Authentication bypass in liketrek TREK up to v3.0.22 allows a remote attacker with valid credentials to circumvent two-factor authentication by manipulating the mfa_token parameter in the Pre-2FA handler of the loginUser function (authService.ts). The CVSS 4.0 vector (PR:L) confirms low-privilege credentials are a prerequisite, meaning the bypass targets users who have valid username/password combinations but should still be blocked by a second factor. The vendor's own release notes for v3.1.0 describe this as a 'critical authentication bypass' - one of 18 privately reported security issues - and strongly recommend immediate upgrade for all self-hosted instances. No public exploit code or CISA KEV listing has been identified at time of analysis.
Bluetooth information disclosure in Google Chrome on macOS (versions prior to 152.0.7977.65) enables a remote attacker - who has already compromised the renderer process - to extract sensitive Bluetooth-related information by combining a crafted HTML page with social engineering. This is a chained, multi-prerequisite vulnerability: successful exploitation requires a prior renderer compromise and active victim interaction, which the CVSS AC:H rating reflects. No public exploit code exists and no active exploitation has been observed (SSVC: Exploitation none; EPSS 0.29%), placing real-world risk substantially below what the C:H confidentiality impact alone might suggest. A vendor patch is available in Chrome 152.0.7977.65.
Authorization bypass in the My Agile Privacy® CMP, Cookie Consent & Privacy Tools WordPress plugin (all versions through 3.3.6) allows unauthenticated remote attackers to overwrite plugin settings controlling cookie shield activation, consent mode JavaScript behavior, and error handling configuration. The root cause is a missing authorization check (CWE-862) on plugin action handlers, confirmed by Wordfence with source-code references pointing to three distinct vulnerable functions in the frontend class. No public exploit code or CISA KEV listing is associated with this CVE at time of analysis, though the low-complexity, zero-authentication attack surface makes opportunistic abuse realistic at scale.
Sensor API information disclosure in Google Chrome before 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to read sensitive device sensor data by loading a crafted HTML page. The flaw (CWE-862, Missing Authorization) does not provide initial access on its own - it is a post-exploitation primitive that extends the capability of a pre-existing renderer compromise. No public exploit code has been identified at time of analysis, and EPSS stands at 0.26% (17th percentile), reflecting low current exploitation probability.
Cross-site scripting with CSP bypass in Adminer before 5.4.3 enables arbitrary JavaScript execution in the browser of any user who connects to an attacker-controlled MySQL server. The vulnerability stems from unsanitized MySQL server version strings being injected directly into script tags that carry valid Content Security Policy nonces, effectively nullifying CSP protections. No public exploit code or CISA KEV entry has been identified at time of analysis, but the attack is meaningful against administrators and developers who routinely connect Adminer instances to external or third-party MySQL servers.
Arbitrary file write in Adminer 5.3.0-5.4.2 allows any authenticated user to write attacker-controlled content to arbitrary writable filesystem paths via path traversal in the ns parameter of the sql-log plugin. The written files are constrained to a .sql extension, which limits but does not eliminate the integrity impact - an attacker can overwrite existing .sql files, pollute backup directories, or write large files to fill disk. No public exploit code or CISA KEV listing has been identified at time of analysis, and the attack surface is narrowed by both the authentication requirement and the non-default plugin dependency.
Item duplication and protected-item extraction in the MintyItanium Lost-Auction Minecraft auction plugin (all versions prior to commit 88c920b05042929db334ba06d57f052b42d6b3f8) allows authenticated players to manipulate GUI interactions to obtain barrier blocks or duplicate items from the auction interface. The root cause is improper control flow in the GUI handling logic (CWE-670), enabling players to bypass intended item restrictions without elevated permissions. No public exploit code has been identified at time of analysis, and the vulnerability is confined to Minecraft server game integrity rather than infrastructure security.
Incomplete cleanup in Chrome's GetUserMedia API exposes sensitive information to remote attackers who have already compromised the renderer process. Affected versions are all Chrome releases prior to 152.0.7977.65 on desktop platforms. An attacker with an established renderer foothold and the ability to socially engineer a user into visiting a crafted HTML page can exploit this residual-data flaw to extract sensitive media or stream-related information - an information-disclosure step that may support privilege escalation or lateral movement within a broader attack chain. No public exploit code has been identified and EPSS sits at 0.23%, reflecting the high prerequisite bar.
