR1200, TR3000, WR300, WR1200, WR1300, WR1500, WR3000, WR3600, WR6500) allows attackers to execute arbitrary OS commands as root by supplying crafted input to WAN configuration parameters. The NVD-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates this 9.8 Critical, implying full network-reachable compromise with no privileges required. No public exploit code and no CISA KEV listing were identified at time of analysis, so there is no public exploit identified at this time; the vendor has published security advisory cudy-sa-26-7-jezzy-4.
OS command injection in the IBM Hardware Management Console (HMC) lets a remote, unauthenticated attacker run arbitrary commands with elevated privileges on the management appliance. It affects HMC V10.3.1050.0 through 10.3.1064.0 and V11.1.1110.0 through 11.1.1112.0, the systems used to manage IBM Power servers (including Novalink deployments), stemming from improper validation of user-supplied input (CWE-78). No public exploit has been identified at time of analysis, but the network-reachable, no-authentication vector and 9.8 CVSS make this a top-priority patch.
Remote code injection in IBM Langflow OSS versions 1.0.0 through 1.10.0 allows an authenticated remote attacker to execute arbitrary code on the underlying host by supplying malicious user-controlled code that is improperly validated (CWE-94). Because Langflow evaluates user-supplied code as part of its low-code AI/agent flow-building functionality, exploitation grants full compromise of the server hosting the application. There is no public exploit identified at time of analysis, but the CVSS 3.1 base score of 9.9 with a scope change reflects that a successful attack can break out of the application context to affect other system components.
SQL injection in the Plesk hosting control panel's XML-RPC API allows a remote, low-privileged authenticated user to inject crafted SQL and read arbitrary data from the Plesk database (CWE-89), which the vendor states leads to full compromise of the panel. All Plesk builds prior to 18.0.79.4 are affected, and WebPros has released a fixed version. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the very high 9.9 CVSS and scope-change to full panel takeover make this a high-priority patch.
Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.1 stems from improper input validation in the PythonREPL sandbox, allowing a low-privileged authenticated user to escape the sandbox and run arbitrary Python. Because the flaw carries a scope-changing CVSS 3.1 score of 9.9 (S:C, C/I/A all High), a successful exploit can compromise the underlying host beyond the intended sandbox boundary. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Directory traversal in IBM App Connect Enterprise 13.0.1.0-13.0.7.2 and 12.0.1.0-12.0.12.27 lets a remote unauthenticated attacker write arbitrary files by sending a crafted URL containing '../' sequences. Because attacker-controlled file writes on an integration server can overwrite configuration, deployment artifacts, or executable content, this maps to a full-compromise CVSS 9.8. No public exploit identified at time of analysis, but the vendor (IBM) has released a fix.
Remote code execution in SGLang (versions up to and including 0.5.15) allows unauthenticated attackers to run arbitrary commands by abusing the /load_lora_adapter_from_tensors endpoint, which deserializes attacker-supplied base64-encoded pickle payloads. The framework's SafeUnpickler relies on an incomplete denylist that can be bypassed, so a crafted pickle stream reaches dangerous reduce logic and executes OS commands on the serving host. Rated CVSS 9.8 with SSVC total technical impact and marked automatable; no public exploit has been confirmed and EPSS is a modest 0.65% (48th percentile), so widespread automated exploitation is not yet evidenced.
Authentication bypass in SolarWinds Web Help Desk (WHD) allows remote unauthenticated attackers to circumvent SAML 2.0 single sign-on and gain access to the application when the SAML 2.0 authentication method is enabled. The flaw (CWE-287, Improper Authentication) is rated CVSS 9.8 with full confidentiality, integrity, and availability impact, meaning a successful bypass yields authenticated-level access to help desk data and administrative functions. No public exploit identified at time of analysis and it is not listed in CISA KEV; the high score reflects the pre-authentication network reachability of the SAML endpoint rather than confirmed in-the-wild activity.
Remote code execution in the Admin and Site Enhancements (ASE) Pro plugin for WordPress (versions up to and including 8.9.0) allows unauthenticated attackers to run arbitrary PHP on the server. The flaw chains three weaknesses in the frontend custom-form save handler - a publicly emitted nonce with no auth check, a CAPTCHA that is bypassed by simply omitting the attacker-supplied key, and unsanitized repeater-row keys from cfgroup[input] that are spliced directly into an eval() call in recursive_html. Reported by Wordfence; with a CVSS of 9.8 and CWE-434, this is a critical, network-exploitable issue, though no public exploit code or CISA KEV listing has been identified at time of analysis.
