Site isolation bypass in Google Chrome prior to 152.0.7977.65 exploits a missing authorization flaw (CWE-862) in the Lighthouse auditing component, allowing an attacker who has already achieved renderer process compromise to cross site isolation boundaries and access limited cross-origin data. The attack chain requires high complexity - a pre-compromised renderer plus active social engineering - making this a second-stage vulnerability in a chained exploit rather than an independently weaponizable flaw. No public exploit code exists and no CISA KEV listing has been identified; EPSS at 0.32% (24th percentile) corroborates the low priority for standalone exploitation.
Web origin policy bypass in Google Chrome's WebRTC component (prior to 152.0.7977.65) enables a network-positioned attacker who has already compromised the renderer process to cross same-origin boundaries via a crafted HTML page requiring user interaction. This is a chained exploitation step - not a standalone critical flaw - making it most relevant as a second-stage component in a targeted multi-stage browser exploit. No public exploit code exists and EPSS of 0.28% at the 20th percentile is consistent with no observed opportunistic exploitation; the vulnerability is not listed in CISA KEV.
Site isolation bypass in Google Chrome prior to 152.0.7977.65 exploits incomplete cleanup (CWE-459) in the SiteIsolation component, enabling a remote attacker who has already compromised the renderer process to escape Chrome's cross-origin process separation via a crafted HTML page. This is a chained, second-stage attack - the CVSS score of 3.1 (Low) and EPSS of 0.28% (20th percentile) reflect the high prerequisite bar of a prior renderer compromise. No public exploit code or CISA KEV listing has been identified at time of analysis.
Site Isolation bypass in Google Chrome prior to 152.0.7977.65 allows a remote attacker who has already compromised the renderer process to escape Chrome's cross-origin boundary enforcement and access a privileged page via a crafted HTML page. This is a chaining vulnerability rather than a standalone exploit - it requires a pre-existing renderer compromise (typically from a separate, higher-severity CVE) before the SiteIsolation authorization flaw can be leveraged. No public exploit code has been identified and EPSS at 0.27% (19th percentile) reflects low standalone exploitation probability, though this class of flaw is historically weaponized as a second stage in full browser sandbox escape chains.
Cross-origin data leakage in Google Chrome's Payments subsystem, affecting all versions prior to 152.0.7977.65, stems from a TOCTOU race condition exploitable by an attacker who has already compromised the renderer process. By delivering a crafted HTML page, the attacker can race the Payments component to read data across origin boundaries, violating the Same-Origin Policy. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; the EPSS score of 0.25% (16th percentile) reflects low real-world exploitation probability.
Origin policy bypass in Google Chrome's Editing component (prior to 152.0.7977.65) requires an attacker who has already compromised the renderer process to additionally leverage social engineering against the user via a crafted HTML page. Successful exploitation leaks limited cross-origin data by circumventing the same-origin policy through improper input validation in the editing subsystem. No public exploit code exists and EPSS sits at the 15th percentile, indicating low near-term exploitation probability; no active exploitation confirmed by CISA KEV.
Site isolation bypass in Google Chrome prior to 152.0.7977.65 allows a remote attacker who has already compromised the renderer process to escape process-level sandboxing constraints via a crafted HTML page. The vulnerability stems from improper input validation in Chrome's Navigation subsystem (CWE-20), and exploitation requires both a prior renderer compromise and user interaction. With a CVSS score of 3.1 (Low), EPSS at 0.24% (15th percentile), no KEV listing, and no public exploit identified, this is a low-urgency chained escalation risk rather than a primary attack vector - but it is meaningful in advanced threat scenarios where a renderer exploit already exists.
Site isolation bypass in Google Chrome prior to 152.0.7977.65 allows a remote attacker who has already compromised the renderer process - and further leverages social engineering - to circumvent Chrome's cross-origin security boundary via a crafted HTML page, resulting in limited confidentiality exposure. The flaw resides in the SiteIsolation authorization logic (CWE-863), meaning Chrome fails to correctly validate whether a renderer process is permitted to access data belonging to a different origin. With an EPSS of 0.23% (13th percentile) and no CISA KEV listing, real-world exploitation probability is low; the dual prerequisite of a pre-existing renderer compromise plus social engineering substantially raises the attack bar beyond what the low CVSS score alone conveys.
Site isolation bypass in Google Chrome prior to 152.0.7977.65 allows a remote attacker who has already achieved renderer process compromise to make unauthorized cross-origin network requests via a crafted HTML page. The incorrect authorization check (CWE-863) in Chrome's Network component fails to enforce origin boundaries when the renderer is compromised, exposing limited confidentiality data from foreign origins. No public exploit has been identified, EPSS probability stands at a low 0.23%, and the vulnerability is not listed in CISA KEV - consistent with the high attack complexity imposed by the renderer-compromise prerequisite.