Observable discrepancy in HTML rendering in Google Chrome prior to 152.0.7977.65 enables a remote attacker to extract sensitive information when a victim visits a crafted HTML page. The root cause is CWE-203 (Observable Discrepancy), where Chrome's handling of specific HTML constructs produces measurable behavioral differences - such as timing variations or rendering side-channels - that leak protected state. No active exploitation is confirmed in CISA KEV, and EPSS sits at 0.22% (13th percentile), indicating low opportunistic risk despite the High confidentiality impact rating in the CVSS vector.
Observable discrepancy in the Forms component of Google Chrome prior to 152.0.7977.65 enables remote attackers to extract sensitive information by serving a crafted HTML page that induces measurable behavioral side-channel differences. The CVSS vector (AC:H/UI:R) confirms exploitation requires both high attack complexity - precise timing or environmental control to reliably observe the discrepancy - and active user interaction to visit the malicious page. No public exploit has been identified at time of analysis, and an EPSS of 0.22% (13th percentile) signals limited automated exploitation interest despite the high confidentiality impact designation.
Network-layer information disclosure in Google Chrome prior to 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to exfiltrate sensitive network-layer data by delivering a crafted HTML page to a victim. The CVSS score of 5.3 reflects constrained real-world risk: high confidentiality impact is offset by the requirement for a prior renderer compromise and active user interaction. No public exploit code or CISA KEV listing exists at time of analysis, and the EPSS score of 0.22% (13th percentile) indicates low anticipated exploitation activity.
Cart quantity manipulation in macrozheng mall up to version 1.0.3 allows authenticated remote attackers to exploit a business logic error in the OmsCartItemServiceImpl.updateQuantity function at the /cart/update/quantity endpoint by submitting maliciously crafted quantity values. The CWE-840 classification confirms the root cause is improper enforcement of business rules rather than a memory-safety flaw, allowing attackers to potentially submit negative, zero, or arbitrarily large quantity values to distort cart totals or order pricing. No public exploit code has been identified at time of analysis, and the vendor's unexplained deletion of the associated GitHub issue (#984) leaves patch status unresolved.
Network-layer information disclosure in Google Chrome before 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to exfiltrate sensitive data by directing a victim to a crafted HTML page. The attack is a multi-stage chain: the renderer compromise is a hard prerequisite not satisfied by this CVE alone, which materially constrains real-world exploitability. No public exploit code has been identified and the EPSS score of 0.21% (11th percentile) corroborates low observed exploitation probability; no CISA KEV listing exists.
Adminer 4.6.0 through 5.4.x blindly prepends the client-supplied X-Forwarded-Prefix HTTP header to internally constructed URLs with no trusted-proxy allowlist or value sanitization, allowing attacker-controlled URL prefixes to propagate into Location redirect headers, Set-Cookie path attributes, and self-referential links. This yields an authenticated open redirect on state-changing POSTs and unauthenticated control of session cookie path scoping against default deployments in the affected version range. CR/LF injection is blocked, ruling out header splitting and XSS despite the intelligence source's XSS tag - that tag appears to be a mis-classification and should not inflate risk estimates. No public exploit has been identified at time of analysis, and no CISA KEV listing exists.
Insufficient JWT expiration validation in the TYPO3 'Syssy - TYPO3 Monitoring & Security Checks' extension allows an attacker already in possession of a valid SYSSY project API key to authenticate using an expired token, bypassing the intended session time boundary (CWE-613). The limited confidentiality and integrity impact (VC:L/VI:L per the CVSS 4.0 vector) reflects access to monitoring and security check data rather than full system compromise. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.
Missing authorization in Checkmk's background job subsystem allows any authenticated user to view the status and output of background jobs by knowing the job ID, potentially exposing data from jobs initiated by other users or higher-privileged roles. Affected releases span the entire 2.2.0 branch and versions below 2.5.0p12, 2.4.0p36, and 2.3.0p50. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog; real-world impact is bounded to information disclosure within authenticated sessions.
