Sandbox-escaping remote code execution affects Google Chrome on macOS prior to 152.0.7977.65, where a use-after-free in the Network component lets a remote attacker who convinces a victim to install a crafted extension run arbitrary code outside the renderer sandbox. Google rates the Chromium severity Medium, but the CVSS 9.6 reflects the scope-changing sandbox escape. No public exploit is identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.24%.
Sandbox-escaping remote code execution in Google Chrome for Android before 152.0.7977.65 stems from a use-after-free in the Sessions component (CVE-2026-79129, CWE-416). A remote attacker who lures a victim into a specific UI interaction (social engineering) can corrupt freed memory to run arbitrary code outside the renderer sandbox. Google has shipped a fixed build; no public exploit identified at time of analysis, EPSS is low (0.23%, 14th percentile), and CISA SSVC lists exploitation status as none.
SCTP state cookie forgery in mediasoup (npm 3.20.0-3.20.5, Rust crate 0.22.0-0.22.4) permits an on-path attacker to establish unauthorized SCTP associations and inject DataChannel messages as a trusted peer, violating RFC 9260 Section 5.1.3. The root cause is that cookie validation relies entirely on two hardcoded magic constants ('msworker' and 0xAD81) rather than a per-instance HMAC secret - all remaining cookie fields are attacker-controlled, and COOKIE-ECHO packets bypass verification-tag and CRC32c checks by design. No public exploit has been identified at time of analysis; real-world risk is bounded by the narrow attack surface: only PlainTransport and PipeTransport with SCTP enabled and without DTLS/SRTP are vulnerable, while the far more common WebRtcTransport path is explicitly unaffected.
Path traversal in dekdee's adobe-xd-mcp 1.0.0 exposes the server filesystem to remote unauthenticated attackers via unsanitized `outputFile` and `outputDir` parameters in the `file-access-from-request` endpoint of `src/parsers/xd-parser.ts`. A public proof-of-concept exploit is available through the project's GitHub issue tracker, and no patch has been released - the vendor has not responded to the disclosure. With a CVSS 4.0 score of 6.9, public exploit code (E:P), and no mitigating authentication requirement, any network-exposed instance is immediately at risk.
Prototype pollution in the `@cleverbrush/deep` package (versions ≤ 4.4.0) allows a remote attacker to corrupt `Object.prototype` by supplying crafted JSON containing reserved JavaScript keys (`__proto__`, `constructor`, `prototype`) to the `deepExtend()` function without any privilege requirement. Any Node.js application that passes externally controlled input through `deepExtend()` is at risk of property injection affecting every plain object in the runtime, potentially enabling authentication bypass or logic manipulation downstream. A public exploit exists (GitHub issue #213); the vulnerability is not listed in CISA KEV, so widespread active exploitation is not confirmed at time of analysis.
Arbitrary code execution in the Natural Language Toolkit (NLTK) before 3.10.3 allows attackers to bypass the library's pickle allowlist and run commands when a crafted model or tokenizer artifact is loaded. The allowlist trusts whole module namespaces rather than specific safe callables, so dangerous in-namespace functions can be invoked via pickle's REDUCE opcode. Reported by VulnCheck; no public exploit identified at time of analysis, though the root cause and gadget functions are documented in the advisory.
Remote code execution in WatchGuard Agent lets an unauthenticated attacker positioned on an adjacent network chain a missing-authentication weakness (CWE-306) with path traversal into arbitrary code execution on the host. Rated CVSS 4.0 9.4 (Critical) by WatchGuard, the flaw combines an authentication bypass with directory traversal so no credentials or user interaction are required. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-adjacent, no-auth, high-impact profile makes it a high-priority patch item.
Arbitrary code execution in NLTK (Natural Language Toolkit) through 3.9.4 allows attackers to run Python code when a victim application loads a malicious transition-parser model file. The TransitionParser.parse() method deserializes model data via pickle with restricted=False, so an attacker-supplied model embedding pickle gadget chains executes with the privileges of the loading process. No CISA KEV listing or public exploit code is identified at time of analysis, though this class of pickle-RCE bug is trivially weaponizable once a malicious model is delivered.
