IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 can expose sensitive information because components of the product may bind to an unrestricted IP address (for example 0.0.0.0 or a public interface) rather than a loopback or otherwise restricted address, leaving the listener reachable from untrusted networks. IBM's published score is 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but the assessed vector is information disclosure only (C:H/I:N/A:N): a remote, unauthenticated attacker with network reachability to the exposed listener could read data they should not have access to, without user interaction or special conditions. The practical risk is entirely governed by network exposure - deployments that firewall ACE, segment it, or bind listeners to restricted interfaces are largely shielded; no public exploit code and no CISA KEV entry were identified at time of analysis.
Oracle APEX versions 24.1.0 through 24.1.21, 24.2.0 through 24.2.20, and 26.1.0 through 26.1.4 contain an easily exploitable flaw in the General component that unauthenticated remote attackers can reach over HTTPS to fully compromise the APEX instance, with high confidentiality, integrity, and availability impact (CVSS 3.1 base score 9.8). The Oracle CPU October 2026 advisory is the vendor's reference for this issue, and no public exploit code or CISA KEV listing was identified in the available data at time of analysis. Network exposure is the primary gating factor: any internet-reachable or otherwise attacker-accessibly APEX deployment on an affected release should be treated as high priority for patching.
Unauthenticated remote attackers can take over Oracle Application Object Library, the core component of Oracle E-Business Suite 12.2.3 through 12.2.15, over HTTP with low complexity and no user interaction, yielding a CVSS 3.1 score of 9.8 with full confidentiality, integrity, and availability impact. The Oracle October 2026 Critical Patch Update advisory is the coordination point; no CISA KEV listing and no public exploit identified at time of analysis, and EPSS was not supplied. Exposure is highest for EBS web tiers reachable from untrusted networks; deployments restricted to trusted internal networks or VPN/WAF fronts have materially reduced attack surface.
Unauthenticated remote takeover of Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 is possible through the Core component, with a CVSS 9.8 vector requiring only HTTP network access and no credentials or user interaction. Successful exploitation yields high confidentiality, integrity, and availability impact, effectively handing the attacker control of the server. No public exploit identified at time of analysis, and no EPSS score was provided; Oracle's October 2026 Critical Patch Update advisory is the authoritative remediation source.
Complete compromise of Oracle WebLogic Server is possible for unauthenticated, network-positioned attackers targeting the T3 or IIOP listeners in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8), meaning no credentials or user interaction are required and confidentiality, integrity, and availability are all fully impacted. No CISA KEV entry or public exploit code is identified in the provided intelligence at time of analysis, but the lack of exploit reporting does not reduce the priority for internet-exposed T3/IIOP endpoints.
Unauthenticated remote takeover of Oracle WebCenter Sites is possible in supported versions 12.2.1.4.0 and 14.1.2.0.0, per Oracle Fusion Middleware's October 2026 advisory. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H means network attackers need no credentials or user interaction and can fully compromise confidentiality, integrity, and availability. No public exploit code or CISA KEV entry was identified in the supplied data at time of analysis.
Unauthenticated attackers with TCP network reach to Oracle Secure Backup 19.1.0.0.0 or 19.1.0.1.0 can take full control of the backup service, with high confidentiality, integrity and availability impact and a CVSS 3.1 base score of 9.8. The vendor rates the attack as low-complexity with no privileges or user interaction required, so network exposure is the main constraint. No public exploit was identified at time of analysis, and no CISA KEV entry was provided.
Argument injection in Argo CD's repo-server allows an authenticated user holding only get permission on an existing Application to run arbitrary commands inside the argocd-repo-server pod. Kustomize forwards ref/version query values from remote base, component or resource URLs straight into git fetch without an end-of-options separator, so a leading-hyphen value is interpreted as --upload-pack and executed whenever the remote uses the local file:// transport; https:// remotes do not trigger execution. Affected releases run from 2.7.0 through the fixed versions 3.3.15, 3.4.10, 3.5.4 and 3.6.0-rc2, and the injected command runs as the repo-server user, exposing repository credentials and other process-readable data with output returned through manifest-generation error messages. No public exploit code or confirmed active exploitation was identified at time of analysis, but the low privilege bar (Application get, no sync or repository write needed via POST /api/v1/applications/manifestsWithFiles) makes this a genuine high-priority issue rather than an inflated score.
