Incorrect authorization in the Chrome Extensions subsystem (CWE-863) allows a remote attacker who has already compromised the renderer process to bypass the web origin policy by delivering a crafted HTML page, affecting all Chrome desktop versions prior to 152.0.7977.65. Chromium rated this High severity despite the NVD CVSS base score of 4.3, because the same-origin policy bypass has meaningful privacy implications even though it requires a pre-compromised renderer as a prerequisite. No public exploit code has been identified and EPSS stands at 0.34% (26th percentile), consistent with no active exploitation confirmed at time of analysis.
Cross-origin information leak in Google Chrome's Paint rendering component (versions prior to 152.0.7977.65) enables remote attackers to bypass the web origin policy by delivering a crafted HTML page. The vulnerability is confined to the confidentiality dimension - no integrity or availability impact - and requires user interaction (visiting the attacker-controlled page) to trigger. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.33% places it in the 25th percentile, indicating low exploitation probability in the near term.
Cross-origin pixel data leakage in the Canvas API of Google Chrome prior to 152.0.7977.65 enables remote attackers to bypass the web same-origin policy by enticing a victim to visit a crafted HTML page. The flaw is classified High severity by the Chromium team and Medium (CVSS 4.3) by NVD, reflecting limited confidentiality impact with no integrity or availability consequences. No public exploit code or CISA KEV listing is identified at time of analysis, and EPSS at 0.33% indicates very low observed exploitation probability.
Missing authorization in the Payments component of Google Chrome on Android (prior to 152.0.7977.65) allows remote attackers to potentially bypass system access restrictions by inducing a user to visit a crafted HTML page. The flaw is classified as CWE-862 and carries a CVSS 3.1 score of 4.3 (Medium), with impact limited to integrity. No public exploit code has been identified at time of analysis, and EPSS scoring of 0.32% (24th percentile) indicates statistically low exploitation probability at scale.
Memory disclosure via uninitialized GPU resource in Google Chrome on Android (prior to 152.0.7977.65) allows a remote attacker to read memory outside the browser sandbox by directing a user to a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) reflects a low-complexity network attack requiring no privileges but dependent on user interaction. No public exploit code has been identified at time of analysis, and the low EPSS score of 0.31% corroborates a currently low exploitation probability despite Chrome's enormous Android deployment footprint.
Race condition in Google Chrome's Autofill subsystem (versions prior to 152.0.7977.65) enables a remote attacker who has already compromised the renderer process to bypass the browser's same-origin policy via a crafted HTML page. This is a second-stage vulnerability requiring a prior renderer exploit, making it a chained-attack component rather than a standalone threat. No public exploit code has been identified, and EPSS at 0.31% (24th percentile) reflects low opportunistic exploitation probability with no CISA KEV listing.
Incorrect reference resolution in Chrome's Preload subsystem (versions prior to 152.0.7977.65) allows remote attackers to bypass the Same-Origin Policy by serving a crafted HTML page to a victim. The vulnerability is limited to confidentiality impact at the low tier - an attacker can read a constrained subset of cross-origin data but cannot modify content or cause a denial of service. No public exploit code has been identified and the EPSS score of 0.31% (23rd percentile) reflects low real-world exploitation probability at time of analysis.
ServiceWorker improper input validation in Google Chrome prior to 152.0.7977.65 enables a remote attacker to bypass system access restrictions by directing a user to a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms no authentication is required from the attacker but user interaction is necessary, limiting the scope of practical exploitation. No public exploit has been identified at time of analysis, and EPSS is low at 0.30% (23rd percentile), consistent with the internal Chromium severity rating of Low.
Incorrect reference resolution in Chrome's Loader component prior to version 152.0.7977.65 enables unauthenticated remote attackers to bypass the browser's web origin policy via crafted network traffic, with user interaction required. The flaw (CWE-706) allows misattribution of resource origins, potentially exposing cross-origin data; CVSS rates impact as limited confidentiality loss only. With an EPSS of 0.30% at the 22nd percentile and no CISA KEV listing, exploitation appears theoretical at this time rather than actively occurring, though origin policy bypass is a meaningful primitive for targeted attacks.