Unauthenticated arbitrary file write in DB-GPT 0.8.0 lets remote attackers achieve remote code execution through the skill_upload endpoint, which builds an upload path by joining the user-controlled multipart filename to the upload directory without canonicalisation or containment checks. Because the route's only auth dependency (get_user_from_headers) returns an admin-role request even when no credentials are supplied, an attacker with no account can write a .py file such as ../../../tmp/x or /tmp/x anywhere the server process can write, then plant or overwrite a Python module that executes when next imported. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the flaw is trivially exploitable and fixed in v0.8.1.
Remote code execution with root privileges is achievable against OpenRGB server instances by sending unauthenticated TCP messages to port 6742, exploiting the UPDATEMODE and SAVE_PROFILE message handlers in combination. The OpenRGB server daemon, deployed as a systemd service in openSUSE Tumbleweed with full root privileges and listening on all interfaces (0.0.0.0:6742), enforces zero authentication or authorization on its custom binary protocol, allowing any network-reachable attacker to drive the exploit chain to full system compromise. A Python reproducer script demonstrating the attack was publicly released alongside the oss-security disclosure on August 25, 2026; publicly available exploit code exists.
Remote code execution in Weidmueller IE-SR-2TX-WL industrial security routers allows an unauthenticated network attacker to run arbitrary OS commands as root via the web management interface. The modified uhttpd server passes the HTTP Basic Authentication username directly into a shell command, so a crafted username containing shell metacharacters yields full device compromise. No public exploit identified at time of analysis, but the flaw is trivially exploitable and carries a CVSS 4.0 base score of 9.3 (Critical).
Remote code execution in Adminer before 5.4.3 (the single-file PHP database management tool) allows unauthenticated attackers to inject ODBC connection parameters through the unsanitized server field of the login form. Because the server value is placed directly into a PDO DSN string for MSSQL/ODBC connections, an attacker can smuggle TraceFile and TraceOn parameters via semicolons to write attacker-controlled PHP into the web root, which executes when the trace file is requested. CVSS 4.0 is rated 9.3 and the flaw was reported by VulnCheck; no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Authenticated Twig sandbox escape in Winter CMS before 1.2.13 lets backend users holding template-editing permissions (cms.manage_pages, cms.manage_layouts, or cms.manage_partials) break out of the CMS 'safe mode' to read and modify arbitrary database records, run raw SQL including DDL like DROP TABLE, exfiltrate backend administrator credentials, and achieve PHP remote code execution by writing PHP into a page, layout, or partial code section. It is an incomplete-fix follow-up (bypass) of CVE-2024-54149, whose method-name blocklist missed Eloquent's __call forwarding to the query builder. Rated CVSS 4.0 9.3 (VulnCheck); no public exploit is identified as actively used, though the vendor advisory and added test cases publish working payloads.
Remote code execution in the TYPO3 'HTML5 Video Player vs. Powermail' extension allows a remote, unauthenticated attacker to achieve arbitrary code execution on the server by supplying a crafted serialized value in an attacker-controlled cookie that is passed to PHP's unserialize(). The flaw is a classic PHP Object Injection (CWE-502) with full confidentiality, integrity, and availability impact and a CVSS 4.0 base score of 9.3. No public exploit identified at time of analysis, but the trivial attack requirements make weaponization straightforward.
Memory-corruption denial of service (and potential code execution) affects the Ruby Nokogiri gem before 1.18.3, which bundles a vulnerable libxml2. The flaw combines a stack buffer overflow when libxml2 reports DTD validation errors involving long (~3kb) QName prefixes (CVE-2025-24928) and a use-after-free during validation against untrusted XML Schemas using xsd:keyref with recursively defined types (CVE-2024-56171). Any Ruby/Rails application that validates attacker-supplied DTD or XSD content is exposed; no public exploit identified at time of analysis, and the issue is not in CISA KEV.
Argument injection in the Natural Language Toolkit (NLTK) Python library before 3.10.3 allows attackers who control the per-call `options` parameter of the `java()` helper to inject dangerous JVM flags (such as `-agentpath`, `-javaagent`, or `@argfile`) into invocations of the bundled Stanford NLP wrapper classes, resulting in arbitrary code execution. The flaw stems from missing validation of JVM options before they are handed to the spawned Java process. Reported by VulnCheck; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary code execution in GitPython before 3.1.59 arises from unsafe re-serialization of multi-line, quoted git-config values: a dormant crafted value is silently rewritten into a live directive such as core.hooksPath whenever GitPython performs any unrelated config write. An attacker who can seed a malicious config value can thereby point hook execution at attacker-controlled code, gaining code execution the next time a hook-invoking git operation runs. Reported by VulnCheck (CWE-88) with a CVSS 4.0 base of 9.3; no public exploit or CISA KEV listing is identified at time of analysis.
