Out-of-bounds write in Chrome's V8 JavaScript engine allows remote attackers to execute arbitrary code within the renderer sandbox by directing a user to a crafted HTML page. All Google Chrome versions prior to 153.0.8010.36 are affected across desktop platforms. Impact is bounded by Chrome's renderer sandbox - an attacker achieves control over the renderer process and can access browser-stored data such as session cookies and saved credentials, but reaching the host OS would require a separately chained sandbox escape exploit. No public exploit identified at time of analysis.
Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based buffer overflow in the ASN.1 decoder that parses VPN certificates, reachable by unauthenticated remote attackers. Because the flaw sits in the certificate-handling path of the internet-facing VPN service, a single crafted certificate or handshake can overflow heap memory and execute attacker-controlled code on security appliances that sit at the network perimeter. No public exploit identified at time of analysis, and the CVE carries no EPSS or KEV signal, but the pre-auth network-reachable RCE profile makes it a top-tier patching priority.
Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during VPN negotiation, letting a remote unauthenticated attacker run arbitrary code on the gateway itself. The CWE-295 root cause means the gateway accepts or mishandles an untrusted/forged certificate in the IKE/SSL-VPN handshake, and processing that malicious certificate leads to code execution rather than merely a trust bypass. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Root-level remote code execution in WebPros cPanel is achievable by any mail-enabled account through a SQL injection flaw in the EmailTrack component. An authenticated low-privilege mailbox user can chain the injection into command execution as root, giving full server takeover; the vendor has shipped fixes across five maintenance branches and a HackerOne-sourced report confirms the issue, though no public exploit has been identified at time of analysis.
Authentication bypass in MaxSite CMS versions 0.78 through 109.6 lets unauthenticated remote attackers forge valid administrator session cookies because the framework ships with a hardcoded session encryption key in application/config/config.php that installers never rotate. Using the publicly known key, an attacker computes a valid HMAC-SHA1 over a crafted ci_session cookie to impersonate an admin, defeating the is_login() and mso_check_allow() authorization checks. Publicly available exploit code exists (published by VulnCheck / EviL0rd); there is no evidence of active exploitation in CISA KEV at time of analysis.
PHP object injection in MaxSite CMS through version 109.6 lets unauthenticated remote attackers forge valid ci_session cookies and pass attacker-controlled serialized data to an unrestricted unserialize() call. Because the framework ships a hardcoded encryption key, an attacker can sign forged session cookies that pass integrity checks, instantiate arbitrary PHP objects, and trigger magic methods to corrupt application state or achieve remote code execution when suitable gadget classes are present. Publicly available exploit code exists (reported by VulnCheck); this is a deserialization flaw (CWE-502) with a full-impact CVSS 4.0 score of 9.2.
Remote code execution in FireBox - WooCommerce Popup Builder (all versions ≤ 3.1.10) allows authenticated Author-level attackers to execute arbitrary PHP on the server by injecting unsanitized PHP expressions into campaign condition rules via the `firebox_meta` REST endpoint. The plugin's `Executer::allowedToRun()` blacklist (Executer.php L231) uses a trivially bypassable regex that permits WordPress core functions such as `wp_insert_user`, `update_option`, and `file_put_contents`, which the `value` function in the PHP Conditions class then evaluates directly. Critically, sites migrated from any version prior to 3.1.10 are automatically subjected to `Migrator::preserveCampaignRoleAccess()`, which grants Author-role users `edit_fireboxes` and `publish_fireboxes` capabilities, making exploitation reachable from any registered Author account with no further privilege requirements. No public exploit code or CISA KEV listing has been confirmed at time of analysis.
Unauthenticated LAN access to the ESPHome Device Builder dashboard on Home Assistant add-on deployments allows any device on the local network to gain host-equivalent control with no credentials. The ingress site, which deliberately skips authentication because the HA supervisor is supposed to authenticate upstream, was bound to 0.0.0.0 instead of loopback and the supervisor gateway. Because the add-on uses host networking for mDNS, this exposed the no-auth site on the host's LAN interface, directly bypassing the supervisor's authentication layer. An attacker with LAN access can run arbitrary Python via external_components at compile time, execute arbitrary shell through compile/validation subprocesses, and read or write arbitrary files in the config and data directories. No public exploit has been identified at time of analysis.
