Memory corruption in the PDF component of Google Chrome on Android (versions prior to 156.0.8078.47) allows a remote, unauthenticated attacker to potentially read memory inside the browser sandbox by enticing a victim to open a crafted HTML page that renders a malicious PDF. The impact is confined to information disclosure within the existing sandbox - there is no sandbox escape, memory write, or code execution described - and exploitation requires user interaction, which together with Android-only platform specificity keeps this at medium severity. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is low at 0.23% (13th percentile); Google rates the Chromium security severity as Medium and a vendor patch is available.
Unauthorized access to critical data in Oracle Siebel CRM's Siebel Apps - Financial Services (Financial Accounts component) is possible for unauthenticated remote attackers in versions 17.0 through 26.9, although Oracle rates exploitation as difficult due to AC:H. Successful attacks could expose all accessible Financial Services data and permit limited unauthorized inserts, updates, or deletes, producing a CVSS 3.1 score of 6.5. No public exploit identified at time of analysis, and no CISA KEV entry was provided; risk is materially higher where the Financial Accounts HTTP interface is internet-facing rather than restricted to internal or VPN access.
Oracle Siebel CRM Deployment 17.0 through 26.9 contains a hard-to-exploit, unauthenticated HTTP-exposed weakness in the Server Infrastructure component that can give an attacker high confidentiality access and limited integrity impact. With CVSS 3.1 score 6.5 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N), the issue is constrained by high attack complexity and has no availability impact. No public exploit identified at time of analysis, and no CISA KEV entry was provided; Oracle's October 2026 Critical Patch Update is the vendor fix.
Stored cross-site scripting in the Brizy WordPress plugin 2.8.23 allows authenticated low-privilege users to inject script content that executes when another user views or renders the affected Brizy page content. Exploitation requires a WordPress account with at least low-level content-creation privileges and a second victim user who opens the crafted content; impact is limited to browser-context script execution rather than server compromise. This is a moderate, not top-priority issue, and no public exploit is identified at time of analysis, with no CISA KEV status indicated in the provided data.
Improper access control in Chrome's Ozone platform windowing/graphics layer (CWE-284) allows a remote attacker to leak sensitive browser information by getting a victim to load a crafted HTML page. All desktop Chrome builds prior to 156.0.8078.47 are affected and require user interaction (UI:R) with no authentication (PR:N), yielding confidentiality-only impact (C:H/I:N/A:N) for a CVSS 3.1 score of 6.5. Google confirmed and patched the issue in the 156.0.8078.47 stable channel release; no public exploit code or CISA KEV entry is associated with the CVE at time of analysis.
Memory corruption in the GPU component of Google Chrome on Android allows a remote attacker to read memory inside the GPU sandbox if a victim loads a crafted HTML page, with impact limited to confidentiality (out-of-bounds read) rather than code execution. Only Chrome for Android builds prior to 156.0.8078.47 are affected; the flaw requires user interaction (UI:R) and content must reach the GPU rendering/compositing path, such as WebGL. There is no public exploit identified at time of analysis despite the classic buffer overflow tag, and EPSS is low at 0.22% (12th percentile), making this a moderate-priority patch-and-move-on issue.
Out-of-bounds read in Google Chrome's CustomTabs component on Android (versions prior to 156.0.8078.47) lets a remote attacker who convinces a user to open a crafted HTML page read memory inside the renderer sandbox. Exploitation requires the victim to render attacker-controlled content in an in-app Custom Tab (UI:R) and there is no authentication requirement (PR:N), but the leak is confined to the sandboxed renderer and has no integrity or availability impact. There is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis; EPSS is 0.22% (12th percentile), consistent with a low operational priority, and a vendor patch exists in Chrome 156.0.8078.47.
