Missing authorization in Chrome's Preload subsystem (CWE-862) allows an attacker who has already compromised the renderer process to bypass the web origin policy via a crafted HTML page, affecting all Chrome desktop versions prior to 152.0.7977.65. The bypass results in limited cross-origin data disclosure (confidentiality impact only). No public exploit code has been identified and the CVE is absent from the CISA KEV catalog; EPSS stands at 0.22% (13th percentile), consistent with low real-world exploitation activity.
Incorrect authorization in Google Chrome's Web Authentication subsystem (Passkeys and Security Keys) allows a remote attacker to bypass the web origin policy by inducing a user to visit a crafted HTML page. All Chrome versions prior to 152.0.7977.65 on desktop platforms are affected. The impact is limited to partial confidentiality - origin policy bypass could expose authentication context or credential associations across origins - with no integrity or availability impact confirmed.
Cross-origin data leakage in Google Chrome's Payments subsystem (prior to 152.0.7977.65) exposes information from other origins when a user visits a crafted HTML page. The vulnerability stems from improper isolation within the Payments component, allowing a remote unauthenticated attacker to read data across origin boundaries - a violation of the Same-Origin Policy that underpins browser security. No public exploit code has been identified at time of analysis, and EPSS of 0.22% (13th percentile) indicates low observed exploitation probability in the wild.
Cross-origin data exfiltration via Skia, Chrome's graphics rendering engine, affects all Google Chrome versions prior to 152.0.7977.65, enabling remote unauthenticated attackers to read pixel-level cross-origin data from a victim's browser session. Exploitation requires user interaction - the victim must visit a crafted HTML page - and impact is limited to partial confidentiality loss with no integrity or availability consequence. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.22% (13th percentile) indicates minimal observed exploitation pressure.
Cross-origin data exposure via the GPU subsystem in Google Chrome prior to 152.0.7977.65 allows a remote, unauthenticated attacker to read data from other web origins by luring a user to a crafted HTML page. The vulnerability resides in Chrome's GPU rendering path and violates the browser's same-origin policy, potentially exposing session tokens, rendered content, or other sensitive cross-origin data. No public exploit code or CISA KEV listing has been identified, and the EPSS score of 0.22% (13th percentile) reflects low current exploitation probability.
Authorization bypass in the Newsletters plugin for WordPress (all versions up to and including 4.17) allows authenticated attackers holding at minimum author-level access to send mass emails to any WordPress user role - including administrators - by forging the newsletters_mailinglistsroles POST field during ordinary post submission. The forged role slug is passed unchecked directly to WordPress's get_users() function, enabling the attacker to weaponize the site's own trusted outbound email channel for phishing campaigns targeting privileged accounts. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low attack complexity and common provisioning of author accounts on multi-contributor sites make exploitation realistic.
System access restriction bypass in Google Chrome Mobile on iOS prior to version 152.0.7977.65 enables a remote attacker to circumvent platform-level security controls by luring a victim to a specially crafted HTML page. The flaw stems from improper input validation (CWE-20) in Chrome's iOS mobile implementation and results in a low-integrity impact with no confidentiality or availability consequence. No public exploit code or active exploitation has been identified at time of analysis; EPSS probability is 0.22% (12th percentile), and CISA SSVC classifies exploitation as none and technical impact as partial, consistent with a low-priority patching posture for most organizations.
DOM information leak in Google Chrome before version 152.0.7977.65 enables remote attackers to bypass the Same-Origin Policy by luring a victim to a crafted HTML page, potentially exposing cross-origin data to the attacker. The CVSS 4.3 Medium score reflects network-exploitable, unauthenticated delivery limited to confidentiality impact with no integrity or availability consequences. No public exploit code has been identified at time of analysis, and an EPSS probability of 0.22% (12th percentile) indicates low near-term exploitation likelihood despite the broad affected product footprint.
Improper input validation in Google Chrome's Safebrowsing component prior to version 152.0.7977.65 allows remote attackers to bypass system access restrictions via a crafted file. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms the attack is network-reachable without authentication but requires user interaction, constraining opportunistic or automated exploitation at scale. EPSS at 0.22% (12th percentile) and absence from CISA KEV indicate low real-world exploitation probability at time of analysis; no public exploit code has been identified.
