Improper input validation in the Powerful Surveys contributed module for Drupal exposes all published versions to confidentiality and integrity compromise under a constrained set of conditions requiring high privileges and user interaction. The flaw, classified under CWE-20, allows a high-privileged authenticated attacker - under high-complexity conditions with mandatory user interaction - to bypass input validation controls and potentially disclose or manipulate survey data. No public exploit exists and EPSS stands at 0.14% (4th percentile), indicating negligible observed exploitation pressure despite the High C and I impact ratings.
SQL injection in SililaWijesinghe's PHP-based Food Ordering System allows unauthenticated remote attackers to manipulate the search_box parameter in /search.php, causing the backend database to execute attacker-controlled SQL queries. A public proof-of-concept exploit has been disclosed via GitHub, and the vendor did not respond to coordinated disclosure, leaving no official patch available. The CVSS 4.0 vector confirms low-complexity, no-authentication remote exploitability with a confirmed proof-of-concept modifier (E:P).
SQL injection in code-projects Simple Inventory System 1.0 exposes the /InventoryManagement/edit.php endpoint to unauthenticated remote exploitation via the unsanitized ID parameter. An attacker with network access can inject arbitrary SQL into backend database queries, enabling unauthorized extraction and modification of all inventory records. Publicly available exploit code exists (CVSS 4.0 E:P), though no CISA KEV listing has been issued, suggesting opportunistic rather than targeted active exploitation at this time.
Heap buffer overflow in PyOpenEXR Python bindings versions 3.3.0-3.3.12 and 3.4.0-3.4.13 causes memory corruption and process crash when opening a crafted deep scanline EXR file. A specific channel naming collision - a literal channel 'left' coexisting with layer-prefixed 'left.R', 'left.G', 'left.B' - causes the wrapper to allocate scalar-shaped deep sample storage and then write into it at RGB stride (three lanes), overflowing the heap allocation. No public exploit or CISA KEV listing exists at time of analysis; vendor-confirmed fixes are available in versions 3.3.13 and 3.4.14.
Heap out-of-bounds read in OpenEXR's RLE decompression path crashes the decoding process on ILP32 (32-bit) builds across versions 3.2.0-3.2.10, 3.3.0-3.3.12, and 3.4.0-3.4.13. A crafted .exr file with a malicious RLE-compressed payload causes the 64-bit unpacked size to truncate before buffer allocation in OpenEXRCore decoding.c, after which unpack_32bit() reads past the allocated buffer boundary, resulting in denial of service. Exploitation requires a victim or automated pipeline to open the malicious file; no public exploit identified at time of analysis, and the vulnerability is constrained to ILP32 build environments.
Out-of-bounds write in OpenEXR's B44 decompression path on ILP32 (32-bit) builds allows an attacker to corrupt heap memory and crash any application that opens a crafted EXR file, affecting the C++ libraries, CLI tools, and PyOpenEXR bindings across versions 3.1.0-3.2.10, 3.3.0-3.3.12, and 3.4.0-3.4.13. When a malformed B44-compressed scanline image triggers integer truncation in the scratch buffer size calculation before allocation, uncompress_b44_impl() subsequently writes using the full attacker-controlled channel width into the undersized buffer, producing a heap out-of-bounds write. Patches are confirmed available in 3.2.11, 3.3.13, and 3.4.14; no public exploit is identified at time of analysis.
Out-of-bounds read in OpenEXR's ILP32 builds enables denial of service via crafted uncompressed deep-tile EXR files across three active release branches (before 3.2.11, 3.3.0-3.3.12, and 3.4.0-3.4.13). The root cause is a 32-bit integer overflow in OpenEXRCore's sample-count table size calculation that causes unpack_sample_table() to iterate beyond an undersized allocation. No public exploit or active exploitation has been identified; vendor-released patches are available for all three affected branches.
Crash-inducing out-of-bounds read in OpenEXR's multipart file processing allows an attacker to cause a denial of service by supplying a crafted EXR file with an empty multiView header attribute. Affected are OpenEXR releases before 3.2.11, within the 3.3.x branch before 3.3.13, and within the 3.4.x branch before 3.4.14 - all maintained by the Academy Software Foundation. Exploitation requires user interaction to open the malicious file, limiting impact to availability only; no public exploit code or active exploitation has been identified at time of analysis.
