Use-after-free in Google Chrome's parser allows remote attackers to execute arbitrary code within the browser's renderer sandbox by convincing a victim to visit a crafted HTML page. All Chrome builds prior to 155.0.8059.39 are affected, and exploitation requires user interaction (UI:R) but no authentication (PR:N). The flaw carries a High Chromium severity rating (CVSS 8.8) and no public exploit has been identified at time of analysis; however, standalone impact is constrained because the description specifies code execution 'inside the sandbox,' meaning a second vulnerability would be needed to escape to the host.
Type confusion in the V8 JavaScript engine of Google Chrome before 155.0.8059.39 allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim renders a crafted HTML page, requiring user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8). Signals conflict and must be weighed carefully: the numeric severity is high, yet Google's own Chromium security severity for this issue is 'Low' and CISA's SSVC assessment records no exploitation and a non-automatable attack path, with no public exploit identified at time of analysis. A vendor-released patch exists in Chrome 155.0.8059.39, so fully updated installations are not exposed.
Type confusion in V8, Chrome's default JavaScript and WebAssembly engine, enables a remote attacker to run arbitrary code inside the browser's renderer sandbox in Google Chrome releases below 155.0.8059.39. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) confirms the attack is network-reachable and requires no authentication, though it does require the victim to open attacker-controlled web content, so a phishing, malvertising, or watering-hole lure is a prerequisite. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none' and the issue as not automatable, so real-world priority currently sits below what the 8.8 base score alone implies; note that code execution is confined to the renderer sandbox, meaning full host compromise would require chaining a separate sandbox-escape flaw. Google has shipped a vendor patch.
Authenticated privilege escalation in the HPE Aruba Networking AOS-S management API allows a read-only account to escalate to full administrative access, giving the attacker complete control over confidentiality, integrity, and availability of the affected switch (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is network-reachable and low-complexity, requiring no user interaction and no non-default configuration beyond the API being reachable, but it is gated by the prerequisite of a valid low-privilege credential (PR:L), so risk concentrates in environments where read-only accounts exist, are shared, or can be compromised; the vendor reports this as a privilege-escalation issue in the AOS-S API. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, yet the combination of a low-bar prerequisite and a total privilege gain makes this a credible, actionable priority rather than an inflated high-CVSS score.
Privilege escalation in the WordPress plugin WP User Profiles (versions 2.7.3 and earlier) allows an authenticated subscriber-level user to elevate to higher privileges, achieving full confidentiality, integrity and availability impact on the affected site. The flaw is network-exploitable with no user interaction and requires only a valid low-privilege account, which is trivially obtainable on any site that permits open user registration; sites that restrict account creation substantially raise the bar. At time of analysis there is no public exploit identified and the CVE is not listed in CISA KEV, but the 8.8 base score and the low prerequisite make prompt patching or plugin removal the priority.
Use-after-free in Google Chrome's Track component (versions prior to 155.0.8059.39) allows a remote attacker to achieve arbitrary code execution inside the renderer sandbox when a victim loads a crafted HTML page. The flaw carries a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning it is network-reachable, low-complexity, and requires no authentication, with mandatory user interaction - the victim must navigate to or be redirected to attacker-controlled content - as the only gating prerequisite. Google rates the issue Critical and shipped a fix in the 155.0.8059.39 stable-channel release; no public exploit code has been identified at time of analysis, and the escape from the browser sandbox would require a separate, independent vulnerability.
Incorrect authorization in Google Chrome's WebProtect component lets a remote, unauthenticated attacker who socially engineers a victim into opening a crafted HTML page read sensitive information held in the browser context - the assessed impact is confidentiality-only (C:H/I:N/A:N), with no integrity or availability loss. Every Chrome build prior to 155.0.8059.39 is affected across platforms, and Google rates the underlying issue as Chromium security severity Medium. Exploitation is not drive-by: the CVSS vector requires user interaction (UI:R) and PR:N, so no credentials or non-default configuration are needed but the victim must be lured to the attacker-controlled page, and no public exploit code has been identified at time of analysis, making the base score of 8.8 an overstatement of realistic risk.