Authorization bypass in the Kimai open-source time-tracking application before 2.56.0 lets any authenticated user holding ROLE_TEAMLEAD (or any role granting edit_other_timesheet/delete_other_timesheet) read, modify, and permanently delete timesheets belonging to any user system-wide through the REST API, ignoring team boundaries. Because timesheet IDs are sequential integers, an attacker can enumerate and target every record, enabling destruction of billable hours and forgery of payroll/invoicing data. Publicly available exploit code exists (working API PoC in the GHSA advisory, verified against 2.52.0), though the vulnerability is not listed in CISA KEV and no EPSS score was provided.
Unrestricted file upload in the Reachy Mini daemon (pip/reachy-mini prior to 1.8.2) permits any unauthenticated network-reachable attacker to write arbitrary files to the robot's filesystem at /tmp/reachy_mini_sounds/<filename>. The daemon's /api/media/sounds/upload endpoint applies no authentication, no extension filtering, no content validation, and no size cap, and is bound to 0.0.0.0 with permissive CORS by default, making every network interface the robot touches an attack surface. The GHSA advisory documents this as step 1 of a three-step compromise chain that, when combined with separately reported Bluetooth authentication bypass and directory traversal vulnerabilities, enables full unauthenticated root access on the robot OS; a public proof-of-concept curl command is embedded in the advisory. No CISA KEV listing identified at time of analysis.
OS command injection in ClipBucket V5's web installer (versions 5.5.1 through 5.5.3-#153) lets unauthenticated remote attackers run arbitrary shell commands as the web server user by supplying a crafted php_cli_filepath value in a POST request to the installer. The flaw stems from the installer passing this parameter unescaped into a shell command that invokes the PHP CLI. A vendor patch exists (commit 36e7c6c), it was reported by VulnCheck, and no public exploit has been identified at time of analysis.
Broken authorization in the Grav Login plugin before 1.0.16 lets an operator holding the api.users.write permission clear login lockout counters on admin.super accounts through the onApiUserListRowAction unlock handler, which never checks the target account's privilege tier. This strips brute-force protection from the highest-privilege accounts, enabling a lower-privileged user to set up password-guessing against super-admin credentials. Reported by VulnCheck with no public exploit identified at time of analysis and no CISA KEV listing.
Email address enumeration in the Grav Login plugin (getgrav/grav-plugin-login) before 3.9.1 lets unauthenticated remote attackers determine which email addresses are registered on a Grav CMS site. The register() method returns a distinct EMAIL_NOT_AVAILABLE error for already-registered addresses while proceeding normally otherwise, and because the registration endpoint enforces no rate limiting, an attacker can test addresses at scale, one per request. No public exploit identified at time of analysis; the assigned CVSS 4.0 score of 9.3 appears substantially inflated for what is fundamentally an information-disclosure weakness.
Remote code execution in the WatchGuard Agent allows an unauthenticated attacker with network access to trigger arbitrary code execution at elevated privilege due to an improper authentication flaw (CWE-306). The CVSS 4.0 base score of 9.3 reflects a network-reachable, no-interaction, no-privilege attack yielding full confidentiality, integrity, and availability impact on the affected host. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the combination of pre-auth reachability and privileged code execution makes this a high-priority exposure.