Arbitrary code execution in Adobe Campaign Classic (ACC) versions 7.4.3 build 9397 and earlier stems from an incorrect authorization flaw (CWE-863) that lets remote attackers run code in the context of the current user without any user interaction. Adobe's PSIRT reported the issue and rates it CVSS 9.8; it is tagged as an authentication-bypass-to-RCE chain. There is no public exploit identified at time of analysis, and it is not on CISA KEV, but SSVC flags the technical impact as total and the attack as automatable.
Remote code execution in LazyOwn RedTeam/APT Framework (grisuno/lazyown) before 0.2.154 allows unauthenticated attackers to run arbitrary OS commands on the C2 server. The lazyc2.py component registers a Socket.IO input event handler with no authentication that passes attacker-supplied data.get('value') through LazyOwnShell.one_cmd into subprocess.call(command, shell=True), yielding full command execution in the C2 process. CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) reflects unauthenticated network-reachable execution; no public exploit identified at time of analysis, though the vulnerable code path and its fix are fully disclosed in the vendor commit.
Command injection in IBM App Connect Enterprise (versions 12.0.1.0-12.0.12.27 and 13.0.1.0-13.0.7.2) lets a remote attacker execute arbitrary OS commands by injecting CRLF characters that break the intended neutralization of command input. Rated CVSS 9.8 (network, no authentication, no user interaction) with total confidentiality, integrity, and availability impact; a vendor patch is available. There is no public exploit identified at time of analysis, and EPSS probability is modest at 0.50% (40th percentile).
Remote code execution in IBM webMethods Integration (on-prem) 10.15 and 10.11 allows an unauthenticated network attacker to run arbitrary code by submitting maliciously crafted serialized data that the platform deserializes without validation (CWE-502). Because the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N with full CIA impact (9.8 Critical), exploitation requires no credentials and no user interaction. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the vendor (IBM) has released a patch, indicating a confirmed, fixable flaw.
Unauthenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.10.1 allows remote attackers to run arbitrary OS commands by injecting shell-control environment variables into the MCP (Model Context Protocol) stdio launcher. The DANGEROUS_ENV_VARS blocklist in src/lfx/src/lfx/base/mcp/util.py omits SHELLOPTS, BASHOPTS, and PS4, letting an attacker abuse Bash's xtrace behavior to execute commands when a stdio-based MCP server subprocess is spawned. Rated CVSS 9.8 with a network, no-privilege, no-interaction vector; a vendor patch is available, but no public exploit code or CISA KEV listing has been identified at the time of analysis.
Default-credential authentication bypass in the LazyOwn RedTeam/APT Framework (grisuno/lazyown) before 0.2.154 lets any network-reachable attacker log into the C2 dashboard using the hardcoded operator credentials 'LazyOwn'/'LazyOwn', gaining full operator-level control of the command-and-control server. The framework ships these defaults in payload.json and core/payload_schema.py and passes them unchanged into lazyc2.py's HTTP Basic authentication. No public exploit identified at time of analysis, but the credentials are trivially known from the source code, and the CVSS base score is 9.8 (Critical).
Remote code execution in SGLang (versions up to and including 0.5.15) allows attackers to run arbitrary code on the inference server by abusing the /update_weights_from_disk endpoint, which falls back to torch.load(..., weights_only=False) and thus deserializes attacker-controlled pickle streams embedded in .bin model-weight files. Because SGLang's HTTP serving API is typically exposed without authentication, an attacker able to reach the endpoint and influence the loaded weights path can achieve code execution as the serving process. This is a CWE-502 deserialization flaw rated CVSS 9.8; a vendor security advisory (GHSA-wf98-gv64-5wrf) and a public technical disclosure exist, though EPSS remains low (0.26%, 18th percentile) and it is not in CISA KEV - no public exploit identified at time of analysis beyond the disclosure write-up.
Authentication bypass in Rocket.Chat's SAML SSO before 8.7.0 (and the 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, 7.10.14 branch fixes) lets a remote unauthenticated attacker log in as any user, including administrators, via an XML Signature Wrapping attack. The parser validated that a signature was cryptographically correct against the trusted IdP certificate but never bound that signature to the samlp:Response/saml:Assertion actually processed, so forged identity attributes wrapped alongside a genuine signature were accepted. There is no public exploit identified at time of analysis, but a HackerOne report and an upstream patch with signature-scope regression tests exist; EPSS/KEV data was not provided.