Use-after-free in Google Chrome's built-in PDF handling (fixed in 155.0.8059.39) lets remote, unauthenticated attackers execute arbitrary code inside the Chrome renderer sandbox when a victim opens a crafted PDF file - exploitation is not automatic and depends entirely on the user interaction of opening the document (CVSS 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-416). Because the code execution is confined to the sandboxed renderer, turning this into full host compromise would require chaining a separate sandbox-escape bug; the advisory rates it Chromium severity High. At the time of analysis there is no public exploit identified and CISA SSVC records exploitation as none, though the vulnerability is fully described and a vendor patch plus the underlying Chromium issue tracker entry are publicly referenced. Google Chrome versions before 155.0.8059.39 are affected on all platforms tracked under cpe:2.3:a:google:chrome.
Information disclosure in Google Chrome for iOS Autofill allows an attacker who lures a victim to a crafted HTML page to obtain sensitive form data that the browser failed to properly clear. Only Chrome for iOS builds prior to 155.0.8059.39 are affected; vulnerable instances require the Autofill feature to have been used so that sensitive data is actually present for the incomplete cleanup to expose. Exploitation requires no authentication (PR:N) but is gated by mandatory user interaction and social engineering (UI:R), meaning it cannot be triggered silently; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. Note that the vendor-assigned CVSS of 8.8 overstates the impact relative to our independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5), which scores confidentiality impact only, with no integrity or availability effect.
Information disclosure in the HPE Networking ClearPass Policy Manager Android client application allows an unauthenticated remote attacker to invoke improperly access-controlled application functionality from an untrusted source, potentially exposing sensitive information held on or accessible to the victim's mobile device. Exploitation requires the ClearPass Android client to be installed plus mandatory victim interaction (UI:R) with attacker-supplied content - for example a malicious co-installed app, crafted intent, deep link, or content - so delivery likely relies on an Android inter-component path rather than direct internet-facing exposure, and no public exploit was identified at time of analysis. Note that the vendor-supplied CVSS 3.1 vector (8.8, C:H/I:H/A:H) overstates the issue relative to the described confidentiality-only impact; our independent assessment limits the score to AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.
Incorrect authorization in Google Chrome's Autofill feature (versions prior to 155.0.8059.39) allows an unauthenticated remote attacker (PR:N) to obtain sensitive information via a crafted HTML page, but exploitation requires social engineering to trick the victim into visiting and interacting with the page (UI:R). The independent assessment limits the impact to confidentiality (C:L) with no integrity or availability effect, and exploitation further depends on the victim having relevant data stored in Autofill; no public exploit or active exploitation has been identified. A vendor patch is available.
Sensitive-information disclosure in Google Chrome for iOS before 155.0.8059.39 allows a remote, unauthenticated attacker to abuse a missing authorization check by socially engineering a victim into opening a crafted HTML page. The independent assessment limits the impact to confidentiality (C:H/I:N/A:N), so this should be treated as an information disclosure issue rather than code execution or data tampering, and exploitation requires user interaction on the iOS build only. Vendor patch 155.0.8059.39 is available, and no public exploit code or CISA KEV active exploitation was identified in the supplied intelligence.
Unauthenticated privilege escalation in the Salon Booking System WordPress plugin (versions 10.31.7 and earlier) allows remote attackers to elevate privileges by inducing a victim to trigger a crafted request, due to incorrect privilege assignment (CWE-266) in the plugin's role handling. The attack requires user interaction (UI:R) but no authentication (PR:N), and affects any WordPress site with the vulnerable plugin active. No public exploit code has been identified at time of analysis, and the issue is not confirmed as actively exploited, yet the high CVSS score (8.8) and potential for significant site compromise warrant prompt remediation.