Authorization bypass in the BetterLinks WordPress plugin (all versions ≤ 3.1.0) permits any authenticated subscriber-level user to create arbitrary short URLs with attacker-controlled slugs and redirect destinations, enabling phishing campaigns that abuse the victim site's trusted domain and SEO manipulation. Exploitation is conditional on the Fluent Boards companion plugin being simultaneously installed and active, and is facilitated by the plugin leaking the betterlinks_admin_nonce to all authenticated users on every frontend page via wp_localize_script. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; real-world risk is bounded by the dual-plugin dependency and the requirement for a valid WordPress account.
Incorrect authorization in the Device component of Google Chrome prior to version 152.0.7977.65 enables remote attackers to bypass system access restrictions - specifically controls governing device-level API access - through a crafted HTML page delivered via social engineering. Exploitation requires user interaction, limiting opportunistic mass exploitation, and EPSS at 0.29% (21st percentile) reflects low real-world exploitation probability. No public exploit identified and no CISA KEV listing; a vendor patch is available.
SQL injection in GazellePW's country-code lookup endpoint exposes authenticated operators to arbitrary database reads via the unsanitized `ip` parameter in requests to `tools.php?action=get_cc`. The CVSS-rated confidentiality impact of C:L is likely understated - a publicly referenced blog post titled '1-click exploit chain for complete GazellePW database compromise' indicates full database exfiltration is achievable. No public exploit identified as confirmed CISA KEV, but exploit chain documentation exists, elevating practical risk for private torrent tracker operators running this codebase.
UI spoofing in Google Chrome's Transactions Platform prior to version 152.0.7977.65 enables remote attackers to misrepresent UI elements - such as payment confirmation dialogs or security indicators - through a crafted HTML page, relying on social engineering for delivery. Classified under CWE-451 (UI Misrepresentation of Critical Information), the flaw requires user interaction and carries no confidentiality or availability impact, confining harm to integrity via deception. No active exploitation is confirmed and EPSS probability is very low (0.29%), but the ubiquitous deployment footprint of Chrome means the absolute population of potential targets is large.
ServiceWorker incorrect authorization in Google Chrome prior to 152.0.7977.65 enables remote attackers to bypass the web origin policy by inducing a victim to visit a crafted HTML page. The flaw (CWE-863) allows a ServiceWorker to access cross-origin resources it should be forbidden from reading, yielding a low confidentiality impact with no integrity or availability consequence. No public exploit or active exploitation has been identified; vendor-released patch 152.0.7977.65 is available.
The Viz compositor component in Google Chrome prior to 152.0.7977.65 can be exploited by an attacker who has already achieved renderer process compromise to bypass Chrome's web origin policy via a crafted HTML page. This is a chained exploit primitive, not a standalone initial-access vector - it escalates an existing renderer foothold into cross-origin data access. EPSS sits at 0.29% (21st percentile), no CISA KEV listing exists, and no public exploit code has been identified, placing real-world urgency below what raw CVSS metrics alone might suggest.
Incorrect authorization in the Navigation subsystem of Google Chrome prior to version 152.0.7977.65 enables remote attackers to bypass the browser's web origin policy by luring a victim to a crafted HTML page. The flaw, classified under CWE-863 (Incorrect Authorization), allows partial cross-origin data reads (limited confidentiality impact per CVSS C:L). No public exploit code or active exploitation has been identified at time of analysis, and the low EPSS score of 0.29% (21st percentile) reflects a currently low real-world exploitation probability. Vendor-released patch 152.0.7977.65 is available.
Web origin policy bypass in Google Chrome's network layer prior to version 152.0.7977.65 allows a remote attacker to circumvent the browser's same-origin enforcement by luring a user to a crafted HTML page. The flaw stems from incorrect authorization logic (CWE-863) in Chrome's networking stack, resulting in limited confidentiality exposure (C:L) with no integrity or availability impact. No active exploitation has been confirmed by CISA KEV, and the EPSS score of 0.29% (21st percentile) indicates low observed exploitation probability at time of analysis.