Cleartext disclosure of AWS STS session tokens affects rclone before 1.74.4 when its S3 backend follows a redirect that keeps the same host:port but downgrades the scheme from HTTPS to HTTP. The redirect-safety logic added in v1.74.3 (commit e7b1eb774) compares only URL.Host and ignores URL.Scheme, so the X-Amz-Security-Token header is re-sent over the now-plaintext connection, letting any passive observer on the path harvest the temporary credential. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Origin validation bypass in Grav CMS before 2.0.16 lets remote attackers defeat the Referer-based same-origin check used by the Uri::referrer() and Pages::referrerRoute() methods. Because the check uses an unanchored str_starts_with() prefix match without a trailing delimiter, a request bearing a Referer from an attacker-controlled look-alike domain (e.g. https://example.com.attacker.tld) is accepted as same-origin, undermining CSRF/origin protections on protected routes. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Identity spoofing and authentication bypass in Alluxio's S3 REST proxy (versions through 2.9.5) lets remote unauthenticated attackers impersonate any user because the proxy does not verify AWS Signature Version 4 signatures in its default configuration. By reading the username directly from an unsigned Authorization header, an attacker can assume the identity of arbitrary users and service accounts to read, write, and delete data. Reported by VulnCheck with a CVSS 4.0 base score of 9.3; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in Amazon Strands Agents Tools before 0.8.5 lets an attacker abuse the python_repl tool to run arbitrary Python on the agent's host by defeating its human-in-the-loop consent gate. A crafted prompt smuggles the non_interactive_mode flag as a keyword argument through the batch tool, causing python_repl to execute without operator approval. No public exploit has been identified at time of analysis, but the CVSS 4.0 base score is 9.2 (Critical) given full confidentiality, integrity, and availability impact on the host.
Account takeover in self-hosted Typebot up to and including 3.17.1 lets an anonymous attacker who knows a victim's email hijack their session via brute force of the passwordless email magic-link login code. The email provider replaces NextAuth's secure token with a 6-digit Math.random() code (900,000-value keyspace, 10-minute validity) that is placed raw in the link, while the verification callback enforces no attempt cap, lockout, or CSRF protection and does not invalidate the real code on wrong guesses. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the flaw is fixed in 3.18.0.
Server-side request forgery in Apache Hive versions 2.1.0 through 4.2.0 lets an authenticated user with CREATE TABLE rights coerce the HiveServer2/Metastore process into fetching an attacker-chosen URL by planting a crafted avro.schema.url table property on an Avro table that is later queried. The fetch runs with the Hive service identity, exposing cloud instance metadata (e.g. 169.254.169.254), internal-only network services, and local files. No public exploit is identified at time of analysis and EPSS is low (0.29%), but the CVSS 9.1 rating and low attack complexity make it a meaningful post-authentication risk; upgrade to 4.2.1 resolves it.
UI spoofing in Google Chrome's Passwords component (versions prior to 152.0.7977.65) lets a remote attacker who has already compromised the renderer process present forged interface elements via a crafted HTML page, enabling deception such as credential phishing. Chromium rated this severity Low, and no public exploit or active exploitation has been identified; EPSS is low at 0.23% (14th percentile). The headline NVD CVSS of 9.1 substantially overstates the practical impact given the required renderer compromise.
Security constraint bypass in Apache Tomcat (7.0.x through 11.0.x) lets remote unauthenticated attackers reach protected resources when a broader security constraint for a longer path is declared ahead of a more restrictive constraint for a shorter sub-path, causing the wrong constraint to be applied. The flaw (CVSS 9.1, CWE-284) exposes access-controlled application paths without valid credentials. No public exploit identified at time of analysis, and EPSS is low (0.23%), but the network-reachable, no-interaction profile makes it a meaningful patch priority.
TOTP second-factor brute-force protection in Punk::Plugin::TOTP before 0.05 for Perl is defeated by replaying a saved session cookie, allowing an attacker with valid first-factor credentials to reset the TOTP failure counter indefinitely. Because Punk::Session stores the entire session state - including the TOTP attempt counter - in a client-side signed cookie when no server-side store is configured, an attacker can save the cookie before failures accumulate and replay it to restore a fresh counter, cycling this indefinitely within the pending_ttl window. No public exploit has been identified at time of analysis, but the technique is trivially reproducible from the advisory description alone.
Authorization bypass in the Drupal Webform REST contrib module (all versions from 0.0.0 up to and including 4.1.0) lets remote unauthenticated attackers reach REST resources they should not be able to access through forceful browsing. Because the module fails to properly enforce access checks on its endpoints, an attacker can read and potentially manipulate webform data or submissions guarded only by obscurity. No public exploit is identified at time of analysis and EPSS risk is low (0.18%, 7th percentile), but the CVSS 9.1 rating and SSVC 'total technical impact' make this a high-severity data-exposure issue.
Information disclosure in Google Chrome's DevTools (versions prior to 152.0.7977.65) lets a remote attacker who convinces a user to install a crafted Chrome extension read adjacent memory inside the renderer sandbox via an off-by-one error. Chromium rates the security severity as Low, and there is no public exploit identified at time of analysis; SSVC lists exploitation status as none and EPSS is negligible (0.16%, 6th percentile).