Arbitrary code execution inside the Chrome renderer sandbox is possible in Google Chrome builds prior to 155.0.8059.39, where a race condition (CWE-367) in the V8 JavaScript engine can be won by a crafted HTML page. Exploitation requires only that the victim load the attacker's page in a vulnerable browser (UI:R, PR:N per the CVSS vector), with no credentials or prior privileges needed, but success additionally depends on hitting a time-of-check/time-of-use timing window, which our assessment captures by raising attack complexity to High (CVSS 3.1 base 8.1 under AC:H, versus the 8.8 score supplied with the CVE under AC:L). The critical caveat is scope: the code execution achieved stays within the renderer sandbox and does not by itself compromise the host operating system, so full system impact requires chaining a separate sandbox-escape vulnerability. No public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none (Automatable: no, Technical Impact: total), and a vendor-released patch exists in Chrome 155.0.8059.39.
Use-after-free in Chrome's font handling on Windows allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page; the flaw affects Google Chrome versions prior to 155.0.8059.39. Exploitation requires user interaction (UI:R) - the victim must load attacker-controlled content - and there are no authentication prerequisites (PR:N), but the resulting code execution is confined to the Chrome sandbox, so host-level compromise would require a second, independent sandbox-escape bug. Consistent with the medium severity rating assigned by the Chromium team, CISA's SSVC assessment records no known exploitation and no automatable exploitation path, and no public exploit code has been identified at time of analysis.
A use-after-free memory-safety flaw in Google Chrome's Media component lets a remote, unauthenticated attacker execute arbitrary code inside the renderer sandbox when a user loads a crafted HTML page containing malicious media content. All Chrome builds prior to 155.0.8059.39 are affected, and exploitation requires the victim to visit or load the attacker-controlled page (UI:R), which is the main practical barrier; no credentials or special privileges are needed. There is no public exploit identified at time of analysis and the CISA SSVC assessment records no exploitation, but the vendor has shipped a fix in 155.0.8059.39, and the EPSS-style risk picture is dominated by Chrome's ubiquity and the high CVSS base score (8.8) rather than by observed attacks.
Use-after-free in Google Chrome's V8 JavaScript engine (all releases prior to 155.0.8059.39) lets unauthenticated remote attackers execute arbitrary code inside the renderer sandbox when a victim navigates to an attacker-controlled page containing crafted HTML/JavaScript. The bug carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and Chromium's own 'High' severity rating, and because the V8 engine is enabled by default in every standard installation, no special configuration or privileges are needed on the target side. Impact is bounded, however: per the vendor description code execution is confined to the sandbox, so a standalone exploit does not by itself compromise the host and a separate sandbox-escape would be required, and no public exploit identified at time of analysis (SSVC Exploitation: none, Automatable: no) - a genuine priority-worthy issue whose urgency is tempered by the required user interaction, sandbox confinement, and absence of observed exploitation.
Use-after-free in the Media component of Google Chrome prior to 155.0.8059.39 lets a remote attacker execute arbitrary code within the browser's renderer sandbox by luring a victim to open a crafted HTML page. The flaw carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no authentication or prior privileges are required, but successful exploitation depends on the user actively navigating to attacker-controlled content. There is no public exploit identified at time of analysis - CISA's SSVC assessment lists exploitation as 'none' - and code execution is contained within the renderer sandbox, so a separate sandbox-escape would be needed to reach the host OS; the vendor has released a patched build.
Arbitrary code execution confined to the renderer sandbox in Google Chrome builds prior to 155.0.8059.39, reachable when a user opens a crafted HTML page that drives the DevTools state-validation path into an inconsistent state. The flaw is network-delivered and requires no authentication (CVSS:3.1/AV:N/AC:L/PR:N), but exploitation is gated by mandatory user interaction (UI:R), which is why CISA's SSVC decision framework rates it as not automatable. No public exploit code and no confirmed active exploitation were identified at time of analysis; Google rates the Chromium severity as High and has shipped a fixed build, so the practical exposure is limited to unpatched clients that have not yet received the auto-update.