Quiz result data exposure in the WP Courses LMS WordPress plugin lets any authenticated user read other users' quiz answers and scores by enumerating sequential resultID integers via the wpcq_get_quiz_result AJAX action. All plugin versions through 3.2.29 are affected; the only access gate - a frontend-exposed WordPress nonce - functions as an anti-CSRF token, not an authorization check, and is freely available to every logged-in user, providing no meaningful barrier. No public exploit code and no CISA KEV listing exist at time of analysis, but the trivial exploitation path and privacy implications of exposed assessment data make this a near-term remediation priority for any platform hosting sensitive educational content.
Web origin policy bypass in Google Chrome's Network component (all versions prior to 152.0.7977.65) permits a remote attacker who has already compromised the renderer process to circumvent same-origin policy enforcement via a crafted HTML page, yielding limited cross-origin data disclosure. The flaw arises from improper input validation (CWE-20) in the network stack and functions as a second-stage amplifier within an exploit chain rather than a standalone initial-access vector. EPSS is very low at 0.28% (20th percentile), and no public exploit code or CISA KEV listing has been identified at time of analysis.
Improper input validation in Chrome's DeviceBoundSessionCredentials (DBSC) component allows remote attackers to bypass the web origin policy by delivering crafted network traffic, contingent on social engineering the user into triggering the request. All Chrome versions prior to 152.0.7977.65 are affected across desktop platforms. No public exploit code has been identified and EPSS sits at 0.28% (20th percentile), consistent with the low-to-medium CVSS 4.3 rating and the user-interaction prerequisite.
Chrome's FileSystem API implementation prior to version 152.0.7977.65 contains incorrect authorization logic (CWE-863) that permits a remote attacker to bypass system access restrictions by directing a user to a crafted HTML page via social engineering. The bypass produces a limited integrity impact - unauthorized write or access to filesystem-restricted resources - with no confidentiality or availability consequence per the CVSS vector (I:L, C:N, A:N). No public exploit code exists and the vulnerability is absent from CISA KEV; EPSS of 0.27% (19th percentile) reflects low near-term exploitation probability.
Cross-origin data leakage in Google Chrome's Canvas API (versions prior to 152.0.7977.65) allows a remote, unauthenticated attacker to read pixel-level data from cross-origin resources rendered in a canvas element via a crafted HTML page. Exploitation requires user interaction - the victim must visit an attacker-controlled page - and impact is limited to partial confidentiality loss (C:L), with no integrity or availability consequences. No public exploit code has been identified and EPSS sits at 0.27% (18th percentile), indicating low real-world exploitation probability; vendor-released patch is available.
Cross-origin data leakage via an uninitialized resource in the WebXR API affects Google Chrome versions prior to 152.0.7977.65. An unauthenticated remote attacker who can socially engineer a user into visiting a crafted HTML page may trigger a read of uninitialized memory, potentially exposing data from other browser origins. Google has rated this Medium severity; a patched release (152.0.7977.65) is available, and no public exploit or active exploitation has been identified at time of analysis.
Race condition in Google Chrome's Permissions component on Android allows a remote attacker, through social engineering, to bypass the web origin policy and access limited cross-origin data. Affected are all Chrome for Android versions prior to 152.0.7977.65. Exploitation requires user interaction with a crafted HTML page; no public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.26% (18th percentile) reflects low observed exploitation probability.
Missing authorization in Google Chrome's Browser component on macOS (versions prior to 152.0.7977.65) enables remote attackers to bypass the web origin policy and reach privileged browser pages via a crafted HTML page, contingent on social engineering the victim into visiting the page. Impact is limited to integrity (CVSS I:L) with no confidentiality or availability consequences; EPSS at 0.26% (18th percentile) signals negligible current exploitation probability. No public exploit identified at time of analysis, and the vendor-released patch is available as of version 152.0.7977.65.