Cross-tenant privilege escalation in StreamsHub Console for Apache Kafka allows an authenticated Kubernetes tenant that can create or modify Console custom resources to point spec.containers.api.spec.image at an arbitrary container image, which the operator then deploys into a pod running under a ServiceAccount bound by ClusterRoleBinding to cluster-wide Strimzi CRD read access, Kafka/KafkaRebalance patch rights, and cluster-monitoring-view. The attacker-controlled code reads the projected ServiceAccount token and gains read/write control over the Strimzi control plane across tenant boundaries, with high confidentiality and integrity impact (CVSS 9.9, scope changed). Exploitation is gated by the tenant-level RBAC permission rather than being open to the internet, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated remote takeover of Oracle Access Manager is possible through its SAML-facing Authentication Engine, affecting builds 12.2.1.4.0 and 14.1.2.1.0 of the Oracle Fusion Middleware component. With a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), Oracle characterizes the flaw as easily exploitable by an attacker who can reach the SAML authentication interface over the network, with full confidentiality, integrity, and availability impact and potential full compromise of the OAM service. No public exploit code or CISA KEV entry was identified at time of analysis, so exploitation has not been confirmed in the wild, but the combination of unauthenticated network access, low attack complexity, and complete impact makes this a top-tier patching priority for any internet- or partner-facing OAM deployment.
Remote, unauthenticated takeover of Oracle WebCenter Content is possible through the Content Server component over HTTP, with CVSS 3.1 score 9.8 affecting versions 12.2.1.4.0 and 14.1.2.0.0. The attack requires only network reachability to the Content Server endpoint and no credentials or user interaction, yielding high confidentiality, integrity and availability impact. No public exploit code or CISA KEV entry was identified at time of analysis, but the exposure is serious for internet-facing instances and should be prioritized.
Remote unauthenticated attackers can achieve takeover of Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 through the Fabric Layer over HTTP, with the 9.8 CVSS reflecting high confidentiality, integrity, and availability impact and no privileges or user interaction required. No public exploit identified at time of analysis and no CISA KEV confirmation is present in the supplied data, but internet-reachable SOA Suite instances should be treated as high priority because the assessed vector is pre-authentication network exploitation.
Oracle SOA Suite releases 12.2.1.4.0 and 14.1.2.0.0 contain a critical flaw in the Fabric Layer component that can be reached over HTTP without any credentials, letting a remote attacker seize full control of the SOA Suite deployment. With a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), successful exploitation yields complete loss of confidentiality, integrity, and availability of the affected middleware, effectively a takeover of the product. There is no KEV listing and no public exploit identified at time of analysis, but the pre-authentication network vector and the fact that Oracle's Fabric Layer normally sits on an internet- or partner-facing service bus make this a top-tier patch priority; EPSS data was not supplied, and our independent assessment confirms the unauthenticated remote exploitation path with network reachability as the primary practical barrier.
Unauthenticated remote compromise of Oracle SOA Suite's Fabric Layer can lead to full takeover of the affected installation. The flaw affects SOA Suite 12.2.1.4.0 and 14.1.2.0.0 and is rated CVSS 9.8 with complete confidentiality, integrity, and availability impact; exploitation requires network access to the SOA Suite HTTP interface. No public exploit identified at time of analysis, and the main practical constraint is reachability rather than authentication or user interaction.
Oracle SOA Suite's Enterprise Scheduling System exposes a SOAP interface that unauthenticated remote attackers can reach on versions 12.2.1.4.0 and 14.1.2.0.0, allowing takeover of the product with high confidentiality, integrity, and availability impact. The 9.8 CVSS score and AV:N/AC:L/PR:N/UI:N vector make network reachability the primary exposure factor, so internet-facing or broadly reachable SOAP endpoints are the highest priority. No public exploit code and no CISA KEV entry were identified in the supplied intelligence at time of analysis.
Unauthenticated remote takeover of Oracle Business Process Management Suite 12.2.1.4.0 and 14.1.2.0.0 is possible through the Human Workflow component exposed over HTTP. The CVSS 3.1 score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials, user interaction, or non-default configuration are required beyond network reachability. No public exploit code or CISA KEV entry was identified at time of analysis, but Oracle's October 2026 Critical Patch Update advisory is the authoritative fix source.
