Use-after-free in the Toolbar component of Google Chrome for Android allows a remote, unauthenticated attacker to achieve arbitrary code execution inside the Chrome sandbox when a victim loads a crafted HTML page. All Chrome builds on Android prior to 156.0.8078.47 are affected; the flaw scores CVSS 3.1 base 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), a classic drive-by browser profile where the only prerequisite is that the user navigates to or renders attacker-controlled content. Google rates the issue Medium in its own Chromium severity scale, and no public exploit code or confirmed active exploitation was identified at time of analysis; a vendor patch is available.
Use-after-free in Google Chrome for Android before 156.0.8078.47 can allow a remote, unauthenticated attacker to execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page (UI:R). Although the CVSS 3.1 base score is 8.8 and tags include RCE and memory corruption, Google rates the Chromium issue Low because code execution is confined to the renderer sandbox and full device compromise would require chaining a separate sandbox escape. Patch to 156.0.8078.47 or later; no public exploit was identified at time of analysis, and no CISA KEV status was provided.
Memory corruption in the Chrome FileSystem component allows a remote, unauthenticated attacker to achieve arbitrary code execution inside the renderer sandbox by convincing a victim to load a crafted HTML page. All Chrome builds prior to 156.0.8078.47 on desktop are affected, and because exploitation requires only a page visit (UI:R) with no privileges (PR:N), browsing-driven attacks are practical despite the medium rating Chromium assigned. Code execution is confined to the sandbox, so full host compromise would require chaining a separate sandbox escape; no public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS data was not provided.
Code execution inside the renderer sandbox is achievable in Google Chrome desktop builds prior to 156.0.8078.47 through a use-after-free in the Streaming component. A remote, unauthenticated attacker can trigger the flaw by convincing a victim to open a crafted HTML page, but the CVSS vector requires user interaction (UI:R) and the resulting code execution remains confined to the renderer sandbox, so a separate sandbox escape is needed to compromise the host. No public exploit was identified at time of analysis, and the vendor has released Chrome 156.0.8078.47 to address the issue.
Memory corruption in Google Chrome's Media component on Windows allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page, affecting versions prior to 156.0.8078.47. The CVSS 3.1 vector (8.8) reflects network reach, low complexity, no privileges, and required user interaction, with high confidentiality, integrity, and availability impact; code execution is sandbox-confined, so host compromise would require a separate sandbox escape. No public exploit was identified at time of analysis and no CISA KEV entry is indicated in the supplied data, while Google has released a fixed Chrome build.
Use-after-free in Google Chrome's Media component allows remote code execution inside the renderer sandbox when a victim opens a crafted HTML page in versions prior to 156.0.8078.47. No authentication is required, but exploitation requires user interaction, and code execution is confined to the sandbox unless chained with a separate sandbox escape. Chrome 156.0.8078.47 fixes the issue; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and assessment signals are moderately consistent but incomplete.
Use-after-free in Google Chrome's Input handling prior to 156.0.8078.47 enables remote code execution inside the browser sandbox when a user opens a crafted HTML page. Exploitation requires user interaction (UI:R) and no authentication (PR:N), but the assessed impact is contained to the renderer sandbox; full host compromise would require chaining a separate sandbox-escape vulnerability. No public exploit code or CISA KEV entry was identified at time of analysis, and the vendor has released 156.0.8078.47 to address the flaw.
Memory corruption in PDFium, Chrome's built-in PDF engine, lets a remote attacker potentially execute arbitrary code inside the renderer sandbox on desktop Chrome builds prior to 156.0.8078.47 when a victim opens a crafted HTML page that triggers PDF rendering. Exploitation requires user interaction (UI:R) but no authentication (PR:N), and because execution is confined to the sandbox, full host compromise would require chaining with a separate sandbox-escape bug. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google has released a fixed build; note the scoring split between NVD's 8.8 and Chromium's own Medium severity, which reflects the sandbox containment.
Arbitrary code execution inside the Chrome renderer sandbox is possible in Google Chrome versions prior to 156.0.8078.47 due to a use-after-free in the Turbolev component. A remote attacker can trigger it only when a victim opens a crafted HTML page (UI:R, PR:N), and the resulting code execution is confined to the sandbox, so full host compromise would require a separate sandbox escape. No public exploit was identified at time of analysis, and Google has released Chrome 156.0.8078.47 to address it.
Memory corruption in the Input Method Editor (IME) component of Google Chrome allows a remote attacker to potentially achieve code execution inside the browser sandbox by convincing a victim to load a crafted HTML page. All Chrome builds prior to 156.0.8078.47 are affected, and exploitation requires user interaction (CVSS UI:R) with no authentication or privileges needed (PR:N). Impact is bounded by sandbox containment - the assessed vector is S:U, so full host compromise would require chaining with a separate sandbox-escape flaw; no public exploit code or CISA KEV active-exploitation entry was identified at time of analysis, though a vendor fix is available.
Use-after-free in Google Chrome's Views component (desktop builds prior to 156.0.8078.47) can corrupt memory when a victim loads a crafted HTML page, potentially allowing arbitrary code execution inside the renderer sandbox. Exploitation is network-reachable, requires user interaction (UI:R), and needs no authentication or special configuration; Google rates the Chromium security severity as Low even though the CVSS 3.1 base score is 8.8, and host compromise would require chaining a separate sandbox escape. Vendor patching is available, and no public exploit identified at time of analysis.
Crafted HTML pages can trigger improper input validation in Google Chrome's Extensions component before 156.0.8078.47, allowing remote attackers to execute arbitrary code within the browser sandbox. Exploitation requires the victim to open attacker-controlled web content and does not require authentication, but the impact is sandbox-confined, so host compromise would require a separate sandbox escape. No public exploit was identified at time of analysis, and Google has released Chrome 156.0.8078.47; the 8.8 CVSS score should be read alongside the Medium Chromium severity and UI requirement.