Stored cross-site scripting in the web-based management interface of Aruba/HPE ClearPass Policy Manager allows a remote attacker to plant script that is stored by the application and later executes in the browser of an administrative user who views the affected page. Consistent with our independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), the injection step requires no authentication, but the payload only fires after an authenticated administrator interacts with the affected view, yielding high confidentiality and integrity impact within that administrative session; the vendor/NVD vector rates it 8.8 under a slightly different scope/impact model. No public exploit code and no evidence of active exploitation were identified at time of analysis (CVE-2026-79799 is not in CISA KEV, and no EPSS score was supplied), so this is a credible, moderately high priority for organizations running ClearPass - particularly those that expose the management interface beyond an isolated management network or trusted admin VLAN.
Arbitrary code execution in AWS Bedrock AgentCore Starter Toolkit before 0.3.14 allows an authenticated same-account actor to inject malicious Python code into generated agent source by importing a crafted Bedrock Agent configuration, which executes when the victim runs or deploys the agent. Exploitation requires the victim to import and then run or deploy the agent, and the actor must have valid same-account credentials. No public exploit identified at time of analysis; remediation requires upgrading to 0.3.14 and re-importing any previously affected agents because the generated source persists.
Information disclosure in the Passwords component of Google Chrome desktop builds prior to 155.0.8059.39 lets a remote, unauthenticated attacker obtain sensitive data when a victim renders a crafted HTML page. The vendor rates the issue Chromium security severity Low, and the independent assessment converges on a limited-confidentiality impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) rather than the 8.8 figure carried in some feeds, so the mandatory user interaction and the low-confidentiality scope are the real risk drivers. There is no public exploit identified at time of analysis, and a vendor patch is already shipping in the stable channel as 155.0.8059.39.
Google Chrome builds prior to 155.0.8059.39 contain a missing authorization check in the Autofill component that allows a remote attacker to read sensitive information in the browser's stored autofill data. Exploitation is not silent: it requires the victim to be socially engineered into opening an attacker-crafted HTML page (CVSS UI:R, PR:N), and the SSVC assessment records Exploitation=none and Automatable=no, meaning this cannot be triggered at scale or without user action. Our independent assessment rates the impact as confidentiality-only (C:H/I:N/A:N), so real-world risk is MODERATE and meaningfully lower than the headline CVSS 8.8 suggests; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, though a vendor patch is available.
Use-after-free in Google Chrome's CSS handling affects builds prior to 155.0.8059.39 and allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. The flaw scores CVSS 3.1 base 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), yet Google assigned it Chromium severity Low because the resulting code execution is confined to the browser sandbox and requires user interaction - full host compromise would require chaining a separate sandbox-escape bug. No public exploit identified at time of analysis, and a vendor patch is available.
Arbitrary code execution confined to Chrome's renderer sandbox is possible in Google Chrome versions prior to 155.0.8059.39, where an incorrect comparison in the font rendering pipeline can be triggered by a crafted HTML page. This is an unauthenticated remote attack (AV:N/PR:N) that requires the victim to load attacker-controlled web content (UI:R); the resulting code execution stays inside the renderer sandbox (S:U), and escaping to the host operating system requires a separate, unrelated sandbox-escape vulnerability - which is why Chromium assigned a Low security severity despite the CVSS 8.8 base score. No public exploit code was identified at time of analysis, and a vendor-released patch (155.0.8059.39) is available.
Race condition in the V8 JavaScript engine allows remote code execution inside the browser sandbox in Google Chrome builds prior to 155.0.8059.39. A remote, unauthenticated attacker can trigger the flaw by getting a victim to open attacker-supplied HTML that drives V8 into the timing window (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) - the required user interaction is the only precondition, and code execution is confined to the renderer/V8 sandbox, so host compromise would require a second, separate sandbox-escape bug. Google has shipped a fixed stable-channel build, and no public exploit code or confirmed active exploitation was identified at time of analysis (CISA SSVC records Exploitation: none; no KEV listing or PoC in the available sources).
