Privilege escalation via symlink attack in SonicWall NetExtender Linux client (versions 10.3.5 and earlier) stems from the NEService auto-upgrade component insecurely handling temporary files, enabling a local low-privileged attacker to manipulate file paths and potentially overwrite or read privileged system files. The CVSS vector confirms full confidentiality, integrity, and availability impact despite requiring local access with high attack complexity. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, though SSVC classifies the technical impact as total.
Scope enforcement bypass in Ech0's comment panel admin API allows any holder of a valid admin-issued access token - regardless of its configured permission scope - to perform unrestricted comment moderation operations across nine unprotected endpoints. All versions of Ech0 before 4.4.3 (CPE: cpe:2.3:a:lin-snow:ech0:*) are affected; the comment router omits the RequireScopes() middleware that every other admin route group in the application applies per-handler. No public exploit has been identified at time of analysis, but exploitation complexity is low for any attacker already holding a scoped access token, making upgrade to 4.4.3 the immediate priority.
OS command injection in NVIDIA OpenShell for Linux's sandbox exec handler allows a low-privileged, network-accessible attacker to inject and execute arbitrary OS commands outside the intended sandbox boundary. All versions are affected per CPE data (cpe:2.3:a:nvidia:openshell:*:*:*:*:*:*:*:*), with confirmed potential impact spanning code execution, information disclosure, and data tampering. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Local file inclusion in Winter CMS before 1.2.13 allows authenticated backend users holding the cms.manage_assets permission to exfiltrate arbitrary server-readable files - including .env - by embedding =include or =require path-traversal directives in theme JavaScript assets. The critical escalation is that the resulting combined asset output is served unauthenticated via the public combine/{file} route, meaning a single privileged write operation exposes APP_KEY and database credentials to any unauthenticated visitor. This is the JavaScript-importer counterpart of two prior Winter CMS LFI bugs (GHSA-58fp-mcx6-7qf9, CVE-2023-52085) in the same asset combiner pipeline. No public exploit identified at time of analysis; vendor-released patch available in 1.2.13.
Remote denial-of-service in vLLM before 0.27.0 allows unauthenticated network attackers to activate the DeepStream GPU video-decode backend per-request, initialize the process-wide GPU decode pool, and submit video content that bypasses pixel-limit enforcement, causing partial availability loss for concurrent inference requests. The root cause is vLLM's failure to classify DeepStream as a GPU backend subject to resource controls combined with an omitted pixel-limit check in the DeepStream decode path (CWE-400). No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Argument injection in Fdawgs node-poppler affects all ten PDF-processing wrapper functions (pdfToText, pdfToCairo, pdfToPpm, and others) in src/index.js across versions up to 9.1.2 and 10.0.1, allowing a remote attacker who can supply a hyphen-prefixed file_path value to inject arbitrary CLI options into the underlying poppler binary invocations. The CVSS 4.0 score of 6.9 reflects network-reachable exploitation with no authentication required at the library level, though real-world exploitability depends on whether the application exposes file_path selection to external input. No public exploit has been identified and no CISA KEV listing exists; a fix is available via upstream GitHub commit db6e3f79d3beb20601be7e59669c39811ae3c330.
Server-side request forgery in Adminer before 5.5.0 allows unauthenticated remote attackers to probe arbitrary internal hosts and ports by injecting PDO DSN keys into the login form's server parameter. The root cause is an incomplete port-validation routine that only inspects leading numeric characters, failing to reject non-numeric port values; a crafted server string such as 'host=internal.host port=6379' bypasses the privileged-port restriction entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the pre-authentication nature and low attack complexity make this an attractive reconnaissance primitive against Adminer deployments exposed to untrusted networks.
Unauthenticated credential exposure in rclone before 1.75.0 allows remote attackers to retrieve backend storage secrets via the pprof debug endpoint, bypassing the main handler's fail-closed authentication entirely. The root cause is architectural: rclone registers Go's net/http/pprof handler on its own separate router route rather than nesting it within the authenticated main handler, so GET /debug/pprof/cmdline returns the full process argv - including cloud backend credentials - to any unauthenticated caller. No CISA KEV listing or confirmed public exploit code exists at time of analysis, but exploitation requires no authentication, no special tooling, and no user interaction, making any network-exposed RC instance immediately vulnerable to credential theft.
