Remote code execution in qwed 5.1.1 allows any authenticated tenant to execute arbitrary Python code inside the API server process by submitting crafted mathematical expressions to the POST /verify/math or POST /verify/batch endpoints. User accounts are freely self-registerable via the default-enabled /auth/signup endpoint - no invitation code or administrator approval required - making the effective exploitation barrier nearly equivalent to unauthenticated. A complete, functional proof-of-concept exploit script is publicly available in the GitHub advisory (GHSA-q27q-98j4-9pfv), and a vendor-released patch is available in version 5.1.2.
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but never wired into the underlying FastAPI application, leaving POST /agents, POST /agents/{name}, and POST /api/v1/agents/{id}/invoke fully unauthenticated regardless of any key configured by the operator. All versions prior to 4.6.58 are affected, with the flaw present since approximately 4.6.34 when the serve subsystem first shipped. A public proof-of-concept exists per the GHSA advisory; no public exploit identified at time of analysis in CISA KEV, but the zero-authentication network attack surface makes this a high-priority fix for any deployment exposing the serve interface to untrusted networks.
DNS rebinding in genieacs-mcp's Streamable HTTP transport (versions <= 0.3.1) allows a malicious website to route browser requests through loopback to the unauthenticated /mcp listener and invoke arbitrary GenieACS NBI operations against managed CPE devices. Affected deployments expose full read/write access to TR-069 device state - including firmware update tasks, parameter changes, device reboots, presets, and connection requests - to any attacker who can lure the server operator to a malicious web page. A proof-of-concept is documented in the GitHub security advisory (GHSA-cmwv-wf9p-p8wx); no CISA KEV listing is present, indicating targeted rather than widespread exploitation at time of analysis.
Cross-workspace authorization bypass in Airbyte Platform through v2.0.0 allows any authenticated workspace member to read, modify, and delete resources in workspaces they have no access to. The flaw in AuthenticationHeaderResolver.resolveWorkspace prioritizes a caller-supplied X-Airbyte-Workspace-Id value for authorization, while the actual operation executes against the caller-supplied resource identifier - with no subsequent reconciliation check. A publicly available exploit exists (reported by VulnCheck), and exploitation requires only basic workspace membership, making this a realistic lateral-movement vector in any multi-tenant Airbyte deployment.
PraisonAI's async Jobs API FastAPI service exposes all seven `/api/v1/runs` endpoints - submit, list, status, result, cancel, delete, and stream - with zero authentication on every route, allowing any network-reachable caller to execute arbitrary prompts against the operator's configured LLM credentials and enumerate or exfiltrate cross-tenant job outputs. Publicly available exploit code is documented in GHSA-2jgc-f764-c5r2, with all five attack primitives confirmed via proof-of-concept returning HTTP 202/200/204 with no credentials. This is a distinct, unpatched sibling of CVE-2026-44338 - the Flask server fix at 4.6.34 did not touch the FastAPI jobs module, which remained fully unauthenticated through version 4.6.51.
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller to execute configured agents via POST /agents and POST /agents/{agent_name} despite an operator-supplied --api-key. The FastAPI app created by _create_agents_app() accepts the key at the CLI layer but never applies it as middleware or a route dependency, rendering the documented authentication control entirely inert on those endpoints. A proof-of-concept is included in GHSA-7ww9-85pg-cv4x, and the flaw is fixed in v4.6.58 via an _authorise_request() method that enforces Bearer or X-Auth-Token header validation.
Unrestricted OS command execution in mcp-shell prior to v0.6.0 allows any LLM connected via stdio to invoke the shell_exec tool with arbitrary command strings, running them as the mcp-shell process user with no filtering, allowlisting, or logging. The root cause is that config.go initializes SecurityConfig.Enabled to false and SecurityValidator.validateCommand unconditionally short-circuits when that flag is false, bypassing all CWE-78-class protections. Both the from-source installation path and the MCP client configuration example in the README omit MCP_SHELL_SEC_CONFIG_FILE, making every operator who follows the documented instructions unknowingly vulnerable. No CISA KEV listing or independent public exploit repository has been identified at time of analysis; a vendor-confirmed fix is available in v0.6.0.