Memory corruption in Google Chrome on Android before version 156.0.8078.47 lets a remote, unauthenticated attacker who convinces a victim to open a crafted HTML page potentially read memory from inside the browser sandbox. The flaw is an out-of-bounds memory access (CWE-119) scored CVSS 6.5 with C:H/I:N/A:N, so the demonstrated impact is information disclosure confined to the sandbox rather than code execution or a confirmed sandbox escape, and exploitation is gated by mandatory user interaction (UI:R) on an unpatched Android build. No public exploit code or active exploitation has been identified at time of analysis, EPSS is low at 0.22% (12th percentile), and Google has released a fixed build.
Memory corruption in the DevTools component of Google Chrome before 156.0.8078.47 permits a remote attacker to read memory within the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction (the victim must navigate to the attacker's page) and no authentication, but the impact is bounded to disclosure inside the sandbox with no escape, no data modification, and no availability loss - which is why Chromium assigned a Low severity. There is no public exploit identified at time of analysis, and EPSS is very low at 0.22% (12th percentile), consistent with the low-severity, interaction-dependent nature of the flaw.
Out-of-bounds read in Google Chrome's Actor component (all desktop builds prior to 156.0.8078.47) allows a remote attacker to read memory inside the renderer sandbox when a victim is lured to a crafted HTML page. Exploitation requires user interaction - the victim must navigate to attacker-controlled content - and the impact is bounded to information disclosure within the sandbox, with no code execution, no cross-origin or cross-process read, and no integrity or availability effect; our assessment scores confidentiality as Low (CVSS 3.1 base ~4.3-5.4 range, NVD lists 6.5 with C:H) rather than the higher NVD value. Google rated the issue Medium (Chromium security severity), EPSS is low at 0.22% (12th percentile), and no public exploit code or CISA KEV entry was identified at time of analysis, so this is a moderate-priority fix rather than an emergency patch.
A memory-corruption flaw in the Speech component of Google Chrome builds prior to 156.0.8078.47 lets remote attackers read out-of-bounds memory within the renderer sandbox by luring a victim to a crafted HTML page. Because the impact is confidentiality-only (C:H/I:N/A:N) and confined to the sandboxed renderer (S:U), the issue alone cannot alter data or achieve code execution and would require chaining with a separate sandbox-escape bug to reach the host. Exploitation requires user interaction (UI:R) and no authentication; no public exploit code or active exploitation is confirmed, and EPSS is low at 0.22% (12th percentile), consistent with a moderate, low-priority risk.
Memory corruption in Google Chrome's Extensions component in builds prior to 156.0.8078.47 allows an unauthenticated remote attacker to read memory inside the browser sandbox when a victim opens a crafted HTML page, with no integrity or availability impact - disclosure is bounded to data reachable by the sandboxed process. Google rates the issue Medium (Chromium severity) even though the CVSS 3.1 score reaches 6.5 on the strength of C:H; exploitation requires user interaction (UI:R) and does not by itself achieve sandbox escape or code execution. No public exploit code has been identified at time of analysis and EPSS is low at 0.22% (12th percentile), consistent with a moderate-priority rather than high-urgency issue; a vendor patch is available in 156.0.8078.47.
Memory corruption in the Loader component of Google Chrome versions prior to 156.0.8078.47 allows a remote attacker to read memory inside the renderer sandbox by convincing a victim to load a crafted HTML page. Impact is confined to information disclosure within the sandbox - there is no indicated write primitive, sandbox escape, or code execution path - and exploitation requires mandatory user interaction (UI:R) with no authentication prerequisite. No public exploit code or active exploitation has been identified at time of analysis, and EPSS is low at 0.22% (12th percentile), consistent with an independent assessment lowering the vector to confidentiality-only impact (C:L).
Google Chrome builds before 156.0.8078.47 contain an out-of-bounds read in the FileSystem component that can expose renderer-process memory to a remote attacker who convinces a user to load a crafted HTML page. The assessed vector requires user interaction (UI:R) and no privileges (PR:N), but limits impact to confidentiality inside the browser sandbox rather than sandbox escape or code execution. Patch is available from the vendor, EPSS is low at 0.22% (12th percentile), and no public exploit was identified at time of analysis.