Remote code execution in SGLang (versions ≤ v0.5.15) allows attackers to achieve arbitrary code execution through the optional dumper subsystem, escaping the intended sandbox when DUMPER_SERVER_PORT is configured. The flaw is code injection (CWE-95) triggered via inference requests, carrying a CVSS 9.8 with SSVC noting proof-of-concept exploit code and automatable exploitation. Currently there is publicly available exploit code exists per the CERT/CC disclosure, though EPSS remains low at 0.17% (7th percentile), and it is not listed in CISA KEV.
Privilege escalation via user impersonation affects Apache JSPWiki through version 2.12.3, where the UserManager component fails to properly validate identity checks, letting attackers assume other users' identities and elevate their privileges. The flaw is classified as an authentication bypass (CWE-290) and carries a CVSS 9.8, though its EPSS score is low (0.16%, 6th percentile) and no public exploit has been identified at time of analysis. A vendor patch is available in version 2.12.4.
SQL injection in the Fruits Bazar PHP/MySQLi ecommerce project 1.0 lets remote attackers inject arbitrary SQL through the product-ID parameter of /show_price_by_pdtId.php, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) allowing unauthenticated exploitation. The flaw carries a 9.8 critical score with full confidentiality, integrity, and availability impact, though its EPSS probability is only 0.15% (5th percentile). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
OS command injection in dnsmgr version 2.15 and earlier lets an attacker execute arbitrary commands through the ping function in CheckUils.php, which passes unsanitized input into a system shell call (CWE-77). SSVC rates the technical impact as total and marks exploitation as proof-of-concept, so publicly available exploit code exists, though it is not on CISA KEV and EPSS is low (0.15%). The published CVSS is 9.8, but note the description characterizes the attacker as 'local' while the CVSS vector encodes AV:N - this discrepancy affects real-world exposure and should be resolved against the target deployment.
SQL injection in CodeAstro Membership Management System 1.0 lets remote attackers inject arbitrary SQL through the membershipType parameter of renew.php, exposing the backend database to read, modification, and potential full compromise. Rated CVSS 9.8 with an unauthenticated network vector, though this is a niche PHP application and there is no public exploit identified at time of analysis. EPSS is very low (0.14%, 4th percentile), indicating little observed exploitation interest despite the high severity.
SQL injection in CodeAstro Membership Management System 1.0 allows remote attackers to manipulate backend database queries through the unsanitized 'id' GET parameter of /print_membership_card.php. Because the endpoint accepts attacker-controlled input directly into a SQL statement, an attacker can extract, alter, or destroy membership records and potentially compromise the entire application database. A public technical write-up documenting the exact injection point exists (TaintRadar research repository), though there is no public exploit identified as weaponized and EPSS remains very low (0.14%, 4th percentile), indicating no observed widespread exploitation.
SQL injection in SourceCodester Tailor Management System 1.0 allows remote attackers to manipulate backend database queries through the unsanitized 'id' parameter of customeredit.php, per the CVSS:3.1 vector (PR:N) without prior authentication. The flaw carries a critical CVSS 9.8 rating with full confidentiality, integrity, and availability impact, enabling database extraction, tampering, or destruction. There is no public exploit code, but a detailed technical write-up documenting the injection point exists, and the EPSS probability is low (0.14%, 4th percentile), indicating limited real-world exploitation interest despite the high severity.
SQL injection in SourceCodester Tailor Management System 1.0 allows remote unauthenticated attackers to manipulate backend database queries through the 'id' parameter of addmeasurement.php. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates trivial network-based exploitation with no authentication, and while rated 9.8 Critical, the EPSS score of 0.14% (4th percentile) reflects low observed exploitation activity. No public exploit code is identified at time of analysis and the flaw is not listed in CISA KEV.
SQL injection in CodeAstro Membership Management System 1.0 lets attackers manipulate the backend database through the unsanitized 'id' parameter of the edit_type.php endpoint (CWE-89). The maximal CVSS 9.8 vector reflects full compromise of confidentiality, integrity, and availability, though the low EPSS score (0.14%, 4th percentile) indicates minimal observed exploitation activity to date. The flaw is documented in public research (TaintRadar) and VulDB, but no public weaponized exploit or active exploitation is confirmed.
