Missing authorization checks in the ruoyi-workflow module of RuoYi-Cloud-Plus 2.6.2 and earlier allow any authenticated user with a low-privilege account to read workflow task details belonging to other users via /task/getTask/{taskId} and to trigger workflow executions they are not entitled to start via /task/startWorkFlow. The FlwTaskController endpoints carry no permission annotations and the service layer never verifies that the caller is the task handler or a related user, so the only barrier is possession of a valid account. EPSS is low (0.19%, 9th percentile) and no CISA KEV listing or public exploit code has been identified at time of analysis, so this is a realistic internal-threat/insider and lateral-movement issue rather than an internet-wide emergency.
UI spoofing in Google Chrome's Accessibility subsystem on macOS (all versions prior to 153.0.8010.36) stems from incorrect reference resolution (CWE-706), enabling a remote unauthenticated attacker to mislead users into perceiving fraudulent UI elements via a crafted HTML page. The attack requires a user to visit a malicious page, and no active exploitation or public proof-of-concept code has been identified at time of analysis. Vendor-released patch 153.0.8010.36 is available via the Chrome stable channel update published on the Chrome Releases blog.
Uninitialized memory in the Codecs component of Google Chrome before 153.0.8010.36 leaks sandbox-internal memory to a remote attacker via a crafted HTML page. The vulnerability stems from CWE-908 (use of uninitialized resource) where codec processing exposes arbitrary memory contents that happen to reside in uninitialized buffers - but exploitation is constrained entirely within the Chrome sandbox (S:U). No active exploitation is confirmed and no public exploit code exists; EPSS stands at 0.19% (9th percentile), consistent with a low-priority medium-severity disclosure issue.
ServiceWorker incorrect authorization in Google Chrome prior to 153.0.8010.36 permits remote attackers to bypass the web origin policy by delivering a crafted HTML page to a target user. The root cause is CWE-863 (Incorrect Authorization) within Chrome's ServiceWorker subsystem, which fails to properly enforce cross-origin access boundaries. No active exploitation has been identified; Chrome's own security team rated the severity Low, consistent with the limited confidentiality-only impact reflected in the CVSS 4.3 score.
Missing authorization in Google Chrome's FedCM (Federated Credential Management) component, versions prior to 153.0.8010.36, enables a remote attacker to bypass the web origin policy by luring a user to a crafted HTML page. The flaw (CWE-862) results in limited confidentiality impact - an origin-policy bypass that could expose data scoped to that cross-origin context. No public exploit exists and EPSS sits at 0.19% (9th percentile), consistent with Chromium's own 'Medium' severity rating and the requirement for user interaction.
Missing authorization in Google Chrome's Browser component (versions prior to 153.0.8010.36) permits remote attackers to bypass system access restrictions by directing users to a crafted HTML page. The flaw, classified as CWE-862 (Missing Authorization), carries a CVSS 4.3 Medium score with a limited integrity impact and no confidentiality or availability consequences. No public exploit code exists and EPSS sits at 0.19% (9th percentile), placing real-world exploitation risk well below the threshold warranting emergency response.
Origin-policy bypass in Google Chrome's Isolated component (prior to 153.0.8010.36) enables unauthenticated remote attackers to cross into privileged page contexts via a crafted HTML page requiring one click from the victim. Chromium rates this Medium severity, consistent with the CVSS 4.3 score and its limited confidentiality-only impact. No public exploit or active exploitation has been identified; EPSS at 0.19% (9th percentile) confirms very low near-term exploitation probability.
Web origin policy bypass in Google Chrome prior to 153.0.8010.36 allows a remote unauthenticated attacker to circumvent Same-Origin Policy (SOP) restrictions by exploiting improper input validation in the Network component via a crafted HTML page. The CVSS 4.3 Medium rating is consistent with Chromium's own 'Medium' severity classification, with impact limited to partial confidentiality loss and no integrity or availability consequence. No public exploit code is identified and EPSS sits at 0.18% (8th percentile), indicating very low near-term exploitation probability.
Out-of-bounds read in stb_truetype's stbtt_GetGlyphShape function enables denial of service against any application that parses attacker-supplied TrueType font files using the nothings/stb library at commit 31c1ad3. The affected function reads glyph outline data from a crafted TTF without sufficient bounds validation, causing an abnormal read that crashes the host application. No public exploit code or CISA KEV listing was identified at time of analysis; CVSS 4.3 with UI:R reflects the realistic, user-triggered exposure.
Site isolation bypass in Google Chrome Core prior to 153.0.8010.36 allows a remote attacker who has already compromised the renderer process to cross site isolation boundaries via a crafted HTML page. This is not a standalone exploit - it is a post-renderer-compromise escalation step that leverages a missing authorization check (CWE-862) in Chrome's Core component to violate the cross-origin process separation that site isolation guarantees. No public exploit code exists and EPSS is 0.18% (7th percentile), consistent with Chromium's own 'Low' severity rating; the practical bar for exploitation is high.