Memory corruption in Google Chrome's CacheStorage implementation, present in versions prior to 156.0.8078.47, allows a remote attacker to potentially read memory inside the renderer sandbox when a victim loads a crafted HTML page. The flaw is unauthenticated from the target's perspective (PR:N) and needs no non-default configuration, but it hinges on user interaction (UI:R) and is scoped to the renderer (S:U), with confidentiality-only impact and no demonstrated sandbox escape. Google's Chromium severity rating is High, EPSS is low at 0.22% (12th percentile), no public exploit code has been identified at time of analysis, and this is a moderate-priority issue rather than a top-tier emergency; a vendor patch is available in 156.0.8078.47.
Out-of-bounds memory read in Google Chrome's ANGLE graphics translation layer on Windows (versions prior to 156.0.8078.47) lets a remote attacker leak memory contents from inside the renderer sandbox by getting a victim to render a crafted HTML page. The flaw is unauthenticated from the network perspective but requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, 6.5), and because the disclosure is contained within the Chrome sandbox it yields confidentiality impact only - no code execution, no integrity or availability effect, and no host escape. No public exploit code has been identified at time of analysis, EPSS is low at 0.22% (12th percentile), and the issue is not in CISA KEV; Google rates it High severity and has shipped a fixed build, so this is a moderate-priority patch-and-move-on item rather than an emergency.
Memory corruption in the Core component of Google Chrome on macOS (versions prior to 156.0.8078.47) allows a remote, unauthenticated attacker to read memory inside the renderer sandbox by getting a victim to render a crafted HTML page. Exploitation is user-driven (UI:R) and platform-limited to macOS; the reported impact is information disclosure bounded by the Chrome sandbox, not code execution or sandbox escape, so real-world harm would typically require chaining with a separate escape bug. There is currently no public exploit identified at time of analysis and the EPSS score is only 0.22% (12th percentile), but a vendor fix is available and Chromium rates the issue Medium severity.
Information disclosure in Google Chrome's font handling allows a remote, unauthenticated attacker to read memory inside the renderer sandbox by convincing a victim to load a crafted HTML page containing a malformed font. All desktop Chrome builds prior to 156.0.8078.47 are affected, and because font parsing is part of normal page rendering, no special configuration is required beyond the victim visiting the attacker's page (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). There is no public exploit code identified at time of analysis and the flaw is not in CISA KEV; EPSS is 0.22% (12th percentile), consistent with a low-urgency, sandbox-confined memory leak that Google itself rated Low severity.
Out-of-bounds read in Google Chrome's SiteIsolation component affects desktop builds prior to 156.0.8078.47 and lets a remote attacker disclose memory contents confined to the renderer sandbox by convincing a victim to load a crafted HTML page. Successful exploitation requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) and yields confidentiality impact only - no memory corruption, code execution, or sandbox escape is established by this bug. Risk is moderate and bounded: EPSS is just 0.22% (12th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis, though a vendor patch is available.
Memory corruption in Google Chrome's BrowserTag component allows remote unauthenticated attackers to trigger a limited memory read inside the renderer sandbox by convincing a victim to load a crafted HTML page (UI:R). Versions prior to 156.0.8078.47 are affected; Google rates the issue Low, and the assessed impact is limited confidentiality (C:L) with no integrity or availability effect despite the recorded 6.5 CVSS score. EPSS is 0.22% (12th percentile), and no public exploit was identified at time of analysis.
Memory corruption in the DevTools component of Google Chrome before 156.0.8078.47 can allow a remote attacker to read memory inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction and is confined to in-sandbox information disclosure; it does not by itself provide sandbox escape or code execution. No CISA KEV entry or public exploit was identified at time of analysis, and EPSS is low at 0.22% (12th percentile).
