Authorization bypass in Ech0 before 4.5.1 allows any authenticated non-admin user to invoke privileged admin endpoints by sending a valid session token to routes unprotected by the RequireScopes middleware. Affected instances expose system logs, visitor statistics, user email addresses, and live WebSocket log streams to any logged-in user regardless of their assigned role. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; however, the low attack complexity and network accessibility make this a realistic threat in any multi-user Ech0 deployment.
Kimai's Twig sandbox exposes server-wide secrets through an unrestricted config() function in administrator-uploaded invoice and export templates, affecting all versions before 2.56.0. An administrator with template upload privileges can craft a malicious template that renders sensitive configuration values - including LDAP bind passwords and SAML SP private keys - directly into invoice or export documents. Those documents are then delivered to lower-privileged users such as team leads who generate them, creating a stealthy credential exfiltration channel. No public exploit identified at time of analysis, and no CISA KEV listing is present in the provided data.
Uncontrolled memory consumption in the JPXStream::readCodestream() function of Innodata Labs' Poppler fork allows remote, unauthenticated attackers to crash the pdftoppm process by supplying a maliciously crafted PDF containing JPXDecode image streams. The SIZ marker segment in a JPEG 2000 codestream provides attacker-controlled values - such as img.nComps - that are used directly in tile and component memory allocation without bounds validation, triggering out-of-memory conditions. No active exploitation has been confirmed (not in CISA KEV), no public proof-of-concept has been identified, and a vendor patch is available per INCIBE advisory.
Arbitrary local file read in self-hosted Typebot prior to 3.18.0 allows any registered user to exfiltrate files readable by the server process - including environment variable secrets, credential encryption keys, and database connection strings - by publishing a chatbot whose Send Email block specifies an absolute filesystem path such as /etc/passwd or /proc/self/environ as an attachment. The root cause is a missing URL-scheme validation in the parseAttachments helper: any value not prefixed with the application's own base URL is passed directly to Nodemailer as a filesystem path, and the Nodemailer transport is instantiated without disableFileAccess, so it reads and emails the file to an attacker-controlled recipient. No public exploit has been identified at time of analysis, but the attack requires no special server configuration because open signup and system SMTP are both enabled by default.
Worker-thread exhaustion in Mesop's debug-mode hot-reload endpoint (prior to version 1.3.3) allows an unauthenticated remote attacker to render the server completely unavailable with minimal effort. The GET /hot-reload endpoint in debug mode enters an unbounded loop controlled by the attacker-supplied counter parameter, holding worker threads indefinitely until the thread pool is exhausted and the server stops responding to all requests. Recovery requires a manual server restart. No public exploit has been identified at time of analysis, but the attack mechanism is trivially simple and fully automatable.
JWT signing key replacement in Cloud Foundry UAA allows a remote authenticated attacker holding only the zones.write authority to fully compromise the entire Cloud Foundry deployment. By exploiting a case sensitivity mismatch between the authorization layer (which performs a case-sensitive string comparison against the literal 'uaa' identifier) and the MySQL persistence layer (which resolves identifiers case-insensitively under its default collation), an attacker submitting 'UAA' or 'Uaa' bypasses the privilege check while the database silently resolves the request against the real system zone record. Exploitation enables overwriting the system zone's JWT signing key, forging tokens claiming admin and administrator scopes, and cascading into full UAA and Cloud Foundry compromise; no public exploit has been identified at time of analysis, though the Changed-Scope CVSS vector and PR:H signal a high-severity, low-noise attack path against MySQL-backed deployments.
Denial of service in Ech0 before 5.0.1 allows unauthenticated remote attackers to saturate server CPU by exploiting a quadratic-time parsing bypass in the Accept-Language header processing chain. The i18n middleware, active on every HTTP request including unauthenticated public endpoints, forwards the raw header without size filtering to golang.org/x/text/language.ParseAcceptLanguage, where the CVE-2022-32149 mitigation caps '-' separators at 1000 but not '_' separators - which the parser aliases to '-' internally - enabling a single crafted 1 MiB request to consume roughly 1.5 seconds of CPU (~70x amplification). No CISA KEV listing is present and no public exploit code has been independently confirmed, though the GHSA advisory includes end-to-end verification and sufficient technical detail for reproduction.