Integer overflow in OpenEXR's deep tiled image decoder crashes any application that opens a crafted EXR file, affecting versions 3.1.0 through 3.4.13 across all three maintained release branches. The overflow occurs in OpenEXRCore's unpack_sample_table() function during the standard exr_decoding_run path, meaning no non-default configuration is required - only that the file uses the deep tiled variant of the format. Impact is denial of service via crash (no code execution demonstrated); no public exploit code exists and this vulnerability is not listed in CISA KEV.
Out-of-bounds read in Adobe Substance 3D Painter exposes sensitive process memory when a victim opens a specially crafted malicious file. The flaw, classified as CWE-125, causes the application to read beyond allocated buffer boundaries during file parsing, potentially leaking in-memory data such as credentials or session tokens accessible to the attacker. Adobe has published security advisory APSB26-129 addressing the issue; no public exploit code has been identified at time of analysis.
Out-of-bounds read in Adobe Illustrator Desktop 2025 and 2026 exposes sensitive process memory to disclosure when a victim opens a specially crafted file. The vulnerability carries a CVSS 3.1 score of 5.5 (Medium) with a local attack vector and required user interaction, limiting opportunistic exploitation but making it viable in targeted social-engineering campaigns. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Arbitrary file system read in Adobe's Content Credentials (C2PA Tool and Content Credentials Rust SDK) exposes sensitive files and directories outside the intended access scope through improper input validation during file parsing. The attack requires a victim to open a malicious file crafted by the attacker, making this a local, user-interaction-dependent vulnerability with high confidentiality impact but no integrity or availability consequence. No public exploit code exists and this CVE is not listed in the CISA KEV catalog at time of analysis.
Substance3D - Designer crashes on availability when a victim opens a specially crafted malicious file, triggering a NULL Pointer Dereference that terminates the application. Adobe Substance 3D Designer users across all tracked versions (CPE wildcard) are affected, with impact limited to application-level denial of service - no code execution, data disclosure, or integrity compromise is possible. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, consistent with its low exploitability ceiling (requires local victim interaction).
Information disclosure in Google Chrome's Mobile component on iOS (all versions prior to 152.0.7977.65) allows a local attacker to read sensitive information by inducing the user to open a crafted file. Exploitation requires physical or logical local access to the device and user interaction, limiting the practical attack surface significantly. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none with only partial technical impact.
Cross-origin data leakage through the CustomTabs component in Google Chrome for Android (versions prior to 152.0.7977.65) enables a local attacker to extract sensitive browsing data belonging to other origins via a co-installed application. The flaw is classified CWE-200 and carries a CVSS Medium score of 5.5, reflecting meaningful confidentiality impact constrained by a local-only attack vector and required user interaction. No public exploit code or active exploitation via CISA KEV has been identified; the vendor-released patch is available in Chrome 152.0.7977.65.
Sensitive information disclosure in NVIDIA NemoClaw arises from process invocation that exposes secrets - such as API keys or authentication tokens - through visible command-line arguments or environment variables, observable by other local users via standard tools like `ps`. All versions are affected per the wildcard CPE (`cpe:2.3:a:nvidia:nemoclaw:*:*:*:*:*:*:*:*`), and exploitation requires only a low-privileged local account on the same system. No active exploitation has been confirmed (not in CISA KEV), and no public proof-of-concept exploit code has been identified at time of analysis.
Buffer overflow in Apple macOS allows a locally-running app with standard user privileges to cause unexpected system termination or write arbitrary data into kernel memory. Affected versions include macOS Sequoia before 15.7.7 and macOS Sonoma before 14.8.7. No public exploit code or active exploitation has been identified at time of analysis; EPSS sits at 0.11% (1st percentile), consistent with SSVC's assessment of no current exploitation.
Out-of-bounds read in the Zephyr ext2 filesystem driver crashes any device that mounts a crafted ext2 image. The superblock fields s_blocks_count and s_first_data_block are consumed verbatim without being bounded against the single-group bitmap capacity, allowing a malicious image to drive ext2_bitmap_count_set() roughly 512 MB past the allocated bitmap block. The resulting memory access crosses an unmapped or MPU-protected region and faults, producing a denial-of-service crash. No public exploit exists and the vulnerability is not in CISA KEV; real-world risk is bounded by the requirement to supply untrusted ext2 media to a target device.