Missing authorization in the Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery contributed module (all versions from 0.0.0 up to and including 3.2.0) lets unauthenticated remote users reach gallery resources they should not be able to see by directly requesting their URLs (forceful browsing). Because the module fails to enforce access control on protected content, an attacker can enumerate and retrieve images or associated data intended for privileged users only. No public exploit identified at time of analysis, and EPSS is low (0.13%), but the flaw is trivially automatable per CISA SSVC.
AEAD authentication bypass in OpenSSL 3.0-4.0 lets attackers forge valid empty-ciphertext/tag pairs when applications encrypt or decrypt via the low-level EVP_Cipher() path with AES-OCB or ChaCha20-Poly1305. A zero-length cipher update was short-circuited to return success without producing or verifying the authentication tag, breaking the integrity guarantee that AEAD is supposed to provide. No public exploit is identified at time of analysis and EPSS is low (0.12%), but the flaw is confirmed and patched by the OpenSSL project and Ubuntu.
Persistent authentication bypass in Ech0 (lin-snow's self-hosted lightweight publishing/memo app) before 4.7.3 lets an attacker who has stolen a 'never-expire' access token retain valid authenticated access indefinitely. Because such tokens carry no JWT 'exp' claim, all three revocation paths fail - logout panics on the nil ExpiresAt field, RevokeToken short-circuits when remaining TTL is zero, and admin 'Delete token' never blacklists the JTI - so a leaked token stays cryptographically valid until the operator rotates the signing key. No public exploit identified at time of analysis; there is no CISA KEV listing and no POC referenced in the provided intelligence.
OS command injection in NVIDIA OpenShell across all supported platforms allows a network-accessible malicious gateway to execute arbitrary operating system commands on a victim host when a user interacts with that gateway. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) reflects that an attacker requires no privileges on the victim system but does require the victim to interact with a malicious or attacker-controlled gateway endpoint. Successful exploitation yields full code execution, data tampering, and information disclosure - with no public exploit or CISA KEV listing identified at time of analysis.
Remote code execution is possible in CM Map Locations WordPress plugin (all versions ≤ 2.1.8) via a limited arbitrary file upload flaw in the uploadMedia function, exploitable by any subscriber-level authenticated user. The upload handler performs only incomplete extension filtering with no MIME-type checks or WordPress capability verification before passing attacker-supplied files to move_uploaded_file(), and the required nonce is automatically exposed to any logged-in subscriber via the CMLOC_Editor_Images JavaScript object on the front-end location editor. No public exploit has been identified at time of analysis, but the low privilege bar and self-service nonce retrieval make this a realistic, high-priority threat for sites with open registration.
Use-after-free in Google Chrome's Compositing engine (all versions prior to 152.0.7977.65) enables remote code execution within the Chrome renderer sandbox when a user visits a crafted HTML page. The CVSS 8.8 score reflects full confidentiality, integrity, and availability impact, but execution is sandbox-confined and Chromium's own severity rating is Medium, suggesting real-world exploitation complexity is non-trivial. No public exploit has been identified and CISA SSVC records exploitation status as none; a vendor patch is available in Chrome 152.0.7977.65.
SQL injection in the All-in-One WP Migration and Backup plugin (servmask, versions through 7.109) enables a two-stage attack path culminating in remote code execution. Insufficient parameterization in the archive restore database layer allows attackers to append arbitrary SQL queries and exfiltrate the ai1wm_secret_key from the WordPress database; once obtained, this key unlocks the plugin's restore endpoint and enables RCE. No KEV listing or EPSS data is available at time of analysis, but the direct RCE chaining potential makes this a high-priority remediation target for any WordPress site running the affected plugin.
Remote unauthenticated arbitrary file overwrite in OpenRGB's custom TCP network protocol (port 6742) allows any network-reachable attacker to overwrite arbitrary files on the host by sending a crafted SAVE_PROFILE message with an attacker-controlled file path. When the daemon is deployed as a systemd service running with full root privileges - as packaged in openSUSE Tumbleweed - this file overwrite primitive translates directly into trivial full remote system compromise. A researcher-published Python reproducer script was released alongside this advisory; upstream release 1.0rc3-hotfix partially addresses the most critical issues.
