Remote code execution in Google Chrome's DevTools component before 153.0.8010.36 stems from a use-after-free (CWE-416) that, per the advisory, allows a crafted HTML page to execute arbitrary code outside the browser sandbox. All desktop Chrome builds prior to the fixed stable release are affected; the flaw was reported internally by the Chrome team, is fixed in the stable channel, and has no public exploit identified at time of analysis. Notably, the assigned CVSS is 9.6 (Critical) while Chromium itself rated the security severity only 'Low', a significant conflict discussed below.
Remote code execution in Google Chrome before 153.0.8010.36 stems from a use-after-free in the browser's Payments component, letting a remote attacker who lures a victim to a crafted HTML page potentially execute arbitrary code outside the renderer sandbox. Chromium rates the severity High, and the supplied CVSS is 9.6 reflecting the sandbox-escape scope change. EPSS is low (0.35%, 29th percentile) and no public exploit is identified at time of analysis.
Remote code execution in Google Chrome on Windows (versions prior to 153.0.8010.36) arises from a use-after-free in ANGLE, Chrome's graphics abstraction layer that translates OpenGL ES calls to Direct3D. A remote attacker who lures a victim to a crafted HTML page can corrupt memory and execute arbitrary code outside the browser sandbox, giving full compromise of the renderer host process. No public exploit identified at time of analysis, and EPSS is modest (0.35%), but the sandbox-escape impact and one-click delivery make this a high-priority browser patch.
Remote code execution outside the browser sandbox affects Google Chrome versions prior to 153.0.8010.36 through a use-after-free flaw in the Web Authentication (WebAuthn) component. A remote attacker who lures a victim to a crafted HTML page can corrupt memory and execute arbitrary code with the privileges of the browser process, escaping the renderer sandbox (scope change). No public exploit has been identified at time of analysis and EPSS is low (0.34%), but the sandbox-escape RCE nature and Chrome's enormous install base make prompt patching important.
Remote code execution in Google Chrome on Windows (versions prior to 153.0.8010.36) arises from a heap buffer overflow in ANGLE, Chrome's graphics abstraction layer. A remote attacker who lures a victim to a crafted HTML page can corrupt heap memory and execute arbitrary code outside the renderer sandbox, gaining full compromise of the host. No public exploit is identified at time of analysis and EPSS is low (0.33%), but the sandbox-escape scope and Chrome's near-universal footprint make prompt patching essential.
Sandbox-escaping remote code execution in Google Chrome's WebPackaging component affects all desktop versions prior to 153.0.8010.36. A use-after-free (CWE-416) reachable from a crafted HTML page can let a remote attacker potentially execute arbitrary code outside the renderer sandbox with no authentication, requiring only that the victim visit a malicious page. No public exploit has been identified at time of analysis; Chromium's own internal triage rated the security severity 'Low', which sits in notable tension with the 9.6 CVSS assigned to the record.
Sandbox-escape remote code execution in Google Chrome for Android before 153.0.8010.36 arises from an integer overflow in the GPU process, letting a remote attacker who lures a victim to a crafted HTML page potentially run arbitrary code outside the renderer sandbox. Fixed in the same 153.0.8010.36 Stable Channel release that addressed several other GPU/media memory-safety bugs; no public exploit identified at time of analysis. Note the rating tension: the input CVSS is 9.6 (Critical) while Google's own Chromium severity is only Medium.
Sandbox-escape remote code execution in Google Chrome before 153.0.8010.36 stems from incorrect reference resolution in the FileSystem component, letting a remote attacker who lures a victim into visiting a crafted HTML page run arbitrary code outside the renderer sandbox. Reported by Google's own Chrome team and patched in the 2026-09 stable-channel desktop update; no public exploit is identified and SSVC lists exploitation as none, with EPSS at a modest 0.32%. Note a signal conflict: Chromium rates this 'Medium' while the assigned CVSS is 9.6, and the description requires user interaction (social engineering), so real-world risk is lower than the raw score suggests.