Unauthenticated remote takeover of Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 is possible through the Fabric Layer component exposed over HTTP. The CVSS 3.1 score is 9.8 with network access, no privileges, and no user interaction, yielding high confidentiality, integrity, and availability impact; Oracle's October 2026 Critical Patch Update advisory is the reference. No public exploit code or CISA KEV entry was identified at time of analysis, but this is a genuine high-priority exposure because default configurations are affected and the only practical barrier is network reachability to the SOA Suite HTTP interface.
Unauthenticated remote takeover of Oracle Data Integrator 12.2.1.4.0 and 14.1.2.0.0 is possible through the ODI Console / Repository Explorer over HTTP, as addressed in Oracle's October 2026 Critical Patch Update. The CVSS 3.1 score is 9.8 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning no authentication, no user interaction, and high confidentiality, integrity, and availability impact. No public exploit code or CISA KEV confirmation was identified in the supplied intelligence at time of analysis, but internet-exposed ODI Console instances are high priority because the assessed limiting factor is network reachability rather than any special configuration.
Unauthenticated remote takeover of Oracle Data Integrator is possible through the Console / Repository Explorer RMI interface on versions 12.2.1.4.0 and 14.1.2.0.0, with CVSS 3.1 score 9.8 reflecting high confidentiality, integrity, and availability impact. Attackers with network reachability to the RMI listener need no credentials or user interaction; the primary exposure constraint is whether that listener is reachable across network boundaries. Exploitation status: no public exploit identified at time of analysis.
Full system takeover of Oracle Solaris 11.3 and 11.4 is possible for unauthenticated network attackers who can reach the Image Packaging System (IPS) HTTP service, with high confidentiality, integrity, and availability impact. The 9.8 CVSS score reflects network reachability with low attack complexity, no privileges, and no user interaction, but practical exposure depends on whether the IPS endpoint is accessible from an attacker-reachable network path. No public exploit code or CISA KEV entry was identified at time of analysis.
Unauthenticated network attackers can take over Oracle Communications BRM Elastic Charging Engine 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0 by reaching the Java RMI interface used in cloud-native deployments; CVSS 3.1 is 9.8 with high confidentiality, integrity, and availability impact and no privileges or user interaction required. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was provided, so practical risk is driven mainly by whether the RMI listener is exposed beyond trusted telecom back-office/OSS-BSS networks.
Remote unauthenticated takeover of Oracle Essbase 21.8.3.0.0 is possible through the TCP-exposed Security component, with CVSS 3.1 scoring 9.8 and high confidentiality, integrity, and availability impact. Exploitation needs only network reachability to the affected service, no credentials, and no user interaction, so internet-facing or broadly reachable Essbase deployments carry the greatest risk. No public exploit code or CISA KEV entry was identified in the supplied intelligence at time of analysis.
Remote, unauthenticated takeover of Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 is possible when attackers can reach the T3 or IIOP listener used by the End User Self Service component. Oracle rates this 9.8 with no credentials, no user interaction, and no non-default configuration required, so default deployments are exposed if those protocols are network-reachable. No public exploit was identified at time of analysis, but risk is highest where T3/IIOP are internet-facing or broadly reachable from untrusted segments.
Unauthenticated network access to the LDAP Gateway in Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 can result in full compromise of the connector, with high confidentiality, integrity, and availability impact (CVSS 9.8). The vector is AV:N/AC:L/PR:N/UI:N, so reachability of the LDAP service is the main prerequisite; deployments that expose it only to trusted networks materially reduce exposure. No CISA KEV status is supplied and no public exploit identified at time of analysis, but the severity and ease of exploitation warrant urgent patching or network restriction.
Remote unauthenticated takeover of Oracle Solaris 11.4 is possible through a flaw in the 'Utility' component, which exposes a network-reachable TCP service to attackers with no credentials or user interaction. Oracle rates the issue CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting full confidentiality, integrity, and availability impact; the precise protocol, port, and vulnerable service configuration are not named in the available data and must be confirmed against the Oracle CPU October 2026 advisory. No public exploit code or CISA KEV entry was identified in the provided intelligence at time of analysis.
