Improper input validation in Google Chrome's Safebrowsing component prior to version 152.0.7977.65 allows remote attackers to bypass system access restrictions via a crafted file. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms the attack is network-reachable without authentication but requires user interaction, constraining opportunistic or automated exploitation at scale. EPSS at 0.22% (12th percentile) and absence from CISA KEV indicate low real-world exploitation probability at time of analysis; no public exploit code has been identified.
Safebrowsing in Google Chrome prior to 152.0.7977.65 fails to properly validate input from crafted files, permitting remote attackers to bypass system access restrictions that the component is designed to enforce. The attack requires user interaction - specifically opening a crafted file - and results in limited integrity impact with no confidentiality or availability compromise. No public exploit code or CISA KEV listing has been identified; EPSS exploitation probability is very low at 0.22% (12th percentile), consistent with the Chromium team's Medium severity classification.
Web origin policy bypass in Google Chrome's Variations component (the Finch A/B testing and feature-flag delivery system) affects all Chrome versions prior to 152.0.7977.65. A remote attacker can deliver crafted network traffic to a user running a vulnerable browser version, potentially circumventing same-origin protections and reading cross-origin data. No public exploit code or CISA KEV listing exists at time of analysis; EPSS at 0.22% (12th percentile) signals low current exploitation activity.
UI spoofing in Google Chrome prior to 152.0.7977.65 allows unauthenticated remote attackers to misrepresent browser interface elements through a crafted HTML page, requiring only that a user visit the malicious content. Classified as CWE-451 (UI Misrepresentation of Critical Information), the flaw breaks the trust contract between the browser and user by rendering deceptive interface states - a classic phishing-enabler primitive. No public exploit code has been identified and EPSS stands at 0.22% (12th percentile), consistent with Chromium's own Low severity rating; real-world exploitation impact is constrained by its dependence on social engineering and user interaction.
Incorrect USB authorization in Google Chrome prior to 152.0.7977.65 allows a remote attacker to bypass system USB access restrictions by socially engineering a user into visiting a crafted HTML page. The flaw (CWE-863) in Chrome's USB subsystem grants unauthorized access without proper permission verification, resulting in a limited integrity impact with no confidentiality or availability consequences. No public exploit code exists and EPSS is very low at 0.21% (11th percentile), consistent with Chromium's own Medium severity rating; a vendor patch has been released.
Incorrect authorization in Google Chrome's Extensions subsystem (versions prior to 152.0.7977.65) permits a remote attacker to bypass system access restrictions through a crafted Chrome extension delivered via social engineering. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms mandatory user interaction limits opportunistic exploitation, and impact is constrained to integrity with no confidentiality or availability consequence. No public exploit code or CISA KEV listing has been identified; EPSS at 0.21% (11th percentile) reflects low current exploitation probability consistent with the social-engineering dependency.
UI spoofing in Google Chrome on macOS prior to 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to forge browser UI elements via a crafted HTML page, potentially deceiving users into believing they are interacting with a trusted interface. The vulnerability is macOS-specific and requires renderer process compromise as an explicit prerequisite, significantly limiting its standalone exploitability. No public exploit code or active exploitation (CISA KEV) has been identified; an EPSS score of 0.21% (11th percentile) reflects negligible likelihood of independent exploitation.
Race condition in Google Chrome for Android's WebAppInstalls component allows a remote attacker, through social engineering, to bypass web origin policy by exploiting a co-installed application on the same device. All Chrome for Android versions prior to 152.0.7977.65 are affected. The impact is limited to a partial confidentiality breach via cross-origin data access; no integrity or availability impact has been identified. No public exploit code exists and EPSS probability sits at 0.20% (10th percentile), indicating very low near-term exploitation likelihood despite Chromium's internal 'High' severity rating.
Incorrect reference resolution in the CustomTabs component of Google Chrome for Android (all versions prior to 152.0.7977.65) allows a remote, unauthenticated attacker to bypass Android system access restrictions by delivering a crafted HTML page. The integrity impact is limited (I:L, S:U) with no confidentiality or availability consequence. No public exploit code exists and exploitation status is confirmed as none by SSVC assessment, placing this squarely in standard patch-cycle priority rather than emergency response.