Cross-origin data leakage in Google Chrome's FindInPage component affects all versions prior to 152.0.7977.65. Exploitation requires a remote attacker to have already compromised the renderer process and then deliver a crafted HTML page that triggers improper input validation, exposing data from a different origin accessible in the browser session. No public exploit code has been identified; EPSS scores this at 0.22% (13th percentile), consistent with the compound, chained nature of exploitation required.
Site isolation bypass in Google Chrome DevTools (versions prior to 152.0.7977.65) enables cross-origin data theft as a second-stage exploit following renderer process compromise. An attacker who has already gained control of a Chrome renderer - itself requiring exploitation of a separate vulnerability - can serve a crafted HTML page exploiting improper input validation in DevTools to breach the browser's inter-site boundary and read data from other open origins. No public exploit code exists and EPSS of 0.22% (12th percentile) confirms this is not currently seeing broad opportunistic exploitation, though the technique is highly attractive for targeted, multi-stage browser exploit chains.
Chrome's Workers component prior to version 152.0.7977.65 mismanages resource lifetimes (CWE-664), enabling a site isolation bypass that allows cross-origin data to be read by an attacker who has already compromised the renderer process via a separate exploit. This is a second-stage chained primitive, not a standalone attack - it requires both user interaction with a crafted HTML page and a pre-existing renderer compromise. No public exploit code has been identified and EPSS of 0.20% (10th percentile) reflects very low observed exploitation probability.
Site isolation bypass in Google Chrome's Speech component allows an attacker who has already established a foothold in the renderer process to cross origin boundaries via a crafted HTML page. Affected versions are all Chrome releases prior to 152.0.7977.65 across all platforms covered by the CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*. No public exploit code has been identified at time of analysis, EPSS probability is very low at 0.20% (10th percentile), and the vulnerability is not listed in CISA KEV - however its value as a second-stage exploit in a browser attack chain elevates practical concern above the low CVSS score alone.
Cross-origin data exposure in Google Chrome before 152.0.7977.65 enables a chained information leak when a renderer process has already been compromised by a separate exploit. Chrome's CORS implementation incorrectly permits cross-origin data access from within a compromised renderer, allowing a remote attacker to exfiltrate data from origins the victim is authenticated to via a crafted HTML page. No public exploit code exists and no CISA KEV listing has been issued; the EPSS score of 0.17% (7th percentile) confirms this is a low-probability, low-severity secondary element of multi-stage browser attack chains rather than a standalone threat.
Cross-origin data exfiltration via the BFCache mechanism in Google Chrome prior to 152.0.7977.65 enables an attacker who has already compromised the renderer process to read data across origin boundaries using a crafted HTML page. This information disclosure (CWE-200) is a second-stage capability, not a standalone attack - it requires chaining with a separate renderer RCE vulnerability, constraining real-world risk significantly. No public exploit code or active exploitation has been confirmed; EPSS is 0.17% and the vulnerability is absent from CISA KEV. Vendor patch is available in Chrome 152.0.7977.65.
CustomTabs in Google Chrome on Android before version 152.0.7977.65 leaks cross-origin data through an observable discrepancy (CWE-203) exploitable by a co-installed malicious application. The information disclosure is constrained to local attack scenarios where an adversary controls a second app on the same Android device, limiting real-world exposure significantly. EPSS stands at 0.18% (7th percentile), no public exploit code has been identified, and the vulnerability is not listed in the CISA KEV catalog.
Cross-origin data leakage in Google Chrome's CustomTabs feature on Android (versions prior to 152.0.7977.65) enables a local attacker to infer cross-origin information via a co-installed malicious application. The vulnerability stems from an observable discrepancy (CWE-203) - a measurable side-channel difference in Chrome's behavior that a co-resident app can detect and use to reconstruct protected web content. Impact is confined to limited confidentiality loss; no public exploit has been identified at time of analysis, and EPSS at 0.15% (4th percentile) signals very low real-world exploitation probability.
Cookie-path scoping manipulation in Adminer 4.6.0-5.5.0 results from an incomplete fix for a prior X-Forwarded-Prefix header injection (GHSA-8478-xrj3-h9c2). The validation guard in bootstrap.inc.php blocks double-slash prefixes (//evil.com) but accepts backslash variants (/\evil.com); because browsers normalize backslash to forward slash, the malformed prefix survives as a network-path reference into cookie_path(), corrupting the Set-Cookie Path attribute. Exploitation depends on a misconfigured or absent reverse proxy that permits clients to supply the X-Forwarded-Prefix header, and no public exploit has been identified at time of analysis.