Denial-of-service in Nokogiri before 1.19.3 stems from three distinct ReDoS vulnerabilities in the CSS selector tokenizer, affecting string-literal and identifier tokenization. Any Ruby application passing attacker-controlled input to `Node#css`, `Node#at_css`, `Nokogiri::CSS.xpath_for`, `Searchable#search`, or `CSS::Parser#parse` is vulnerable to exponential regex backtracking that can exhaust CPU resources and deny service. No public exploit code has been identified at time of analysis, but the unauthenticated network attack surface and low exploitation complexity make this a high-priority patch target for Nokogiri-dependent Ruby applications.
XML Entity Expansion (Billion Laughs) in NLTK before 3.10.3 allows unauthenticated remote attackers to cause denial of service by submitting crafted XML payloads with nested entity declarations that expand exponentially in memory. Multiple NLTK modules rely on Python's xml.etree.ElementTree parser, which honors DTD entity definitions, making them susceptible to this class of attack. No public exploit code has been identified at time of analysis, though the attack technique is universally documented and trivially constructable.
Team membership disruption in Kimai before 2.63.0 allows authenticated teamleads to permanently strip all members from any team they can edit by exploiting a non-atomic delete-before-validate workflow in the PATCH /api/teams/{id} endpoint. The endpoint deletes all existing member rows before completing validation of the replacement list; when a malformed payload triggers a validation error, the deletion is not rolled back, leaving teams with no members or teamleaders and collapsing team-based access control. No public exploit has been identified and active exploitation is not confirmed by CISA KEV, but the CVSS 4.0 score of 8.7 and low-privilege attack vector make this a credible insider or compromised-account threat.
Credential extraction in Grav CMS before 2.0.16 allows authenticated users with page-edit permissions to read hashed passwords and two-factor authentication secrets from User objects via insufficiently filtered Twig template sandbox methods. The allow-listed offsetGet() and offsetExists() methods on User objects expose sensitive fields that should be restricted within the sandboxed template context, enabling offline password cracking and subsequent authentication bypass. No public exploit has been identified at time of analysis, but the exploit technique is straightforward for any attacker holding page-edit rights.
Host header injection in Grav CMS before 3.9.2 allows attackers to poison outgoing invitation emails, replacing the legitimate site URL with an attacker-controlled domain in token-bearing links sent via the sendInvitationEmail() function. The vulnerability exploits a gap in Grav's existing Host header defenses: the require_trusted_host protection was applied only to password reset flows, leaving invitation emails without equivalent validation. When a poisoned invitation email is delivered and the recipient clicks the link, the one-time invitation token is transmitted to the attacker's server rather than the legitimate site. No public exploit has been identified at time of analysis, and the CVE is not listed in the CISA KEV catalog, though the reported CVSS 4.0 score of 8.7 reflects high confidentiality risk from token capture.
Password reset and account activation token comparison in Grav Login Plugin before 3.9.1 uses PHP's non-constant-time === operator instead of hash_equals(), exposing a CWE-208 timing oracle in both taskReset() (classes/Controller.php) and the activation handler (login.php). Combined with the absence of rate limiting on the token-submission endpoint, an unauthenticated network attacker can submit high-volume repeated token guesses against a known username and statistically recover a valid reset token via timing discrepancy. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the vendor itself characterizes practical exploitability as low, and no end-to-end network exploitation has been demonstrated.
Server-side request forgery in NLTK before 3.10.3 allows unauthenticated remote attackers to reach internal HTTP services and load attacker-controlled downloader indexes when an HTTP proxy is configured. The flaw sits in nltk.pathsec.urlopen and its callers (nltk.data.load, nltk.downloader.Downloader.index, nltk.downloader.Downloader.download): local hostname validation passes the supplied public URL, but proxy-handler inheritance then replaces NLTK's safe URL handlers so the actual fetch is executed by the proxy against an internally-resolvable destination that is never re-validated. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 base score is 8.7, reflecting high confidentiality impact under network-accessible, unauthenticated conditions.
Unauthorized project report export in Kimai before 2.64.0 allows any authenticated user, regardless of role, to download the full project overview export via the unprotected `report_project_view_export` route, exposing customer names, project names, currency, budget type, and aggregate totals across all customers. The root cause is a misplaced authorization guard attached to the `__invoke` method on a sibling route rather than at the controller class level, leaving the export route with no access control. No public exploit code has been identified at time of analysis, but the vulnerability is trivially exploitable by any valid Kimai account holder.
Information disclosure in Grav CMS before 2.0.16 enables authenticated users holding page-edit permission to retrieve sensitive system configuration values - including Redis passwords and other stored credentials - by invoking `config.get()` or `config.toArray()` within Twig templates. The root cause is an incomplete default denylist in the Twig sandbox configuration that fails to block access to the `config` object when the `config_access` feature is enabled. No public exploit has been identified and the vulnerability is not confirmed actively exploited at time of analysis.