Sandbox-escape remote code execution affects Google Chrome on macOS prior to 153.0.8010.36, where an improper quantity-validation flaw (CWE-1284) in Tint, the WebGPU/WGSL shader compiler in Chromium's Dawn graphics stack, lets a crafted HTML page break out of the renderer sandbox. A remote attacker who lures a victim to a malicious web page can potentially execute arbitrary code with the privileges of the browser process on the host. Google reports a fix is shipped; there is no public exploit identified at time of analysis, and Chromium internally rated the issue Medium severity despite the high provided CVSS.
Remote code execution in Google Chrome on macOS prior to 153.0.8010.36 stems from a use-after-free in the Payments component, letting a remote attacker who lures a user to a crafted HTML page execute arbitrary code outside the browser sandbox. The provided CVSS vector (9.6) reflects a scope-changing sandbox escape requiring user interaction (a page visit), while Chromium rated the underlying bug 'High' rather than 'Critical'. A vendor patch is available; EPSS is low (0.30%, 22th percentile) and no public exploit is identified.
Sandbox-escape remote code execution in Google Chrome on Android (versions prior to 153.0.8010.36) stems from a use-after-free in Dawn, Chromium's WebGPU implementation. A remote attacker who lures a victim to a crafted HTML page can trigger the freed-object reuse to execute arbitrary code outside the renderer sandbox. Chromium rates this 'High'; there is no public exploit or CISA KEV listing, and EPSS is low (0.30%), indicating no evidence of active or widespread exploitation at time of analysis.
Remote code execution in Google Chrome prior to 153.0.8010.36 allows a remote attacker to escape the renderer sandbox and run arbitrary code on the host by luring a victim to a crafted HTML page that triggers a heap buffer overflow in the WebGL implementation. Chromium rates this Critical and the CVSS 9.6 score reflects a scope-changing sandbox escape; no public exploit is identified at time of analysis, and EPSS is low at 0.29% (21st percentile). Patched in the September 2026 stable-channel desktop release.
Stored cross-site scripting in SkillTree (NSA skills-service) before 4.4.2 lets an unauthenticated attacker self-register with a malicious firstName/lastName/nickname that executes in an administrator's browser when they open the Quiz Runs page. Because registration fields are stored unsanitized and later rendered through Vue's v-html directive, the flaw escalates from simple alert() proof to remote script loading via import() and full XSRF-token theft, enabling any admin action (delete projects, create backdoor accounts, exfiltrate user data). Publicly detailed in the GitHub Security Advisory; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in Google Chrome desktop prior to 153.0.8010.36 arises from a use-after-free in the WebGL implementation, allowing a remote attacker to run arbitrary code outside the browser sandbox by luring a victim to a crafted HTML page. Google rates the Chromium severity as Critical and the CVSS is 9.6, reflecting a full renderer-to-host sandbox escape. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.28% (20th percentile).
Sandbox-escape remote code execution in Google Chrome before 153.0.8010.36 stems from a numeric truncation error in the Media component, letting a remote attacker who lures a victim to a crafted HTML page potentially run arbitrary code outside the renderer sandbox. The vendor patch is available via the September 2026 stable-channel update; no public exploit is identified at time of analysis. Note a signal conflict: Chromium rated this 'Medium' severity while the supplied CVSS base score is 9.6 Critical.
Out-of-bounds write in the Media component of Google Chrome before 153.0.8010.36 allows a remote attacker to potentially execute arbitrary code outside the browser's renderer sandbox by luring a victim to a crafted HTML page. The scope-changing memory-corruption bug carries a CVSS of 9.6 despite Chromium's own 'Medium' severity rating, and a vendor patch is available. There is no public exploit identified at time of analysis.
Remote code execution in Google Chrome for macOS prior to 153.0.8010.36 stems from a use-after-free in the Extensions component, letting a remote attacker escape the renderer sandbox and run arbitrary code by luring a victim to a crafted HTML page. The flaw carries a CVSS 9.6 (scope-changed, network vector with user interaction), though Chromium's own security team rated it 'Medium'. No public exploit has been identified at time of analysis, and the fix is available in the stable channel.