Null pointer dereference in iOS and iPadOS allows a locally installed app to trigger unexpected system termination (device crash/reboot) by supplying crafted input that bypasses input validation. Affected versions span the legacy 18.x branch (prior to 18.7.9) and the current 26.x branch (prior to 26.5), covering a broad swath of Apple mobile devices. No active exploitation has been identified - CISA KEV status is absent, SSVC rates exploitation as none, and EPSS sits at the 1st percentile - placing this squarely as a patch-cycle priority rather than an emergency response item.
Incorrect authorization in the Downloads component of Google Chrome prior to version 152.0.7977.65 enables remote attackers to bypass system-level file access restrictions through a crafted HTML page delivered via social engineering. The flaw (CWE-863) requires user interaction to trigger, limiting opportunistic mass exploitation; however, Chrome's ubiquitous install base makes even low-probability attack paths operationally significant. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS sits low at 0.32% (24th percentile).
UI misrepresentation in Google Chrome's Linux Toolkit Theming component enables remote attackers to bypass system access restrictions through a crafted HTML page, relying on social engineering to complete the attack. All Chrome versions prior to 152.0.7977.65 on Linux are affected; Google shipped the fix in stable channel release 152.0.7977.65. No active exploitation has been confirmed (absent from CISA KEV), and an EPSS of 0.30% at the 23rd percentile reflects low automated exploitation probability.
Stored cross-site scripting in GazellePW's torrent remaster custom title feature allows authenticated tracker members to inject persistent JavaScript that executes in every subsequent visitor's browser. The unsanitized `remaster_custom_title` parameter is written to the database through both upload and edit code paths (Upload.php, takeedit.php, torrents.class.php) and rendered without encoding, with CVSS Scope Changed confirming cross-user impact. A publicly referenced blog post at snaacky.com describes a 1-click exploit chain leveraging this flaw for complete GazellePW database compromise, meaningfully elevating the practical risk above the base CVSS 5.4 score. No public exploit has been confirmed by CISA KEV, and EPSS sits at 0.30% (22nd percentile), consistent with a niche deployment target.
Broken access control in GazellePW's IP lock manager allows any authenticated user to add, modify, or delete IP lock entries for arbitrary accounts via tools.php?action=iplock, bypassing per-account authorization checks. A public write-up at snaacky.com describes this flaw as part of a 1-click exploit chain enabling complete GazellePW database compromise, substantially elevating its effective impact beyond the standalone CVSS 5.4 score. No CISA KEV listing exists, but the public chain write-up makes this an urgent remediation priority for any GazellePW operator.
Stored XSS in GazellePW (GazellePosterWall) allows authenticated low-privilege users to inject persistent JavaScript via a crafted subtitle filename, which is stored during upload and rendered unsanitized in the subtitle deletion page. A public exploit writeup (snaacky.com) documents a 1-click chain leveraging this flaw to achieve complete GazellePW database compromise, substantially elevating the practical impact beyond the CVSS 5.4 Medium base score. No public exploit confirmation via CISA KEV exists, but the availability of a detailed public exploit chain warrants prioritized remediation on any instance where untrusted authenticated users can upload subtitles.
Stored cross-site scripting in GazellePW's custom bonus title feature allows authenticated users with low privileges to inject persistent JavaScript payloads that execute in the browsers of other users - including administrators - who view bonus management pages. Affected is a specific commit (86c4bedf) of the GazellePosterWall PHP application. A public exploit writeup at snaacky.com describes a 1-click chain leveraging this and related issues to achieve complete database compromise, significantly elevating real-world impact beyond the base CVSS score of 5.4. No public KEV listing; EPSS is low at 0.29%, but the published exploit chain warrants elevated attention for any operator of this software.
Stored XSS in GazellePW (GazellePosterWall) commit 86c4bedf allows low-privileged authenticated users to inject arbitrary JavaScript through the avatar_mouse_over_text parameter in the donor feature, with the payload persisting in storage and executing in victims' browsers when they hover over the attacker's avatar tooltip. CVSS 5.4 (Scope: Changed) reflects cross-user impact, meaning the stored payload can target administrators or other members of the tracker platform. A public exploit chain writeup at snaacky.com describes a 1-click exploit leveraging GazellePW vulnerabilities to achieve complete database compromise, elevating the practical severity beyond the base CVSS score alone.