Safebrowsing in Google Chrome prior to 152.0.7977.65 fails to properly validate input from crafted files, permitting remote attackers to bypass system access restrictions that the component is designed to enforce. The attack requires user interaction - specifically opening a crafted file - and results in limited integrity impact with no confidentiality or availability compromise. No public exploit code or CISA KEV listing has been identified; EPSS exploitation probability is very low at 0.22% (12th percentile), consistent with the Chromium team's Medium severity classification.
Web origin policy bypass in Google Chrome's Variations component (the Finch A/B testing and feature-flag delivery system) affects all Chrome versions prior to 152.0.7977.65. A remote attacker can deliver crafted network traffic to a user running a vulnerable browser version, potentially circumventing same-origin protections and reading cross-origin data. No public exploit code or CISA KEV listing exists at time of analysis; EPSS at 0.22% (12th percentile) signals low current exploitation activity.
UI spoofing in Google Chrome prior to 152.0.7977.65 allows unauthenticated remote attackers to misrepresent browser interface elements through a crafted HTML page, requiring only that a user visit the malicious content. Classified as CWE-451 (UI Misrepresentation of Critical Information), the flaw breaks the trust contract between the browser and user by rendering deceptive interface states - a classic phishing-enabler primitive. No public exploit code has been identified and EPSS stands at 0.22% (12th percentile), consistent with Chromium's own Low severity rating; real-world exploitation impact is constrained by its dependence on social engineering and user interaction.
Incorrect USB authorization in Google Chrome prior to 152.0.7977.65 allows a remote attacker to bypass system USB access restrictions by socially engineering a user into visiting a crafted HTML page. The flaw (CWE-863) in Chrome's USB subsystem grants unauthorized access without proper permission verification, resulting in a limited integrity impact with no confidentiality or availability consequences. No public exploit code exists and EPSS is very low at 0.21% (11th percentile), consistent with Chromium's own Medium severity rating; a vendor patch has been released.
Incorrect authorization in Google Chrome's Extensions subsystem (versions prior to 152.0.7977.65) permits a remote attacker to bypass system access restrictions through a crafted Chrome extension delivered via social engineering. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms mandatory user interaction limits opportunistic exploitation, and impact is constrained to integrity with no confidentiality or availability consequence. No public exploit code or CISA KEV listing has been identified; EPSS at 0.21% (11th percentile) reflects low current exploitation probability consistent with the social-engineering dependency.
UI spoofing in Google Chrome on macOS prior to 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to forge browser UI elements via a crafted HTML page, potentially deceiving users into believing they are interacting with a trusted interface. The vulnerability is macOS-specific and requires renderer process compromise as an explicit prerequisite, significantly limiting its standalone exploitability. No public exploit code or active exploitation (CISA KEV) has been identified; an EPSS score of 0.21% (11th percentile) reflects negligible likelihood of independent exploitation.
Race condition in Google Chrome for Android's WebAppInstalls component allows a remote attacker, through social engineering, to bypass web origin policy by exploiting a co-installed application on the same device. All Chrome for Android versions prior to 152.0.7977.65 are affected. The impact is limited to a partial confidentiality breach via cross-origin data access; no integrity or availability impact has been identified. No public exploit code exists and EPSS probability sits at 0.20% (10th percentile), indicating very low near-term exploitation likelihood despite Chromium's internal 'High' severity rating.
Incorrect reference resolution in the CustomTabs component of Google Chrome for Android (all versions prior to 152.0.7977.65) allows a remote, unauthenticated attacker to bypass Android system access restrictions by delivering a crafted HTML page. The integrity impact is limited (I:L, S:U) with no confidentiality or availability consequence. No public exploit code exists and exploitation status is confirmed as none by SSVC assessment, placing this squarely in standard patch-cycle priority rather than emergency response.
Incorrect reference resolution in the WebView component of Google Chrome on Android (versions prior to 152.0.7977.65) enables a remote attacker to potentially bypass the web origin policy by delivering a crafted HTML page. The flaw carries a Chromium-internal severity of Low, consistent with the limited confidentiality-only impact (C:L/I:N/A:N) reflected in the CVSS 4.3 score. No public exploit has been identified at time of analysis, and the EPSS score of 0.20% (10th percentile) confirms negligible current exploitation probability.