Incorrect reference resolution in the WebView component of Google Chrome on Android (versions prior to 152.0.7977.65) enables a remote attacker to potentially bypass the web origin policy by delivering a crafted HTML page. The flaw carries a Chromium-internal severity of Low, consistent with the limited confidentiality-only impact (C:L/I:N/A:N) reflected in the CVSS 4.3 score. No public exploit has been identified at time of analysis, and the EPSS score of 0.20% (10th percentile) confirms negligible current exploitation probability.
Web origin policy bypass in Google Chrome's cache component affects all versions prior to 152.0.7977.65, exploitable by a remote unauthenticated attacker who tricks a user into visiting a crafted HTML page. The incorrect reference resolution (CWE-706) in the cache layer allows cross-origin data to be read, constituting a Same-Origin Policy bypass with limited confidentiality impact. No active exploitation is confirmed and EPSS sits at 0.20% (10th percentile), indicating low real-world exploitation pressure at this time.
Broken access control in GazellePW's API user endpoint permits any authenticated user holding a standard API token to enable or disable arbitrary user accounts - including administrator accounts - via the req=disable or req=enable action parameters. Affected is GazellePW at commit 86c4bedf727691b5a97af42a4864869d18446449. A researcher has published a multi-step exploit chain at snaacky.com documenting how this flaw can be combined with other weaknesses to achieve complete database compromise; no public exploit identifier (CISA KEV) has been confirmed but public exploit documentation exists.
Web Workers race condition in Google Chrome prior to 152.0.7977.65 enables Same-Origin Policy bypass for attackers who have already achieved renderer process compromise. The flaw (CWE-367 TOCTOU) allows a timing attack between origin validation and Worker data access, permitting cross-origin data reads from within a compromised renderer. No active exploitation is confirmed (not in CISA KEV) and EPSS of 0.19% (9th percentile) reflects the chained-exploit prerequisite that substantially limits real-world attacker reach.
Incorrect authorization in the Controls component of Google Chrome prior to version 152.0.7977.65 enables web origin policy bypass via a crafted HTML page, requiring only that a user visit the attacker-controlled page. The flaw (CWE-863) allows limited cross-origin integrity manipulation with no confidentiality or availability impact, as reflected in the CVSS integrity-only impact score. No public exploit has been identified at time of analysis, EPSS stands at 0.19% (8th percentile), and the Chromium team internally rated severity as Low - all signals consistent with a narrow-impact, user-interaction-dependent authorization gap.
Web origin policy bypass in Google Chrome Extensions affects all desktop versions prior to 152.0.7977.65, exploitable only by an attacker who has already compromised the renderer process. The incorrect authorization flaw (CWE-863) in the Extensions subsystem allows the renderer-level attacker to cross Same-Origin Policy boundaries via a specially crafted HTML page, potentially reading data from origins the renderer should not access. No public exploit code and no CISA KEV listing exist; EPSS is 0.19% (8th percentile), consistent with Chromium's own 'Low' severity rating for this issue.
Incorrect authorization in Chrome's WebProtect component (CWE-863) allows a remote attacker to bypass system access restrictions via a crafted HTML page, affecting all Chrome versions prior to 152.0.7977.65. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms impact is limited to partial integrity loss with no confidentiality or availability consequence, and exploitation is gated on the victim actively navigating to attacker-controlled content. No active exploitation is confirmed - CISA KEV status is absent and EPSS stands at 0.19% (8th percentile), consistent with the Low severity rating assigned by the Chromium security team.
Incorrect authorization in Google Chrome's browser component prior to version 152.0.7977.65 allows web origin policy bypass via a crafted HTML page. Remote unauthenticated attackers can exploit this flaw by inducing a user to visit a malicious page, resulting in limited cross-origin data reads - a breach of the same-origin policy, which is a foundational browser security boundary. No public exploit identified at time of analysis and not listed in CISA KEV; EPSS of 0.19% (8th percentile) confirms low exploitation probability in the current threat landscape.