Local file inclusion in MaxSite CMS through 109.6 allows unauthenticated remote attackers to execute privileged PHP handler files by supplying base64-encoded path traversal sequences to the ajax and require-maxsite dispatcher endpoints. The encoding technique bypasses the dispatchers' path validation logic, enabling attackers to reach admin-gated handler actions entirely without credentials. A public proof-of-concept exploit was published on 2026-09-08; the vulnerability spans essentially the entire version history of the product (0.78 through 109.6), and no patched release has been confirmed at time of analysis.
Unauthenticated remote denial-of-service in PocketMine-MP before 5.41.1 allows any actor who can reach the server's Minecraft Bedrock port to crash the process with a single crafted LoginPacket. The server's JsonMapper is configured to log unexpected clientData JWT properties using PHP's `var_export()` without any size or depth bounds; an attacker embeds a deeply nested or massive object structure in an unknown property, causing the PHP process to exhaust all available memory during serialization. A proof-of-concept is publicly available in the GHSA advisory; no CISA KEV listing at time of analysis, but the zero-authentication, pre-auth attack vector and public PoC make this a high-priority patch for any publicly reachable PocketMine-MP instance.
Stored cross-site scripting in Open WebUI's terminal port preview feature allows an authenticated attacker sharing a terminal server with a victim to execute arbitrary JavaScript in the victim's browser at the Open WebUI origin, enabling full account takeover. The vulnerability affects versions 0.8.11 through 0.11.1 and stems from a dangerous iframe sandbox configuration that combines `allow-scripts` with `allow-same-origin`, which together nullify sandbox isolation when content is served from the application's own origin. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed, but the attack is straightforward for any authenticated user on a shared terminal deployment.
Unauthenticated remote denial-of-service in PocketMine-MP before 5.43.1 allows any network client to crash the Minecraft Bedrock server by sending a malformed Certificate field during offline login. The LoginPacketHandler fails to validate the Certificate JSON structure before mapping it to an internal auth chain object, leaving PHP class properties uninitialized and triggering a fatal error that terminates the server process. A publicly available proof-of-concept is referenced in the vendor's GitHub Security Advisory (GHSA-g2fj-p69p-9chp); no CISA KEV listing is confirmed at time of analysis.
Unauthenticated SQL injection in the ELEX WooCommerce Request a Quote WordPress plugin (all versions before 2.4.1) allows remote attackers to extract arbitrary data from the underlying WordPress database without credentials or user interaction. The flaw stems from a user-controlled parameter passed directly into a SQL query without sanitization or escaping, and the CVSS scope change reflects that the injection can reach any table in the shared MySQL/MariaDB instance - including WordPress user credentials, WooCommerce order records, and PII. A publicly available exploit exists per WPScan; the vendor has released a fix in version 2.4.1, and no active exploitation is confirmed in CISA KEV at this time.
Unauthenticated SQL injection in the Quentn WP WordPress plugin before version 1.2.15 allows remote attackers to extract arbitrary data from the underlying database without any credentials. The vulnerability stems from a request parameter that is passed directly into an unprepared SQL query without escaping, enabling full database read access including user credentials, configuration data, and any content stored in the WordPress database. A publicly available exploit exists per WPScan, and the CVSS scope-change indicator (S:C) reflects that the impact crosses into the database component beyond the plugin itself.
Out-of-bounds write in Samsung's Keymaster trustlet - a Trusted Execution Environment (TEE) component running in ARM TrustZone that handles cryptographic key operations - allows local attackers with high privileges to corrupt memory within the secure world, potentially compromising key material or TEE integrity. Affected devices run Android 14 through 17, with a fix delivered in Samsung's SMR Sep-2026 Release 1. No public exploit code or active exploitation has been identified at time of analysis.