Heap memory leaks in Nokogiri's XSLT transform method (versions before 1.19.3) enable gradual denial of service against long-running Ruby applications that pass attacker-controlled input to `Nokogiri::XSLT::Stylesheet#transform` parameters containing null bytes. Each null-byte-bearing call leaks approximately 24-32 bytes of heap memory; meaningful service degradation requires sustained, high-rate malicious traffic against the specific code path. No public exploit has been identified at time of analysis, and the vulnerability is absent from CISA KEV. Notably, the VulnCheck-reported CVSS 4.0 score of 6.9 is higher than the Nokogiri maintainers' own assessment of CVSS 5.3 Moderate, reflecting scoring convention differences rather than disagreement on impact.
Unchecked return value in Nokogiri's CRuby extension (versions 1.5.1 through 1.19.0) causes the `canonicalize` method to silently return an empty string on XML canonicalization failure instead of raising an exception. This silent failure propagates incorrectly to downstream SAML libraries, which have been demonstrated in practice to accept the malformed output as a valid canonicalized document, enabling signature validation bypass. The JRuby implementation is not affected; exploitation has been confirmed as demonstrated by a HackerOne researcher but is not listed in CISA KEV.
Unauthenticated metric inflation in Ech0 before 4.7.3 allows any remote attacker to arbitrarily increment the fav_count field of any post by repeatedly calling PUT /api/echo/like/:id without credentials or rate limiting. The endpoint is explicitly registered on the public router group, bypassing all JWT authentication middleware, and the service layer performs no identity check or per-user binding before executing the database increment. A proof-of-concept is publicly documented in GHSA advisory GHSA-rgj7-vg8v-j4wr; no active exploitation is confirmed via CISA KEV.
Path traversal in rclone's serve s3 command (versions before 1.74.4) allows unauthenticated remote attackers to both read and overwrite files at the serve root directory by embedding dot-dot sequences in S3 object keys. Go's path.Join() in the S3 backend normalizes traversal sequences that the S3 protocol treats as opaque identifiers, so a request like GET /bucket/../root-secret.txt resolves outside the intended bucket scope to a root-level file. A public proof-of-concept is available; no active exploitation has been confirmed in CISA KEV, but the unauthenticated default configuration and low attack complexity make exposed instances high-priority for patching.
Unauthenticated remote attackers can increment the fav_count of any echo - including private ones - in Ech0 through 4.5.6 by issuing repeated PUT /api/echo/like/:id requests with no authentication, rate limiting, or deduplication. Each request triggers a database write and four-key cache invalidation, enabling both persistent metric corruption and amplified load against the database and cache layers. A proof-of-concept is publicly available in the GHSA advisory; no CISA KEV listing exists at time of analysis.
Ech0 before version 4.7.3 exposes guest commenter email addresses to unauthenticated remote callers via public comment-listing API endpoints, due to a missing `json:"-"` serialization tag on the Comment model's Email field. Any attacker with HTTP access to an Ech0 instance can enumerate every guest commenter email stored in the database by calling `/api/comments` or `/api/comments/public` without credentials. A working proof-of-concept script is published in the GHSA advisory; no public exploit has been confirmed as actively exploited (CISA KEV listing absent).
Rocket.Chat's unauthenticated DDP method sendForgotPasswordEmail lacks a rate-limiting rule, enabling any network caller to flood a target email address with password reset messages from the deployment's own mail sender and to enumerate account types at scale. The method is reachable both via the Meteor DDP protocol and the unauthenticated HTTP route POST /api/v1/method.callAnon/sendForgotPasswordEmail, requiring no credentials. A side-channel in the method's response - returning false only when the target belongs to an OAuth-authenticated account with Accounts_AllowPasswordChangeForOAuthUsers disabled - allows an attacker to distinguish account authentication types, confirming information disclosure beyond simple email abuse. No public exploit or KEV listing is identified at time of analysis.
Server-side request forgery in the Grav API plugin before version 1.0.16 allows an attacker who controls authoritative DNS for a configured webhook hostname to reach private internal network resources from the Grav server. The flaw exploits a TOCTOU race (CWE-367) between hostname validation and HTTP delivery: validation resolves the hostname to a legitimate public address, but a DNS rebind before delivery redirects the actual request to an RFC1918 address. No public exploit has been identified at time of analysis and the vulnerability has not been confirmed in CISA KEV.