Incorrect authorization in Google Chrome's Network component prior to version 152.0.7977.65 allows a remote, unauthenticated attacker to bypass the browser's web origin policy by delivering a crafted HTML page to a victim. The bypass yields limited confidentiality exposure, consistent with the CVSS C:L rating, and requires the target user to interact with attacker-controlled content. No public exploit code has been identified and EPSS stands at 0.19% (8th percentile), indicating low current exploitation probability despite the broad deployment footprint of Chrome.
Improper resource exposure in Google Chrome's StreamsAPI (versions prior to 152.0.7977.65) enables remote attackers to partially bypass the web origin policy and read limited data from privileged browser pages via a crafted HTML page. Exploitation requires user interaction - the victim must visit an attacker-controlled page - consistent with CVSS UI:R and S:U, confining impact to the victim's own browser context. No active exploitation is confirmed (not in CISA KEV), and an EPSS score of 0.18% (8th percentile) indicates very low real-world exploitation probability at time of analysis.
Incorrect authorization (CWE-863) in Chrome's Browser component on Android allows remote attackers to bypass system access restrictions through social engineering and UI interaction. Affected versions are all Chrome releases for Android prior to 152.0.7977.65. The flaw carries only a limited integrity impact with no confidentiality or availability consequence, and Chromium's own severity rating of 'Low' is consistent with the very low EPSS score of 0.17% (7th percentile). No public exploit code exists and the vulnerability has not been added to the CISA KEV catalog.
Address bar spoofing in Google Chrome for Android's CustomTabs feature enables remote unauthenticated attackers to misrepresent the displayed URL to users through a crafted HTML page. All Chrome for Android versions prior to 152.0.7977.65 are affected on the Android platform only; desktop Chrome is not impacted. No public exploit identified at time of analysis, and the EPSS score of 0.17% (7th percentile) combined with Chromium's own 'Low' severity rating reflect limited real-world exploitation probability, though the phishing-enablement potential makes it worth patching promptly.
Chrome's PermissionElement component can be visually spoofed via a crafted HTML page, allowing a remote attacker to mislead users into granting browser permissions they did not intend to approve. All Chrome desktop versions prior to 152.0.7977.65 are affected, as confirmed by the vendor's Stable Channel advisory and EUVD-2026-66037. No public exploit code has been identified at time of analysis, and EPSS at 0.17% reflects negligible observed exploitation interest.
Cross-origin data exposure via a ServiceWorker flaw in Google Chrome prior to 152.0.7977.65 permits remote attackers to read data from origins they do not control. An attacker can exploit this by delivering a crafted HTML page to a victim user, leveraging Chrome's ServiceWorker API to bypass same-origin isolation and exfiltrate cross-origin responses. No public exploit code is identified at time of analysis, and the EPSS score of 0.17% (7th percentile) reflects low observed exploitation activity; the mandatory user-interaction requirement further constrains automated abuse.
Incorrect authorization in Chrome's ServiceWorker component (CWE-863) allows remote unauthenticated attackers who can socially engineer a user into installing a crafted Chrome extension to bypass the web origin policy, resulting in limited cross-origin data exposure. All Chrome releases prior to 152.0.7977.65 are affected across platforms; a vendor patch is available. No public exploit code has been identified and the EPSS score of 0.17% (7th percentile) indicates very low current exploitation probability, consistent with the absence of a CISA KEV listing.
Insecure Direct Object Reference in Fluent Boards Pro WordPress plugin (all versions through 2.0.11) enables authenticated attackers with Subscriber-level access to perform unauthorized actions by supplying arbitrary user-controlled object keys that the plugin accepts without ownership validation. The CVSS 4.3 Medium rating reflects network accessibility offset by the authentication prerequisite and limited integrity-only impact. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Unauthorized action execution in Fluent Support Pro plugin for WordPress (all versions through 2.3.1) is possible for any authenticated subscriber-level user due to a missing capability check on a plugin function. The missing check (CWE-862) means WordPress's built-in role/capability enforcement is bypassed, allowing low-privileged users to invoke functionality reserved for higher-privilege roles. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog; however, the low authentication bar (any registered user) makes it accessible to a broad attacker pool on sites with open user registration.