Web origin policy bypass in Google Chrome's cache component affects all versions prior to 152.0.7977.65, exploitable by a remote unauthenticated attacker who tricks a user into visiting a crafted HTML page. The incorrect reference resolution (CWE-706) in the cache layer allows cross-origin data to be read, constituting a Same-Origin Policy bypass with limited confidentiality impact. No active exploitation is confirmed and EPSS sits at 0.20% (10th percentile), indicating low real-world exploitation pressure at this time.
Broken access control in GazellePW's API user endpoint permits any authenticated user holding a standard API token to enable or disable arbitrary user accounts - including administrator accounts - via the req=disable or req=enable action parameters. Affected is GazellePW at commit 86c4bedf727691b5a97af42a4864869d18446449. A researcher has published a multi-step exploit chain at snaacky.com documenting how this flaw can be combined with other weaknesses to achieve complete database compromise; no public exploit identifier (CISA KEV) has been confirmed but public exploit documentation exists.
Web Workers race condition in Google Chrome prior to 152.0.7977.65 enables Same-Origin Policy bypass for attackers who have already achieved renderer process compromise. The flaw (CWE-367 TOCTOU) allows a timing attack between origin validation and Worker data access, permitting cross-origin data reads from within a compromised renderer. No active exploitation is confirmed (not in CISA KEV) and EPSS of 0.19% (9th percentile) reflects the chained-exploit prerequisite that substantially limits real-world attacker reach.
Incorrect authorization in the Controls component of Google Chrome prior to version 152.0.7977.65 enables web origin policy bypass via a crafted HTML page, requiring only that a user visit the attacker-controlled page. The flaw (CWE-863) allows limited cross-origin integrity manipulation with no confidentiality or availability impact, as reflected in the CVSS integrity-only impact score. No public exploit has been identified at time of analysis, EPSS stands at 0.19% (8th percentile), and the Chromium team internally rated severity as Low - all signals consistent with a narrow-impact, user-interaction-dependent authorization gap.
Web origin policy bypass in Google Chrome Extensions affects all desktop versions prior to 152.0.7977.65, exploitable only by an attacker who has already compromised the renderer process. The incorrect authorization flaw (CWE-863) in the Extensions subsystem allows the renderer-level attacker to cross Same-Origin Policy boundaries via a specially crafted HTML page, potentially reading data from origins the renderer should not access. No public exploit code and no CISA KEV listing exist; EPSS is 0.19% (8th percentile), consistent with Chromium's own 'Low' severity rating for this issue.
Incorrect authorization in Chrome's WebProtect component (CWE-863) allows a remote attacker to bypass system access restrictions via a crafted HTML page, affecting all Chrome versions prior to 152.0.7977.65. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms impact is limited to partial integrity loss with no confidentiality or availability consequence, and exploitation is gated on the victim actively navigating to attacker-controlled content. No active exploitation is confirmed - CISA KEV status is absent and EPSS stands at 0.19% (8th percentile), consistent with the Low severity rating assigned by the Chromium security team.
Incorrect authorization in Google Chrome's browser component prior to version 152.0.7977.65 allows web origin policy bypass via a crafted HTML page. Remote unauthenticated attackers can exploit this flaw by inducing a user to visit a malicious page, resulting in limited cross-origin data reads - a breach of the same-origin policy, which is a foundational browser security boundary. No public exploit identified at time of analysis and not listed in CISA KEV; EPSS of 0.19% (8th percentile) confirms low exploitation probability in the current threat landscape.
Incorrect authorization in Google Chrome's Network component prior to version 152.0.7977.65 allows a remote, unauthenticated attacker to bypass the browser's web origin policy by delivering a crafted HTML page to a victim. The bypass yields limited confidentiality exposure, consistent with the CVSS C:L rating, and requires the target user to interact with attacker-controlled content. No public exploit code has been identified and EPSS stands at 0.19% (8th percentile), indicating low current exploitation probability despite the broad deployment footprint of Chrome.
Improper resource exposure in Google Chrome's StreamsAPI (versions prior to 152.0.7977.65) enables remote attackers to partially bypass the web origin policy and read limited data from privileged browser pages via a crafted HTML page. Exploitation requires user interaction - the victim must visit an attacker-controlled page - consistent with CVSS UI:R and S:U, confining impact to the victim's own browser context. No active exploitation is confirmed (not in CISA KEV), and an EPSS score of 0.18% (8th percentile) indicates very low real-world exploitation probability at time of analysis.