Out-of-bounds read in Google Chrome's Extensions component affects builds prior to 156.0.8078.47 and allows a remote, unauthenticated attacker to read memory inside the Chromium sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction (UI:R) and is bounded to information disclosure within the sandbox rather than code execution or host compromise. No public exploit was identified at time of analysis, EPSS is low at 0.22% (12th percentile), and a vendor patch is available in Chrome 156.0.8078.47; this is a moderate, not urgent, priority.
Memory corruption in Google Chrome versions before 156.0.8078.47 can let remote, unauthenticated attackers read memory inside the renderer sandbox when a victim loads a crafted HTML page. The flaw is limited to information disclosure within the sandbox, with no established code execution, data modification, denial of service, or sandbox escape, and exploitation requires user interaction. Vendor-released patch: 156.0.8078.47; EPSS is 0.22% (12th percentile); no public exploit identified at time of analysis.
Editors in ApostropheCMS who can import a content type but lack that type's publish role can use the import-export module's write helpers to create, replace, or remove published document variants, bypassing normal publish-permission and lifecycle checks. The flaw is an authenticated, missing-authorization issue (CWE-862, CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) affecting ApostropheCMS core before 4.34.0 when paired with @apostrophecms/import-export before 3.7.1. It is most relevant to deployments that intentionally separate import rights from publication rights; no public exploit code or confirmed active exploitation was identified at time of analysis.
Memory disclosure inside the Chrome renderer sandbox affects Google Chrome versions prior to 156.0.8078.47; a remote attacker can trigger it only when the victim loads a crafted HTML page, yielding read access to sandboxed process memory with no integrity or availability impact. No public exploit identified at time of analysis, and EPSS is low at 0.22% (11th percentile). Google has released Chrome 156.0.8078.47 as the fixed version.
An out-of-bounds read in Chrome's ANGLE graphics backend on Windows lets a remote attacker disclose renderer memory by getting a victim to load a crafted HTML page that exercises the WebGL/GPU rendering path. Only Windows installations prior to 156.0.8078.47 are affected, and exploitation requires user interaction - the target must navigate to the attacker's page - with the leak confined to memory inside the renderer sandbox, so there is no code execution, no integrity or availability impact, and no sandbox escape by itself. Google's internal rating is High, but the practical risk is moderate (CVSS 6.5, EPSS 0.22% / 11th percentile) and no public exploit was identified at time of analysis; the flaw is fixed in the 156.0.8078.47 stable channel release.
Memory corruption in the iOSWebView component of Google Chrome for iOS (versions prior to 156.0.8078.47) allows a remote attacker who convinces a victim to load a crafted HTML page to read memory inside the renderer sandbox. Only the iOS build is affected - desktop and Android Chrome are out of scope - and the assessed impact is confidentiality-only (C:H/I:N/A:N) with no sandbox escape or code execution. No public exploit code or active exploitation is identified at time of analysis, and EPSS is low at 0.22% (11th percentile), though the vendor has released a patched build.
Memory disclosure in Google Chrome's Chromoting component allows a remote, unauthenticated attacker to read memory within the browser sandbox when a victim opens a crafted HTML page. The issue affects Chrome versions prior to 156.0.8078.47 and requires user interaction; the assessed impact is confidentiality-only, with no sandbox escape, code execution, integrity, or availability effect. EPSS is low at 0.22%, no public exploit has been identified at time of analysis, and a vendor patch is available.
Memory corruption in Google Chrome on iOS (versions prior to 156.0.8078.47) can let a remote attacker read memory inside the browser sandbox when a victim loads a crafted HTML page during Navigation processing. Exploitation requires user interaction and affects only the iOS build; it does not provide a sandbox escape, write access, or denial of service. No public exploit was identified at time of analysis, EPSS is low at 0.22% (11th percentile), and the vendor has released Chrome 156.0.8078.47 as the fix.
Information disclosure in ANGLE, the graphics translation layer bundled with Google Chrome on Windows, affects releases prior to 156.0.8078.47. A remote attacker who convinces a user to load a crafted HTML page can exercise the vulnerable rendering path and leak sensitive process memory or cross-origin data; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, 6.5) confirms confidentiality-only impact that requires user interaction, with no privileges or authentication needed and default Chrome configurations exposed because ANGLE is the standard graphics backend on Windows. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google rates the issue Chromium security severity Medium.