Out-of-bounds read in the WebGL component of Google Chrome before 153.0.8010.36 lets a remote attacker who lures a victim to a crafted HTML page potentially execute arbitrary code outside the browser sandbox. Chromium rates the security severity as High, and a vendor patch is available; no public exploit has been identified and CISA SSVC records exploitation as none, with EPSS at a low 0.28% (20th percentile).
Remote code execution in Google Chrome (desktop) prior to 153.0.8010.36 stems from a use-after-free in the Passwords component that, when triggered via crafted UI interaction and social engineering, can let a remote attacker escape the renderer sandbox and run arbitrary code. All Chrome desktop builds before the 153.0.8010.36 stable release are affected. No public exploit identified at time of analysis, and no EPSS or KEV data was provided; note that Google's Chromium team rated the underlying bug only 'Medium' severity, which sits in tension with the supplied CVSS 9.6.
Sandbox-escaping remote code execution in Google Chrome's Aura windowing layer affects all desktop builds prior to 153.0.8010.36. A remote attacker who lures a victim to a crafted HTML page can trigger a use-after-free (CWE-416) and potentially execute arbitrary code outside the renderer sandbox. No public exploit identified at time of analysis; the fix ships in the stable-channel desktop update.
Sandbox-escaping remote code execution in Google Chrome's Payments component (versions prior to 153.0.8010.36) lets a remote attacker who successfully social-engineers a victim into visiting a crafted HTML page trigger a use-after-free and potentially run arbitrary code outside the renderer sandbox. Chromium rates the security severity 'High'; the supplied CVSS is 9.6 reflecting scope change and full CIA impact. No public exploit is identified at time of analysis and EPSS is low (0.26%, 17th percentile), and CISA SSVC records exploitation status as none.
Sandbox-escape remote code execution in Google Chrome's Device component on macOS (versions prior to 153.0.8010.36) allows a remote attacker to potentially run arbitrary code outside the renderer sandbox by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) reported by Google's own Chrome team; Chromium assigned it 'High' severity while the CVSS base score is 9.6. No public exploit identified at time of analysis, and EPSS is low (0.26%).
Remote code execution in Google Chrome on iOS before 153.0.8010.36 stems from a use-after-free in the Sharing component (CWE-416), letting a remote attacker who lures a victim to crafted network content execute arbitrary code outside the browser sandbox. Google has shipped a patched Chrome build; no public exploit is identified at time of analysis, and Google/Chromium rated the underlying bug 'Medium' severity even though the assigned CVSS base score is 9.6.
Sandbox-escaping remote code execution in Google Chrome (desktop) prior to 153.0.8010.36 stems from a use-after-free in the browser's Core component that a remote attacker can trigger through a maliciously crafted Chrome extension. Successful exploitation lets attacker-controlled code run outside the renderer sandbox with the browser process's privileges, but it requires convincing the victim to install or interact with the malicious extension (social engineering). There is no public exploit identified at time of analysis, EPSS is low (0.24%, 15th percentile), and CISA SSVC records exploitation as none, so the risk is high-impact but currently unproven in the wild.
Remote code execution in Google Chrome on Windows prior to 153.0.8010.36 arises from a type-confusion bug in the browser's Rust code, letting a remote attacker who lures a victim to a crafted HTML page potentially execute arbitrary code outside the renderer sandbox. Google shipped a fixed build via the Stable channel, and the flaw was reported internally by the Chrome team. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though sandbox-escape memory-corruption bugs in Chrome are historically high-value exploitation targets.
Sandbox-escaping remote code execution in Google Chrome's Browser process on Windows (all versions prior to 153.0.8010.36) stems from a use-after-free flaw. A remote attacker who lures a victim into opening a crafted HTML page can corrupt reclaimed heap memory in the privileged browser process and execute arbitrary code outside the renderer sandbox. No public exploit identified at time of analysis; the vendor has shipped a fixed stable build.