Unauthenticated attackers can bypass JWT signature verification in Eclipse ioFog Controller 3.8.0 through 3.9.1 on the operator WebSocket upgrade handlers for the exec and log routes, allowing them to open privileged sessions for any microservice or fog node whose UUID they know. By crafting a token with an 'admin' group claim, the attacker matches the built-in admin role without needing an account or RoleBinding. No public exploit identified at time of analysis, but the flaw is rated CVSS 9.8 and requires immediate attention.
Arbitrary code execution outside the renderer sandbox in Google Chrome prior to 156.0.8078.47 can be triggered when a victim loads a crafted HTML page that corrupts memory in Chrome's Network component. The assessed CVSS vector requires user interaction and high attack complexity but no authentication (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H), and successful exploitation would bypass the normal need for a separate sandbox-escape chain. Google rates the Chromium severity as Medium; no public exploit code was identified at time of analysis, and patched builds are not affected.
Memory corruption in Google Chrome's Compositing component before 156.0.8078.47 can let an unauthenticated remote attacker potentially execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page. The issue requires user interaction to open the malicious content and, per independent assessment, has high practical attack complexity because reliable heap manipulation and defeat of sandbox/ASLR mitigations are needed. No public exploit was identified at time of analysis, and the vendor has released a fixed build.
Sandbox escape and code execution in Google Chrome's Privacy component allows remote attackers to run arbitrary code outside the browser sandbox when a victim renders a crafted HTML page, affecting all Chrome builds prior to 156.0.8078.47. Exploitation requires user interaction (CVSS UI:R) and no authentication (PR:N), yet the resulting scope change (S:C) lets a renderer-level flaw compromise the host - Google rates it Chromium security severity Medium, suggesting lower exploit reliability than the 9.6 base score implies. No public exploit code or CISA KEV listing was identified at time of analysis, and a vendor patch is available.
Out-of-bounds write in Google Chrome's Forms component before version 156.0.8078.47 allows a remote, unauthenticated attacker to potentially execute arbitrary code outside the sandbox when a victim opens a crafted HTML page. Exploitation requires the victim to navigate to the malicious page (UI:R); no public exploit code or confirmed active exploitation was identified at time of analysis, and Google rates the Chromium security severity as Low despite the 9.6 CVSS score. Vendor-released patch: 156.0.8078.47.
Sandbox escape in Google Chrome on Windows (versions prior to 156.0.8078.47) lets a remote attacker who lures a victim to a crafted HTML page trigger memory corruption in the CredentialProvider component and potentially execute code outside the Chrome sandbox. The attack is unauthenticated (PR:N) but requires user interaction (UI:R) - the victim must navigate to attacker-controlled content - and is confined to the Windows platform on unpatched builds. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, though the vendor rates the underlying bug only 'Medium' (Chromium security severity) while the CVSS 3.1 vector scores 9.6 with a scope change (S:C), a discrepancy that reflects Google's typical treatment of sandbox-escape primitives that must be chained with a separate renderer compromise to achieve full code execution.
Use-after-free in Google Chrome's Internals component before 156.0.8078.47 allows a remote attacker to escape the browser sandbox and execute arbitrary code when a victim loads a crafted HTML page. The flaw is unauthenticated from the attacker's perspective but requires victim interaction (UI:R), and the scope change plus high confidentiality, integrity, and availability impact produce a Critical 9.6 base score. No public exploit code or confirmed active exploitation was identified at time of analysis; Google has released the fixed 156.0.8078.47 build.
Use-after-free in Google Chrome's WebAppInstalls (web app / PWA installation) component affects versions prior to 156.0.8078.47 and can let a remote attacker who convinces a victim to open a crafted HTML page potentially execute arbitrary code outside the browser sandbox. The CVSS 3.1 base score is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), driven by the scope change and high confidentiality, integrity and availability impact, although Google assigns only a Medium Chromium security severity and frames code execution as 'potential' because it depends on reliably reclaiming freed memory after the free. No public exploit code or CISA KEV entry was identified at time of analysis, and the mandatory user interaction (UI:R) rules out fully autonomous, unattended exploitation; the vendor-released fix is Chrome 156.0.8078.47.
Improper input validation in ANGLE, Chrome's default graphics translation layer, allows a remote unauthenticated attacker who persuades a Windows user to open a crafted HTML page to potentially execute arbitrary code outside the browser sandbox in Google Chrome builds prior to 156.0.8078.47. The CVSS 3.1 base score is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), reflecting mandatory user interaction offset by a scope change that carries impact beyond the renderer boundary; the flaw carries a Chromium security severity of High and is enabled by default on all Windows installs. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so the risk is driven by default-configuration exposure and the sandbox-escape potential rather than confirmed active exploitation.