SQL injection in liketrek TREK's Journey Entry Update endpoint allows authenticated remote attackers to manipulate underlying database queries via the journeyService.updateEntry function in versions up to and including 3.0.22. The flaw (CWE-89) is network-reachable but requires a valid user session (PR:L), constraining the attack surface to authenticated users of self-hosted instances. No public exploit code or CISA KEV listing exists at time of analysis; the issue was privately disclosed alongside 17 other vulnerabilities all remediated in the 3.1.0 release.
Race condition in Google Chrome's Transactions Platform on Android (prior to 152.0.7977.65) enables remote attackers to bypass system access restrictions with high integrity impact. Exploitation requires social engineering the victim into visiting a crafted HTML page, and the race window makes reliable triggering difficult (AC:H per CVSS). Chromium's own severity rating is Low; EPSS at 0.18% (7th percentile) confirms minimal real-world exploitation pressure, and no public exploit or KEV listing has been identified.
Skia, the 2D graphics library embedded in Google Chrome prior to 152.0.7977.65, leaks sensitive information when an attacker who has already compromised the renderer process delivers a crafted HTML page to a victim. This CWE-200 flaw functions as a chaining component in a multi-stage exploit rather than a standalone entry point - it amplifies the impact of a prior renderer compromise rather than providing initial access. No public exploit code exists, EPSS is 0.17% (7th percentile), and Chrome's own severity classification is Low, all consistent with the mandatory pre-condition of a pre-compromised renderer.
Observable discrepancy in Chrome's Glic component allows remote information disclosure against users running versions prior to 152.0.7977.65. An attacker who persuades a victim to visit a crafted HTML page can exploit a behavioral or timing side-channel in the Glic AI-integration subsystem to extract sensitive information with high confidentiality impact, despite the medium overall CVSS score. No public exploit identified at time of analysis, and EPSS at 0.17% (7th percentile) indicates very low current exploitation probability.
Cleartext transmission of TYPO3 system information occurs in the Syssy - TYPO3 Monitoring & Security Checks extension when OpenSSL is absent on the hosting server, exposing potentially sensitive configuration and system data to network interception (CWE-319). All tracked versions of the extension are affected per CPE data, though exploitation is constrained by the dual requirement of OpenSSL being unavailable and the attacker already possessing the SYSSY project's API key. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; the CVSS 4.0 score of 5.3 reflects the medium-severity, partially-authenticated nature of the flaw.
Race condition in Google Chrome's Editing component prior to version 152.0.7977.65 enables remote attackers who successfully socially engineer a victim to visit a crafted HTML page to extract sensitive information from the browser. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) shows the attack is network-delivered but requires high complexity timing and explicit user interaction, limiting real-world exploitability. No public exploit identified at time of analysis, and the extremely low EPSS score of 0.14% (4th percentile) corroborates the vendor's own Low Chromium severity designation.
Argument injection in the Okta Privileged Access client allows a crafted SSH target username beginning with a hyphen to be interpreted as a command-line option by the underlying SSH subprocess. Organizations using Okta Privileged Access for SSH session brokering are affected when a user initiates a connection to a target whose username has been set to a hyphen-prefixed value. If exploited, an attacker who can influence the target username definition could cause the SSH client to process injected options, achieving high confidentiality impact. No public exploit code is identified at time of analysis, and CISA KEV does not list this CVE.
Log endpoint access control in Ech0 before 4.4.3 is broken for any authenticated non-admin user, exposing real-time and historical server logs via three unguarded API endpoints. The router registers GET /api/system/logs, GET /api/system/logs/stream, and WS /ws/system/logs under middleware that validates JWT signatures but never checks role or scope - a pattern inconsistent with every other admin-restricted route in the codebase. Disclosed log data includes internal file paths, error stack traces, Go module names, and structured application state fields that facilitate reconnaissance for follow-on attacks; no public exploit is identified at time of analysis.
Improper output encoding in NVIDIA OpenShell's inference proxy on Linux allows a local low-privileged attacker to cause information disclosure and data tampering across component boundaries. The CVSS scope-change flag (S:C) indicates impact extending beyond the vulnerable component itself, suggesting the inference proxy mediates data between trust zones. No public exploit code exists and this vulnerability has not been confirmed in CISA KEV, but the scope change elevates practical risk above the 5.2 base score suggests.