Incorrect authorization in Chrome's CustomTabs feature on Android (prior to 152.0.7977.65) allows a co-installed malicious application to bypass the browser's web origin policy. The flaw is classified CWE-863 and is limited to Android deployments where an attacker controls a separately installed app on the same device. A vendor patch was released in Chrome 152.0.7977.65; no public exploit code or CISA KEV listing exists, and EPSS sits at 0.14% (3rd percentile), indicating minimal observed exploitation pressure.
Web origin policy bypass in Google Chrome for Windows (prior to 152.0.7977.65) stems from inadequate encryption strength in the browser's Notifications subsystem, exploitable via a crafted HTML page using social engineering. An unauthenticated remote attacker who tricks a user into visiting a malicious page can read limited cross-origin notification data, violating the same-origin boundary. No public exploit code has been identified and EPSS is extremely low (0.13%, 3rd percentile), consistent with the Chromium team's own Medium severity rating.
System access restriction bypass in Google Chrome's Workers subsystem affects all versions prior to 152.0.7977.65, functioning as the second link in an exploit chain where an attacker must first compromise the renderer process. Improper input validation in Workers then allows a crafted HTML page to circumvent Chrome's sandbox-enforced access controls, yielding limited confidentiality and integrity impact on the host. EPSS is 0.22% (12th percentile) with no confirmed active exploitation via CISA KEV, placing this squarely in the category of a chained, low-probability threat rather than a mass-exploitation vector.
Privilege escalation in Doorkeeper OpenID Connect prior to 1.10.4 allows self-registered OAuth clients to obtain scopes beyond what the server intends to grant. The Dynamic Client Registration endpoint directly assigns client-supplied scope values to the application record without intersecting them against the server's configured `default_scopes` and `optional_scopes`, and because `enforce_configured_scopes` is disabled by default, Doorkeeper's ScopeChecker subsequently honors those persisted application-level scopes over server-level restrictions. No public exploit has been identified at time of analysis; a vendor patch was released July 2, 2026.
HCL Hive's software supply chain governance weaknesses expose the application to risk from vulnerable, unmaintained, or malicious third-party dependencies incorporated into its build or runtime environment. The flaw (CWE-1104) reflects insufficient vetting of upstream components, meaning existing dependencies may carry unpatched CVEs or could serve as an introduction vector for malicious code. With a CVSS of 4.2 (AV:N/AC:H/PR:N/UI:R), exploitation is constrained by high attack complexity and user interaction requirements; no public exploit and no CISA KEV listing were identified at time of analysis.
Forceful Browsing in Drupal Core across multiple active and end-of-life release branches (10.x through 10.6.13, 11.3.x through 11.3.14, 11.4.x through 11.4.4, and all 11.0.x-11.2.x) allows unauthenticated remote attackers to bypass authorization and directly access protected resources due to missing authorization checks (CWE-862). The CVSS vector (AV:N/AC:H/PR:N/UI:R) indicates network-reachable exploitation but with high complexity and required user interaction, limiting opportunistic mass attacks. No active exploitation is confirmed - EPSS stands at 0.13% (3rd percentile) and CISA SSVC rates exploitation as none and not automatable - but a vendor patch is available via SA-CORE-2026-010.
Insecure direct object reference in Kibana's AI Assistant feature allows an authenticated low-privileged user to access or modify another user's AI conversation by supplying that conversation's identifier in API requests. Affected versions are addressed in the Elastic security update ESA-2026-51, covering Kibana 8.16.3 and 8.17.2. No public exploit code or active exploitation has been identified at time of analysis; the AC:H rating reflects the hard-to-guess nature of the conversation identifier as a meaningful practical barrier.
Denial-of-service via heap buffer overflow in SQLite's optional SQLAR extension affects any application that compiles or loads ext/misc/sqlar.c and processes attacker-controlled archive entries. The root cause is an integer-width mismatch in sqlarUncompressFunc(): a 64-bit decompressed-size argument is silently truncated to 32 bits by sqlite3_value_int(), causing sqlite3_malloc() to allocate an undersized heap buffer before zlib's uncompress() writes the full payload into it (CWE-122). The vulnerability is absent from CISA KEV, EPSS stands at 0.28% (20th percentile), the upstream fix is confirmed at Git commit 169f68ed, and a third-party GitHub repository referencing the CVE suggests proof-of-concept code is publicly accessible.