OAuth and SCIM identity confusion in Open WebUI 0.6.41-0.10.x (SQLite-backed deployments only) allows unauthenticated remote attackers to hijack arbitrary stored user accounts, including administrator accounts, by presenting an OAuth subject claim containing SQL LIKE wildcard characters. SQLAlchemy's `JSON.contains()` on SQLite compiles to a substring LIKE match rather than an exact equality check, so a crafted `sub` claim such as `%admin%` can resolve to a different stored identity and cause the server to issue the attacker a valid session token for that identity. Vendor-released patch is available in version 0.11.1; no active exploitation has been confirmed.
Denial of service in Open WebUI versions 0.9.0-0.11.0 allows unauthenticated remote attackers to stall the application server and amplify traffic to the configured identity provider by submitting requests to the backchannel-logout OAuth endpoint. The handler fetches the OIDC discovery document and signing keys on every inbound request-including invalid ones-before performing any token validation; additionally, the original synchronous PyJWKClient call blocks the asyncio event loop, so each malicious request can render the single-worker instance unresponsive. No public exploit code has been identified at time of analysis; the issue is fixed in version 0.11.1.
Unauthenticated information disclosure in the Loops & Logic WordPress plugin (all versions before 4.3.0) exposes arbitrary user records - including email addresses and role assignments - and arbitrary site configuration options to any unauthenticated visitor. The plugin's public template-data AJAX action fails to enforce access controls, permitting unauthenticated HTTP requests to retrieve data restricted to privileged users. A publicly available proof-of-concept exists per the WPScan advisory; however, EPSS at 0.17% (7th percentile) and SSVC 'exploitation: none' indicate no confirmed active exploitation at time of analysis.
Memory exhaustion denial of service in PocketMine-MP before 5.32.1 allows any authenticated Bedrock client to crash the server by sending a single crafted ResourcePackClientResponsePacket. The server iterates the client-supplied packIds array without deduplicating UUIDs, so a custom client supplying hundreds of copies of a valid pack UUID causes the server to transmit ResourcePackDataInfoPacket repeatedly, rapidly exhausting PHP process memory. No public KEV listing, but exploit details are publicly available via GHSA-fqqv-56h5-f57g.
Improper privilege management in Open WebUI 0.10.0 through 0.11.0 allows any authenticated low-privilege user with write access to a knowledge base to delete administrator-owned external connection configurations shared across the entire instance. The DELETE /api/v1/knowledge/{id}/delete endpoint in knowledge.py correctly validated the user's write access to their own knowledge base but then cascaded the delete to the underlying shared external connection without verifying admin role or checking whether other knowledge bases depended on that connection. This means a single non-admin user can render all other knowledge bases on the instance that share the same external vector store connection permanently unavailable. No public exploit has been identified at time of analysis; vendor-released patch is available in version 0.11.1.
Memory and CPU exhaustion in PocketMine-MP before 5.39.2 allows any authenticated in-game player to render the game server unresponsive by sending a ModalFormResponsePacket with an arbitrarily large JSON payload. The server processes incoming form response data without enforcing any size limit, enabling an attacker to exhaust server memory and CPU with JSON arrays containing millions of elements. A public proof-of-concept Node.js script is confirmed in vendor advisory GHSA-788v-5pfp-93ff; no public exploit identified at time of analysis in CISA KEV.
CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner callback and status-update endpoints that return administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata without requiring any credentials. Unauthenticated network attackers can systematically enumerate panel administrators and recent scanner activity across multi-tenant hosting installations, enabling reconnaissance for follow-on credential attacks or phishing. No public exploit code has been identified at time of analysis; vendor-released patch version 2.4.6 is available.
Remote denial-of-service in PocketMine-MP before 5.42.1 allows unauthenticated network attackers to degrade server performance by sending LoginPackets whose clientData JWT bodies contain large numbers of arbitrary junk properties. The server's JsonMapper iterates over and logs a warning for every unexpected property, enabling log flooding and unbounded CPU waste with no authentication required. A publicly available proof-of-concept exists via the vendor's own GitHub security advisory; no active exploitation in the CISA KEV has been reported.