Reflected cross-site scripting in code-projects Online Shopping System 1.0 allows remote attackers to inject malicious client-side scripts via the 'Success' argument in /admin/sumit_form.php. The administrative panel endpoint fails to sanitize user-supplied input before rendering it in the browser response, enabling script injection targeting any user - likely an administrator - who follows a crafted URL. A proof-of-concept exploit has been publicly disclosed on GitHub, though no confirmed active exploitation or CISA KEV listing exists at time of analysis.
Reflected XSS in AshAuthentication's confirmation and magic link interaction pages allows unauthenticated attackers to inject arbitrary JavaScript into a victim's browser by crafting a malicious GET URL. Versions 4.8.0 through 4.14.1 and 5.0.0-rc.0 through 5.0.0-rc.12 of this Elixir framework authentication library embed user-supplied request parameters verbatim into hidden HTML form inputs using unescaped EEx template expressions, and since the vulnerable accept handlers are served over GET, simply loading the crafted link is sufficient - no form submission or prior session is required. No public exploit code has been independently identified at time of analysis, though the attack is trivially constructable from the public advisory and commit diff alone.
Unbounded memory allocation in CPython's zipfile module allows a crafted archive to exhaust process memory during decompression of bzip2, LZMA, or Zstandard members. The ZipExtFile._read1() method lacked the max_length output bound that the DEFLATE code path already enforced, permitting a small compressed member with an attacker-controlled declared size to expand into unlimited memory per read call. No public exploit is identified at time of analysis; exploitation requires user interaction (opening the archive), and the CVSS 4.0 base score of 2.1 reflects the low, availability-only impact.
Port forwarding in GitHub CLI versions 2.28.0 through 2.97.0 binds its local TCP listener to all network interfaces (0.0.0.0) rather than loopback only, exposing forwarded Codespace services to any adjacent host that can route to the user's machine while `gh codespace ports forward` is active. Developers using this command on shared or untrusted networks - corporate Wi-Fi, conference networks, co-working LAN segments - may unintentionally expose Codespace services that were intended to remain private. The vulnerability is fixed in v2.98.0 per advisory GHSA-vfhh-p7hm-pxfh; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Kimai's Twig invoice template sandbox fails to block the getApiToken() and getPlainApiToken() User methods, allowing admins with template creation permissions to exfiltrate hashed API tokens from any user who generates an invoice using that template. Affected are OnPremise deployments of Kimai before 2.53.0 where invoice template upload is enabled and admins hold the manage_invoice_template permission. No public exploit is independently confirmed, but the GHSA advisory includes complete proof-of-concept reproduction steps; the CVSS 4.0 score of 2.0 reflects the high prerequisite access level and limited confidentiality impact. Note: the 'RCE' tag present in source intelligence appears to be a mis-tag - the vulnerability is information disclosure, not remote code execution.
Privilege escalation in rclone before 1.74.4 allows an attacker who controls a source remote to plant a setuid binary on the destination filesystem when the victim uses the --metadata flag during a copy or sync operation. The local backend passes source-supplied mode, uid, and gid metadata verbatim to os.Chmod and os.Chown without masking ModeSetuid or ModeSetgid bits, enabling an attacker to store a crafted binary with mode=40000755 and uid=0 on a remote they control. If rclone runs as root - common in automated backup/restore workflows - any local user on the destination system can execute the planted binary to gain root access. A proof-of-concept is documented in the upstream advisory; no confirmed active exploitation (CISA KEV) is recorded at time of analysis.
Open redirect in Kimai's SAML Assertion Consumer Service handler (versions up to and including 2.52.0) enables an attacker with IdP-level access to redirect successfully authenticated users to arbitrary attacker-controlled URLs by supplying a malicious RelayState POST parameter. The vulnerable code in SamlAuthenticationSuccessHandler.php performs no host or scheme validation on the RelayState value - only checking that it does not equal the configured login_path - meaning any fully qualified external URL is accepted as a redirect destination post-SSO. Exploitation is narrowly constrained: SAML must be explicitly enabled (a non-default configuration) and the attacker must control or compromise the IdP; no public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Denial of service in OpenEXR 3.4.0 through 3.4.12 allows any application calling exr_start_read() on untrusted input to be unconditionally aborted by a crafted HTJ2K-compressed EXR file containing a QCD marker with lower five bits set to zero. The flaw chains two weaknesses: OpenJPH's vendored assertion-based validation calls abort() instead of returning a recoverable error, and OpenEXR's error handling wraps only its internal HT header parser, leaving downstream codestream construction calls entirely unprotected. No public exploit or active exploitation (CISA KEV) has been identified, but the trivial triggering condition and prevalence of OpenEXR in automated rendering pipelines make this a meaningful denial-of-service risk for media production infrastructure.