Stack-buffer-underflow in aria2's IOFile::getLine() function through version 1.37.0 allows a crash when the function processes an empty line, causing the expression buf[len - 1] to evaluate as buf[-1] and access memory before the buffer's start. The impact is limited to a local availability disruption - no confidentiality or integrity exposure has been identified - and the EPSS score of 0.15% (5th percentile) confirms negligible real-world exploitation interest. No public exploit code exists and this vulnerability is absent from CISA KEV, placing it firmly in the low-priority tier for most security teams.
Authorization bypass in Apache Tomcat's FORM-based authentication lets attackers reach protected resources that a security constraint was meant to restrict, defeating rules that grant a role POST access but withhold GET (or vice versa) on the same URL. It affects Tomcat 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, 9.0.0.M1 through 9.0.120, plus EOL 8.5.0-8.5.100 and 7.0.0-7.0.109. There is no public exploit identified at time of analysis, and EPSS is low (0.28%), but CISA SSVC rates the technical impact as total and the attack as automatable.
Improper Authorization in Apache Tomcat causes security-role-ref mappings - intended only for servlet-level isUserInRole() checks - to be incorrectly applied as role aliases within the Realm's authorization logic, allowing authenticated low-privileged users to access resources protected by higher-privileged roles. Supported branches 9.0.25-9.0.120, 10.1.0-M1-10.1.57, and 11.0.0-M1-11.0.24 are confirmed affected, along with EOL branches 7.0.97-7.0.109 and 8.5.46-8.5.100. No public exploit identified at time of analysis, and EPSS probability stands at 0.20% (10th percentile), though the CVSS 8.1 score reflects meaningful integrity and availability exposure in deployments relying on Realm-enforced role separation.
Apache Tomcat's Unix domain socket creation path exposes a TOCTOU race condition across versions 9.0.42-9.0.120, 10.1.0-M1-10.1.57, and 11.0.0-M1-11.0.24, enabling an unauthorized local OS user to seize the socket before Tomcat finalizes access permissions. The vendor-assigned CVSS 8.1 with AV:N directly conflicts with the description's explicit 'local user' constraint and the inherently host-local nature of Unix domain sockets - the effective attack surface is limited to users with OS-level access on Tomcat hosts. No public exploit code or active exploitation has been identified; EPSS sits at 0.16% (5th percentile), indicating negligible real-world exploitation pressure at time of analysis.
HCL Hive exposes sensitive host environment information through a network-accessible information disclosure flaw, enabling unauthenticated remote attackers - under high attack complexity conditions - to collect reconnaissance data about the underlying system. The CVSS 3.7 (Low) score reflects both the constrained confidentiality impact and the high exploitation complexity. No public exploit code or active exploitation has been identified at time of analysis.
Server-side request forgery in JFrog Artifactory's External Dependency feature allows a low-privileged authenticated user to trigger outbound HTTP requests from the Artifactory server to remote CocoaPods repositories under specific high-complexity conditions. The CVSS scope change (S:C) indicates the forged requests escape the Artifactory application boundary, creating potential for internal network probing from the server's network position. No public exploit code exists and no active exploitation has been confirmed; no KEV listing is present at time of analysis.
Uninitialized GPU resource use in Google Chrome prior to 152.0.7977.65 enables an attacker who has already compromised the renderer process to read memory outside the Chrome sandbox boundary via a crafted HTML page. The vulnerability (CWE-908) is a second-stage primitive - it cannot be exploited in isolation and requires a pre-existing renderer process compromise as a hard prerequisite. No public exploit code has been identified and EPSS stands at 0.31%, consistent with its role as a chained exploitation component rather than a primary attack vector.
Out-of-bounds read in Google Chrome's Media component prior to version 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to leak memory contents across the Chrome sandbox boundary via a crafted HTML page. The attack is a chained, second-stage capability - it requires prior renderer code execution and user interaction - not a standalone entry point. No public exploit has been identified at time of analysis, and the EPSS score of 0.29% (21st percentile) reflects low observed exploitation likelihood.