Web origin policy bypass in Google Chrome prior to 152.0.7977.65 allows a remote attacker to circumvent same-origin restrictions via a crafted HTML page, achieving limited integrity impact in the user's browsing context. The flaw is rooted in incorrect authorization logic (CWE-863) within Chrome's Select component, as confirmed by the vendor's stable channel advisory. No public exploit has been identified at time of analysis, and EPSS signals very low exploitation probability at 0.26% (18th percentile), consistent with Chromium's own Low severity rating.
Web origin policy bypass in Google Chrome's Network component (all versions prior to 152.0.7977.65) grants a remote attacker who has already compromised the renderer process the ability to circumvent Same-Origin Policy restrictions via a crafted HTML page, leaking limited confidential data from cross-origin contexts. This is a second-stage exploitation primitive - it is only dangerous when chained with a separate renderer compromise vulnerability. No public exploit identified at time of analysis, and the low EPSS score of 0.26% (18th percentile) reflects minimal current exploitation interest.
HttpsUpgrades protection mechanism failure in Google Chrome prior to 152.0.7977.65 enables remote attackers to bypass the browser's web origin policy via crafted network traffic. The vulnerability affects all desktop Chrome installations before the patched stable channel release and requires user interaction to trigger, consistent with CVSS UI:R. No public exploit code has been identified and no CISA KEV listing exists; the EPSS score of 0.26% (18th percentile) indicates low current exploitation probability.
Web origin policy bypass in Google Chrome's ReaderMode feature prior to version 152.0.7977.65 allows a remote attacker to inject content into a privileged browser page context via a crafted HTML page, requiring social engineering to achieve user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) limits impact to integrity only, with no confidentiality or availability consequences. No public exploit code or CISA KEV listing exists; EPSS at 0.26% (17th percentile) confirms very low observed exploitation probability.
Race condition in Google Chrome's Core component on Windows (all versions prior to 152.0.7977.65) enables a remote attacker to bypass the browser's web origin policy via a crafted HTML page, requiring social engineering to induce user interaction. Exploitation allows partial cross-origin data disclosure (C:L), with no integrity or availability impact. No public exploit code has been identified and no active exploitation is confirmed; EPSS sits at 0.24% (15th percentile), consistent with Chromium's own 'Low' severity rating for this issue.
Uninitialized memory in Chrome's ANGLE graphics abstraction layer, across all desktop platforms prior to version 152.0.7977.65, enables remote attackers to read cross-origin data by delivering a crafted HTML page to a victim user. The flaw breaks the browser's same-origin policy through the graphics pipeline rather than through JavaScript or DOM manipulation. No public exploit or CISA KEV listing exists; EPSS of 0.24% at the 15th percentile reflects low current exploitation pressure.
Improper access control in Chrome's Workers subsystem allows a remote unauthenticated attacker to bypass the web origin policy by luring a user to a crafted HTML page, resulting in limited cross-origin data leakage. Affected versions span all Chrome releases prior to 152.0.7977.65 across desktop platforms. No public exploit identified at time of analysis and EPSS probability stands at 0.24% (15th percentile), indicating this is a low-urgency but real boundary-enforcement gap in the browser's sandboxing model.
Incorrect authorization in Chrome's WebAppInstalls component on Android (versions prior to 152.0.7977.65) enables a remote attacker to bypass system access restrictions by luring a user to a crafted HTML page. The flaw (CWE-863) results in a low-integrity impact with no confidentiality or availability consequence, consistent with CVSS 4.3 Medium. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS of 0.24% (15th percentile) signals low current exploitation interest.
Google Chrome's Preload subsystem prior to version 152.0.7977.65 contains a missing authorization flaw (CWE-862) that permits unauthenticated remote attackers to bypass the web origin policy. By delivering a crafted HTML page to a victim running an unpatched Chrome browser, an attacker can cause the Preload mechanism to speculatively fetch cross-origin resources without enforcing same-origin access controls, resulting in limited confidentiality exposure. No public exploit has been identified at time of analysis, and a vendor-released patch is available in Chrome 152.0.7977.65.