Memory corruption in the Autofill component of Google Chrome prior to 156.0.8078.47 lets a remote, unauthenticated attacker read memory beyond intended bounds inside the renderer sandbox by convincing a victim to load a crafted HTML page. Successful exploitation requires user interaction (CVSS UI:R) and yields only information disclosure within the sandbox - confidentiality impact is high but there is no integrity or availability impact, no scope change, and no direct path to host compromise without chaining a separate sandbox escape. No public exploit code has been identified at time of analysis and EPSS is low at 0.22% (11th percentile), though vendor-released patches are available and should be applied as routine hygiene rather than emergency response.
Out-of-bounds read in Google Chrome before 156.0.8078.47 allows remote attackers to potentially read limited process memory inside the renderer sandbox when a victim navigates to a crafted HTML page. Exploitation is unauthenticated but requires user interaction (UI:R), and the assessed impact is low confidentiality only-no sandbox escape, code execution, integrity, or availability effect was assessed. No public exploit identified at time of analysis and no CISA KEV listing is present; EPSS is low at 0.22%, and Google has released a fixed build.
Critical data exposure in Oracle WebCenter Content 14.1.2.0.0 requires a low-privileged authenticated attacker, network access via HTTP, and interaction by a separate user, and is rated difficult to exploit. Successful exploitation can give unauthorized read access to critical WebCenter Content data and limited update, insert, or delete access, with scope change potentially affecting additional Oracle products. No public exploit code was identified at time of analysis.
Oracle WebCenter Content deployments at 12.2.1.4.0 and 14.1.2.0.0 expose the Content Server component to a low-privileged, authenticated attacker who can send crafted HTTP requests and, after convincing a separate user to perform an interaction, obtain unauthorized read access to critical content and limited insert/update/delete capability, with scope change allowing follow-on impact to other products. Oracle classifies the flaw as difficult to exploit - high attack complexity, a mandatory valid account, and a human-interaction lure all gate success - so the 6.5 MEDIUM score is a fair representation and this should be treated as a routine patch-cycle item rather than an emergency. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor fix is available through the October 2026 Oracle Critical Patch Update.
Oracle Siebel CRM's Customer Order Management component (versions 17.0 through 26.9) contains a medium-severity (CVSS 6.5) flaw that requires a low-privileged authenticated attacker and interaction by another user. Successful exploitation over HTTP can let an attacker read and modify limited Order Management data, cause partial denial of service, and potentially affect additional products because of the scope-change metric. No public exploit was identified at time of analysis; Oracle addressed the issue in its October 2026 Critical Patch Update.
Improper access control in the DevTools component of Google Chrome builds earlier than 156.0.8078.47 lets a remote attacker who convinces a victim to open a crafted HTML page leak sensitive information from the browser; no credentials or elevated privileges are required, but the attack hinges on the victim actively loading the attacker's page. The flaw is rated Medium (CVSS 6.5, AV:N/AC:L/PR:N/UI:R/C:H/I:N/A:N) with confidentiality-only impact, and Google has released a fixed build (156.0.8078.47). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the issues.chromium.org tracker remains access-restricted, limiting technical detail.
Unauthenticated HTTP access to Oracle BI Publisher 12.2.1.4.0 can allow a remote attacker to read a subset of accessible data and perform limited unauthorized updates, inserts, or deletions through the Web Server component. The issue is network-reachable, low-complexity, and requires no user interaction (CVSS 3.1 6.5), but impact is limited to partial confidentiality and integrity effects with no availability impact. No public exploit code or CISA KEV active exploitation is identified in the provided data, so no public exploit identified at time of analysis.