SQL injection in GazellePW's tags manager endpoint allows remote authenticated users holding moderator-level (users_mod) privileges to execute arbitrary SQL commands against the underlying database. The vulnerability resides in the tagid and type parameters passed via POST to tools.php?action=manage_tags at a specific commit (86c4bedf). A publicly documented exploit chain exists at snaacky.com that claims full database compromise, suggesting the official CVSS impact metrics (C:L/I:L) materially understate real-world severity. No public KEV listing; EPSS is low at 0.28% (20th percentile), consistent with the privilege barrier limiting opportunistic exploitation.
CustomTabs UI spoofing in Google Chrome for Android (prior to 152.0.7977.65) allows a remote attacker using social engineering to misrepresent browser UI elements through a crafted HTML page, enabling phishing-grade deception of users who believe they are interacting with a trusted interface. The flaw is classified under CWE-451 (UI Misrepresentation of Critical Information) and is limited to the Android platform's CustomTabs feature. No active exploitation is confirmed via CISA KEV, and EPSS sits at 0.22% (13th percentile), indicating negligible current exploitation activity.
UI misrepresentation in Chrome's WebAppInstalls component allows remote attackers to spoof browser UI elements by serving a crafted HTML page to a user who visits it. All Chrome releases prior to 152.0.7977.65 are affected across desktop platforms. Exploitation requires user interaction (visiting a malicious page) but no authentication, and could be used to deceive users into believing they are interacting with a trusted installation prompt - for example, tricking a user into approving a Progressive Web App install from an attacker-controlled origin. No public exploit code has been identified and EPSS is low (0.22%, 13th percentile), placing this firmly in the 'patch on schedule' tier rather than emergency response.
UI misrepresentation in Google Chrome prior to 152.0.7977.65 enables remote attackers to spoof browser interface elements via a crafted HTML page, potentially deceiving users about the identity or security state of a site they are visiting. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) confirms network delivery with no attacker authentication required, though user interaction is a hard prerequisite. No public exploit code and no active exploitation have been identified; the EPSS score of 0.22% at the 13th percentile reflects very low near-term exploitation probability.
UI spoofing in Google Chrome on macOS prior to version 152.0.7977.65 enables a remote attacker to misrepresent input UI elements by serving a crafted HTML page, classified under CWE-451 (UI Misrepresentation of Critical Information). Victims who visit the malicious page may be deceived by falsified browser UI elements - such as address bar content, form fields, or security indicators - potentially leading to credential theft or other social engineering outcomes. No active exploitation is confirmed (not in CISA KEV), and EPSS is very low at 0.22%; a vendor patch is available at 152.0.7977.65.
Address bar spoofing in Google Chrome prior to version 152.0.7977.65 enables remote attackers to deceive users about the true origin of a page they are visiting via a crafted HTML page, exploiting CWE-451 (UI Misrepresentation of Critical Information) in the browser's navigation subsystem. The practical impact is phishing amplification: a victim visiting the attacker's page may see a trusted domain displayed in the address bar and submit credentials or sensitive information to an attacker-controlled site. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS at 0.22% (13th percentile) confirms low automated exploitation probability, though the social-engineering utility of address bar spoofing makes targeted abuse plausible.
UI misrepresentation in Google Chrome's Geometry rendering component allows remote attackers to spoof browser interface elements by delivering a crafted HTML page to an unaware user. Versions prior to 152.0.7977.65 are affected across all desktop platforms where Chrome is installed. With CVSS 5.4, a low EPSS of 0.17% (7th percentile), and no CISA KEV listing, this is a moderate-severity phishing and social-engineering amplifier rather than a code-execution vector - but Chrome's near-ubiquitous deployment means the aggregate exposure is broad.
Stored XSS in Drupal Core allows authenticated low-privileged users to inject persistent malicious scripts that execute in the browsers of other site visitors, including administrators. The vulnerability spans multiple Drupal release trains - 10.x through 10.6.x, and all 11.0.*, 11.1.*, and 11.2.* branches - and is addressed in patched releases 10.6.13, 11.3.14, and 11.4.4 per the vendor advisory SA-core-2026-012. No public exploit code has been identified at time of analysis, and CISA SSVC classifies exploitation as none with non-automatable attack paths, placing this at moderate real-world priority despite scope change in the CVSS vector.