Denial of service in GNU wget's FTP OPIE/S-KEY authentication handler allows a malicious or intercepted FTP server to cause wget to perform approximately 2.1 billion MD5 computations by supplying a crafted sequence number near INT_MAX in the OPIE challenge line. All versions of GNU wget with OPIE/S-KEY FTP authentication support are affected per CPE cpe:2.3:a:gnu:wget:*:*:*:*:*:*:*:*. The --timeout option provides no mitigation because it governs network I/O exclusively, not CPU-bound computation. No public exploit identified at time of analysis; a fix is confirmed via upstream GitLab commit.
Server-side request forgery in Ech0 through 4.2.1 (Go-based self-hosted application by lin-snow) allows an authenticated admin to exfiltrate data from internal network services and cloud metadata endpoints by exploiting a DNS resolution bypass in webhook URL validation. The validateWebhookURL function checks only literal IP strings via net.ParseIP(), so hostnames like 169.254.169.254.nip.io pass validation unchallenged and DNS-resolve to private IPs at request time. Publicly available exploit code exists (curl-based PoC in GHSA-r2x7-427f-rq69); no confirmed active exploitation (not in CISA KEV). The CVSS 4.0 score of 5.1 reflects the PR:H prerequisite, which substantially limits real-world exposure.
Stack trace disclosure in rclone's RC API exposes internal file paths, Go module versions, goroutine states, and memory addresses to authenticated API callers who intentionally trigger panics. All rclone versions through v1.74.4 with the RC API enabled are affected; the vulnerability is rooted in the panic recovery handler at fs/rc/jobs/job.go including raw debug.Stack() output directly in HTTP JSON error responses. A proof-of-concept is confirmed in the GHSA advisory; no public exploit identified at time of analysis beyond that PoC, and this vulnerability is not listed in CISA KEV.
Privileged information disclosure in YOOtheme Pro for Joomla (versions 1.0.0 through 5.0.41) allows authenticated users holding only com_template editing permissions to read metadata about arbitrary Joomla modules - access that normally requires the separate com_modules permission. The root cause is CWE-284 (Improper Access Control): the extension's template editor fails to verify whether the requesting user holds the appropriate module-management permission before returning module data. No public exploit identified at time of analysis, and the CVSS 4.0 score of 5.1 (Medium) reflects the high privilege requirement and limited confidentiality impact.
Missing authorization in Chrome's CustomTabs feature on Android exposes sensitive browser information to co-installed malicious applications on versions prior to 152.0.7977.65. The vulnerability stems from CWE-862 (Missing Authorization), meaning Chrome does not properly verify whether a companion app is permitted to access data surfaced through the CustomTabs interface. No public exploit code or active exploitation has been identified; EPSS sits at the 6th percentile, confirming low real-world exploitation probability despite the High confidentiality impact in the CVSS vector.
NVIDIA Unified Fabric Manager Enterprise session management embeds a hard-coded cryptographic key (CWE-321), enabling a local attacker to extract session material and potentially escalate privileges within the InfiniBand fabric management plane. All four active UFM Enterprise release tracks - GA, LTS 2023, LTS 2024, and LTS 2025 - are confirmed affected per CPE data published by NVIDIA. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS data is absent from available intelligence, limiting probabilistic exploitation forecasting.
Chrome's Sharing feature on Android leaks sensitive information to local attackers in all versions prior to 152.0.7977.65, exploitable only when a malicious co-installed app is present on the target device combined with social engineering. Despite a High confidentiality impact in the CVSS vector, the overall score of 5.1 reflects severe practical constraints: local access, high complexity, and a social engineering dependency. No public exploit code has been identified, EPSS probability is 0.15% (4th percentile), and Chromium's own severity rating is Low - signals that align to suggest low near-term operational risk.
SQL injection in the Media Sweep - WordPress Media Cleaner plugin (all versions through 1.1.3) exposes WordPress database contents to exploitation via the 'fields' REST API parameter, which lacks proper escaping and parameterization. Authenticated attackers holding administrator-level WordPress credentials can append arbitrary SQL to existing queries, enabling sensitive data exfiltration from the underlying database. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog.