Resource exhaustion in PocketMine-MP before 5.25.2 allows unauthenticated Bedrock clients to degrade server availability by submitting crafted packets containing excessive delimiter characters across sign editing, JWT login, and command parsing endpoints. The root cause is PHP `explode()` being called without a limit parameter in multiple packet-handling paths, causing the server to allocate unbounded memory arrays proportional to delimiter count in attacker-controlled input. No CISA KEV listing exists, but a proof-of-concept is publicly available via the vendor's GitHub security advisory (GHSA-g274-c6jj-h78p); vendor assessment notes real-world impact is partially mitigated by existing packet decompression size limits already enforced upstream.
Stored Cross-Site Scripting in the Content Mask WordPress plugin before 1.8.5.6 allows any user holding at least a Contributor-level WordPress account to inject persistent malicious scripts into post content, which then execute in the browsers of all users - including administrators - who view or preview the affected page. Notably, the plugin's own built-in role-restriction feature fails to block the attack, widening the exploitation surface beyond what site operators may expect. A publicly available proof-of-concept exists via WPScan, though EPSS at 0.16% (6th percentile) and SSVC 'exploitation: none' indicate no observed mass exploitation at time of analysis.
Stored cross-site scripting in the Sina Extension for Elementor WordPress plugin (versions before 3.10.4) allows authenticated users holding at least a Contributor role to inject persistent malicious scripts via an unescaped Table widget setting that is rendered inside an HTML attribute. When a higher-privileged user - such as an Editor or Administrator - views the affected page, the attacker-controlled script executes in their browser, enabling session hijacking, credential theft, or unauthorized administrative actions on the WordPress site. A publicly available proof-of-concept exists via WPScan, though EPSS stands at 0.15% (5th percentile) and no active exploitation is confirmed in CISA KEV.
Broken Windows directory-ownership verification in gix-sec (gitoxide's trust enforcement crate) causes all filesystem paths to be unconditionally trusted when the process runs with an unfiltered administrative token, nullifying safe.directory protections. Versions 0.13.2 and earlier of gix-sec contain a logic inversion in is_path_owned_by_current_user: the administrator-specific branch checks the SID of the running process against the Administrators group rather than checking the SID of the target directory, so both IsWellKnownSid and CheckTokenMembership always return true for elevated processes regardless of who actually owns the directory. A local limited-privilege attacker can plant a malicious Git repository (configuring core.sshCommand or hooks) in a shared or system-root location and trigger arbitrary code execution with full administrative rights when any admin-level gitoxide-backed operation encounters that path. No CISA KEV listing is present, but a working proof-of-concept is included in the GHSA advisory.
Infinite-loop denial-of-service in Open WebUI 0.5.0-0.11.0 allows any authenticated user to permanently crash the backend service by storing id-less messages in a cyclic parent chain. The flaw in `get_message_list` (backend/open_webui/utils/misc.py) caused the chat-history traversal to never terminate, blocking the async event loop and consuming memory until the process died - with the condition persisting across restarts until an operator manually removes the offending messages or upgrades. No public exploit or active exploitation has been identified, but the low barrier (any login) and persistence across restarts make this an operationally impactful issue for self-hosted deployments.
Denial-of-service in Open WebUI versions 0.10.0 through 0.11.0 allows any authenticated user to permanently block all server-side request processing by submitting a cyclic chat message tree and then triggering the message-deletion endpoint. The DELETE /api/v1/chats/{id}/messages/{message_id} API delegates to a Python helper that traverses childrenIds in a while loop without recording visited node identifiers, entering an infinite loop that occupies the server's request thread indefinitely until the process is forcibly killed. No active exploitation or KEV listing is recorded, but the attack requires only a valid user session and no special configuration, making it a credible insider or compromised-credential threat for any multi-user deployment. Vendor-released patch is available in version 0.11.1.
Unauthenticated shortcode injection in the Contact Form 7 Captcha WordPress plugin before 0.1.9 allows any site visitor to execute arbitrary WordPress shortcodes registered on the target site. The plugin incorrectly passes visitor-submitted form field values through the WordPress shortcode parser without sanitization, meaning an attacker submitting a shortcode tag as a form value triggers its execution in the rendered response. With a publicly available proof-of-concept and the breadth of shortcodes available across typical WordPress installations - some of which can include files, run PHP, or interact with other plugins - the practical impact can escalate beyond the conservative C:L/I:L baseline to full remote code execution, depending on the shortcodes registered on the site.