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users route agent web-fetching functions to internal HTTP services by supplying hostnames - such as 127.0.0.1.nip.io - that pass the static IP blocklist in spider_tools._host_is_blocked() because the function never performs DNS resolution before validation. The affected functions scrape_page, extract_links, crawl, and extract_text are registered as default LLM-callable agent tools, so any agent prompted to retrieve a user-supplied URL will trigger this path; a live proof-of-concept is documented in the GitHub Security Advisory (GHSA-x44h-65qv-cw74), confirming that publicly available exploit code exists. The CVSS scope change (S:C) and high confidentiality impact (C:H) reflect real ability to exfiltrate responses from internal services such as cloud metadata endpoints or localhost-bound APIs.
Arbitrary OS command execution in mcp-shell's default Docker image allows any MCP tool caller to bypass the secure-mode executable allowlist by supplying `/bin/bash -c <payload>` to the `shell_exec` tool, running commands as `mcpuser` (UID 1000) inside the container. The validator in `security.go` extracts only the first whitespace-delimited token as the executable, approves `/bin/bash` against the default allowlist, and passes the `-c` flag through the metacharacter check unchallenged because the default `blocked_patterns` array is empty. A fully working PoC is included in the GitHub Security Advisory GHSA-3x77-wg38-92r3; no public exploit identified at time of analysis beyond the researcher-provided PoC, and no CISA KEV listing exists. Vendor-released patch v0.6.0 is confirmed.
OS command injection in mcp-shell's 'secure mode' allows any MCP client to execute arbitrary shell commands by exploiting Git's runtime alias mechanism. The security validator in security.go blocks common shell metacharacters but omits '!', the prefix Git uses to invoke shell aliases via '-c alias.NAME=!CMD'. Because /usr/bin/git is in the default allowed_executables list and the CVSS PR:N vector confirms no authentication is required, all default Docker deployments (mcpuser, UID 1000, Git pre-installed) are exploitable by any entity with MCP connectivity. A fully functional PoC is published in the GHSA advisory; no CISA KEV listing is present at time of analysis.
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe execution endpoints despite authentication being nominally enabled. Versions prior to 4.6.58 of the pip package are affected: when the server is started with --auth api-key or --auth jwt but the corresponding PRAISONAI_API_KEY or PRAISONAI_JWT_SECRET environment variable is absent, create_auth_middleware() silently bypasses all authentication checks. The CLI safety check that blocks external binding only verifies auth mode is not 'none', failing to detect this secret-absent misconfiguration, leaving POST /v1/recipes/run, /v1/recipes/stream, and /v1/recipes endpoints fully open to unauthenticated callers. No active exploitation is confirmed (not in CISA KEV); vendor-released patch is available in v4.6.58.
Authentication bypass in djust's WebSocket LiveView consumer allows unauthenticated remote clients to invoke protected event handlers on views gated by login_required, permission_required, or redirecting on_mount hooks. All djust versions prior to 1.0.4 are affected: handle_mount sends a navigate/redirect frame on auth denial but neither closes the WebSocket nor clears self.view_instance, leaving the socket open and exploitable. Because handle_event never rechecks authentication after mount, a non-browser WebSocket client that ignores the redirect can send arbitrary event frames and execute state-mutating or data-reading handlers without an authenticated session. No public exploit identified at time of analysis beyond the WebsocketCommunicator proof-of-concept reproducer disclosed in GHSA-xx4j-w367-7247; this vulnerability is not listed in CISA KEV.
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to unauthenticated remote callers, even when operators have explicitly configured an auth_token in ServerConfig. The AgentServer._create_app factory never reads or enforces the configured token, rendering it dead code while /info actively misleads operators by displaying it as masked ('***'), creating a false sense of security. No public exploit code has been identified at time of analysis, and it is not listed in CISA KEV; the fix is confirmed in praisonaiagents 1.6.58.