Stored cross-site scripting in Ech0 before 4.4.3 allows authenticated administrators to upload SVG or HTML files containing arbitrary JavaScript that executes in the application origin when accessed by any user, enabling session hijacking and credential exfiltration. The file upload handler at internal/service/file/file.go trusts the client-supplied multipart Content-Type header without server-side magic byte detection or extension validation, and SVG uploads are permitted in the default AllowedTypes configuration without any bypass required. Uploaded files are served publicly without authentication via a gin.Static route, meaning any user - authenticated or not - who visits the file URL triggers execution. Vendor-released patch 4.4.3 is available; no public exploit has been identified at time of analysis.
Stored XSS in Ech0 before 4.7.3 allows admin-privileged attackers to inject executable JavaScript into the public RSS/Atom feed via unescaped tag names or raw HTML markdown content. The payload persists in the database and executes when RSS subscribers open the feed in clients that render Atom `<summary type="html">` as HTML, affecting anonymous and authenticated subscribers without further attacker interaction. No public exploit code and no CISA KEV listing exist at time of analysis; the admin-only injection prerequisite substantially constrains real-world risk.
Cross-site scripting in Drupal Core across all maintained 11.x release branches allows network-accessible unauthenticated attackers to inject malicious scripts into rendered web pages, with impact occurring in victims' browser contexts upon user interaction. High attack complexity (AC:H) constrains opportunistic exploitation, and all signals - EPSS at 0.15% (4th percentile), SSVC exploitation status of none, no KEV listing, and no public exploit code - converge on a low-urgency posture. Vendor patches are available for the 11.3.x and 11.4.x branches via Drupal SA-CORE-2026-011, while Drupal 11.2.x and earlier receive no fix as an end-of-life branch.
Unauthorized option-write in LearnPress (WordPress LMS plugin) versions up to and including 4.4.4 allows authenticated attackers with Editor-level access to overwrite arbitrary WordPress site options with a page ID integer via the learnpress_create_page AJAX endpoint. The LP_Admin_Ajax::create_page() handler validates only the edit_pages capability and a wp_rest nonce - both granted to Editors - but applies no allowlist to the field_name parameter before it is forwarded to update_option(). Exploiting this flaw, an attacker can enable open user registration, corrupt the active plugin list to deny service, or manipulate other administrator-reserved settings. No public exploit has been identified at time of analysis and CISA KEV does not list this CVE.
Remote same-origin policy bypass in Google Chrome prior to 152.0.7977.65 exploits a use-after-free condition (CWE-672) in the Network component, allowing an attacker who has already achieved renderer process compromise to escape origin boundaries via a crafted HTML page. The vulnerability carries a CVSS 4.3 and EPSS of 0.66% (49th percentile), consistent with its role as a second-stage exploit chain component rather than a standalone initial-access vector. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Heap out-of-bounds read in GIMP's file-xwd plugin allows a crafted XWD image file to trigger an application crash or leak partial heap memory contents into the rendered image output. Users running GIMP on Red Hat Enterprise Linux 6 through 9 are affected when they open a malicious XWD file; the plugin fails to cross-validate image width and bytes-per-line parameters against the allocated buffer size, permitting an out-of-bounds read. No public exploit is identified at time of analysis and the vulnerability is not listed in CISA KEV, placing real-world urgency in the low-to-moderate range.
Chrome's QUIC protocol implementation prior to version 152.0.7977.65 permits remote attackers to bypass the browser's web origin policy by directing a user to a crafted HTML page. The flaw is classified as CWE-610 (Externally Controlled Reference to a Resource in Another Sphere), meaning an attacker can influence a reference within the QUIC layer to access cross-origin resources that should be restricted. Impact is limited to partial confidentiality loss; no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Cross-origin data leakage in Google Chrome's ANGLE graphics layer (versions prior to 152.0.7977.65) allows an unauthenticated remote attacker to read limited data across origin boundaries by inducing a victim to visit a crafted HTML page. The root cause is an uninitialized resource (CWE-908) in ANGLE, Chrome's graphics abstraction engine, which can expose residual GPU buffer contents from other origins. No public exploit identified at time of analysis; EPSS is low at 0.40% (33rd percentile), and the vulnerability is not listed in CISA KEV.