Sandbox-escaping remote code execution in Google Chrome before 153.0.8010.36 stems from improper array-index validation (CWE-129) in ANGLE, Chrome's graphics abstraction layer. A remote attacker who lures a victim to a crafted HTML page can potentially corrupt memory and execute arbitrary code outside the renderer sandbox. Chromium rates this 'High'; no public exploit is identified at time of analysis and EPSS is low (0.21%).
Remote code execution in Google Chrome's ANGLE graphics component on Windows (versions prior to 153.0.8010.36) allows a remote attacker to trigger an out-of-bounds write and potentially execute arbitrary code outside the browser sandbox via a crafted HTML page. Rated Chromium 'High' with a CVSS of 9.6 reflecting a scope-changing sandbox escape, though exploitation requires the victim to load malicious web content. No public exploit identified at time of analysis, and EPSS is low (0.21%), consistent with CISA SSVC scoring exploitation as 'none'.
Sandbox-escape remote code execution in Google Chrome (Chromium-based desktop) before 153.0.8010.36 stems from an incorrect authorization flaw in the DevTools component. A remote attacker who lures a victim to a crafted HTML page can potentially execute arbitrary code outside the renderer sandbox, achieving full compromise of the browser process. No public exploit identified at time of analysis; EPSS is low (0.21%, 11th percentile) and the issue is not in CISA KEV, but Google rates the Chromium security severity as High.
Missing authentication on the Invoice Generation endpoint in Rizwan17's inventory-management-system (PHP, all commits through bfe78a33) allows unauthenticated remote attackers to manipulate the `order_date` and `invoice_no` parameters in `includes/invoice_bill.php` without any credential check (CWE-306). The CVSS 4.0 vector confirms PR:N/UI:N exploitation with low integrity and availability impact and no confidentiality exposure. A public proof-of-concept has been disclosed via GitHub issue #14, and the project maintainer has not yet responded to the report, leaving no patch available at time of analysis.
SQL injection in Rizwan17's inventory-management-system allows unauthenticated remote attackers to manipulate database queries via the `pro_name[]` array parameter in the `storeCustomerOrderInvoice` function of `includes/manage.php`. The CVSS 4.0 vector (PR:N/AC:L/AT:N) confirms no authentication is required and exploitation is straightforward. A public proof-of-concept exists via GitHub issue #13, and the vendor has not responded to the disclosure, leaving no patch available.
Stored cross-site scripting in the Orbit Fox WordPress plugin (before version 3.0.9) allows users holding at minimum contributor-level access to inject arbitrary JavaScript by supplying an unsanitized HTML tag name within a Beaver Builder widget, with the malicious script persisting in page markup and executing in the browser of every subsequent visitor. The vulnerability carries a CVSS 5.4 Medium score and a publicly available proof-of-concept has been confirmed by WPScan, lowering the bar for exploitation on multi-author sites. No active exploitation is confirmed in CISA KEV at time of analysis, and the EPSS score of 0.15% reflects low automated exploitation probability.
Missing authorization controls in WPLP Cookie Consent WordPress plugin before 4.4.2 allow any subscriber-level authenticated user to invoke privileged AJAX actions without nonce or capability verification. Affected actions expose administrator scan data for reading and deletion, and permit complete overwrite of the plugin's stored configuration by low-privileged users. A publicly available exploit exists per WPScan, though EPSS is 0.13% (3rd percentile), indicating limited observed exploitation activity to date.
Path traversal in the Pandora malware-analysis platform (pandora-analysis, versions ≤1.12.7) lets an attacker who submits a crafted archive or disk image write extracted files outside the intended extraction directory. Because the extractor worker (ISO, BZ2, CAB, GZ, LZMA handlers) wrote decompressed content to attacker-influenced paths without confirming the destination stayed inside the target directory, a malicious sample can overwrite files accessible to the worker process, enabling file tampering, denial of service, and potential further compromise. No public exploit identified at time of analysis; the fix is present in the referenced upstream commit.