Use-after-free in Google Chrome's garbage-collection code before 155.0.8059.39 allows an unauthenticated remote attacker to corrupt memory and execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction (PR:N, UI:R) and the code execution stays contained in the browser sandbox, so OS-level compromise would require chaining a separate sandbox-escape flaw; no public exploit identified at time of analysis, and CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', which tempers the high 8.8 CVSS base score. Vendor-released patch: 155.0.8059.39, distributed through Chrome's stable channel.
Use-after-free in the Streaming component of Google Chrome prior to 155.0.8059.39 allows unauthenticated remote attackers to execute arbitrary code inside the renderer sandbox when a victim is socially engineered into loading a crafted HTML page, consistent with the CVSS vector AV:N/AC:L/PR:N/UI:R. Google rates the issue Medium severity (Chromium) while the CVSS base score is 8.8, reflecting high confidentiality, integrity, and availability impact on the renderer process rather than the host. There is no CISA KEV listing and no public exploit identified at time of analysis, and the SSVC assessment records exploitation as none; the primary containment is Chrome's process sandbox, so full host compromise would require chaining a separate sandbox-escape flaw.
Use-after-free in Google Chrome allows unauthenticated remote attackers to execute arbitrary code within the renderer sandbox by convincing a victim to load a crafted HTML page, affecting all versions prior to 155.0.8059.39. The attack requires user interaction (UI:R) but no authentication or special configuration, and while code execution is confined to the sandbox, the CVSS 3.1 score is 8.8. No public exploit or active exploitation has been identified, and a vendor patch is available.
Google Chrome builds prior to 155.0.8059.39 contain a use-after-free in PDF handling that allows a remote, unauthenticated attacker to execute arbitrary code inside the browser's renderer sandbox when a victim loads a crafted HTML page that embeds a malicious PDF. Exploitation requires the user to open attacker-controlled web content processed by Chrome's built-in PDF (PDFium) viewer - a mandatory interaction step (CVSS UI:R) with no zero-click vector, and any code execution is confined to the sandboxed renderer unless chained with a separate sandbox escape. There is no public exploit identified at time of analysis, SSVC records no observed exploitation and rates the issue not automatable, but technical impact is rated total given high confidentiality, integrity, and availability impact; a vendor patch exists in 155.0.8059.39.
Use-after-free in Google Chrome's Media component allows a remote attacker to execute arbitrary code inside the browser's renderer sandbox by luring a victim into loading a crafted HTML page in any Chrome build prior to 155.0.8059.39. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), consistent with Google's own 'High' Chromium security severity, and requires no authentication or privileges on the victim host beyond the user visiting the malicious content (UI:R). Exploitation is confirmed to be constrained by user interaction and by the renderer sandbox - CISA SSVC scores it Exploitation: none, Automatable: no, Technical Impact: total - and there is no public exploit identified at time of analysis, though a vendor-released patch is available.
Use-after-free in Google Chrome's parser allows remote, unauthenticated attackers to execute arbitrary code inside the renderer sandbox by convincing a victim to load a crafted HTML page, affecting all Chrome versions prior to 155.0.8059.39. Exploitation requires user interaction (the victim must visit or open the malicious page), and the resulting code execution is contained by Chrome's renderer sandbox, so full host compromise would require chaining with a separate sandbox-escape vulnerability. A vendor patch is available in 155.0.8059.39, and no public exploit identified at time of analysis, with CISA's SSVC assessment recording exploitation as none.
Remote code execution inside the renderer sandbox is possible in Google Chrome builds prior to 155.0.8059.39, where a use-after-free in the Media component can be triggered by a crafted HTML page. Exploitation requires the victim to load attacker-controlled web content (UI:R) but no authentication or special privileges (PR:N), so default desktop installs are affected; resulting code execution is contained within the renderer sandbox rather than the host operating system. At time of analysis there is no public exploit identified at time of analysis per available intelligence (SSVC exploitation: none, automatable: no), and a vendor patch is available from Google. Rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and Chromium security severity High, this is a genuine high-priority patching item, though the signals are mixed on urgency.