Potential out-of-sandbox code execution in Google Chrome desktop stable releases before 156.0.8078.47 is reachable when a user opens an attacker-crafted HTML page, requiring user interaction but no authentication. The CVSS 9.6 scope-changed score reflects high confidentiality, integrity, and availability impact, but Chromium rates the issue Medium and the advisory describes out-of-sandbox execution as potential rather than demonstrated; a vendor patch is available in 156.0.8078.47, and no public exploit identified at time of analysis.
Memory corruption in Google Chrome's ServiceWorker implementation before 156.0.8078.47 can allow a remote attacker who persuades a user to load crafted HTML to potentially execute arbitrary code outside the browser sandbox. The flaw needs no target credentials but requires user interaction (UI:R) and affects default Chrome configurations; CVSS 3.1 scores it 9.6 due to scope change and high confidentiality, integrity, and availability impact, and exploitation status is no public exploit identified at time of analysis.
Use-after-free in Google Chrome Core before 156.0.8078.47 allows a remote, unauthenticated attacker to execute arbitrary code outside the renderer sandbox when a victim loads a crafted HTML page, with the required user interaction being the main limiting factor. Default desktop Chrome installations on affected versions are exposed if a user visits the malicious page; successful exploitation crosses the sandbox boundary and can affect the host. Vendor-released patch: 156.0.8078.47, and no public exploit identified at time of analysis.
Memory corruption in the DevTools component of Google Chrome prior to 156.0.8078.47 lets a remote attacker who convinces a victim to load a crafted HTML page execute arbitrary code outside the browser sandbox (a scope change from the renderer into the host environment). Exploitation is materially constrained: the defect lives in DevTools rather than the normal rendering path, so the victim must have DevTools open or active while loading the malicious page - which is why Chromium assigns this a 'Low' security severity despite a 9.6 CVSS base score, and our own assessment raises attack complexity to High for the same reason. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; the vendor-released fix is Chrome 156.0.8078.47.
Improper input validation in Chrome's PrintPreview component (versions prior to 156.0.8078.47) lets a remote attacker who convinces a victim to open a crafted HTML page and invoke print preview escape the renderer sandbox and potentially execute arbitrary code outside it. The CVSS 3.1 vector scores 9.6 Critical: network reachable, low complexity, no privileges required, but user interaction (UI:R) and changed scope (S:C) reflecting the sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis; vendor-released patch version 156.0.8078.47 is available.
Improper input validation in Google Chrome's Extensions subsystem, affecting builds prior to 156.0.8078.47, can let a remote attacker who persuades a victim to render a crafted HTML page potentially escape the browser sandbox and run arbitrary code at the operating-system level, rather than inside the renderer's restricted environment. The attack requires user interaction (the victim must navigate to or load the attacker-supplied content) but no authentication or prior privileges, and the CVSS 3.1 vector is unusually severe for a Chrome bug at AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H (9.6) because the scope change reflects crossing from the browser process into the host OS - yet Google's own Chromium severity rating for this issue is Low, and the advisory's wording is 'potentially execute arbitrary code,' indicating the escape is not deterministic and may hinge on additional runtime conditions. At the time of analysis there is no public exploit code identified and no CISA KEV listing, and a vendor patch exists in Chrome 156.0.8078.47, distributed through Chrome's automatic update channel, which materially shortens the realistic exposure window.
Improper input validation in Google Chrome's Date handling lets a remote, unauthenticated attacker potentially execute arbitrary code outside the browser sandbox when a victim opens a crafted HTML page in any build prior to 156.0.8078.47. Google rates the Chromium security severity as High and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) reflects full confidentiality, integrity and availability impact with changed scope, meaning the compromise can escape Chrome's normal trust boundary. The only real prerequisite is user interaction - the target must be lured to attacker-controlled web content - and patched builds plus ChromeOS/desktop channel updates remove the condition; no public exploit code or CISA KEV listing was identified at time of analysis.