SQL injection in CodeAstro Membership Management System 1.0 allows attackers to manipulate backend database queries through the unsanitized 'id' parameter of /edit_member.php, enabling extraction or modification of member records and potentially full database compromise. The flaw is a classic CWE-89 error where user-supplied input is concatenated directly into a SQL statement. Publicly available exploit code exists in a documented writeup, though the vulnerability carries a low EPSS probability (0.14%) and is not in CISA KEV, indicating no confirmed active exploitation.
SQL injection in CodeAstro Membership Management System 1.0 lets remote attackers manipulate backend database queries through the unsanitized fromDate parameter in report.php and revenue_report.php. With no public exploit identified at time of analysis and a very low EPSS score (0.14%), the flaw carries a maximal CVSS 9.8 but appears to affect a niche PHP application; authentication requirements not confirmed beyond the PR:N stated in the CVSS vector, which indicates unauthenticated access. Successful exploitation permits full read/write access to membership and financial data.
SQL injection in CodeAstro Membership Management System 1.0 allows remote attackers to manipulate backend database queries through the unsanitized 'id' parameter of /delete_members.php. Per the supplied CVSS 3.1 vector (PR:N), no authentication is required, giving attackers full read/write/delete access to the underlying database. There is no public exploit identified at time of analysis, though a TaintRadar research write-up documenting the flaw is referenced; the EPSS score is low (0.14%, 4th percentile) and the CVE is not listed in CISA KEV.
SQL injection in CodeAstro Membership Management System 1.0 allows remote unauthenticated attackers to inject arbitrary SQL through the 'id' parameter of /delete_membership.php, enabling full database compromise. The flaw carries a CVSS 9.8 rating with SSVC noting a public proof-of-concept and 'total' technical impact, though publicly available exploit code exists rather than confirmed active exploitation. Despite the critical severity, EPSS estimates only a 0.14% exploitation probability (4th percentile), reflecting the product's niche footprint.
SQL injection in CodeAstro Membership Management System 1.0 lets remote unauthenticated attackers manipulate backend database queries through the 'id' parameter of /memberProfile.php, enabling extraction or modification of member records and potential full database compromise. The flaw is trivially reachable over the network (CVSS 9.8, AV:N/AC:L/PR:N/UI:N) and a public technical writeup exists in the TaintRadar research repository, though it is not listed in CISA KEV. EPSS is low at 0.14% (4th percentile), indicating no observed mass exploitation to date despite the maximal severity score.
SQL injection in UMAI Vision Traffic Analysis System (versions 29/30 up to but not including 34) lets remote unauthenticated attackers inject arbitrary SQL commands through unsanitized input, enabling full database compromise. Rated CVSS 9.8 with a network, no-privilege, no-interaction vector, the flaw was reported by Turkey's national CERT (TR-CERT) and has a vendor patch available. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Heap-based buffer overflow in schreibfaul1's ESP32-audioI2S library version 3.4.5 lets an attacker who controls audio stream metadata corrupt heap memory through the latinToUTF8() character-encoding routine, with SSVC rating the technical impact as total (potential code execution, information disclosure, DoS or privilege escalation). The flaw is demonstrated by publicly available exploit code but is not listed in CISA KEV, so it reflects a POC-stage issue rather than confirmed active exploitation. The library is a widely-used hobbyist Arduino/ESP32 audio component, so exposure is concentrated in embedded maker and IoT projects rather than enterprise fleets.
Use-after-free memory corruption in SQLite 3.41's JSON extension (json.c, jsonCacheInsert) can be triggered when an application processes attacker-influenced JSON through SQLite's JSON1 functions, potentially leading to a crash (denial of service) or, if the freed heap object is reclaimed and controlled, memory disclosure or code execution in the host process. Because SQLite is an embedded library, real-world reach depends on whether the front-end application exposes JSON functions to untrusted input. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as 'none' - the 9.8 rating appears heavily influenced by an assumed network vector rather than demonstrated remote exploitability.
Sandbox escape in Google Chrome for Android before 151.0.7922.72 lets an attacker who has already compromised the renderer process break out of the browser sandbox by feeding crafted untrusted input to the Web Authentication (WebAuthn) component. Rated High severity by Chromium and scored CVSS 9.6, it is a second-stage bug chained after an initial renderer exploit rather than a standalone remote compromise. No public exploit identified at time of analysis, and EPSS exploitation probability is low at 0.34% (27th percentile).