Integer overflow leading to out-of-bounds write in NI LabVIEW 2026 Q3 and prior enables information disclosure or arbitrary code execution when a user opens a specially crafted VI file. The attack is file-based and requires social engineering to deliver a malicious Virtual Instrument file to a target, making it a credible threat in engineering, research, and industrial automation environments where VI files are routinely shared. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds read in NI LabVIEW 2026 Q3 and all prior versions can result in information disclosure or arbitrary code execution when the application processes a maliciously crafted VI file containing a specially structured image. The root cause is a signed-to-unsigned integer conversion error (CWE-195) in the image-loading code path, causing the parser to read beyond intended memory boundaries. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Symlink following in LACT (Linux AMDGPU Control Tool) versions through 0.10.0 allows a local low-privileged user to redirect privileged file operations to attacker-chosen paths via a crafted UNIX symbolic link, resulting in local denial-of-service. Reported by SUSE and tracked in their Bugzilla (bsc#1276481), the flaw is rooted in CWE-61 and is confined to systems with multi-user local access where LACT is installed. No public exploit code has been identified and the issue does not appear in the CISA KEV catalog.
NULL pointer dereference in OpenEXR 3.4.0-3.4.12 causes a deterministic crash in the OpenEXRCore C API function `exr_attr_set_bytes()` when a caller passes a positive `hint_length` alongside a NULL `type_hint` pointer, enabling reliable denial of service against any application that processes EXR content via this API. The flaw is confined to availability impact with no confidentiality or integrity exposure, and the CVSS 4.0 local attack vector limits remote exploitation to indirect paths such as network-facing EXR parsing pipelines. No public exploit code or active exploitation has been identified; a vendor-released patch is available in version 3.4.13.
Command injection in NVIDIA UFM Enterprise's user management component enables an authenticated administrator to execute arbitrary OS-level commands by sending a crafted API request, spanning all active release tracks (GA, LTS 2023, LTS 2024, LTS 2025). Successful exploitation can yield full code execution on the UFM host, privilege escalation beyond the administrative role, and disclosure of sensitive InfiniBand fabric management data. No public exploit code or CISA KEV listing has been identified at time of analysis, and the adjacent network attack vector (AV:A) constrains the realistic attacker population to those with both admin credentials and access to the management network segment.
Insufficient session expiration in Apache Tomcat allows an authenticated attacker to maintain an active WebSocket connection after the underlying HTTP session has been invalidated, violating the Jakarta WebSocket specification's requirement that WebSocket sessions close when their parent HTTP session ends. Affected are all supported branches from 9.0.0.M1 through 9.0.120, 10.1.0-M1 through 10.1.57, and 11.0.0-M1 through 11.0.24, plus EOL branches 7.0.43-7.0.109 and 8.5.0-8.5.100. No public exploit or CISA KEV listing has been identified at time of analysis, and the low EPSS score (0.28%, 19th percentile) reflects limited real-world exploitation probability.
Chrome's Network component prior to version 152.0.7977.65 contains an improper input validation flaw that allows a pre-positioned attacker - one who has already compromised the renderer process - to bypass system access restrictions via a crafted HTML page. All Google Chrome desktop releases below 152.0.7977.65 on Windows, macOS, and Linux are affected. With a CVSS score of 6.8, an EPSS of 0.24%, no CISA KEV listing, and no public exploit identified at time of analysis, the threat is real but confined to sophisticated chained-attack scenarios.
Out-of-bounds write in Zephyr RTOS's ext2 filesystem driver enables supervisor-mode memory corruption when a device mounts a crafted ext2 image from a physical storage medium such as an SD card. The driver's superblock validation function omits bounds-checking the s_log_block_size field, allowing an attacker-controlled value to produce an inflated block size that silently misconfigures the kernel memory slab allocator beyond its static backing buffer, with impact ranging from denial of service to potential code execution in kernel mode. No confirmed active exploitation or public POC is identified at time of analysis; a vendor patch is available as upstream commit f270f4bd0e59585da31e1fbaa79c5abf73f1364b.