Incorrect authorization (CWE-863) in Chrome's Browser component on Android allows remote attackers to bypass system access restrictions through social engineering and UI interaction. Affected versions are all Chrome releases for Android prior to 152.0.7977.65. The flaw carries only a limited integrity impact with no confidentiality or availability consequence, and Chromium's own severity rating of 'Low' is consistent with the very low EPSS score of 0.17% (7th percentile). No public exploit code exists and the vulnerability has not been added to the CISA KEV catalog.
Address bar spoofing in Google Chrome for Android's CustomTabs feature enables remote unauthenticated attackers to misrepresent the displayed URL to users through a crafted HTML page. All Chrome for Android versions prior to 152.0.7977.65 are affected on the Android platform only; desktop Chrome is not impacted. No public exploit identified at time of analysis, and the EPSS score of 0.17% (7th percentile) combined with Chromium's own 'Low' severity rating reflect limited real-world exploitation probability, though the phishing-enablement potential makes it worth patching promptly.
Chrome's PermissionElement component can be visually spoofed via a crafted HTML page, allowing a remote attacker to mislead users into granting browser permissions they did not intend to approve. All Chrome desktop versions prior to 152.0.7977.65 are affected, as confirmed by the vendor's Stable Channel advisory and EUVD-2026-66037. No public exploit code has been identified at time of analysis, and EPSS at 0.17% reflects negligible observed exploitation interest.
Cross-origin data exposure via a ServiceWorker flaw in Google Chrome prior to 152.0.7977.65 permits remote attackers to read data from origins they do not control. An attacker can exploit this by delivering a crafted HTML page to a victim user, leveraging Chrome's ServiceWorker API to bypass same-origin isolation and exfiltrate cross-origin responses. No public exploit code is identified at time of analysis, and the EPSS score of 0.17% (7th percentile) reflects low observed exploitation activity; the mandatory user-interaction requirement further constrains automated abuse.
Incorrect authorization in Chrome's ServiceWorker component (CWE-863) allows remote unauthenticated attackers who can socially engineer a user into installing a crafted Chrome extension to bypass the web origin policy, resulting in limited cross-origin data exposure. All Chrome releases prior to 152.0.7977.65 are affected across platforms; a vendor patch is available. No public exploit code has been identified and the EPSS score of 0.17% (7th percentile) indicates very low current exploitation probability, consistent with the absence of a CISA KEV listing.
Insecure Direct Object Reference in Fluent Boards Pro WordPress plugin (all versions through 2.0.11) enables authenticated attackers with Subscriber-level access to perform unauthorized actions by supplying arbitrary user-controlled object keys that the plugin accepts without ownership validation. The CVSS 4.3 Medium rating reflects network accessibility offset by the authentication prerequisite and limited integrity-only impact. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Unauthorized action execution in Fluent Support Pro plugin for WordPress (all versions through 2.3.1) is possible for any authenticated subscriber-level user due to a missing capability check on a plugin function. The missing check (CWE-862) means WordPress's built-in role/capability enforcement is bypassed, allowing low-privileged users to invoke functionality reserved for higher-privilege roles. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog; however, the low authentication bar (any registered user) makes it accessible to a broad attacker pool on sites with open user registration.
Incorrect authorization in Chrome's CustomTabs feature on Android (prior to 152.0.7977.65) allows a co-installed malicious application to bypass the browser's web origin policy. The flaw is classified CWE-863 and is limited to Android deployments where an attacker controls a separately installed app on the same device. A vendor patch was released in Chrome 152.0.7977.65; no public exploit code or CISA KEV listing exists, and EPSS sits at 0.14% (3rd percentile), indicating minimal observed exploitation pressure.
Web origin policy bypass in Google Chrome for Windows (prior to 152.0.7977.65) stems from inadequate encryption strength in the browser's Notifications subsystem, exploitable via a crafted HTML page using social engineering. An unauthenticated remote attacker who tricks a user into visiting a malicious page can read limited cross-origin notification data, violating the same-origin boundary. No public exploit code has been identified and EPSS is extremely low (0.13%, 3rd percentile), consistent with the Chromium team's own Medium severity rating.