Use-after-free in Google Chrome's Select component before version 155.0.8059.39 allows unauthenticated remote attackers to execute arbitrary code inside the browser's renderer sandbox, but only after socially engineering a victim into opening a crafted HTML page (CVSS 3.1 8.8, AV:N/AC:L/PR:N/UI:R). The impact is confined to the sandbox, so compromise of the host operating system would require chaining a separate sandbox-escape vulnerability. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google - the reporting party - has released a fixed build.
Remote code execution inside the Chrome renderer sandbox is possible in Google Chrome builds prior to 155.0.8059.39, where a use-after-free defect in the HTML handling path can be triggered by a crafted HTML page. Any user running an unpatched desktop Chrome who loads attacker-controlled web content (CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) can be targeted; no credentials or elevated privileges are required, but mandatory user interaction (UI:R) and the renderer sandbox confinement limit the direct blast radius, since escaping the sandbox to the host OS would require a separate, distinct vulnerability not covered by this CVE. Google has shipped a vendor patch (155.0.8059.39) and the issue was reported through the Chrome vulnerability program with a Chromium severity rating of High; no public exploit code and no confirmed active exploitation have been identified, and the affected-code flaw is consistent across the CPE wildcard for google:chrome.
Remote code execution confined to Chrome's renderer sandbox is possible in Google Chrome prior to 155.0.8059.39, where a use-after-free in the browser's Bindings layer can be triggered when a victim opens a crafted HTML page. The attack is unauthenticated (PR:N) but depends on user interaction (UI:R), and because the assessed scope is unchanged (S:U), code execution is contained inside the renderer sandbox - reaching the host would require a separate sandbox-escape vulnerability. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Chrome's automatic update mechanism narrows the realistic exposure window, making this a high-priority patch item rather than an emergency.
Arbitrary code execution in Backstage TechDocs documentation builds allows an authenticated user with write access to a repository registered in the Backstage catalog to run commands on the build host by embedding malicious keys in the repository's mkdocs.yml. Both TechDocs build modes configured locally or in a container (techdocs.generator.runIn set to 'local' or 'docker') are vulnerable because the affected @backstage/plugin-techdocs-node package (prior to 1.14.6, and 1.15.0 through 1.15.3) failed to sanitize nested markdown_extensions and theme configuration values before invoking MkDocs. Exploitation is access-gated rather than anonymous: CVSS 3.1 scores this 8.8 with a PR:L vector, EPSS is low at 0.26% (16th percentile), CISA SSVC rates exploitation as none and automatable as no, and no public exploit code has been identified at time of analysis.
The signals here conflict sharply and must be reconciled before prioritization: the supplied CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and the 'Authentication Bypass' tag imply full compromise, while the authoritative assessed vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N describes only a confidentiality impact with mandatory user interaction. As assessed, an unauthenticated remote attacker can obtain sensitive information from Google Chrome desktop builds prior to 155.0.8059.39 when a victim opens a crafted HTML page, with no integrity or availability impact and no authenticated-session or special-configuration prerequisite in the product itself. There is no CISA KEV listing and no public exploit code identified at time of analysis, Chromium rates the underlying issue Low severity, and the vendor-released patch is Chrome 155.0.8059.39.
Privilege escalation in the WordPress plugin Tourfic Pro (the paid extension of the Tourfic travel and hotel booking plugin) at version 1.17.3 and earlier allows an attacker to elevate to a higher-privileged WordPress role, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflecting full loss of confidentiality, integrity and availability within the affected site. The CVSS vector's PR:L indicates the attacker must first hold a low-privilege authenticated account (for example a self-registered subscriber) and that no user interaction is required, but the vendor's own description labels the flaw 'Unauthenticated' - a material conflict that determines whether only registered users or any site visitor can trigger it, and defenders should verify which precondition actually applies. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; the plugin's comparatively small installed base further limits real-world exposure, so this is best treated as a credible priority for sites running the plugin rather than a broadly exploited campaign.