CORS origin-policy bypass in Google Chrome before 153.0.8010.36 allows a remote attacker, via social engineering and crafted network traffic, to circumvent the browser's web origin policy due to improper certificate validation in the CORS implementation (CWE-295). The impact is constrained to low-integrity effects - Chrome may treat cross-origin requests as authorized when they should be rejected - with no confidentiality or availability impact. No public exploit code exists, EPSS is 0.18% (7th percentile), and Chromium's own severity designation is 'Low', collectively confirming this as a low-priority but real integrity flaw.
Authenticated information disclosure in Tanium Server across three supported release branches (7.7.3, 7.8.2, and 7.8.4) allows a low-privilege network user to access data they are not authorized to view, as described in vendor advisory TAN-2026-033. The CVSS 4.3 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) confirms the flaw is network-reachable, low-complexity, and requires only standard credentials with no user interaction. Vendor-released patches are available for all affected branches; no public exploit code or CISA KEV listing exists at time of analysis.
Information disclosure in Tanium Comply allows authenticated low-privilege network users to access data beyond their authorization level. Versions in the 2.37 branch prior to 2.37.308 are confirmed affected per the EUVD advisory tied to vendor bulletin TAN-2026-032. No public exploit code or active exploitation has been identified; Tanium self-reported and patched the issue.
Out-of-bounds read in the Tint WGSL shader compiler in Google Chrome prior to 153.0.8010.36 allows a remote, unauthenticated attacker to read limited memory contents within the browser's renderer sandbox by directing a victim to a crafted HTML page. Scope is confined to the sandbox (S:U/C:L), with no integrity or availability impact and no sandbox escape; Chromium rates this 'Low' severity, consistent with the CVSS 4.3 score. No public exploit code exists and EPSS is negligible at 0.17% (7th percentile), indicating low exploitation probability; a vendor-released patch is available in Chrome 153.0.8010.36.
Cross-origin data leakage in Google Chrome's Prefetch subsystem (versions prior to 153.0.8010.36) enables a remote attacker to infer information about cross-origin resources via an observable discrepancy side-channel triggered by a crafted HTML page. The vulnerability affects unauthenticated users who visit the malicious page, requiring only passive user interaction (browsing). Chromium's own severity rating of 'Low' aligns with the CVSS 4.3 score; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in ANGLE (Chrome's OpenGL ES translation layer) in Google Chrome prior to 153.0.8010.36 enables a remote unauthenticated attacker to read limited memory content outside the renderer sandbox by luring a user to a crafted HTML page. Unlike co-patched ANGLE issues in the same Chrome 153.0.8010.36 release that achieve full sandbox escape and remote code execution, this flaw is bounded to confidentiality impact only with no scope change - the read does not escape the renderer process. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.17% reflects minimal current attacker interest.
Cross-origin data exposure in Google Chrome's Scroll component (all versions prior to 153.0.8010.36) enables an attacker who has already achieved renderer process compromise to exfiltrate sensitive data from other web origins via a crafted HTML page. This is a secondary-stage vulnerability - it does not provide initial access but extends an existing renderer compromise into a cross-origin information leak. Chromium rated this Medium severity, consistent with the 4.3 CVSS score; no public exploit exists and EPSS at 0.17% (7th percentile) reflects the narrow, chained exploitation scenario.
Out-of-bounds read in ANGLE (Chrome's graphics translation layer) affects Google Chrome prior to 153.0.8010.36, enabling a remote attacker to read memory from the renderer process when a victim visits a crafted HTML page. The impact is limited to partial confidentiality disclosure (C:L) with no integrity or availability consequence, and the vulnerability is contained within the renderer sandbox (S:U). No public exploit code and no CISA KEV entry have been identified at time of analysis; vendor-released patch 153.0.8010.36 is available.
Cross-site request forgery in Chrome's DeviceBoundSessionCredentials (DBSC) subsystem allows a remote, unauthenticated attacker to bypass the web origin policy by luring a victim to a crafted HTML page. DeviceBoundSessionCredentials is Chrome's mechanism for cryptographically binding session tokens to a specific device, and the CSRF flaw undermines that origin-isolation guarantee, potentially allowing limited credential scope leakage (C:L). No public exploit code exists and no active exploitation has been confirmed; the EPSS score of 0.17% (7th percentile) and Chromium's own 'Medium' severity rating align with the modest real-world risk.