Unauthenticated record tampering in the TYPO3 Telephone Directory extension allows any visitor who can identify an employee UID to overwrite that employee's data via a direct POST request, bypassing HMAC-based edit-link authorization entirely. The extension enforces HMAC validation only at the form-render step, leaving the persistence action unprotected under CWE-862 (Missing Authorization). With a CVSS 4.0 score of 8.7 and an attack profile of network-accessible, no-privilege, no-interaction, no public exploit has been identified at time of analysis, but the attack requires no authentication and minimal attacker capability.
Cross-user bookmark tampering in Kimai versions before 2.57.0 allows any authenticated low-privileged user to inject or remove timesheet entries from another user's favorites list via an IDOR flaw (CWE-639) in the favorite add and remove endpoints. Any account holding the standard `start_own_timesheet` permission can reference another user's timesheet identifier to manipulate their `favorite/recent` workflow state without administrative access. No confirmed active exploitation exists (not in CISA KEV); a PoC was submitted during responsible disclosure but removed before public release. Vendor-released patch is available in version 2.57.0.
Use-after-free memory corruption in Nokogiri before 1.18.4 exposes Ruby applications to potential heap corruption and process compromise when processing attacker-supplied XSLT stylesheets. The root cause is Nokogiri's bundled libxslt dependency (prior to v1.1.43), which contains two distinct UAF bugs: CVE-2025-24855 (XPath context node leaked by xsltEvalXPathStringNs) and CVE-2024-55549 (namespace prefix handling corruption). No public exploit code has been identified at time of analysis, and CISA KEV listing is absent; a vendor-released patch (Nokogiri 1.18.4) is available.
Out-of-bounds memory read in Nokogiri (CRuby) versions before 1.19.4 crashes the host Ruby process when application code incorrectly passes a non-Node argument to the protected internal `Node#initialize_copy_with_args` method. The method backs the public `Node#dup` and `#clone` APIs and, prior to 1.19.4, unwraps its argument directly as a libxml2 `xmlNode` struct without verifying the object's type, causing it to misread an `xmlNs` (Namespace) struct out of bounds. Critically, the vendor explicitly confirms this cannot be triggered by untrusted external input - only by a programming error in application code - making the provided CVSS 4.0 score of 8.7 (AV:N/PR:N) a significant overstatement of real-world risk. No public exploit has been identified at time of analysis.
Heap-based buffer under-read in libxml2's XML Schema identity constraint processor affects all Nokogiri releases prior to 1.18.8, which bundle the vulnerable libxml2 library. The flaw in xmlSchemaIDCFillNodeTables can be triggered by supplying a crafted XSD schema or by submitting untrusted XML documents for validation against trusted schemas that combine xsd:keyref with recursively defined types carrying additional identity constraints. No public exploit has been identified at time of analysis, and upstream libxml2 maintainers and MITRE independently rate actual exploitability as low - in notable conflict with the NVD-assigned CVSS 4.0 base score of 8.7.
Unrestricted file upload in Webkul QloApps allows a remote attacker holding administrative credentials to upload executable files - including PHP webshells - to a publicly accessible server directory and achieve full server-side remote code execution. The booking document upload workflow in the hotel reservation module failed to validate file extensions or inspect MIME types server-side, trusting client-supplied metadata entirely. Upstream fix commit 153ec1c is available via GitHub PR #1801; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Crater Invoice through 6.0.6 is achievable by any authenticated company owner via a Zip Slip attack against the self-update API's unzip endpoint. Crafted ZIP archives containing path-traversal sequences (`../`) in entry names are passed without sanitization to PHP's `ZipArchive::extractTo()`, enabling arbitrary PHP file writes into the web-accessible `public/` directory and subsequent webshell execution. A public proof-of-concept is available on GitHub; no CISA KEV listing was identified at time of analysis, though the combination of a low exploitation bar and public PoC makes this a priority finding.