Local File Inclusion in the Events Manager WordPress plugin (all versions through 7.3.7.4) allows an administrator-level attacker to store a malicious PHP file traversal path via the em_options_save function, which is then executed without any further authentication on every admin_init hook invocation - including unauthenticated admin-ajax.php requests. The two-phase attack converts a high-privilege write primitive into a persistent, unauthenticated code execution trigger that survives account remediation until the stored option is manually purged. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds read in the OpenEXR HTJ2K decoder (versions 3.4.0-3.4.12) crashes any application that opens a crafted EXR file containing a malformed PLEN (payload length) header field. The decoder advances a raw pointer into the compressed data buffer by the attacker-supplied header size without first verifying it fits within the buffer, passing the resulting out-of-bounds offset to the OpenJPH memory-input path and causing a process crash. No active exploitation has been identified and no public proof-of-concept exists; vendor-released patch v3.4.13 resolves the flaw.
Second-order SQL injection in the Events Manager WordPress plugin (all versions through 7.4.0) allows authenticated contributors to extract sensitive data from the WordPress database by exploiting unsafe meta key concatenation in the event and location duplication flow. An attacker with contributor-level access plants SQL metacharacters in a custom event or location meta key via the standard WordPress add-meta interface; WordPress stores these verbatim in wp_postmeta, and when the duplicate action is subsequently invoked, the plugin reads the stored key via get_post_meta() and concatenates it unsafely into an INSERT SQL query. No public exploit has been identified at time of analysis, but Wordfence has published the advisory and the vulnerable code paths in em-event.php and em-location.php are exposed via Trac source references, significantly lowering the barrier to exploit construction.
Missing authorization in Google Chrome's BFCache (Back/Forward Cache) component allows a remote attacker who has already compromised the renderer process to bypass system access restrictions via a crafted HTML page. Affected versions are all Chrome releases prior to 152.0.7977.65. The integrity impact is rated High, enabling unauthorized writes or modifications to protected resources beyond the renderer sandbox. EPSS is low at 0.38% (31st percentile), and no active exploitation or public POC has been identified, but the vulnerability is noteworthy as a sandbox-escape primitive in a chained attack.
Incorrect authorization in Chrome's FileSystem API (CWE-863) allows a remote attacker to bypass system access restrictions through a crafted HTML page delivered via social engineering, achieving high-integrity impact on versions prior to 152.0.7977.65. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms network delivery with mandatory user interaction and no confidentiality exposure - only unauthorized writes or modification of normally restricted filesystem locations. No active exploitation is confirmed (not in CISA KEV), and EPSS sits at 0.38% (31st percentile), consistent with the social-engineering friction required. A vendor patch is available in stable channel 152.0.7977.65.
Cross-origin data leakage in Google Chrome's Performance API implementation prior to version 152.0.7977.65 enables remote information disclosure via observable timing discrepancies. By serving a crafted HTML page, a remote unauthenticated attacker can exploit CWE-203 side-channel behavior to infer or extract data belonging to other web origins, violating the browser Same-Origin Policy. No active exploitation is confirmed (not in CISA KEV), and EPSS sits at 0.37% (30th percentile), indicating low near-term exploitation probability despite the high confidentiality impact rating in CVSS.
Incorrect authorization in Chrome's Editing component (prior to 152.0.7977.65) permits remote attackers to read sensitive information by enticing a user to visit a specially crafted HTML page. The flaw (CWE-863) affects all Chrome versions across all platforms below the fixed release, with a high confidentiality impact but no integrity or availability consequence. No public exploit code or active exploitation is confirmed; EPSS stands at 0.36% (28th percentile), indicating low real-world exploitation probability at time of analysis.
Incorrect DOM authorization in Google Chrome prior to 152.0.7977.65 enables remote unauthenticated attackers to exfiltrate sensitive information by luring a user to a crafted HTML page. The flaw (CWE-863) bypasses DOM-level permission checks, resulting in High confidentiality impact with no integrity or availability consequences. No public exploit has been identified at time of analysis, and EPSS at 0.36% (28th percentile) indicates minimal observed exploitation pressure despite the patch now being available from Google.