Unauthenticated shortcode injection in the CleanTalk WordPress anti-spam plugin before 6.87 allows any site visitor to trigger arbitrary shortcodes registered on the target WordPress site to execute server-side, with output persisted and rendered to every subsequent visitor of the affected page. Because shortcode execution scope depends entirely on which shortcodes third-party plugins have registered, actual impact can range from minor data leakage to server-side code execution if code-execution shortcodes are present. A publicly available exploit exists, and the vendor has released a patch in version 6.87.
Missing authorization on gift card redemption in Ultimate Gift Cards for WooCommerce (versions before 3.2.10) allows any authenticated subscriber to redeem gift cards belonging to other users, zeroing the victim's balance and crediting the full value to the attacker's own account. Two separate redemption code paths are affected: version 3.2.9 patched one path but left a second path vulnerable when a companion plugin from the same vendor is active; both paths are fully remediated in 3.2.10. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.14% (4th percentile) and SSVC indicates no confirmed active exploitation.
Item and experience duplication in PocketMine-MP before 5.39.2 allows any authenticated server player to exploit a race condition during another player's disconnection, causing inventory loot and XP to drop multiple times from a single death event. The InGamePacketHandler fetches entities via World->getEntity() without validating the flaggedForDespawn state, so the death handler can fire multiple times for the same disconnect-death event if a crafted attack packet arrives within the narrow timing window. A detailed proof-of-concept with exact reproduction steps is publicly available via the vendor's GitHub Security Advisory; vendor patch 5.39.2 is available and no KEV listing exists.
Remote code execution in Google Cloud Agent Development Kit (ADK) for Python versions 2.0.0 through 2.6.0 allows an unauthenticated remote attacker to run arbitrary code on the host by submitting a crafted test session replay to the 'adk web' developer interface when the pytest package is present. The flaw stems from an incomplete input-restriction check (CWE-184) that lets malicious replay content reach code execution. No public exploit has been identified at time of analysis, but the vendor rates it CVSS 10.0 and shipped a fix in v2.7.0.
Remote code execution in KGUARD DVR devices running 2016-era firmware allows any unauthenticated attacker with network reachability to run arbitrary system commands, because a command-execution service is bound to all interfaces (0.0.0.0) with no authentication, leading to full device takeover. The flaw is actively exploited in the wild by the Mirai_ptea (Rimasuta), Mirai_aurora, and rapperbot botnets for malware propagation and DDoS, per Netlab 360 reporting. Firmware released after 2017 mitigates the issue by restricting the service to the localhost interface.
Remote code execution in Perforce Akana API Platform allows unauthenticated attackers to run arbitrary code on the Policy Manager console host. A path normalization discrepancy between the authentication filter and the servlet dispatcher lets a crafted request slip past authentication and reach an endpoint that evaluates attacker-supplied script without sandboxing. Rated CVSS 4.0 10.0; no public exploit identified at time of analysis, but the no-auth/no-interaction profile makes this a top-priority patch.
The Payment Plugins for PayPal WooCommerce WordPress plugin (versions 1.1.0 through 2.0.25) fails to verify that a stored PayPal vault payment method token belongs to the authenticated user requesting to attach it, allowing any subscriber-level account holder to claim ownership of another customer's vaulted card. Once bound to the attacker's account, the victim's stored payment method can be charged fraudulently or permanently deleted. A publicly available proof-of-concept exists per WPScan, though EPSS (0.13%, 3rd percentile) and SSVC exploitation status 'none' indicate no widespread active exploitation at time of analysis.