Incorrect type conversion (CWE-704) in Chrome's Safebrowsing component on macOS allows remote attackers to bypass system access restrictions by delivering a specially crafted file, requiring user interaction to trigger. All Chrome for Mac versions prior to 153.0.8010.36 are affected; Google released the fix in the September 2026 stable channel update. No public exploit code exists and EPSS sits at 0.17% (7th percentile), consistent with Chromium's own 'Low' severity designation.
UI spoofing in Google Chrome prior to 153.0.8010.36 permits a remote attacker who has already compromised the renderer process to present falsified browser interface elements to the user through crafted network traffic. The root cause is improper input validation (CWE-20) in the Chromium rendering engine, allowing a compromised renderer to influence UI presentation in ways the browser should reject. No public exploit or CISA KEV listing exists; an EPSS of 0.16% (6th percentile) and Chromium's own 'Low' severity rating confirm this is a second-stage, chained capability rather than a standalone high-risk flaw.
Address bar spoofing in Google Chrome prior to 153.0.8010.36 allows a remote attacker to misrepresent the displayed URL via a specially crafted domain name, exploiting a flaw in the UrlFormatting subsystem. The attack requires social engineering to direct a victim to the attacker-controlled domain, after which the browser renders a deceptive address bar that masks the true origin. No public exploit has been identified at time of analysis, and EPSS at 0.16% (6th percentile) reflects low observed exploitation interest, consistent with the medium severity and UI:R requirement.
Improper access controls in Tanium Comply allow an authenticated low-privileged user to perform unauthorized write actions against compliance data or configuration, resulting in limited integrity impact. Affected across three active release branches - 2.32, 2.35, and 2.37 - with specific patch thresholds published by Tanium. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, placing this in the category of moderate enterprise risk requiring patching within standard change-management windows.
Improper access controls in Tanium Comply allow an authenticated low-privileged user to perform unauthorized write operations they should not be permitted to execute. The vulnerability stems from CWE-639 (Authorization Bypass Through User-Controlled Key), meaning the application fails to enforce object-level authorization checks, allowing a user to manipulate resource identifiers to access or modify other users' or roles' data. No public exploit has been identified at time of analysis, and EPSS data is not available in the provided intelligence.
Cross-origin data leakage in Google Chrome's Core component (all versions prior to 153.0.8010.36) enables a remote attacker to exfiltrate data from origins other than the attacker-controlled context via a specially crafted Chrome extension. The extension acts as the delivery mechanism, causing Chrome's Core to expose cross-origin content it should otherwise isolate. EPSS sits at 0.15% and Chromium's own severity rating is Low, consistent with the limited, read-only confidentiality impact and the user-interaction requirement for extension installation. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
RSA operations in mirage-crypto-pk for OCaml before version 2.3.0 raise an undocumented exception when processing abnormally small messages during encryption or decryption. Any OCaml application - including MirageOS unikernel services - that exposes RSA operations to attacker-influenced inputs without upstream size validation can have those operations disrupted by a remote attacker with low-privilege access. No public exploit has been identified at time of analysis; the CVSS score of 4.3 (A:L only) reflects a limited, availability-focused impact with no confirmed confidentiality or integrity exposure.
Denial-of-service in the HarmonyOS preview service module allows a remote, unauthenticated attacker to degrade or crash the preview functionality when a user interacts with a crafted input. Affected versions are limited to HarmonyOS 6.1.0 on Huawei consumer devices. Exploitation yields only a low-severity availability impact; confidentiality and integrity are unaffected.
Cross-origin data disclosure in Google Chrome's Paint rendering component (versions prior to 153.0.8010.36) enables a remote attacker to read data belonging to a different web origin by directing a victim to a crafted HTML page. The root cause is an origin validation error (CWE-346) in the Paint pipeline, which under certain rendering conditions fails to enforce the Same-Origin Policy, leaking partial cross-origin data to the attacker-controlled page. EPSS is 0.14% (3rd percentile), Chromium rates this 'Medium,' and no public exploit or CISA KEV listing exists at time of analysis - placing this squarely in standard patch-cadence rather than emergency response territory.
UI spoofing in Google Chrome's FedCM (Federated Credential Management) implementation allows an attacker who has already compromised the renderer process to inject malformed identity-provider dialog elements via a crafted HTML page, potentially deceiving users into submitting credentials to an attacker-controlled endpoint. All Chrome desktop versions prior to 153.0.8010.36 are affected. The attack is two-stage: an independent renderer-compromise vulnerability must first be exploited, making this a chained post-exploitation capability rather than a standalone initial-access vector. No public exploit code and no CISA KEV listing are confirmed at time of analysis.