Server-side template injection in compliance-trestle's custom Jinja2 tags enables remote code execution when the tool processes attacker-controlled Markdown or YAML content. Versions before 3.12.4 and the 4.0.x series through 4.0.3 are affected; the root flaw is that MDCleanInclude and MDSectionInclude re-parse included content using a non-sandboxed jinja2.Environment, allowing injected expressions to traverse Python object internals and invoke arbitrary OS commands as the Trestle process user. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack surface is realistic in supply-chain workflows where users import third-party SSP or YAML documents.
Cross-site request forgery against the PraisonAI MCP HTTP-stream transport allows unauthenticated remote attackers to execute arbitrary MCP tools on a developer's local machine when a victim visits a malicious webpage. The attack is enabled by a flawed prefix-match origin check (`startswith`) in versions prior to 4.6.58 that accepts `http://localhost.attacker.com` as a valid localhost origin, and is further facilitated by the absence of a default API key and the CORS simple-request mechanism (Content-Type: text/plain) that bypasses browser preflight. The highest-impact consequence is persistent prompt injection: a forged request can write attacker-controlled agent instruction files that the runtime loads on every subsequent agent run. No public exploit is identified at time of analysis; vendor-released patch 4.6.58 is confirmed.
Credential leakage in the urllib Node.js HTTP client (npm package node-modules/urllib) allows attacker-controlled redirect targets to capture sensitive authentication headers sent by the victim application. Versions through 4.9.0 (v3/v4 branch) and through 2.44.0 (v2 branch) recursively reuse the original caller-supplied options object - including Authorization, Cookie, Proxy-Authorization, x-api-key, x-auth-token, and x-access-token headers - when following redirects to a different origin, violating the WHATWG Fetch specification's cross-origin header-stripping requirement. No public exploit code has been released beyond the proof-of-concept topology described in the GHSA advisory, and no active exploitation has been confirmed by CISA KEV at time of analysis.
Server-Side Request Forgery in praisonaiagents (pip package, versions < 1.6.58) allows any attacker who can influence an AI agent's crawl target - via crafted task instructions or prompt injection embedded in previously crawled content - to exfiltrate cloud instance metadata (including IAM credentials), internal localhost services, and RFC1918 API endpoints. The web_crawl tool's SSRF protection validates only the initial URL's hostname IP, then invokes httpx with follow_redirects=True, allowing an attacker-controlled public URL to 302-redirect the agent to 169.254.169.254 or 127.0.0.1 without any re-validation. This is an incomplete fix for a prior SSRF class in the same component. A fully functional proof-of-concept is publicly documented in GHSA-5r34-2g38-6569, and no public exploit identified at time of analysis beyond the PoC; no CISA KEV listing is present.
Authentication bypass in PraisonAI's HTTP agent-serving layer allows unauthenticated remote invocation of registered agents despite the operator having configured an API key via --api-key. The root defect is in _create_agents_app(): it never reads config["api_key"] and never attaches a FastAPI Depends() auth dependency to POST /agents and POST /agents/{agent_name}, making the advertised --api-key flag a no-op. A public proof-of-concept confirms HTTP 200 responses to credentialless requests on all agent invocation routes while sibling /api/v1/ routes correctly return 401; no CISA KEV listing was identified at time of analysis.
Blind SSRF in Chainlit's MCP endpoint allows unauthenticated remote attackers to force the server to issue outbound HTTP requests to arbitrary internal or external URLs - including cloud metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254) - with fully attacker-controlled HTTP headers including Authorization and Cookie. Affected versions span 2.4.0rc0 through 2.11.x; the amplified form with attacker-controlled header forwarding affects 2.6.4 through 2.11.x, enabling state-changing authenticated requests against internal APIs without requiring any response read-back. Publicly available exploit code exists, confirmed against Chainlit 2.11.0 by SPL Security researchers; no CISA KEV listing is present at time of analysis.
Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any process-writable filesystem location by supplying a crafted user_id containing ../ sequences to the FileMemory constructor. All versions of the praisonaiagents pip package below 1.6.58 are affected; the vulnerability exists in the core library's FileMemory class, not an example or optional component. A detailed proof-of-concept is included in the GitHub Security Advisory (GHSA-gxmw-5f7x-6g22), and no public exploit identified at time of analysis beyond that PoC; no CISA KEV listing exists.
Workspace boundary escape in PraisonAI's praisonai.code CODE_TOOLS exposes three independent path traversal vectors affecting all file operation and command execution tools exported for use by AI agents. Agents configured with a workspace parameter - intended as a filesystem security boundary - can be manipulated via prompt injection or untrusted input to read, write, enumerate, and execute commands outside that boundary, bounded only by the process user's OS permissions. Publicly available proof-of-concept code demonstrates all six bypass paths against real praisonai.code agent tools; no CISA KEV listing exists at time of analysis.
Server-Side Request Forgery in PraisonAI's Jobs API (pip/praisonai < 4.6.58) results from two compounding flaws: a fail-open DNS error handler in `JobSubmitRequest.validate_webhook_url()` that silently accepts any webhook URL when `socket.gaierror` is raised, and a TOCTOU race where `JobExecutor._send_webhook()` performs a completely independent DNS resolution via `httpx.AsyncClient` minutes to hours after validation. Authenticated attackers with a valid API bearer token can submit a job whose `webhook_url` hostname returns NXDOMAIN at validation time, then update DNS to a private IP before job completion, causing the executor to POST job result data to internal infrastructure. A detailed proof-of-concept is publicly available in GHSA-rg5q-pp8p-f7jm; no public exploit identified at time of analysis beyond the PoC, and this CVE is not listed in CISA KEV.
Hard-coded credentials in all versions of the Furuno FA-50 maritime AIS transponder allow any attacker with knowledge of the static credentials and access to the vessel's internal network to authenticate to the device's settings screen and alter the vessel's identification number. Modification of the AIS identification number (MMSI) carries serious maritime safety implications, enabling vessel impersonation or disruption of AIS-based collision avoidance and vessel tracking systems. Disclosed via JPCERT coordination and JVN advisory JVNVU95422936; no public exploit has been identified at time of analysis.
Configuration manipulation in the Furuno FA-50 maritime device (all versions) is possible without authentication from the vessel's internal network. The product fails to enforce access controls on its settings interface (CWE-306), allowing any attacker who gains internal network access to alter device configuration parameters. No public exploit code has been identified at time of analysis, and the device is not listed in CISA KEV, but the unauthenticated network-accessible vector and high integrity impact (CVSS 4.0: 8.7, VI:H) make this a meaningful risk in maritime operational environments.
OS command injection in NVIDIA OpenShell across all supported platforms allows a network-accessible malicious gateway to execute arbitrary operating system commands on a victim host when a user interacts with that gateway. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) reflects that an attacker requires no privileges on the victim system but does require the victim to interact with a malicious or attacker-controlled gateway endpoint. Successful exploitation yields full code execution, data tampering, and information disclosure - with no public exploit or CISA KEV listing identified at time of analysis.
Remote code execution is possible in CM Map Locations WordPress plugin (all versions ≤ 2.1.8) via a limited arbitrary file upload flaw in the uploadMedia function, exploitable by any subscriber-level authenticated user. The upload handler performs only incomplete extension filtering with no MIME-type checks or WordPress capability verification before passing attacker-supplied files to move_uploaded_file(), and the required nonce is automatically exposed to any logged-in subscriber via the CMLOC_Editor_Images JavaScript object on the front-end location editor. No public exploit has been identified at time of analysis, but the low privilege bar and self-service nonce retrieval make this a realistic, high-priority threat for sites with open registration.
Use-after-free in Google Chrome's Compositing engine (all versions prior to 152.0.7977.65) enables remote code execution within the Chrome renderer sandbox when a user visits a crafted HTML page. The CVSS 8.8 score reflects full confidentiality, integrity, and availability impact, but execution is sandbox-confined and Chromium's own severity rating is Medium, suggesting real-world exploitation complexity is non-trivial. No public exploit has been identified and CISA SSVC records exploitation status as none; a vendor patch is available in Chrome 152.0.7977.65.