System access restriction bypass in Google Chrome's Workers subsystem affects all versions prior to 152.0.7977.65, functioning as the second link in an exploit chain where an attacker must first compromise the renderer process. Improper input validation in Workers then allows a crafted HTML page to circumvent Chrome's sandbox-enforced access controls, yielding limited confidentiality and integrity impact on the host. EPSS is 0.22% (12th percentile) with no confirmed active exploitation via CISA KEV, placing this squarely in the category of a chained, low-probability threat rather than a mass-exploitation vector.
Privilege escalation in Doorkeeper OpenID Connect prior to 1.10.4 allows self-registered OAuth clients to obtain scopes beyond what the server intends to grant. The Dynamic Client Registration endpoint directly assigns client-supplied scope values to the application record without intersecting them against the server's configured `default_scopes` and `optional_scopes`, and because `enforce_configured_scopes` is disabled by default, Doorkeeper's ScopeChecker subsequently honors those persisted application-level scopes over server-level restrictions. No public exploit has been identified at time of analysis; a vendor patch was released July 2, 2026.
HCL Hive's software supply chain governance weaknesses expose the application to risk from vulnerable, unmaintained, or malicious third-party dependencies incorporated into its build or runtime environment. The flaw (CWE-1104) reflects insufficient vetting of upstream components, meaning existing dependencies may carry unpatched CVEs or could serve as an introduction vector for malicious code. With a CVSS of 4.2 (AV:N/AC:H/PR:N/UI:R), exploitation is constrained by high attack complexity and user interaction requirements; no public exploit and no CISA KEV listing were identified at time of analysis.
Forceful Browsing in Drupal Core across multiple active and end-of-life release branches (10.x through 10.6.13, 11.3.x through 11.3.14, 11.4.x through 11.4.4, and all 11.0.x-11.2.x) allows unauthenticated remote attackers to bypass authorization and directly access protected resources due to missing authorization checks (CWE-862). The CVSS vector (AV:N/AC:H/PR:N/UI:R) indicates network-reachable exploitation but with high complexity and required user interaction, limiting opportunistic mass attacks. No active exploitation is confirmed - EPSS stands at 0.13% (3rd percentile) and CISA SSVC rates exploitation as none and not automatable - but a vendor patch is available via SA-CORE-2026-010.
Insecure direct object reference in Kibana's AI Assistant feature allows an authenticated low-privileged user to access or modify another user's AI conversation by supplying that conversation's identifier in API requests. Affected versions are addressed in the Elastic security update ESA-2026-51, covering Kibana 8.16.3 and 8.17.2. No public exploit code or active exploitation has been identified at time of analysis; the AC:H rating reflects the hard-to-guess nature of the conversation identifier as a meaningful practical barrier.
Denial-of-service via heap buffer overflow in SQLite's optional SQLAR extension affects any application that compiles or loads ext/misc/sqlar.c and processes attacker-controlled archive entries. The root cause is an integer-width mismatch in sqlarUncompressFunc(): a 64-bit decompressed-size argument is silently truncated to 32 bits by sqlite3_value_int(), causing sqlite3_malloc() to allocate an undersized heap buffer before zlib's uncompress() writes the full payload into it (CWE-122). The vulnerability is absent from CISA KEV, EPSS stands at 0.28% (20th percentile), the upstream fix is confirmed at Git commit 169f68ed, and a third-party GitHub repository referencing the CVE suggests proof-of-concept code is publicly accessible.
Stack-buffer-underflow in aria2's IOFile::getLine() function through version 1.37.0 allows a crash when the function processes an empty line, causing the expression buf[len - 1] to evaluate as buf[-1] and access memory before the buffer's start. The impact is limited to a local availability disruption - no confidentiality or integrity exposure has been identified - and the EPSS score of 0.15% (5th percentile) confirms negligible real-world exploitation interest. No public exploit code exists and this vulnerability is absent from CISA KEV, placing it firmly in the low-priority tier for most security teams.
Open redirect in Kimai's SAML Assertion Consumer Service handler (versions up to and including 2.52.0) enables an attacker with IdP-level access to redirect successfully authenticated users to arbitrary attacker-controlled URLs by supplying a malicious RelayState POST parameter. The vulnerable code in SamlAuthenticationSuccessHandler.php performs no host or scheme validation on the RelayState value - only checking that it does not equal the configured login_path - meaning any fully qualified external URL is accepted as a redirect destination post-SSO. Exploitation is narrowly constrained: SAML must be explicitly enabled (a non-default configuration) and the attacker must control or compromise the IdP; no public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.