Use-after-free in Google Chrome's PerformanceAPIs - the Performance, PerformanceObserver and performance timing interfaces - allows a remote, unauthenticated attacker who gets a victim to load a crafted HTML page to potentially execute arbitrary code outside the browser sandbox on Chrome builds prior to 156.0.8078.47. The only prerequisite is that the user navigate to (or be redirected to) attacker-controlled content (UI:R, PR:N), and changed-scope scoring drives the CVSS to 9.6 - a number that must be read alongside Google's own Chromium severity rating of Medium and the assessment's caveat that the sandbox escape is described as potential rather than confirmed. Vendor patch is available; no public exploit was identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Memory corruption in Google Chrome's CSS engine allows a remote, unauthenticated attacker to potentially execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page; affected builds are Chrome desktop and ChromeOS prior to 156.0.8078.47. Exploitation requires user interaction because the victim must render the malicious page, and no public exploit was identified at time of analysis. Google rates the issue Critical (CVSS 9.6) and has released a fixed version.
Use-after-free in Google Chrome for Android before 156.0.8078.47 can allow a remote, unauthenticated attacker to potentially execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page. The CVSS 3.1 score is 9.6 (Critical), driven by the scope change reflecting a sandbox escape, although Chromium rates the flaw Medium and the vendor describes code execution outside the sandbox as potential. Exploitation requires user interaction to load the crafted page; no public exploit code or active exploitation has been identified at time of analysis.
Arbitrary code execution outside the sandbox is possible in Google Chrome prior to 156.0.8078.47 because of a use-after-free in the V8 JavaScript engine. An unauthenticated remote attacker can lure a victim to a crafted HTML/JavaScript page; successful exploitation can corrupt V8 memory and execute code on the host beyond the renderer sandbox. Google has released 156.0.8078.47 to address it, and no public exploit identified at time of analysis.
Memory corruption in the Prompts component of Google Chrome for Android before 156.0.8078.47 can allow a remote, unauthenticated attacker to execute arbitrary code outside the sandbox when a victim loads a crafted HTML page. The CVSS 3.1 score is 9.6 because of the scope change and high confidentiality/integrity/availability impact, even though Google assigns a Medium Chromium severity; exploitation requires user interaction, and no public exploit code or CISA KEV entry is identified in the provided data. Google has released 156.0.8078.47 as the vendor-fixed version.
Memory corruption in the WebAppInstalls component of Google Chrome for Android before 156.0.8078.47 can be triggered when a user opens an attacker-crafted HTML page, potentially allowing remote code execution outside the browser sandbox. No authentication is required, but exploitation depends on user interaction, is limited to Android builds below the fixed version, and our assessment applies AC:H despite the mechanical 9.6 CVSS score. No public exploit has been identified at time of analysis, and Google rates the Chromium issue Low, so the conflicting severity signals should be reconciled before treating this as a high-urgency RCE campaign.
Signals conflict and that conflict is the headline: CVE-2026-113138 is a memory-corruption flaw in Google Chrome's WebAppInstalls component affecting versions prior to 156.0.8078.47, with a CVSS 3.1 score of 9.6 but a Chromium vendor severity of Medium. An unauthenticated remote attacker can trigger the flaw when a victim loads crafted HTML (UI:R), potentially achieving code execution outside the sandbox, although the vendor's wording and Medium rating indicate host compromise likely depends on additional sandbox-escape chaining rather than being guaranteed. Vendor-released patch: 156.0.8078.47; no public exploit was identified at time of analysis.
Memory corruption in Google Chrome's PolicyContainer component affects desktop builds prior to 156.0.8078.47 and can allow a remote attacker to potentially execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page. Exploitation requires the target to actively visit attacker-controlled content (CVSS UI:R, PR:N), and while the vector scores 9.6 because the scope change pushes confidentiality, integrity, and availability impact to High, Chromium's own 'Medium' severity rating and the description's 'potentially' indicate weaponization is non-trivial. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Use-after-free in Google Chrome's DevTools component, affecting desktop builds prior to 156.0.8078.47, can potentially allow a remote attacker to execute arbitrary code outside the browser sandbox. Exploitation requires the victim to load a crafted HTML page while an active DevTools session is engaged, so the attack is remote and unauthenticated but gated by user interaction and a non-default browser state - which is why Chromium assigned it a Low security severity while the raw vector scores 9.6 and our independent assessment lowers it to high attack complexity (AC:H). No public exploit code or confirmed active exploitation was identified at time of analysis, and Google has released a fixed build.