SQL injection in the All-in-One WP Migration and Backup plugin (servmask, versions through 7.109) enables a two-stage attack path culminating in remote code execution. Insufficient parameterization in the archive restore database layer allows attackers to append arbitrary SQL queries and exfiltrate the ai1wm_secret_key from the WordPress database; once obtained, this key unlocks the plugin's restore endpoint and enables RCE. No KEV listing or EPSS data is available at time of analysis, but the direct RCE chaining potential makes this a high-priority remediation target for any WordPress site running the affected plugin.
Remote unauthenticated arbitrary file overwrite in OpenRGB's custom TCP network protocol (port 6742) allows any network-reachable attacker to overwrite arbitrary files on the host by sending a crafted SAVE_PROFILE message with an attacker-controlled file path. When the daemon is deployed as a systemd service running with full root privileges - as packaged in openSUSE Tumbleweed - this file overwrite primitive translates directly into trivial full remote system compromise. A researcher-published Python reproducer script was released alongside this advisory; upstream release 1.0rc3-hotfix partially addresses the most critical issues.
Authentication bypass in NVIDIA UFM Enterprise's web interface authorization component allows an attacker on the adjacent network to send specially crafted HTTP requests that circumvent authentication checks, yielding code execution and privilege escalation on the UFM management host. All four active release tracks - GA, LTS 2023, LTS 2024, and LTS 2025 - are listed as affected per NVD CPE data. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Denial-of-service attack vectors in OpenRGB's unauthenticated TCP network protocol server (listening on 0.0.0.0:6742) allow any network-reachable attacker to crash or resource-exhaust the OpenRGB daemon without authentication. CVE-2026-18794 covers multiple DoS paths rooted in absent input-size validation - the server performs uncapped memory allocations from attacker-controlled length fields and passes raw network data to string constructors without null-termination checks. A Python reproducer script was published alongside coordinated disclosure on 2026-08-25, lowering the exploitation bar significantly. No CISA KEV listing; upstream 1.0rc3-hotfix addresses the worst aspects of the disclosed flaw set.
Use-after-free in Google Chrome's V8 JavaScript engine allows remote attackers to execute arbitrary code within the browser renderer sandbox on all Chrome versions prior to 152.0.7977.65. Exploitation requires only a single user interaction - visiting a crafted HTML page - with no authentication or special privileges needed (CVSS 8.8, AV:N/AC:L/PR:N/UI:R). Despite full C/I/A impact within the sandbox, EPSS probability is low at 0.46% (38th percentile), SSVC exploitation status is 'none', and no public exploit or CISA KEV listing exists at time of analysis; a vendor patch has been released at version 152.0.7977.65.
Out-of-bounds write in ANGLE, Chrome's GPU abstraction layer, affects Google Chrome on Windows prior to 152.0.7977.65 and can be triggered by a remote, unauthenticated attacker via a crafted HTML page, potentially achieving arbitrary code execution within the Chrome sandbox. The CVSS score of 8.8 reflects high theoretical severity, though sandbox containment (S:U) limits immediate blast radius to the GPU process. No public exploit code or CISA KEV listing exists at time of analysis, and the low EPSS of 0.42% (35th percentile) signals limited near-term exploitation probability despite the high CVSS rating.
Remote code execution in Google Chrome's Chromecast component (versions prior to 152.0.7977.65) stems from a use-after-free memory corruption flaw that enables remote attackers to execute arbitrary code within Chrome's renderer sandbox. Exploitation requires a victim to visit a crafted HTML page, making it network-reachable but not fully automated. No public exploit code has been identified at time of analysis, and the vulnerability is absent from the CISA Known Exploited Vulnerabilities catalog, with EPSS indicating low observed exploitation probability despite the high CVSS score.