Incorrect authorization in Chrome's Navigation component (versions prior to 153.0.8010.36) allows a remote attacker who has already compromised the renderer process to spoof browser UI elements - such as the address bar or security indicators - via a crafted HTML page. This is a chained exploit step, not a standalone vulnerability: renderer-level code execution via a separate flaw is a hard prerequisite. Chromium classifies severity as 'Medium,' consistent with the CVSS 4.2 score; no public exploit code and no active exploitation (CISA KEV) have been identified.
UI misrepresentation in Google Chrome prior to 153.0.8010.36 allows a remote attacker to spoof browser UI elements - such as the address bar, security indicators, or permission dialogs - via a specially crafted HTML page, requiring social engineering to lure the victim. Exploiting CWE-451, the attacker can deceive users into trusting a malicious or phishing page as legitimate, potentially leading to credential theft or other user-driven disclosures. No public exploit code has been identified and EPSS is 0.24% (15th percentile), consistent with the Chromium team's 'Medium' severity rating and the high-complexity social engineering prerequisite.
Clickjacking via UI spoofing in Google Chrome prior to 153.0.8010.36 allows a remote attacker who has already compromised the renderer process to overlay deceptive UI elements through a crafted HTML page, requiring additional social engineering to complete the attack. The vulnerability (CWE-1021) affects all desktop Chrome builds before the September 2026 stable-channel release. No public exploit code exists and no active exploitation has been identified; EPSS of 0.20% (10th percentile) reflects the low probability of opportunistic exploitation given the demanding prerequisites.
Race condition in the Browser component of Google Chrome prior to 153.0.8010.36 allows a remote unauthenticated attacker to bypass system access restrictions by inducing a victim to visit a crafted HTML page. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L) reflects limited, non-scope-changing impact - this is not a sandbox escape but a partial access-control bypass within the Browser process. EPSS at 0.20% (10th percentile), Chromium's own 'Medium' severity rating, and the absence of KEV listing or public exploit code all converge on low near-term exploitation risk.
UI spoofing via a confused deputy flaw in Google Chrome's Fullscreen API (all versions prior to 153.0.8010.36) enables a remote attacker who has already compromised the renderer process to impersonate browser-trusted UI elements using a crafted HTML page and social engineering. This is a secondary exploitation step - it does not provide initial access - and becomes relevant only after a separate, higher-severity renderer compromise has been achieved. No public exploit code or CISA KEV listing exists; EPSS of 0.17% (6th percentile) reflects very low automated exploitation probability consistent with the chained, human-dependent attack path.
Chrome's Downloads subsystem in versions prior to 153.0.8010.36 contains an incorrect authorization check (CWE-863) that allows an attacker who has already compromised the renderer process to spoof download-related UI elements via a crafted HTML page. This vulnerability is a post-renderer-compromise chaining primitive - it cannot be exploited independently and must be paired with a separate renderer exploit. Chromium rates this 'Medium' and the CVSS score of 4.2 aligns with that assessment; EPSS at 0.17% (6th percentile) and absence from CISA KEV confirm low real-world exploitation probability.
UI spoofing in the Passwords component of Google Chrome on Android (versions prior to 153.0.8010.36) enables an attacker who has already compromised the renderer process to display falsified password-manager interface elements via a crafted HTML page. Exploitation is constrained by a hard prerequisite - a separate renderer compromise must precede this attack - and requires user interaction with the malicious page. No public exploit code exists and EPSS sits at 0.16% (6th percentile), in line with Chromium's own 'Low' severity classification.
Clickjacking via TrustedWebActivities (TWA) in Google Chrome on Android prior to 153.0.8010.36 allows a local attacker with a co-installed malicious app to spoof the browser address bar, enabling deceptive phishing scenarios where the user believes they are on a trusted domain. The attack leverages CWE-1021 (UI layer redressing) in Chrome's TWA feature, which is designed to let Android apps surface web content with reduced browser chrome. No public exploit code has been identified and EPSS sits at 0.18% (8th percentile), consistent with the local-access requirement and high attack complexity. Google has released the fix in the stable channel update to 153.0.8010.36.
Out-of-bounds memory read in the stb library's stbsp_vsnprintf function (stb_sprintf.h) at commit 31c1ad3 enables a denial-of-service condition when a consuming application passes attacker-controlled input to the function. The nothings/stb project is Sean Barrett's widely-vendored, public-domain, single-file C library suite embedded across game engines, imaging tools, and embedded systems. No public exploit code and no CISA KEV listing exist at time of analysis; the local attack vector and high attack complexity in the CVSS vector further limit practical exploitability.
Permission control weakness in the HarmonyOS window module allows a local attacker to bypass access restrictions and read protected service data on HarmonyOS 6.1.0 devices. The CVSS vector (AV:L/AC:H/PR:N) confirms local-only exploitation with high attack complexity, substantially limiting reach. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog; the primary concern is confidentiality exposure on unpatched consumer and laptop devices.