SQL injection in Webkul QloApps back-office address search allows a remote attacker holding valid administrator credentials to execute arbitrary SQL via the unsanitized 'bo_query' parameter passed to the 'searchByName()' method in 'Address.php'. The scope of the patch (commit 123c97c, PR #1783) reveals the flaw spans at least five PHP files - including 'CustomerMessage.php' and three hotel reservation module classes - each inserting raw user input directly into LIKE or IN SQL clauses without using QloApps' own 'pSQL()' sanitization or integer casting. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
SQL injection in Webkul QloApps exposes the entire database to remote authenticated administrators who can supply unsanitized input to the 'bo_query' parameter in the back-office search interface. The patch diff reveals the flaw extends beyond CustomerMessage.php to Address.php and multiple hotel reservation system modules (HotelBranchRefundRules, HotelRoomTypeFeaturePricing, HotelRoomTypeGlobalDemandAdvanceOption), all of which concatenated user-supplied strings directly into SQL queries without pSQL() sanitization or integer casting. No public exploit code or CISA KEV listing is identified at time of analysis; EPSS data was not provided in the source intelligence.
Privilege escalation in the Codefresh CI/CD platform allows authenticated platform users to elevate their account to Administrator level by invoking a specific API endpoint, per Codefresh security advisory SA2026-01. All versions covered by CPE cpe:2.3:a:octopus_deploy:codefresh are listed as affected with no minimum version floor specified. A successful attacker gains unrestricted administrative control of the platform - including access to all pipelines, stored secrets, integrations, and organizational settings. No public exploit code has been identified at time of analysis, and CISA KEV listing is not confirmed.
Remote code execution in Le-yan's Medical Practice Management System allows unauthenticated remote attackers to execute arbitrary OS commands on the server by inducing a user to visit a crafted HTML page. The root cause is CWE-940 (Improper Verification of Source of a Communication Channel), indicating the application processes incoming requests without validating their origin - a pattern consistent with CSRF-driven command injection where the server's trust of unverified channels is the enabling weakness. No public exploit code has been identified and no CISA KEV listing is present, but the CVSS 4.0 score of 8.6 with full confidentiality, integrity, and availability impact on the vulnerable system reflects high severity with significant consequences in a healthcare data context.
Unsafe dynamic class instantiation in Vocos allows arbitrary code execution when a user loads a model from an attacker-controlled Hugging Face repository. The library's `Vocos.from_pretrained` fetches a remote `config.yaml` from a caller-supplied repository and passes it directly to `instantiate_class`, which imports and calls any Python callable named in the configuration without an allowlist. Any user who loads a Vocos model from a repository they do not fully trust is exposed to full code execution in their Python process. No public exploit has been identified at time of analysis, but the attack path requires minimal sophistication given the direct code path from remote config to `__import__`/`getattr`/call.
Two domain-ownership authentication bypass flaws in @better-auth/sso allow authenticated organization owners to compromise user account integrity via unauthorized organization assignment or identity provider hijacking. Affected versions span the stable 1.6.x line (before 1.6.27), the 1.4.x maintenance line (before 1.4.8), and the 1.7 prerelease line (before 1.7.0-rc.5). An attacker holding an org-owner role can either silently recruit users with matching email domains into an attacker-controlled organization by registering an unverified SSO provider, or exploit a race condition between verification and update endpoints to substitute a different domain after DNS proof is collected - which, combined with implicit account linking, enables effective account takeover. No public exploit code or CISA KEV listing has been identified at time of analysis.
Arbitrary file write in browse-mcp (npm, versions ≤ 0.8.1) allows a malicious MCP client - or an autonomous LLM agent steered by indirect prompt injection on a visited page - to write attacker-controlled bytes to any filesystem path the process can reach, including shell init files, autostart entries, and cron files, enabling host code execution. The root cause is CWE-22 path traversal in browser_download (unvalidated save_dir argument) and browser_save_state/browser_load_state (unvalidated path argument), compounded by the force_fetch fallback bypassing the BROWSE_MCP_ALLOWED_ORIGINS origin fence entirely. No public exploit has been identified at time of analysis; vendor-released patch 0.8.2 is confirmed available.
Symlink following in Grav CMS Scheduler's Job::createLockFile() enables local attackers to overwrite arbitrary files writable by the web server process, affecting all versions prior to 2.0.16. The flaw arises because lock files are written to predictable paths inside a world-writable temp directory with no verification that the target path is not an attacker-controlled symlink; the next scheduled job execution blindly writes the job ID string to whatever the symlink points at. No public exploit has been identified at time of analysis, but the predictable path and world-writable directory make the conditions straightforward to stage on shared-hosting or multi-tenant systems.
GitPython before 3.1.59 discloses local file content through exception messages when parsing .gitmodules files that contain [include] directives, because the library fails to disable the merge_includes feature in GitConfigParser. An attacker who can introduce a malicious .gitmodules into a repository processed by a vulnerable GitPython instance can cause the first line of any locally readable file to appear verbatim in a MissingSectionHeaderError exception when repo.submodules is accessed. No active exploitation has been confirmed (absent from CISA KEV) and no public POC is referenced in available intelligence; a vendor-released patch exists in version 3.1.59.