Missing HttpOnly cookie flags in HCL Hive expose session tokens and sensitive credentials to client-side script access, enabling session hijacking when combined with cross-site scripting. The CVE description cites broader infrastructure weaknesses - lateral movement, container breakout, and internal communications exposure - suggesting CWE-1004 is one root cause within a cluster of related configuration flaws. No public exploit has been identified at time of analysis, and no KEV listing exists, but the network-accessible attack surface with no privilege requirement (beyond user interaction) makes this relevant for any internet-exposed Hive deployment.
Missing authorization in the WebAppInstalls component of Google Chrome for Android (prior to 152.0.7977.65) enables an attacker who has already achieved renderer process compromise to extract sensitive information by issuing crafted IPC requests that bypass browser-process authorization checks. This is a chained exploit primitive rather than a standalone attack - it elevates a pre-existing renderer compromise into an unauthorized data disclosure. No active exploitation has been confirmed (absent from CISA KEV), and the EPSS score of 0.38% at the 30th percentile reflects the high practical barrier imposed by the required renderer prerequisite.
CPU exhaustion in libsoup's HTTP Range header processing affects any SoupServer deployment carrying the CVE-2025-32907 fix but not MR !550. Supplying a Range header with approximately 25,000 repeated satisfiable byte ranges triggers an O(N²) coalescing loop - each g_array_remove_index() call induces an O(N) memmove on GArray - blocking the server's event loop for roughly 90 ms per request from a single unauthenticated client. The description explicitly rules out memory corruption and information disclosure; this is a pure availability issue with no public exploit identified at time of analysis.
Authorization bypass in the Events Manager WordPress plugin (versions up to and including 7.4.0) exposes restricted event metadata to unauthenticated remote attackers. The plugin fails to verify user authorization before returning event and location data, allowing any internet user to retrieve titles, dates, descriptions, and location details that administrators have explicitly restricted as draft, pending, trashed, or private. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog; a patched version (7.4.1) is confirmed available via the WordPress plugin repository changeset.
Observable discrepancy (CWE-203) in Google Chrome's network stack prior to version 152.0.7977.65 enables remote attackers to extract sensitive information by exploiting behavioral differences observable from a crafted HTML page. Exploitation requires high attack complexity and user interaction - the victim must visit a malicious page - constraining real-world impact despite the high confidentiality rating in the CVSS vector. No public exploit code exists and no active exploitation has been reported; Google has released a patch in Chrome 152.0.7977.65.
Observable discrepancy in Chrome's Autofill subsystem allows remote information disclosure via a crafted HTML page, affecting all desktop Chrome versions before 152.0.7977.65. The flaw (CWE-203) enables a network-reachable attacker to infer sensitive stored autofill data - such as addresses or payment fields - by measuring behavioral or timing differences triggered by form elements on a malicious page. Google has issued a patch in stable channel version 152.0.7977.65; no public exploit code exists and no CISA KEV listing has been recorded at time of analysis.
Denial of service in GOVCERT-LU's eml_parser Python library (versions prior to 3.0.2) allows a network-reachable attacker to abort SOC pipeline email parsing by submitting a crafted EML file containing deeply nested CFWS (Comment/Folding White Space) constructs in address-bearing headers such as To, From, Cc, or Bcc. The RecursionError raised internally by Python's email.utils.getaddresses() propagates uncaught through eml_parser, halting analysis of the entire message rather than just the offending header. No public exploit or active exploitation has been identified at time of analysis; the vendor notes partial mitigation because callers already need to handle exceptions from other pathological EML inputs.
WebProtect race condition in Google Chrome prior to 152.0.7977.65 exposes sensitive information to attackers who have already achieved renderer process compromise. The flaw (CWE-367 TOCTOU) enables a second-stage information disclosure step within a broader browser exploitation chain, requiring a victim to interact with a crafted HTML page. No public exploit code has been identified and EPSS sits at 0.29% (22nd percentile), indicating limited real-world exploitation pressure at this time; a vendor patch is available.