Unauthenticated payment cancellation in WP Travel WordPress plugin before 12.0.2 allows any remote actor to cancel a payment on any customer booking by exploiting a missing authorization check on a front-end payment-message handler. The plugin fails to verify that the requester is entitled to act on the targeted booking, enabling arbitrary booking disruption without credentials. A publicly available proof-of-concept reported by WPScan amplifies practical risk beyond the low 0.15% EPSS score, making opportunistic exploitation plausible against any exposed installation.
Unauthenticated content disclosure in the Kirki WordPress plugin before 6.3.0 allows any remote attacker to retrieve the full rendered page content of posts that are in private, draft, pending, or trashed states. The plugin renders and returns post content without first verifying whether the requesting party holds read permissions for that post, effectively bypassing WordPress's built-in visibility controls. A publicly available proof-of-concept exists via WPScan, though EPSS probability remains low at 0.14%, and the flaw has not been added to CISA KEV as of this analysis.
SupportCandy WordPress plugin before version 3.5.3 allows unauthenticated users to read the full contents of any support ticket by exploiting a missing pre-validation step on per-ticket authorization codes. The plugin discloses the genuine authorization code to any requester before verifying whether the submitted code is valid, effectively inverting the access control check and rendering the protection mechanism moot. A publicly available exploit exists via WPScan; no active exploitation has been confirmed by CISA KEV, and EPSS sits at 0.14%.
Unauthenticated information disclosure in SupportCandy WordPress plugin before 3.5.3 exposes protected customer-uploaded support ticket attachments to any remote attacker. The attachment download endpoint lacks an authorization check and uses sequential numeric identifiers, enabling trivial enumeration of all attachments across all tickets regardless of ticket visibility or customer ownership. A publicly available exploit exists per WPScan, though EPSS at 0.14% (4th percentile) indicates limited observed exploitation activity at time of analysis.
Unauthenticated order data exposure in the Payment Plugins for PayPal WooCommerce WordPress plugin before version 2.0.26 allows remote attackers to harvest customer PII from any WooCommerce order. The plugin outputs order secrets into frontend JavaScript configuration without first validating the supplied order key, and because WooCommerce order identifiers are sequential integers, an attacker can iterate through IDs to retrieve the secret for each order and subsequently access that customer's billing address, shipping address, and associated personal details. A publicly available proof-of-concept exists; no active exploitation is confirmed by CISA KEV at time of analysis.
Unauthenticated billing data exposure in Payment Plugins for Stripe WooCommerce (versions before 4.0.12) allows any remote attacker to enumerate all WooCommerce orders and retrieve their full billing details plus the per-order secret key embedded in front-end JavaScript. The root cause is missing order key validation before order data is serialized into the plugin's client-side configuration, combined with WooCommerce's use of sequential, predictable order identifiers that make enumeration trivial. A publicly available exploit exists per WPScan, and the SSVC assessment confirms the attack is automatable, though EPSS remains low (0.14%) suggesting no widespread active exploitation at time of analysis.
Price manipulation via IDOR in Sunshine Photo Cart WordPress plugin before 3.7 allows unauthenticated shoppers to complete purchases at arbitrarily reduced prices. The plugin accepts a client-supplied price identifier when adding items to the cart but never verifies that the identifier belongs to the item being purchased, enabling any visitor to reference a cheaper price entry from elsewhere on the site and check out at that lower amount. No public exploitation confirmed via CISA KEV, but WPScan has published a proof-of-concept, and EPSS sits at 0.14% (3rd percentile), indicating low automated scanning pressure despite the trivial exploit condition.
Enrollment record exposure in the Masteriyo LMS WordPress plugin (versions 1.3.1 through below 3.4.0) lets unauthenticated attackers retrieve any learner's enrollment status, progress data, and timestamps by iterating sequential integer record identifiers against the plugin's REST API - a classic IDOR pattern with no authorization gate. A secondary gap extends the exposure to authenticated enrolled users, who can similarly read other learners' records without restriction. A publicly available proof-of-concept is documented by WPScan, though no confirmed active exploitation (CISA KEV) has been recorded.