Path traversal in NVIDIA OpenShell Sandbox for Linux permits low-privileged network-authenticated attackers to bypass L7 REST network policy enforcement, reaching REST endpoints that policy rules were designed to block. The Changed Scope (S:C) in the CVSS vector signals that the real impact falls on downstream services or data stores protected by the bypassed policy, yielding high confidentiality exposure (C:H) and limited integrity impact (I:L) on resources outside the sandbox trust boundary. No active exploitation has been confirmed in CISA KEV and no public proof-of-concept has been identified at time of analysis.
Privilege escalation in Ech0 before 4.4.3 allows an attacker holding an admin's profile:read access token to change the admin's password via a misauthorized PUT /user endpoint, then authenticate to obtain an unrestricted session token that bypasses all scope enforcement. The CWE-863 root cause is a mismatch between the declared read-only scope on the route and the write operations the handler actually performs; session tokens produced after login skip scope checks entirely, granting full admin API access. Publicly available exploit code exists per the GHSA advisory; no confirmed active exploitation in CISA KEV at time of analysis.
Server-Side Request Forgery (SSRF) in JFrog Artifactory allows a low-privileged authenticated user with read access to a remote VCS repository to replace the repository's configured origin URL or supply an arbitrary absolute VCS data URL, causing Artifactory's server process to issue outbound HTTP requests to attacker-controlled destinations - including internal network services, cloud metadata endpoints, or other infrastructure inaccessible from the public internet. The scope-changed CVSS vector (S:C) confirms the impact extends beyond Artifactory itself to systems on its internal network segment. No public exploit identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Local privilege escalation to SYSTEM in SKYSEA Client View and SKYMEC IT Manager allows any authenticated Windows user to execute arbitrary code with SYSTEM-level privileges. The root cause is a missing authorization check (CWE-862) within one or more privileged components of these IT asset management products. No public exploit identified at time of analysis, and this vulnerability has not been listed in the CISA KEV catalog, but the low-privilege local exploitation path and full SYSTEM compromise make it a significant risk in multi-user or shared Windows environments where these products are deployed.
Privilege escalation to SYSTEM in SKYSEA Client View and SKYMEC IT Manager (Sky Co., Ltd.) affects any Windows host where these IT management agents are installed. The root cause is CWE-276 - incorrect default permissions set on installation artifacts - allowing any authenticated local Windows user to plant or replace code that a SYSTEM-level service component subsequently executes. No public exploit code and no CISA KEV listing are confirmed at time of analysis, but the CVSS 4.0 score of 8.5 and zero attack complexity barriers make this a credible priority for organizations running these products in multi-user or shared-workstation environments.
Memory corruption in NI LabVIEW 2026 Q3 (26.3.0) and all prior versions enables information disclosure or arbitrary code execution when a victim opens a specially crafted VI (Virtual Instrument) file. The root cause is CWE-787 (Out-of-bounds Write), indicating a write operation beyond the bounds of an allocated buffer during VI file parsing. No public exploit code or active exploitation has been identified at time of analysis, but the file-borne delivery model is realistic in engineering and research environments where LabVIEW projects are routinely shared.
Memory corruption in NI LabVIEW 2026 Q3 (26.3.0) and all prior versions enables information disclosure or arbitrary code execution when a user opens a specially crafted Virtual Instrument (VI) file. The root cause is an out-of-bounds read (CWE-125) that, combined with tags indicating buffer overflow behavior, can corrupt memory state sufficient to achieve code execution. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 score of 8.5 reflects the high impact potential once a victim opens a malicious VI file.
Memory corruption in NI LabVIEW 2026 Q3 (26.3.0) and all prior versions enables information disclosure or arbitrary code execution when a user opens a specially crafted Virtual Instrument (VI) file. Rooted in CWE-125 (Out-of-bounds Read), the parser reads beyond allocated buffer boundaries, which can expose adjacent memory or - under favorable heap conditions - enable full code execution. No public exploit or CISA KEV listing has been identified at time of analysis, though the RCE potential and broad LabVIEW user base warrant prioritized patching.
Memory corruption in NI LabVIEW (all versions through 26.3.0) enables information disclosure or arbitrary code execution when a user opens a specially crafted VI (Virtual Instrument) file. The CVSS 4.0 base score of 8.5 reflects high impact across confidentiality, integrity, and availability on the vulnerable system, with local file-based delivery requiring passive user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the RCE potential and industrial control / engineering deployment context warrant prompt patching.