Sandbox escape in Google Chrome's ANGLE graphics layer prior to version 151.0.7922.72 lets a remote attacker who lures a victim to a crafted HTML page trigger a type confusion (CWE-843) and potentially break out of the renderer sandbox. Google rates the Chromium severity High, and the CVSS 9.6 reflects a scope-changing bug requiring only that the victim open a page. There is no public exploit identified at time of analysis, EPSS is low at 0.31% (24th percentile), and CISA's SSVC marks exploitation as none.
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox using a crafted HTML page. Rated High by Chromium and CVSS 9.6, the flaw is a CWE-843 type confusion; Google has shipped a fixed Stable channel build. There is no public exploit identified and no CISA KEV listing, and EPSS is low at 0.31% (24th percentile), indicating no evidence of active exploitation at time of analysis.
Sandbox escape in Google Chrome on ChromeOS (versions prior to 151.0.7922.72) stems from a heap buffer overflow in the Color component, allowing a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page. Chromium rates the severity High and the CVSS score is 9.6 owing to the scope change into the host OS. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.31% (24th percentile), consistent with a second-stage bug that requires a prior renderer compromise.
Sandbox escape in Google Chrome desktop before 151.0.7922.72 stems from a use-after-free in the Ozone platform abstraction layer, letting a remote attacker who lures a victim to a crafted HTML page break out of the renderer sandbox and gain broader host access. Rated Critical by Chromium with CVSS 9.6 and a scope-changed vector, though exploitation currently shows as none in CISA SSVC and EPSS is low (0.31%). Vendor patch is available; no public exploit or KEV listing has been identified at time of analysis.
Sandbox escape in Google Chrome's ANGLE graphics layer, fixed in stable release 151.0.7922.72, lets a remote attacker who lures a victim to a crafted HTML page break out of the renderer sandbox and gain broader access on the host. Rated Critical by Chromium and scored CVSS 9.6, the flaw stems from insufficient validation of untrusted input (CWE-20) processed by ANGLE and carries a scope-changing impact. There is no public exploit identified at time of analysis and EPSS is low at 0.31% (23rd percentile), but the Critical rating and sandbox-escape primitive make prompt patching important.
Sandbox escape in Google Chrome's Views UI framework (versions prior to 151.0.7922.72) lets a remote attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page. Google rates the Chromium severity Critical (CVSS 9.6), and while a patch is available on the Stable channel, there is no public exploit identified at time of analysis and EPSS estimates exploitation probability at just 0.31%. Exploitation depends on chaining a prior renderer compromise, so this is one link in a full exploit chain rather than a standalone remote-code-execution bug.
Sandbox escape in Google Chrome for Android before 151.0.7922.72 stems from insufficient input validation in Dawn, Chromium's WebGPU implementation, and allows a remote attacker who lures a victim to a crafted HTML page to potentially break out of the renderer/GPU-process sandbox (CVSS 9.6, scope-changed). There is no public exploit identified at time of analysis and the flaw is not in CISA KEV; EPSS is low at 0.31% (23rd percentile), consistent with SSVC rating exploitation as 'none' despite a 'total' technical impact. Chrome rates the underlying Chromium bug as Critical.
Sandbox escape in Google Chrome's ANGLE graphics layer affects all desktop builds prior to 151.0.7922.72, where an integer overflow can be triggered by a crafted HTML page to potentially break out of the renderer sandbox. Reported internally by the Chrome team and rated High by Chromium, with a vendor patch already shipped in the stable channel; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.29%, 21st percentile). Because sandbox escapes in ANGLE are typically chained with a renderer bug, this is a high-value component of a full-chain browser exploit rather than a standalone remote code execution.
Sandbox escape in Google Chrome for Android before 151.0.7922.72 lets an attacker who already controls a compromised renderer process break out of the sandbox through crafted input handled by the browser's Accessibility component. Rated High by Chromium and CVSS 9.6, it is a second-stage bug typically chained after an initial renderer exploit, giving an attacker a path to full compromise of the browser/host context. There is no public exploit identified at time of analysis, EPSS risk is low (0.29%, 21st percentile), and it is not on CISA KEV.