Unauthorized ADMIN access in Dell Secure Connect Gateway (SCG) 5.0 allows a remote unauthenticated attacker to replay a previously captured request indefinitely, forging ADMIN-level access and refresh tokens. Because the token-issuing flow performs no nonce validation and enforces no request expiry, a single intercepted request grants durable administrative control of the gateway. The Appliance edition is affected before 5.36.00.16 and the Application edition before 5.36.00.00; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
We need answer JSON only. Need synthesize. Need follow precision. Let's parse input. CVE-2026-71801 description: s-pms SPMS-Server through v1.0 hardcoded default access token secret core config file, not overridden/removed production. Remote unauthenticated attacker can locally forge valid admin session tokens bypass auth gaining full unauthorized access to protected backend APIs. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE-798 hardcoded credentials. EPSS 0.24% percentile 15. Reported by mitre. CPE cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:* (bad). Tags: Authentication Bypass, N A. EUVD. References: github issue, nvd. Need output fields. product_name: "SPMS-Server" maybe 1-3 words. s-pms SPMS-Server. Could be "SPMS-Server". Summary: original synthesis. Don't copy description. Start with specific impact verb and product. E.g. "Authentication bypass in SPMS-Server through v1.0 allows remote unauthenticated attackers to forge administrative session tokens and access protected backend APIs." Mention hardcoded default token secret, not overridden production. No KEV, no POC? POC? References github issue maybe vulnerability report not POC? Input does not have POC explicitly. Need not claim POC exists. EPSS low 0.24 percentile 15. "No public exploit identified at time of analysis" though GitHub issue maybe report. Need use only phrases. KEV not present. Use "no public exploit identified at time of analysis". But maybe references include github issue; it's vulnerability disclosure not necessarily exploit. We can mention POC status? Need no. Technical_context: CWE-798 Use of Hard-coded Credentials. Underlying auth likely token-based with secret stored in config. CPE is n/a but affected product is SPMS-Server through v1.0. Explain hardcoded default access token secret in core config; not overridden production profile leads to token forgery. Use CWE. risk_assessment: Assess CVSS 9.8 critical, AV:N/AC:L/PR:N/UI:N, high C/I/A. EPSS 0.24 percentile 15 suggests low likelihood of wid
We need answer JSON only. Need synthesize. Need be careful precision. Let's parse input. CVE-2026-87595 description: SSRF in Mobile in Google Chrome prior to 153.0.8010.36 allowed remote attacker leveraging social engineering to bypass system access restrictions via crafted HTML page. Chromium severity Low. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H given. CWE-918. EPSS 0.18% percentile 7%. Patch available from vendor. Tags Google, SSRF. CPE google chrome. Affected versions EUVD: ["Chrome 153.0.8010.36 <153.0.8010.36"] weird, maybe means prior to 153.0.8010.36. References. Need output fields. product_name: Google Chrome. summary: original synthesis not copy. Mention SSRF in Chrome Mobile prior 153.0.8010.36, remote attacker leveraging social engineering bypass access restrictions via crafted HTML. Chromium severity low despite CVSS 9.8. EPSS low, no KEV, no POC. Need say no public exploit identified. "confirmed actively exploited"? no KEV absent. POC absent. Use phrase "no public exploit identified at time of analysis". Could say "Although CVSS score is 9.8, Chromium rates severity Low; EPSS is 0.18%". Need uncertainty: CVSS vector conflict with description: AV:N PR:N UI:N vs description says social engineering = user interaction likely. We need state this explicitly in risk and confidence. CVSS says UI:N and high impact, but description says leveraging social engineering and Chromium severity low. Maybe SSRF impact could be high? But likely CVSS is incorrect? We can use own assessed vector maybe UI:R due social engineering, maybe AC:L? Let's determine assessed CVSS. Vulnerability: SSRF in Mobile in Google Chrome prior to 153.0.8010.36. Remote attacker leveraging social engineering via crafted HTML page to bypass system access restrictions. SSRF means server-side request forgery in Chrome Mobile? The browser is client? "Mobile" component. Attack vector network? User interaction required because social engineering to visit crafted HTML page. So AV:N AC:L PR:N UI:R
Arbitrary file upload with path traversal in LZ-litchi 1.0.0 lets remote unauthenticated attackers write attacker-controlled files to locations outside the intended storage directory by manipulating the 'directory' parameter of POST /app-api/infra/file/upload. Because uploaded content and destination path are both attacker-controlled, an attacker can plant a web-executable payload and achieve code execution on the host. No public exploit is confirmed beyond the referenced GitHub issue writeup, and EPSS remains low (0.18%) despite the maximal CVSS of 9.8.