Authenticated privilege escalation in Zyxel EX3501-T0 5G NR CPE firmware through 5.44(ACHR.6)C0 allows a low-privileged session holder to rewrite the login_privilege data via the device's Data Access Layer and obtain full administrative control. The root cause is a missing authorization check (CWE-863) on DAL operations, reachable over the network but gated behind a valid low-privilege login (PR:L), so it is not an unauthenticated remote compromise path. No public exploit code and no confirmed active exploitation were identified at time of analysis; note that the vendor-published base score of 6.5 reflects only confidentiality impact, whereas our assessment scores it C:H/I:H/A:H because tampering with privilege state also damages device integrity and availability.
A mid-tier, difficult-to-exploit flaw in Oracle Helidon 4.0.0 through 4.5.5 exposes the LRA (Long Running Actions / MicroProfile LRA saga-coordination) HTTP endpoints to unauthenticated remote attackers, allowing partial reads, unauthorized update/insert/delete of some Helidon-accessible data, and partial denial of service. Exploitation is not a straightforward single request - successful attacks hinge on high-complexity conditions the attacker must induce or race (AC:H), and the scope change flag means impact can propagate to other products integrated with the Helidon service. No public exploit code or confirmed active exploitation was identified at time of analysis, though Oracle's October 2026 CPU advisory addresses the issue; the primary pressure point is availability and data integrity for internet-facing Helidon LRA deployments.
Memory corruption in the Google Lens component of Google Chrome on desktop allows a remote attacker to read memory within the renderer sandbox by convincing a victim to load a crafted HTML page. Exploitation requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N per independent assessment) and is confined to memory reads inside the already-sandboxed renderer - there is no sandbox escape, no memory write, and no availability impact, which is why Google rated it Chromium security severity Low and EPSS is only 0.19% (9th percentile). No public exploit code or confirmed active exploitation was identified at time of analysis, and Chrome builds from 156.0.8078.47 onward contain the fix.
Out-of-bounds read in Google Chrome's Payments component affects builds prior to 156.0.8078.47 and lets a remote attacker disclose memory inside the renderer sandbox when a victim loads a crafted HTML page. The attack is unauthenticated but requires user interaction, and the impact is limited to information disclosure rather than code execution or data modification; it is most concerning as a building block for a separate sandbox escape. EPSS is low at 0.19% (9th percentile), and no public exploit was identified at time of analysis; Google has released Chrome 156.0.8078.47 as the fix.
Memory corruption in Chrome's V8 JavaScript engine allows a remote, unauthenticated attacker to read memory inside the renderer sandbox by convincing a victim to open a crafted HTML page in any desktop Chrome build prior to 156.0.8078.47. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms the only meaningful barrier is user interaction - the target must navigate to attacker-controlled content - while impact is confined to confidentiality of in-sandbox memory with no code execution, data modification, or sandbox escape described. Exploitation has not been confirmed in the wild: there is no CISA KEV listing and no public exploit identified at time of analysis, and EPSS sits at 0.19% (9th percentile), indicating low practical exploitation likelihood in the near term.
Memory corruption in the Views UI component of Google Chrome on macOS prior to 156.0.8078.47 allows an unauthenticated remote attacker who persuades a victim to load a crafted HTML page to read memory inside the renderer sandbox. The impact is limited to confidentiality of renderer-process memory - there is no sandbox escape, no write primitive, and no code execution path described - and exploitation is gated by mandatory user interaction and the macOS-specific build. Google rates this Chromium severity Medium, EPSS is low at 0.19% (9th percentile), and no public exploit has been identified at time of analysis; a vendor patch exists in 156.0.8078.47.
Memory corruption in the WebAppInstalls component of Google Chrome for Android before version 156.0.8078.47 lets a remote attacker who convinces a user to open a crafted HTML page trigger an out-of-bounds memory read inside the renderer sandbox, potentially exposing process memory contents. The attack is unauthenticated (PR:N) but requires the victim to actively load the malicious page (UI:R), and the weakness is confined to Chrome on Android with default configurations affected. Impact is limited to information disclosure within the sandbox with no write primitive, sandbox escape, or denial-of-service shown; no public exploit code has been identified at time of analysis, EPSS is 0.18% (8th percentile), and the issue is not in CISA KEV. Our independent assessment scores confidentiality impact as Low (CVSS 3.1 base ~4.3: AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) rather than the NVD-style C:H, reflecting the sandbox-contained read primitive, making this a low-to-moderate priority patch rather than an emergency.