Remote code execution within the Chrome sandbox is possible in Google Chrome prior to 152.0.7977.65 via a stack-based buffer overflow in the V8 JavaScript engine, triggered by a crafted HTML page visited by an unpatched user. The vulnerability requires no authentication or elevated privileges from the victim - only that they visit an attacker-controlled page - and achieves arbitrary code execution within Chrome's renderer sandbox. No public exploit has been identified at time of analysis, and EPSS at 0.39% (31st percentile) indicates low current exploitation probability despite the 8.8 CVSS score; notably, Google's own internal severity rating is Medium, reflecting the sandbox containment.
Type confusion in Chrome's ANGLE graphics abstraction layer (all versions prior to 152.0.7977.65) enables remote attackers to potentially execute arbitrary code outside the browser sandbox by directing a user to a specially crafted HTML page. The CVSS 8.8 score reflects network-accessible delivery with no privilege requirements, full confidentiality, integrity, and availability impact, though user interaction is necessary. No public exploit identified at time of analysis; SSVC rates exploitation as 'none', yet technical impact is rated 'total' given the sandbox-escape language in the description.
Integer overflow in the WebRTC component of Google Chrome prior to 152.0.7977.65 enables remote code execution confined to the browser's sandbox via a crafted HTML page. The flaw requires no authentication (PR:N) and no special browser configuration, as WebRTC is enabled by default, but it does require the victim to visit an attacker-controlled page (UI:R). No public exploit code has been identified and EPSS places exploitation probability at 0.35%, consistent with SSVC's assessment of no current exploitation; notably, Google's own internal Chromium severity rating for this issue is 'Low,' suggesting the sandbox boundary and exploit reliability considerations factor into their triage.
Remote code execution outside the browser sandbox is achievable in Google Chrome prior to 152.0.7977.65 via improper input validation in the Media component, triggered by visiting a crafted HTML page. The sandbox escape aspect is the critical differentiator here - Chrome's multi-process sandbox is its primary defense-in-depth layer, so bypassing it yields native OS-level code execution under the victim's account. No public exploit identified at time of analysis, and SSVC classifies exploitation as none with the attack non-automatable due to required user interaction.
Out-of-bounds read in Google Chrome's ANGLE graphics engine on Windows prior to version 152.0.7977.65 enables remote attackers to potentially execute arbitrary code outside the browser sandbox. Exploitation requires no authentication and only that a victim navigate to a crafted HTML page, yielding a CVSS 8.8 score with high impact across confidentiality, integrity, and availability. A vendor-released patch is available; no public exploit or confirmed active exploitation has been identified at time of analysis.
Remote code execution inside the Chrome sandbox affects Google Chrome prior to version 152.0.7977.65 through a use-after-free vulnerability in the Platform component, triggered when a user visits a specially crafted HTML page. An unauthenticated remote attacker can exploit this to execute arbitrary code within the browser sandbox, with full high-impact ratings on confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and CISA has not added this to the Known Exploited Vulnerabilities catalog.
Use-after-free in the WebRTC component of Google Chrome before version 152.0.7977.65 enables remote code execution confined within the browser sandbox. Exploitation requires a victim to visit a specially crafted HTML page, placing UI:R as a meaningful friction point. No public exploit code has been identified and CISA has not added this to the Known Exploited Vulnerabilities catalog; SSVC also indicates no current exploitation activity. Despite a CVSS score of 8.8 and tags indicating RCE and memory corruption potential, the EPSS score of 0.33% at the 25th percentile reflects low observed exploitation probability relative to the broader vulnerability population.
Use-after-free in Google Chrome's Script engine allows remote code execution confined to the renderer sandbox on all desktop platforms running versions prior to 152.0.7977.65. Exploitation requires only that a user visit a crafted HTML page - no authentication or special configuration is needed - making the attack surface broad wherever Chrome remains unpatched. No public exploit has been identified at time of analysis and CISA has not added this to KEV, but the CVSS 8.8 rating and SSVC 'total' technical impact designation warrant prompt patching across managed fleets.