Web origin policy bypass in Google Chrome prior to 152.0.7977.65 enables a remote attacker who has already achieved renderer process compromise to read limited cross-origin data via a crafted HTML page. The vulnerability stems from CWE-863 (Incorrect Authorization) in Chrome's Input component, which fails to enforce origin boundaries correctly when processing renderer-supplied input. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS sits at 0.24% (15th percentile), consistent with low observed exploitation pressure.
Incorrect authorization in Google Chrome's Extensions subsystem (all versions before 152.0.7977.65) allows an attacker who has already compromised the renderer process to bypass the web origin policy and reach privileged browser pages via a crafted HTML page. This is a chained, second-stage vulnerability - a prior renderer compromise is required - substantially narrowing the realistic attacker pool despite the network-accessible vector. No active exploitation is confirmed (not listed in CISA KEV), and the EPSS probability of 0.24% at the 15th percentile is consistent with this chained attack profile.
Incorrect authorization in Google Chrome's Transactions Platform (versions prior to 152.0.7977.65) permits a remote attacker who has already achieved renderer process compromise to bypass the browser's web origin policy via a crafted HTML page. The flaw is classified CWE-863 and carries a vendor severity of High, though the CVSS base score of 4.3 reflects the limited confidentiality-only impact and required user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.24% (15th percentile) indicates low observed exploitation probability.
Incorrect authorization in the Paint component of Google Chrome before version 152.0.7977.65 enables remote unauthenticated attackers to potentially bypass the Same-Origin Policy via a crafted HTML page, resulting in limited cross-origin data exposure. Exploitation requires user interaction - the victim must navigate to the attacker-controlled page - and impact is confined to partial confidentiality loss with no integrity or availability effect. No public exploit code has been identified at time of analysis and the low EPSS score of 0.24% (15th percentile) corroborates low observed exploitation activity; a vendor patch was released in the Chrome 152 stable channel.
Missing authorization in Google Chrome's Passwords component prior to version 152.0.7977.65 allows a remote attacker, who has already compromised the renderer process, to bypass web origin policy and access stored password data for other origins via a crafted HTML page combined with social engineering. The attack requires two chained prerequisites - renderer compromise and user interaction - which significantly constrains real-world exploitability despite the network-facing attack vector. No active exploitation (KEV) or public proof-of-concept has been identified; EPSS sits at a very low 0.24% (15th percentile). A vendor patch is available.
Cross-origin data exposure in Google Chrome's StorageAccessAPI implementation allows a remote attacker to read data across origin boundaries by directing a victim to a specially crafted HTML page. All Chrome desktop releases prior to 152.0.7977.65 are affected across all platforms. No public exploit code has been identified and CISA SSVC classifies current exploitation status as none, consistent with the Chromium team's own Low severity rating.
Uninitialized resource use in Chrome's ANGLE graphics abstraction layer (versions prior to 152.0.7977.65) enables remote attackers to potentially bypass the web origin policy via a crafted HTML page, resulting in limited cross-origin information disclosure. Exploitation requires user interaction - a victim must visit the attacker-controlled page - which constrains real-world impact despite the network-accessible attack vector. No public exploit code and no CISA KEV listing are present; EPSS places exploitation probability at 0.24% (15th percentile), consistent with a low-priority but broadly applicable patch.
Web origin policy bypass in Google Chrome's Preload component (versions prior to 152.0.7977.65) enables a remote attacker who has already compromised the renderer process to read cross-origin data via a specially crafted HTML page. Classified as CWE-20 (Improper Input Validation) with a vendor-assigned CVSS score of 4.3 (Medium), the vulnerability is a second-stage attack primitive rather than a standalone exploit - requiring prior renderer compromise as a hard prerequisite. No public exploit code or active exploitation has been confirmed at time of analysis; Google has released a fix in Chrome 152.0.7977.65.