Memory corruption in NI LabVIEW 26.3.0 and all prior versions enables information disclosure or arbitrary code execution when a user opens a specially crafted Virtual Instrument (VI) file. Classified under CWE-125 (Out-of-bounds Read), the flaw's buffer-overflow and RCE tags suggest that the out-of-bounds read condition can, under certain memory layout circumstances, corrupt control-flow data and escalate beyond information disclosure to full code execution. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis; NI has published a vendor security advisory.
Memory corruption in NI LabVIEW 2026 Q3 (26.3.0) and all prior versions enables information disclosure or arbitrary code execution when a user opens a specially crafted Virtual Instrument (VI) file. The CWE-787 out-of-bounds write root cause combined with the high-impact CVSS 4.0 score of 8.5 places this in a serious tier for LabVIEW deployments across engineering, scientific, and industrial automation environments. No public exploit code has been identified at time of analysis, but the user-interaction trigger (social engineering via malicious VI file) is a well-understood threat model for desktop engineering tools.
Untrusted search path execution in NLTK before 3.10.3 allows a local attacker with write access to the current working directory or the ability to insert relative entries into PATH to substitute a malicious executable named 'dot' for the legitimate Graphviz binary, achieving arbitrary code execution under the invoking process's privileges. The affected code paths are dependencygraph.dot2img and AlignedSent._repr_svg_, both of which invoke the Graphviz dot binary by bare name without validating an absolute path. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 8.5 reflects the high-impact code execution potential.
Arbitrary code execution in libtiff's thumbnail command-line tool (commit 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938) allows local attackers to achieve full system compromise through a CWE-190 integer overflow in the main() function of libtiff/tools/thumbnail.c. When a crafted TIFF file triggers the wraparound, memory corruption can enable attacker-controlled code execution with the privileges of the invoking process. No public exploit is confirmed at time of analysis, and EPSS probability is very low (0.17%, 6th percentile), indicating limited real-world exploitation risk despite the high CVSS base score of 8.4.
Use-after-free in Chrome's Views UI component enables sandbox escape to arbitrary code execution outside the browser sandbox, affecting all Google Chrome versions prior to 152.0.7977.65. Exploitation requires an attacker who has already achieved renderer process compromise - making this a chained, second-stage attack rather than a direct initial access vector. No public exploit code has been identified and SSVC assessment confirms no active exploitation at time of analysis, though the technical impact is rated total due to the scope change across the sandbox boundary.
Use-after-free in Google Chrome's Chromecast component allows a remote attacker who has already compromised the renderer process to escape the sandbox and execute arbitrary code on the underlying system via a crafted HTML page. Affected versions are all Chrome releases prior to 152.0.7977.65. No public exploit or CISA KEV listing exists at time of analysis, and EPSS sits at a low 0.46%, but SSVC rates technical impact as total given the sandbox-escape outcome.
GPU improper input validation in Google Chrome on Android (prior to 152.0.7977.65) enables a remote attacker who has already compromised the renderer process to escape Chrome's sandbox and execute arbitrary code at the OS level via a crafted HTML page. This is a chained sandbox escape - a second-stage exploit requiring a separate renderer compromise as a prerequisite, which the AC:H CVSS rating accurately reflects. No public exploit code has been identified and the vulnerability is absent from CISA KEV, but the full S:C/C:H/I:H/A:H impact ratings indicate that a successful chain yields complete browser compromise on Android.
Use-after-free in the Audio component of Google Chrome on Android (versions prior to 152.0.7977.65) enables sandbox escape and arbitrary code execution outside the Chrome renderer sandbox. Exploitation requires an attacker to have already compromised the renderer process and then deliver a crafted HTML page to trigger the memory corruption. No public exploit code or CISA KEV listing exists at time of analysis; SSVC confirms no active exploitation observed and the attack is not automatable.
Sandbox escape via improper privilege management in Chrome's Navigation component allows a remote attacker who has already compromised the renderer process to break out of the Chrome sandbox and execute arbitrary code at OS level. Affected versions are all Chrome releases prior to 152.0.7977.65 across desktop platforms. The attack chain is multi-stage - renderer compromise must precede the sandbox escape - and social engineering is required, but the resulting impact is full confidentiality, integrity, and availability compromise outside the sandbox. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS exploitation probability is low at 0.40% (33rd percentile).