Authentication bypass in liketrek TREK up to v3.0.22 allows a remote attacker with valid credentials to circumvent two-factor authentication by manipulating the mfa_token parameter in the Pre-2FA handler of the loginUser function (authService.ts). The CVSS 4.0 vector (PR:L) confirms low-privilege credentials are a prerequisite, meaning the bypass targets users who have valid username/password combinations but should still be blocked by a second factor. The vendor's own release notes for v3.1.0 describe this as a 'critical authentication bypass' - one of 18 privately reported security issues - and strongly recommend immediate upgrade for all self-hosted instances. No public exploit code or CISA KEV listing has been identified at time of analysis.
Bluetooth information disclosure in Google Chrome on macOS (versions prior to 152.0.7977.65) enables a remote attacker - who has already compromised the renderer process - to extract sensitive Bluetooth-related information by combining a crafted HTML page with social engineering. This is a chained, multi-prerequisite vulnerability: successful exploitation requires a prior renderer compromise and active victim interaction, which the CVSS AC:H rating reflects. No public exploit code exists and no active exploitation has been observed (SSVC: Exploitation none; EPSS 0.29%), placing real-world risk substantially below what the C:H confidentiality impact alone might suggest. A vendor patch is available in Chrome 152.0.7977.65.
Authorization bypass in the My Agile Privacy® CMP, Cookie Consent & Privacy Tools WordPress plugin (all versions through 3.3.6) allows unauthenticated remote attackers to overwrite plugin settings controlling cookie shield activation, consent mode JavaScript behavior, and error handling configuration. The root cause is a missing authorization check (CWE-862) on plugin action handlers, confirmed by Wordfence with source-code references pointing to three distinct vulnerable functions in the frontend class. No public exploit code or CISA KEV listing is associated with this CVE at time of analysis, though the low-complexity, zero-authentication attack surface makes opportunistic abuse realistic at scale.
Sensor API information disclosure in Google Chrome before 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to read sensitive device sensor data by loading a crafted HTML page. The flaw (CWE-862, Missing Authorization) does not provide initial access on its own - it is a post-exploitation primitive that extends the capability of a pre-existing renderer compromise. No public exploit code has been identified at time of analysis, and EPSS stands at 0.26% (17th percentile), reflecting low current exploitation probability.
Cross-site scripting with CSP bypass in Adminer before 5.4.3 enables arbitrary JavaScript execution in the browser of any user who connects to an attacker-controlled MySQL server. The vulnerability stems from unsanitized MySQL server version strings being injected directly into script tags that carry valid Content Security Policy nonces, effectively nullifying CSP protections. No public exploit code or CISA KEV entry has been identified at time of analysis, but the attack is meaningful against administrators and developers who routinely connect Adminer instances to external or third-party MySQL servers.
Arbitrary file write in Adminer 5.3.0-5.4.2 allows any authenticated user to write attacker-controlled content to arbitrary writable filesystem paths via path traversal in the ns parameter of the sql-log plugin. The written files are constrained to a .sql extension, which limits but does not eliminate the integrity impact - an attacker can overwrite existing .sql files, pollute backup directories, or write large files to fill disk. No public exploit code or CISA KEV listing has been identified at time of analysis, and the attack surface is narrowed by both the authentication requirement and the non-default plugin dependency.
Item duplication and protected-item extraction in the MintyItanium Lost-Auction Minecraft auction plugin (all versions prior to commit 88c920b05042929db334ba06d57f052b42d6b3f8) allows authenticated players to manipulate GUI interactions to obtain barrier blocks or duplicate items from the auction interface. The root cause is improper control flow in the GUI handling logic (CWE-670), enabling players to bypass intended item restrictions without elevated permissions. No public exploit code has been identified at time of analysis, and the vulnerability is confined to Minecraft server game integrity rather than infrastructure security.
Incomplete cleanup in Chrome's GetUserMedia API exposes sensitive information to remote attackers who have already compromised the renderer process. Affected versions are all Chrome releases prior to 152.0.7977.65 on desktop platforms. An attacker with an established renderer foothold and the ability to socially engineer a user into visiting a crafted HTML page can exploit this residual-data flaw to extract sensitive media or stream-related information - an information-disclosure step that may support privilege escalation or lateral movement within a broader attack chain. No public exploit code has been identified and EPSS sits at 0.23%, reflecting the high prerequisite bar.