Insufficient permissions restrictions in iOS and iPadOS (all versions prior to 26.5) allow a malicious locally-installed app to enumerate other applications installed on the device. The flaw, rooted in improper privilege management (CWE-269), exposes app inventory data that Apple's sandbox model is designed to protect. No public exploit identified at time of analysis, EPSS is extremely low at 0.09%, and SSVC exploitation status is confirmed none - placing this squarely as a low-urgency privacy concern rather than an active threat.
Memory disclosure via uninitialized GPU resource in Google Chrome prior to 152.0.7977.65 enables a remote attacker - who has already compromised the renderer process - to read memory contents outside the Chrome sandbox through a crafted HTML page. This is a chained, second-stage attack: the GPU component fails to initialize memory before use (CWE-908), leaking data only after renderer compromise. No public exploit code exists and the vulnerability is not listed in CISA KEV; EPSS of 0.40% (33rd percentile) further signals limited real-world exploitation pressure. A vendor-released patch is available in Chrome 152.0.7977.65.
Cross-origin data exposure in Google Chrome's GPU component prior to version 152.0.7977.65 can be triggered by a remote attacker who has already compromised the renderer process. The vulnerability stems from an uninitialized GPU resource (CWE-908) that leaks memory contents readable across origin boundaries. Exploitation requires chaining this issue with a separate renderer compromise, significantly raising the bar; no public exploit code has been identified and EPSS probability sits at 0.40%.
Improper resource exposure in Google Chrome's Preload mechanism prior to version 152.0.7977.65 enables remote attackers to bypass Site Isolation by luring a user to a crafted HTML page. The flaw (CWE-668) allows cross-origin resource data to leak across security boundaries, undermining Chrome's core renderer isolation architecture and potentially exposing sensitive information from other origins loaded in the browser. No public exploit has been identified at time of analysis; EPSS at 0.39% (32nd percentile) and the absence of a CISA KEV listing indicate low but non-zero exploitation probability.
Site isolation bypass in Google Chrome prior to 152.0.7977.65 allows a remote attacker who has already compromised the renderer process to cross origin security boundaries via a crafted HTML page, resulting in limited cross-site data disclosure. The flaw is an incorrect authorization check (CWE-863) in Chrome's SiteIsolation subsystem - a defense-in-depth mechanism that keeps different origins in separate OS processes. No public exploit has been identified and EPSS stands at 0.38%, consistent with the high prerequisite of prior renderer compromise; this vulnerability is not listed in CISA KEV.
Site isolation boundary bypass in Google Chrome prior to 152.0.7977.65 enables an attacker who has already compromised the renderer process to read cross-origin data via a crafted PDF file. This is a chained, second-stage attack technique - not a standalone exploit - requiring renderer process compromise as a hard prerequisite before the missing authorization check (CWE-862) in SiteIsolation becomes actionable. No public exploit code or CISA KEV listing has been identified; the EPSS score of 0.35% (27th percentile) aligns with the complex prerequisites that suppress widespread exploitation.
Cross-origin data disclosure in Google Chrome's Skia graphics library (versions prior to 152.0.7977.65) enables a remote attacker who has already achieved renderer process compromise to leak cross-origin data by loading a crafted HTML page. The uninitialized resource flaw (CWE-908) exposes stale Skia memory contents that may contain pixel or data residue from other origins. No public exploit code has been identified, the vulnerability is absent from CISA KEV, and an EPSS of 0.34% (26th percentile) reflects low current exploitation activity.
Site isolation bypass in Google Chrome prior to 152.0.7977.65 enables cross-origin information disclosure via a crafted HTML page, but only when an attacker has already achieved renderer process compromise through a separate, chained exploit. The flaw, tracked internally as Chromium issue 498327743, carries a CVSS score of 3.1 reflecting the high-complexity, multi-stage attack prerequisite. No public exploit code or active exploitation has been identified; EPSS exploitation probability stands at 0.33% (25th percentile), consistent with no observed widespread abuse.