Origin policy bypass in Google Chrome prior to 152.0.7977.65 exposes users to potential cross-site data leakage when a victim visits an attacker-controlled page. The Network component fails to properly validate input (CWE-20), enabling circumvention of the browser's web origin policy - a fundamental Same-Origin Policy enforcement mechanism - allowing a remote attacker to read data from origins other than the page's own. No public exploit has been identified and EPSS stands at 0.24% (15th percentile), indicating low current exploitation probability, though Chrome's ubiquitous global deployment amplifies the aggregate exposure.
Web origin policy bypass in Google Chrome before 152.0.7977.65 exploits improper input validation (CWE-20) in the browser's Input component, allowing a remote attacker who has already compromised the renderer process to circumvent same-origin protections via a crafted HTML page combined with social engineering. The confidentiality impact is limited (CVSS C:L) with no integrity or availability consequence, and the Chromium team rates this Medium severity. No public exploit code exists and EPSS at 0.24% (15th percentile) reflects the low opportunistic exploitation probability given the chained pre-conditions required.
PyOpenEXR Python bindings in OpenEXR versions 3.3.0-3.3.12 and 3.4.0-3.4.13 leak uninitialized same-process heap memory to calling Python code when processing crafted deep scanline EXR files that contain layer-prefixed RGB channels. The flaw originates in PyPart::setDeepSliceData(), where lane assignment uses exact unprefixed string matching, leaving the green and blue NumPy array lanes uninitialized before returning them to the caller. Python applications ingesting untrusted EXR files that subsequently log, serialize, or transmit the resulting arrays may inadvertently expose heap contents; no public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Improper privilege management in Google Chrome's FileSystem subsystem (all versions prior to 152.0.7977.65) allows a remote attacker to bypass system access restrictions by tricking a user into loading a specially crafted HTML page. The flaw is rated CVSS 4.3 (Medium) with impact limited to low integrity bypass - no confidentiality or availability impact - and carries an EPSS of 0.23% (13th percentile), indicating minimal observed exploitation interest. Vendor patch is available in stable channel 152.0.7977.65; no public exploit code or CISA KEV listing has been identified at time of analysis.
Incorrect authorization in Google Chrome Mobile on iOS (versions prior to 152.0.7977.65) allows a remote attacker to bypass system access restrictions by inducing a user to visit a crafted HTML page. The flaw stems from improper authorization enforcement (CWE-863) within the iOS-specific mobile browser code path, permitting limited integrity violations without confidentiality or availability impact. No public exploit has been identified and EPSS sits at a low 0.23% (13th percentile), consistent with a medium-severity, user-interaction-dependent issue not yet seeing active targeting.
Incorrect authorization in Chrome's Network component allows remote unauthenticated attackers to bypass system access restrictions via a crafted HTML page, resulting in low-integrity impact. All Chrome versions prior to 152.0.7977.65 are affected across desktop platforms. No public exploit code has been identified and EPSS at 0.23% (13th percentile) reflects low real-world exploitation probability; a vendor patch has been issued in the stable channel.
Missing authorization in Google Chrome's Network component, prior to version 152.0.7977.65, allows a remote attacker who has already compromised the renderer process to bypass system access restrictions by serving a crafted HTML page to a user. This is effectively a second-stage sandbox-bypass vulnerability requiring a pre-compromised renderer as a prerequisite, making it a chained exploit component rather than a standalone critical flaw. No public exploit code and no CISA KEV listing have been identified; EPSS is 0.23% (13th percentile), consistent with low near-term exploitation probability. A vendor patch is available in stable channel release 152.0.7977.65.
Authorization bypass in the FundEngine WordPress donation and crowdfunding plugin (all versions through 1.8.1) allows authenticated subscribers to overwrite the title, body, and author field of any post or page on the affected site. The vulnerable handler in apps/content.php accepts an attacker-supplied post_author integer without verifying the caller's rights over the target post, and the wp_rest nonce that nominally gates the endpoint is freely retrievable by any logged-in user from /wp-admin/admin-ajax.php?action=rest-nonce, eliminating it as a meaningful access control. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and minimal authentication requirement elevate real-world risk on sites that permit open subscriber registration.