Memory disclosure in Google Chrome's Video component (versions prior to 152.0.7977.65) allows a remote attacker to read memory contents from within the Chrome sandbox by directing a victim to a specially crafted HTML page. The uninitialized resource flaw (CWE-908) means the Video subsystem may expose stale memory - potentially including session tokens, credentials, or other sensitive browser data - without requiring any authentication from the attacker. No public exploit code or active exploitation has been identified at time of analysis; the EPSS score of 0.34% (26th percentile) confirms low automated exploitation probability.
Resource exhaustion via crafted SASL UNBIND in 389 Directory Server (389-ds-base) allows a remote authenticated attacker to stall connections and deny LDAP service to legitimate users. Affected deployments span Red Hat Directory Server 11, 12, and 13, plus 389-ds-base as packaged across RHEL 6 through 10. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 6.5 rating (AV:N/AC:L/PR:L) indicates low-complexity network exploitation requiring only a low-privilege LDAP bind - a realistic bar in any environment with shared directory users.
Chrome's FileSystem API prior to version 152.0.7977.65 improperly handles case sensitivity when enforcing access restrictions, enabling a remote attacker to bypass system-level file access controls via a crafted HTML page delivered through social engineering. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms a network-reachable, unauthenticated path with high integrity impact, though the mandatory user interaction requirement limits mass exploitation. No public exploit has been identified at time of analysis, and an EPSS of 0.33% at the 26th percentile reflects limited observed exploitation activity.
Incorrect authorization in Chrome's WebProtect component exposes sensitive browser information to remote attackers via crafted HTML pages, affecting all Chrome versions prior to 152.0.7977.65. The flaw carries a CVSS 6.5 score with high confidentiality impact; an unauthenticated attacker requires only that a target user visit a malicious page, making social-engineering delivery viable. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS of 0.32% (24th percentile) indicates low current exploitation activity despite the broad attack surface.
Memory disclosure in Google Chrome for Android (prior to 152.0.7977.65) exposes sandbox-contained memory via an uninitialized GPU resource, triggered when a victim loads a crafted HTML page. The flaw is platform-specific to Android and carries confidentiality-only impact bounded by Chrome's GPU sandbox isolation - no integrity or availability exposure. No public exploit code is identified at time of analysis, and EPSS at 0.31% (24th percentile) aligns with the vendor's own 'Low' Chromium severity rating, indicating low near-term exploitation probability.
Sensitive information disclosure via the QUIC protocol stack in Google Chrome affects all versions prior to 152.0.7977.65, exploitable by remote unauthenticated attackers through a crafted HTML page. When a victim navigates to an attacker-controlled page, Chrome's QUIC (HTTP/3) implementation improperly exposes confidential data, with high confidentiality impact but no integrity or availability consequences. No public exploit has been identified at time of analysis; CISA SSVC rates exploitation status as none and EPSS is 0.31% (23rd percentile), indicating low near-term exploitation probability despite the medium-severity classification.
URL extraction bypass in GOVCERT-LU eml_parser prior to version 3.0.2 allows a remote sender to craft phishing emails containing HTML-entity-encoded URLs that evade the library's URL extraction entirely. Security gateways and SOC pipelines relying on eml_parser to produce IOC lists will silently omit these obfuscated links, preventing submission to threat-intelligence feeds, URL reputation services, and sandboxes. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the regression test added in the fix commit provides a clear reproduction template.
Memory read outside Chrome's sandbox via an uninitialized resource in ANGLE affects Google Chrome prior to 152.0.7977.65, enabling an attacker who has already compromised the renderer process to exfiltrate memory beyond sandbox boundaries using a crafted HTML page. This is a chained exploit component - it does not enable initial access but extends an attacker's reach post-renderer-compromise, making it a meaningful escalation primitive in a multi-stage browser exploit chain. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS is low at 0.29% (21st percentile), consistent with its role as a secondary exploit stage.
Cross-origin data disclosure in Google Chrome's ANGLE graphics layer on Windows allows a remote unauthenticated attacker to read data from other origins by serving a crafted HTML page to a victim user. The flaw is rooted in an uninitialized resource (CWE-908) within ANGLE, Chrome's graphics abstraction layer, affecting all Chrome versions on Windows prior to 152.0.7977.65. No public exploit code has been identified and the vulnerability is absent from CISA KEV; EPSS of 0.29% (21st percentile) corroborates low observed exploitation activity, though the C:H confidentiality rating reflects the severity of cross-origin data leakage if exploited.