Local privilege escalation to root in Samsung's DualDAR (Dual Data-at-Rest) encryption component affects Samsung mobile devices running Android 14, 15, 16, and 17 prior to the SMR (Samsung Maintenance Release) Sep-2026 Release 1. A use-after-free condition lets a local attacker who already holds elevated privileges execute arbitrary code as root, fully compromising the device. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Payment bypass in the WP Express Checkout WordPress plugin (versions before 2.5.0) allows unauthenticated users to forge completed order records without submitting actual payment. The plugin fails to perform server-side validation against the payment processor to confirm a transaction was successfully completed, trusting client-supplied signals instead. Any visitor to an affected WordPress store can obtain goods or services for free, making this a high-impact business-logic flaw despite its moderate CVSS score. A publicly available exploit exists via WPScan, and no public exploitation (KEV) has been confirmed at time of analysis.
Unauthenticated arbitrary option overwrite in WPLP Cookie Consent WordPress plugin before 4.4.2 lets any remote visitor corrupt a site-wide WordPress option with attacker-controlled data. The vulnerable consent-state persistence routine lacks both WordPress capability checks (CWE-862) and CSRF token validation, and it fires unconditionally on every front-end page load - no special request path or trigger required. A WPScan-published POC is publicly available; no active exploitation is confirmed in CISA KEV.
Path traversal in GitHacker ≤1.1.7 allows a malicious git server to coerce the tool into reading arbitrary files from the victim's local filesystem via an unsanitized `ref:` value in a crafted `.git/HEAD`. The exploitable primitive is narrower than full arbitrary file-read: the recovery loop converts every 40-character hex substring in any accessed file into an outbound HTTP GET back to the attacker's server, yielding an existence oracle for arbitrary paths and hex-fragment exfiltration for files containing cryptographic material such as password hashes, HMAC-SHA1 outputs, or SSH key fingerprints. Exploitation requires the victim to actively run GitHacker against an attacker-controlled URL; no public exploit code has been identified at time of analysis, and a vendor-released patch is available as version 1.1.8.
Network amplification in PocketMine-MP before 5.39.2 allows authenticated game clients to trigger server-broadcast consuming animations for all visible players by sending crafted ActorEventPacket messages. Each malicious packet causes the server to invoke ConsumingItemAnimation.broadcastAnimation() for every peer in range, multiplying network load and CPU/memory consumption proportionally to the online player count. A publicly available proof-of-concept exists via the GitHub security advisory; no active exploitation has been confirmed in CISA KEV.
Remote code execution in Samsung Mobile Devices arises from a heap-based buffer overflow in the JPEG decoding path of libimagecodec.quram.so (the proprietary Quram/Qmage image codec) on builds prior to SMR Sep-2026 Release 1. A remote attacker who delivers a maliciously crafted JPEG image to a vulnerable device can corrupt heap memory and execute arbitrary code in the context of the image-processing component. No public exploit was identified at time of analysis, and the CVE is not listed in CISA KEV; Samsung rates it CVSS 4.0 9.2 (critical).
Remote code execution in the DNG (Adobe Digital Negative) image decoder within Samsung's Quram imaging library (libimagecodec.quram.so) affects Samsung mobile devices on Android 14, 15, 16, and 17 prior to the SMR Sep-2026 Release 1 patch. A crafted DNG image parsed by the library triggers a heap-based buffer overflow, letting a remote attacker run arbitrary code in the context of the process handling the image. No public exploit identified at time of analysis, and it is not on the CISA KEV list, but Quram image-parsing flaws have a strong historical track record of weaponization on Samsung/Android.
Authentication bypass in Parse Server's built-in LDAP authentication adapter (versions <= 8.6.87 and 9.0.0 through 9.10.1-alpha.6) lets an unauthenticated attacker who knows a valid directory username obtain a session token for that account, resulting in full account takeover. The adapter forwarded a client-supplied empty password to the directory and treated any non-error bind response as successful authentication, so a zero-length credential triggers an RFC 4513 unauthenticated-simple-bind that directories like Active Directory answer with success. No public exploit identified at time of analysis, but the flaw is trivial to trigger against affected LDAP-backed deployments.