A low-severity information disclosure exists in the Payments component of Google Chrome, where a remote attacker using a crafted HTML page and social-engineering lures could cause the browser to leak sensitive information handled by the payments/autofill feature in builds prior to 155.0.8059.39. Exploitation is not automatic: the victim must be convinced to open the attacker's page while running a vulnerable build, and the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) confines realistic impact to confidentiality loss with no integrity or availability effect. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; a vendor patch is available in Chrome 155.0.8059.39. Note that the supplied CVSS base score of 8.8 (C:H/I:H/A:H) is inconsistent with both the Chromium severity rating of Low and the independent assessment, and should not be used for prioritization without reconciliation.
Information disclosure in Google Chrome's Autofill component lets a remote, unauthenticated attacker read sensitive data by luring a victim to a crafted HTML page on any Chrome build prior to 155.0.8059.39. Exploitation requires user interaction (UI:R) - the victim must actually navigate to the attacker's page - which is the primary limiting factor, and no non-default configuration or privileges are needed since Autofill is enabled by default. The independent assessment scopes impact to confidentiality only (C:H/I:N/A:N), while the supplied vector additionally claims high integrity and availability impact; no public exploit code and no confirmed active exploitation have been identified at time of analysis, and vendor-patched builds are available.
Incorrect reference resolution in Google Chrome on macOS before 155.0.8059.39 can disclose sensitive information to a remote attacker who uses social engineering to make the victim load a crafted HTML page. Exploitation requires a macOS user running an affected Chrome build who actively opens attacker-supplied content (UI:R), with no authentication required (PR:N) and network-delivered payloads (AV:N); there is no confirmed active exploitation and no public exploit code identified at time of analysis, and the only data supplied is a vendor patch and a Chromium issue. The signals conflict sharply: the headline CVSS of 8.8 (C:H/I:H/A:H) is not supported by the available evidence, and the assessed vector is confidentiality-only (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, roughly 6.5 Medium), matching Chromium's own 'Medium' severity label, so real-world priority is lower than the 8.8 figure implies.
Google Chrome on Android releases before 155.0.8059.39 mishandle Autofill reference resolution, allowing a remote attacker who socially engineers a victim into opening a crafted HTML page to read sensitive information held in the browser's Autofill store. The CVSS vector PR:N means no authentication is needed, but the required user interaction (UI:R) and social-engineering dependency are the main practical barriers; no public exploit code has been identified at time of analysis. Our independent assessment scores this as confidentiality-only (CWE-706, use of incorrectly-resolved name or reference), so it should be treated as an information-disclosure issue rather than code execution or data tampering.
Information disclosure in Google Chrome for Android lets a remote attacker who successfully socially engineers a victim into opening a crafted HTML page expose sensitive data handled by the browser's Passwords component; builds prior to 155.0.8059.39 are affected, and no authentication or non-default configuration is required. The vendor classifies the issue as Low severity (CWE-200) and no public exploit code was identified at time of analysis. Note that the supplied CVSS base score of 8.8 (C:H/I:H/A:H) is inconsistent with the information-disclosure description and the vendor's Low rating; our independent assessment scores it AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, i.e. a confidentiality leak that strictly depends on user interaction.
Google Chrome for Android prior to 155.0.8059.39 contains an incorrect-authorization flaw in its Transactions Platform component that lets an unauthenticated remote attacker read sensitive information from the browser by luring the victim into opening a crafted HTML page. No public exploit code has been identified at time of analysis and the issue is not reported as actively exploited, though the attack is fully remote (AV:N/PR:N) and requires only that a user on a vulnerable Android build load the attacker's page (UI:R). Note that public severity signals conflict: the vendor rates this Chromium security severity 'Low' and limits impact to information disclosure, while a widely replicated CVSS 3.1 base score of 8.8 lists high integrity and availability impact that is not supported by the description - our independent assessment scores it 8.8-adjacent only on confidentiality (C:H/I:N/A:N).