Authentication bypass in NVIDIA UFM Enterprise's web interface authorization component allows an attacker on the adjacent network to send specially crafted HTTP requests that circumvent authentication checks, yielding code execution and privilege escalation on the UFM management host. All four active release tracks - GA, LTS 2023, LTS 2024, and LTS 2025 - are listed as affected per NVD CPE data. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Denial-of-service attack vectors in OpenRGB's unauthenticated TCP network protocol server (listening on 0.0.0.0:6742) allow any network-reachable attacker to crash or resource-exhaust the OpenRGB daemon without authentication. CVE-2026-18794 covers multiple DoS paths rooted in absent input-size validation - the server performs uncapped memory allocations from attacker-controlled length fields and passes raw network data to string constructors without null-termination checks. A Python reproducer script was published alongside coordinated disclosure on 2026-08-25, lowering the exploitation bar significantly. No CISA KEV listing; upstream 1.0rc3-hotfix addresses the worst aspects of the disclosed flaw set.
Use-after-free in Google Chrome's V8 JavaScript engine allows remote attackers to execute arbitrary code within the browser renderer sandbox on all Chrome versions prior to 152.0.7977.65. Exploitation requires only a single user interaction - visiting a crafted HTML page - with no authentication or special privileges needed (CVSS 8.8, AV:N/AC:L/PR:N/UI:R). Despite full C/I/A impact within the sandbox, EPSS probability is low at 0.46% (38th percentile), SSVC exploitation status is 'none', and no public exploit or CISA KEV listing exists at time of analysis; a vendor patch has been released at version 152.0.7977.65.
Out-of-bounds write in ANGLE, Chrome's GPU abstraction layer, affects Google Chrome on Windows prior to 152.0.7977.65 and can be triggered by a remote, unauthenticated attacker via a crafted HTML page, potentially achieving arbitrary code execution within the Chrome sandbox. The CVSS score of 8.8 reflects high theoretical severity, though sandbox containment (S:U) limits immediate blast radius to the GPU process. No public exploit code or CISA KEV listing exists at time of analysis, and the low EPSS of 0.42% (35th percentile) signals limited near-term exploitation probability despite the high CVSS rating.
Remote code execution in Google Chrome's Chromecast component (versions prior to 152.0.7977.65) stems from a use-after-free memory corruption flaw that enables remote attackers to execute arbitrary code within Chrome's renderer sandbox. Exploitation requires a victim to visit a crafted HTML page, making it network-reachable but not fully automated. No public exploit code has been identified at time of analysis, and the vulnerability is absent from the CISA Known Exploited Vulnerabilities catalog, with EPSS indicating low observed exploitation probability despite the high CVSS score.
Remote code execution within the Chrome sandbox is possible in Google Chrome prior to 152.0.7977.65 via a stack-based buffer overflow in the V8 JavaScript engine, triggered by a crafted HTML page visited by an unpatched user. The vulnerability requires no authentication or elevated privileges from the victim - only that they visit an attacker-controlled page - and achieves arbitrary code execution within Chrome's renderer sandbox. No public exploit has been identified at time of analysis, and EPSS at 0.39% (31st percentile) indicates low current exploitation probability despite the 8.8 CVSS score; notably, Google's own internal severity rating is Medium, reflecting the sandbox containment.
Type confusion in Chrome's ANGLE graphics abstraction layer (all versions prior to 152.0.7977.65) enables remote attackers to potentially execute arbitrary code outside the browser sandbox by directing a user to a specially crafted HTML page. The CVSS 8.8 score reflects network-accessible delivery with no privilege requirements, full confidentiality, integrity, and availability impact, though user interaction is necessary. No public exploit identified at time of analysis; SSVC rates exploitation as 'none', yet technical impact is rated 'total' given the sandbox-escape language in the description.
Integer overflow in the WebRTC component of Google Chrome prior to 152.0.7977.65 enables remote code execution confined to the browser's sandbox via a crafted HTML page. The flaw requires no authentication (PR:N) and no special browser configuration, as WebRTC is enabled by default, but it does require the victim to visit an attacker-controlled page (UI:R). No public exploit code has been identified and EPSS places exploitation probability at 0.35%, consistent with SSVC's assessment of no current exploitation; notably, Google's own internal Chromium severity rating for this issue is 'Low,' suggesting the sandbox boundary and exploit reliability considerations factor into their triage.