Out-of-bounds read in Google Chrome's GetUserMedia implementation allows remote attackers to read memory inside the renderer sandbox by convincing a user to open a crafted HTML page on versions prior to 156.0.8078.47. The issue is medium severity (CVSS 6.5) with high confidentiality impact but no integrity or availability impact, and exploitation requires user interaction (UI:R) while no authentication is required (PR:N); the sandbox limits exposure unless chained with a separate sandbox-escape vulnerability. No public exploit identified at time of analysis, EPSS is low at 0.18% (8th percentile), and a vendor-released patch is available in Chrome 156.0.8078.47.
Memory corruption within Chrome's CSS engine lets a remote attacker read memory that is otherwise confined to the renderer sandbox by convincing a user to open a crafted HTML page in any Chrome build prior to 156.0.8078.47. The CVSS vector (AV:N/AC:L/PR:N/UI:R) means no credentials are needed, but the attack is not drive-by-silent: it depends on the victim navigating to attacker-controlled content, so it is a social-engineering or malicious-page delivery problem rather than a wormable one. Impact is bounded to information disclosure inside the sandbox - there is no sandbox escape, no code execution and no data modification - and our independent assessment rates confidentiality impact as Low rather than the vendor-published High, giving a moderate-risk browser flaw that does not warrant emergency prioritization. EPSS is just 0.18% (8th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis, though Google has shipped a fix in 156.0.8078.47.
Out-of-bounds read in Google Chrome's WebHID handling before version 156.0.8078.47 lets a remote attacker disclose memory from inside the renderer sandbox by convincing a user to open a crafted HTML page. Exploitation requires user interaction (UI:R) and no authentication (PR:N), but the effect is limited to read-only information disclosure (C:H/I:N/A:N) and does not itself provide code execution or sandbox escape. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is low at 0.18% (8th percentile); a vendor patch is available in 156.0.8078.47.
An out-of-bounds write in Apple's operating systems (iOS/iPadOS, macOS, tvOS, visionOS, watchOS) allows an attacker within wireless radio range to crash or unexpectedly terminate the system. No authentication or user interaction is required, but the impact is limited to denial of service - there is no memory disclosure or code execution. Unpatched devices below iOS/iPadOS 26.7 or 27, macOS Sequoia 15.8 / Tahoe 26.7 / Golden Gate 27, and tvOS/visionOS/watchOS 27 remain affected; no public exploit code or active exploitation has been identified, and EPSS is low (0.18%, 7th percentile) with CISA SSVC reporting no exploitation and low automatability.
Sensitive information disclosure in Google Chrome's Extensions subsystem affects builds prior to 156.0.8078.47, where improper access control lets a remote attacker use a crafted HTML page to read data that should be isolated from web content. Exploitation is not zero-click: the victim must load the attacker's page in a vulnerable browser (UI:R), though no authentication or credentials are needed and the attack path is remote and low complexity. Google rates the issue Medium (Chromium severity) and has released a fixed build; no public exploit code or confirmed active exploitation was identified at time of analysis, and the realistic impact is bounded to confidentiality loss with no integrity or availability effect.
Critical project data exposure and limited data tampering in Primavera P6 Enterprise Project Portfolio Management Web Access can occur when a low-privileged authenticated user persuades another user to interact with crafted HTTP content. Affected releases span 21.12.0.0 through 25.12.8, and the CVSS scope change means a successful attack may also affect connected Oracle products. Exploitation is rated difficult, requires valid credentials and a second human victim; no public exploit identified at time of analysis, and there is no CISA KEV entry.