Information disclosure in Google Chrome for Android (versions prior to 155.0.8059.39) allows remote, unauthenticated attackers to reach sensitive data held by the browser's Autofill feature via a crafted HTML page, with the flaw rooted in incorrect authorization (CWE-863) in the Autofill path. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N), exploitation requires the victim to actively navigate to the attacker's page and the impact is confined to confidentiality, with no integrity or availability effect; the vendor-supplied 8.8 score (C:H/I:H/A:H) and the 'Low' Chromium severity conflict with this assessment and should be reconciled before prioritization. Chrome on Android is the affected build, no public exploit was identified at time of analysis, and a vendor-released patch (155.0.8059.39) is available.
Incorrect authorization in the Selection component of Google Chrome for iOS lets a remote, unauthenticated attacker obtain sensitive information when a victim opens a crafted HTML page, and the issue is resolved in Chrome 155.0.8059.39. Only the iOS build of Chrome below that version is in scope; desktop and Android builds are not named as affected, and exploitation requires the user to actively visit the attacker-controlled page (UI:R per the assessed vector). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so the practical risk is bounded by mandatory user interaction, the narrow iOS-only affected population, and the fact that a vendor fix already ships; note that the supplied base score of 8.8 (C:H/I:H/A:H) is inconsistent with both the Chromium 'Low' severity label and the assessed vector, which rates impact as confidentiality-only.
Sensitive information disclosure in Google Chrome builds prior to 155.0.8059.39 lets an unauthenticated remote attacker obtain data through the browser's Bluetooth handling by convincing a victim to open a crafted HTML page (CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N per the independent assessment). The root cause is an incorrect authorization check (CWE-863) in the Web Bluetooth code path, so exploitation is limited to an information leak rather than code execution; the mandatory UI:R requirement means this is not a no-interaction drive-by, and the victim must be running a vulnerable Chrome version that reaches the affected Bluetooth logic. No public exploit identified at time of analysis, and the issue is not confirmed actively exploited (no CISA KEV entry), although the vendor-rated 8.8 score conflicts with the assessed confidentiality-only vector and should be weighed as a severity signal rather than proof of integrity or availability impact. Vendor-released patch: 155.0.8059.39.
Use-after-free and out-of-bounds pointer handling in the Linux kernel CIFS/SMB client (cifs.ko) lets a malicious or man-in-the-middle SMB server corrupt kernel memory on a connecting client by returning crafted encrypted compound PDUs. The defect sits in receive_encrypted_standard(), where a stale next_buffer pointer retained on error paths and unvalidated NextCommand/next_cmd offsets taken from pre-decryption length can lead to use-after-free and reads beyond the reassembly buffer, affecting confidentiality, integrity and availability of the host. Exploitation requires the victim to act as an SMB client and mount or connect to an attacker-controlled share, with SMB3 encryption/sealing negotiated and attacker-controlled server responses; no public exploit has been identified at time of analysis, EPSS is low at 0.21% (11th percentile), and vendor-released patches exist for the affected stable trees.
Remote code execution inside the Chrome renderer sandbox is possible in Google Chrome versions prior to 155.0.8059.39 through a race condition in the V8 JavaScript engine, triggered when a victim loads a crafted HTML page. The flaw requires no authentication (PR:N) but does require user interaction (UI:R) and depends on winning a non-deterministic timing window, which is reflected in the assessed AC:H and makes reliable exploitation harder. Resulting code execution stays within the renderer sandbox, so escaping to the host OS would require chaining a separate sandbox-escape vulnerability; no public exploit code has been identified at time of analysis, and vendor patches are available.