Web origin policy bypass in Google Chrome's StorageAccessAPI enables an attacker who has already compromised the renderer process to exfiltrate cross-origin storage data via a crafted HTML page, affecting all Chrome versions prior to 152.0.7977.65. The vulnerability is rated medium severity (CVSS 4.3) and requires both user interaction and a pre-existing renderer compromise, making it a second-stage chained exploit component rather than a standalone initial access vector. No public exploit code has been identified and no active exploitation is confirmed at time of analysis.
Canvas API information leak in Google Chrome prior to 152.0.7977.65 enables remote attackers to bypass the Same-Origin Policy and read cross-origin pixel data via a crafted HTML page. Exploitation requires user interaction (visiting the malicious page) and results in low confidentiality impact - pixel-level canvas data leakage rather than credential or file system exposure. No public exploit has been identified and EPSS at 0.39% (32nd percentile) confirms low real-world exploitation probability; no CISA KEV listing exists.
Injection in Google Chrome's Tabs component (versions prior to 152.0.7977.65) enables remote attackers to partially bypass system access restrictions by directing a user to a specially crafted HTML page. The flaw is classified CWE-74 (Injection) and carries only a low integrity impact (I:L) with no confidentiality or availability consequences, consistent with Chromium's own 'Medium' severity rating. No public exploit code has been identified and EPSS probability is low at 0.38% (31st percentile), indicating limited real-world exploitation pressure despite the browser's ubiquitous deployment footprint.
Incorrect authorization in Google Chrome's Network subsystem (all versions before 152.0.7977.65) permits remote unauthenticated attackers to bypass system access restrictions by inducing a user to visit a crafted HTML page. Classified as CWE-863, the flaw allows a limited integrity violation against the affected system without confidentiality or availability impact. No public exploit has been identified at time of analysis, and the low EPSS score (0.38%, 31st percentile) indicates minimal current exploitation pressure.
Cross-origin data leakage in Google Chrome's SVG rendering engine (prior to 152.0.7977.65) allows a remote attacker to bypass same-origin policy boundaries through observable behavioral discrepancies. Exploitation requires the victim to interact with a crafted HTML page (UI:R), limiting opportunistic mass exploitation. No public exploit code exists and no CISA KEV listing is present; EPSS of 0.37% (30th percentile) confirms low current exploitation probability.
Incorrect reference resolution in Google Chrome's Passwords feature (versions prior to 152.0.7977.65) allows a remote attacker to bypass system access restrictions by delivering a crafted file that a user must open. The integrity impact is limited (CVSS I:L), and no confidentiality or availability loss is indicated. With EPSS at 0.36% (29th percentile), no KEV listing, and no public exploit identified at time of analysis, real-world exploitation risk is currently low despite the network-accessible attack vector.
Chrome's Network subsystem before version 152.0.7977.65 allows remote attackers to bypass the browser's web origin policy due to improper initialization (CWE-665), exploitable via a crafted HTML page that requires user interaction. The impact is limited to partial confidentiality disclosure (C:L), with no integrity or availability consequences, and the CVSS score of 4.3 (Medium) aligns with EPSS exploitation probability of 0.36% (29th percentile). No public exploit code or CISA KEV listing exists at the time of analysis; a vendor patch is available in the stable channel.
Web origin policy bypass in Google Chrome's Loader component (all versions prior to 152.0.7977.65) enables remote unauthenticated attackers to read limited cross-origin data by luring a user to a crafted HTML page. The flaw stems from incorrect authorization (CWE-863) in how the Loader enforces origin boundaries, allowing an attacker-controlled page to extract content from another origin the victim is browsing. EPSS is 0.34% (26th percentile), no CISA KEV listing exists, and no public exploit code has been identified at time of analysis, placing this in the lower tier of active exploitation risk despite broad product prevalence.
Incorrect authorization in Google Chrome Core prior to 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to bypass the web origin policy by combining that foothold with social engineering via a crafted HTML page. The flaw is classified CWE-863 (Incorrect Authorization), meaning the browser's Core incorrectly validates authorization checks across origins under this specific post-compromise condition. No public exploit or CISA KEV listing is present, and the EPSS score of 0.34% (26th percentile) reflects limited real-world exploitation probability at this time.