Memory disclosure in Google Chrome's ANGLE graphics subsystem (prior to 152.0.7977.65) exposes out-of-sandbox memory contents when a user visits a crafted HTML page. The uninitialized resource flaw (CWE-908) in ANGLE - Chrome's cross-platform graphics abstraction layer - allows a remote attacker to read memory that should be isolated within the renderer sandbox, leading to high-confidence confidentiality impact. No public exploit has been identified at time of analysis, and EPSS at 0.29% reflects currently low exploitation probability despite the high CVSS confidentiality rating.
Stack buffer overflow in file-roller's archive extraction path causes denial of service when a victim opens or extracts a crafted 7z or RAR archive containing an excessively long file path entry. The unbounded string copy in the progress-line parsing routine overwrites a fixed-size stack buffer, crashing the application with no confidentiality or integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation is gated entirely on user interaction with a malicious archive.
Address bar spoofing in Google Chrome prior to 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to deceive users about the current page origin via a crafted HTML page. The root cause is missing authorization (CWE-862) in Chrome Core, where the renderer can influence address bar state without proper permission checks. No public exploit code or CISA KEV listing exists at time of analysis; EPSS is very low at 0.28%, consistent with the chained exploitation requirement.
Incorrect authorization in Google Chrome's WebProtect component before version 152.0.7977.65 allows a remote, unauthenticated attacker to exfiltrate sensitive information by directing a user to a specially crafted HTML page. The flaw carries a CVSS 3.1 score of 6.5 with high confidentiality impact (C:H) and no integrity or availability impact, scoped entirely within the browser process. No public exploit is identified at time of analysis, and the EPSS score of 0.27% (19th percentile) indicates low current exploitation probability despite Chrome's ubiquitous deployment footprint.
ServiceWorker in Google Chrome versions prior to 152.0.7977.65 leaks sensitive information to remote attackers via a crafted HTML page, exploiting CWE-200 (Exposure of Sensitive Information to Unauthorized Actor). The vulnerability requires no attacker-side authentication (PR:N per CVSS) but does require user interaction - a victim must visit the malicious page. With CVSS C:H and no integrity or availability impact, the primary threat is data exfiltration; no public exploit has been identified at time of analysis and EPSS sits at a low 0.27%.
Cross-origin data exposure in Google Chrome's Extensions subsystem prior to version 152.0.7977.65 allows a remote attacker who successfully socially engineers a victim into installing a crafted malicious extension to read data from web origins the extension should not have access to. The high confidentiality impact (C:H) is real, but exploitation is gated on user interaction - the victim must install the malicious extension - which substantially limits opportunistic mass exploitation. No active exploitation has been confirmed (absent from CISA KEV), and the EPSS score of 0.27% (18th percentile) reflects low current exploitation probability consistent with no observed in-the-wild use.
UI misrepresentation in the Chrome Extensions subsystem (CWE-451) enables remote attackers to use social engineering and a crafted extension to deceive users into disclosing sensitive information. All Google Chrome desktop installations prior to version 152.0.7977.65 are affected. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed by CISA KEV; however, the high confidentiality impact in the CVSS vector reflects the potential for credential or sensitive-data theft if a user is successfully deceived into installing a malicious extension.
Chrome's browser Sync subsystem in versions prior to 152.0.7977.65 leaks sensitive user data due to improper validation of crafted inbound network traffic (CWE-20), enabling a remote attacker to read high-confidentiality synchronized content such as credentials or browsing history. The CVSS 6.5 vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-reachable with no privilege requirement, but a user interaction step limits opportunistic mass exploitation. No public exploit code or CISA KEV listing exists; EPSS at 0.25% (16th percentile) corroborates low near-term exploitation probability, and the vendor-released patch (152.0.7977.65) is already available.
Cross-origin data disclosure in Google Chrome's ANGLE graphics translation layer affects all desktop versions prior to 152.0.7977.65. The uninitialized GPU resource (CWE-908) can be triggered by a crafted HTML page, allowing a remote attacker to read residual data across origin boundaries - a direct violation of browser isolation guarantees. No public exploit code or active exploitation is identified at the time of analysis; the 0.24% EPSS score (15th percentile) places real-world exploitation probability in low-priority territory despite the High confidentiality sub-score in the CVSS rating.