Missing authorization in the WebView component of Google Chrome on Android before 153.0.8010.36 lets a remote attacker who first tricks a user via social engineering bypass system access restrictions through crafted network traffic. The flaw is tracked as CWE-862 (missing authorization) and was reported by Google's Chrome team; a vendor patch is available. Chromium rates the security severity as Medium, EPSS is low (0.17%), and no public exploit or CISA KEV listing has been identified.
Incorrect authorization in the Extensions component of Google Chrome before 153.0.8010.36 allows a remote attacker to bypass system access restrictions and reach a privileged internal page by luring a victim to a crafted HTML page. Google credits its own team with discovery, and a fixed build is available; no public exploit has been identified at time of analysis, and Chromium rated the underlying issue only Low severity despite the 9.8 NVD score.
Arbitrary code execution in Actions Semiconductor's Tool - Media Player Utilities v4.46 lets a physically proximate attacker run code on a host by abusing the Production.dll and RdiskUpgrade.exe firmware/disk-upgrade components (CWE-94 code injection). The flaw affects this specific flashing/production utility bundled with Actions Semiconductor media-player SoC toolchains. SSVC rates technical impact as total with a public proof-of-concept, but EPSS is only 0.17% (6th percentile), and the required physical/local proximity sharply limits real-world reach.
Remote code execution in Google Chrome for Android prior to 153.0.8010.36 arises from an out-of-bounds write in the WebGL graphics subsystem, letting a remote attacker who lures a user to a crafted HTML page execute arbitrary code outside the renderer sandbox. Rated Critical by Chromium and CVSS 9.6, the scope-changed vector reflects a full sandbox escape. No public exploit is identified at time of analysis and EPSS is low (0.39%), but WebGL memory-corruption bugs are historically high-value targets.
Remote code execution in Google Chrome for Android prior to 153.0.8010.36 stems from a use-after-free in the WebGL implementation that a remote attacker can trigger with a crafted HTML page to execute arbitrary code outside the browser sandbox. Chromium rates this Critical and the CVSS is 9.6, reflecting a full renderer-to-sandbox-escape chain requiring only that a victim visit a malicious page. No public exploit is identified at time of analysis and EPSS is low (0.36%), but the sandbox-escape impact makes it a priority patch.
Remote code execution in Google Chrome's DevTools component before 153.0.8010.36 stems from a use-after-free (CWE-416) that, per the advisory, allows a crafted HTML page to execute arbitrary code outside the browser sandbox. All desktop Chrome builds prior to the fixed stable release are affected; the flaw was reported internally by the Chrome team, is fixed in the stable channel, and has no public exploit identified at time of analysis. Notably, the assigned CVSS is 9.6 (Critical) while Chromium itself rated the security severity only 'Low', a significant conflict discussed below.
Remote code execution in Google Chrome before 153.0.8010.36 stems from a use-after-free in the browser's Payments component, letting a remote attacker who lures a victim to a crafted HTML page potentially execute arbitrary code outside the renderer sandbox. Chromium rates the severity High, and the supplied CVSS is 9.6 reflecting the sandbox-escape scope change. EPSS is low (0.35%, 29th percentile) and no public exploit is identified at time of analysis.
Remote code execution in Google Chrome on Windows (versions prior to 153.0.8010.36) arises from a use-after-free in ANGLE, Chrome's graphics abstraction layer that translates OpenGL ES calls to Direct3D. A remote attacker who lures a victim to a crafted HTML page can corrupt memory and execute arbitrary code outside the browser sandbox, giving full compromise of the renderer host process. No public exploit identified at time of analysis, and EPSS is modest (0.35%), but the sandbox-escape impact and one-click delivery make this a high-priority browser patch.
Remote code execution outside the browser sandbox affects Google Chrome versions prior to 153.0.8010.36 through a use-after-free flaw in the Web Authentication (WebAuthn) component. A remote attacker who lures a victim to a crafted HTML page can corrupt memory and execute arbitrary code with the privileges of the browser process, escaping the renderer sandbox (scope change). No public exploit has been identified at time of analysis and EPSS is low (0.34%), but the sandbox-escape RCE nature and Chrome's enormous install base make prompt patching important.