Type confusion in V8, Chrome's JavaScript engine, allows remote unauthenticated attackers to execute arbitrary code within the Chrome renderer sandbox by luring a user to a crafted HTML page. All Google Chrome desktop versions prior to 152.0.7977.65 are affected across Windows, macOS, and Linux. No public exploit has been identified at time of analysis, and the EPSS score of 0.33% (25th percentile) reflects limited current exploitation probability; the vendor patch is available and should be applied promptly.
Type confusion in Chrome's V8 JavaScript engine (versions prior to 152.0.7977.65) enables remote code execution within the browser sandbox when a victim is socially engineered into visiting a crafted HTML page. The vulnerability arises from a CWE-843 type confusion flaw in V8, allowing an attacker to manipulate object type assumptions at runtime to achieve arbitrary code execution. Importantly, execution is constrained to the Chrome sandbox, which Chromium's own severity rating of 'Low' reflects; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds write in ANGLE (Chrome's graphics abstraction layer) prior to version 152.0.7977.65 enables remote attackers to execute arbitrary code outside the browser sandbox by serving a crafted HTML page. The vulnerability carries a CVSS score of 8.8 and targets Chrome's Almost Native Graphics Layer Engine, a critical rendering subsystem, making exploitation viable against any unpatched Chrome user who visits a malicious page. No public exploit code or CISA KEV listing exists at time of analysis; EPSS probability is low at 0.30%, and SSVC assesses exploitation as 'none', suggesting real-world exploitation remains limited despite the high theoretical severity.
Heap buffer overflow in Google Chrome's Media component prior to version 152.0.7977.65 enables remote code execution inside the renderer sandbox when a user visits a crafted HTML page. The CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U) reflects low attack complexity and no authentication requirement, but the unchanged scope (S:U) confirms execution is sandboxed - a full system compromise would require a separate sandbox escape not described in this CVE. No public exploit code has been identified and no CISA KEV listing exists; EPSS of 0.28% (20th percentile) indicates low observed exploitation activity, which is consistent with a patch-and-monitor posture rather than emergency response.
Heap-based buffer overflow in Google Chrome's WebRTC component (versions prior to 152.0.7977.65) enables a remote attacker to execute arbitrary code inside the Chrome renderer sandbox by delivering a crafted HTML page to a victim user. The CVSS score of 8.8 reflects broad impact (C:H/I:H/A:H) with no authentication prerequisite, though code execution is initially sandboxed and scope is unchanged (S:U). No public exploit code has been identified at time of analysis; SSVC records exploitation status as none and EPSS probability is low at 0.28% (20th percentile), suggesting this has not yet been leveraged at scale despite the high-severity rating.
Heap-based buffer overflow in ANGLE (Almost Native Graphics Layer Engine) within Google Chrome for Android prior to 152.0.7977.65 enables remote code execution outside the renderer sandbox via a crafted HTML page, meaning a successful attacker escapes Chrome's process isolation boundary with full C/I/A impact. Exploitation requires no authentication and only that a victim navigate to an attacker-controlled page, making drive-by compromise via phishing or malvertising a realistic delivery path. No public exploit has been identified at time of analysis and no CISA KEV listing exists, though the sandbox-escape capability significantly elevates real-world priority beyond what the raw CVSS score alone conveys.
Use-after-free in the Bluetooth component of Google Chrome prior to version 152.0.7977.65 enables remote attackers to execute arbitrary code outside the browser sandbox. Exploitation requires the attacker to socially engineer a victim into installing or triggering a crafted Chrome extension, after which the memory corruption in the Bluetooth subsystem is leveraged to escape Chrome's sandbox and achieve code execution at the OS level. No public exploit identified at time of analysis, and EPSS places this in the 20th percentile, suggesting limited active exploitation despite the high CVSS severity.
Type confusion in Chrome's Animation component allows remote unauthenticated attackers to potentially execute arbitrary code within the browser sandbox by luring a user to a crafted HTML page. All Chrome versions prior to 152.0.7977.65 are affected across desktop platforms. No public exploit code or active exploitation has been identified at time of analysis, and EPSS places this at the 19th percentile (0.27%), suggesting limited immediate exploitation pressure despite the high CVSS score.