Use-after-free in Google Chrome's Web Workers implementation before 156.0.8078.47 allows unauthenticated remote attackers to execute arbitrary code inside the renderer sandbox when a victim loads crafted HTML/JavaScript; the CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-416), while Chromium itself rates the issue Low. The assessed impact is sandbox-confined, so system-level compromise would require chaining a separate sandbox escape, and exploitation requires user interaction plus a vulnerable pre-156.0.8078.47 build. No CISA KEV entry or public exploit is present in the supplied data, so the status is no public exploit identified at time of analysis; signals are mixed in a way that matters for prioritization because the numeric severity is high but the practical exploit path is constrained.
Memory corruption in the DevTools component of Google Chrome builds prior to 156.0.8078.47 lets remote attackers execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page that exercises the DevTools code path. Exploitation is unauthenticated (PR:N per the CVSS vector) but requires user interaction (UI:R), and the vendor-confirmed scope is unchanged (S:U), meaning code execution is confined to the Chromium sandbox rather than the host operating system - which is why Chromium assigns this a Low security severity despite the 8.8 CVSS base score. No public exploit identified at time of analysis, and a vendor patch is available in Chrome 156.0.8078.47; the sharp gap between the NVD-style 8.8 score and the vendor's Low rating is the central judgement call in this case.
Google Chrome builds prior to 156.0.8078.47 contain an improper input-validation weakness in the GPU component that allows a remote, unauthenticated attacker to execute arbitrary code inside the browser sandbox after a victim loads a crafted HTML page. Exploitation requires user interaction but no privileges, and the resulting code execution is confined to Chrome's sandbox unless chained with a separate sandbox-escape flaw. CVSS 3.1 scores this as 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); no public exploit was identified at time of analysis, and it is not reported as actively exploited.
Google Chrome on Windows before 156.0.8078.47 contains a use-after-free in CredentialProvider that can let a remote, unauthenticated attacker run arbitrary code inside the browser’s renderer sandbox when a victim opens a crafted HTML page. Exploitation requires user interaction and is contained by the sandbox, so host-level compromise would require a separate sandbox escape. No public exploit code or CISA KEV entry was identified at time of analysis, and the independently assessed impact is limited to low confidentiality, integrity, and availability effects within the sandbox.
Strategic Network Optimization in Oracle E-Business Suite versions 12.2.3 through 12.2.15 can be taken over through a network-based attack that requires no credentials but does require a victim to interact with attacker-controlled content. The CVSS 3.1 score is 8.8 with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, reflecting high confidentiality, integrity, and availability impact; no public exploit was identified at time of analysis. The limiting prerequisite is user interaction, not authentication, so exposure of the SNO HTTP interface together with successful social engineering is the practical attack path.
Arbitrary code execution inside the renderer sandbox is possible in Google Chrome for Android builds prior to 156.0.8078.47, where a range error (CWE-118) in the SiteIsolation component is reachable through a crafted HTML page. Attackers who convince a victim to navigate to such a page can corrupt memory in the renderer process; because the flaw is confined to the sandbox (CVSS S:U), the practical outcome is renderer-process compromise rather than direct operating-system takeover unless the attacker chains a separate sandbox-escape bug. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, though the vendor rates it Medium severity while the CVSS 3.1 base score of 8.8 reflects high confidentiality and integrity impact with mandatory user interaction (AV:N/AC:L/PR:N/UI:R).
Authenticated low-privileged attackers can achieve full takeover of Oracle REST Data Services in versions 24.2.0 through 26.2.2 by sending crafted HTTP requests to the ORDS interface, with high impact to confidentiality, integrity and availability (CVSS 8.8). Oracle rates the flaw easy to exploit - no user interaction, no race condition and no non-default configuration is required - so the practical barriers are simply any valid low-privilege ORDS account plus network reachability of the ORDS listener. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so active exploitation is not confirmed; realistic risk is concentrated in internet-exposed ORDS deployments that issue accounts broadly.
Use-after-free in Google Chrome's SiteIsolation component before 156.0.8078.47 allows unauthenticated remote attackers to trigger memory corruption and execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. The attack requires user interaction (UI:R) and does not by itself escape Chrome's sandbox, so host compromise would require chaining an additional sandbox-escape vulnerability. No public exploit identified at time of analysis, but the vendor has released a fixed build and the issue is rated High severity.
Oracle Database's OLAP component in versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3 can be compromised by an authenticated, low-privileged database user who holds the DBMS_AW privilege and can reach the Oracle Net listener; successful exploitation can result in takeover of Oracle OLAP with high confidentiality, integrity, and availability impact (CVSS 8.8). The attack requires network access via Oracle Net but no user interaction, and the main exposure control is limiting who receives DBMS_AW and how broadly the listener is reachable. No public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4: a low-privileged attacker with HTTP network access to the Product Quality Management component can compromise confidentiality, integrity, and availability at high impact (CVSS 3.1 base 8.8, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The PR:L authentication prerequisite is the main limiting factor - an attacker must already hold or obtain a valid low-privileged account, so this is not anonymous exploitation, but once inside no user interaction or special configuration is required. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV); the intelligence signals are sparse, resting on a single Oracle CPU reference with no CWE mapping or CPE data.
Memory corruption in Chrome's CustomTabs component on Android can let an unauthenticated remote attacker execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page, requiring user interaction. Google rates the Chromium security severity Low and the vendor notes impact is confined to the sandbox, which tempers the 8.8 CVSS score; affected builds are Chrome for Android before 156.0.8078.47, and no public exploit was identified at time of analysis. The issue is fixed in 156.0.8078.47.
Improper input validation in the Omnibox of Google Chrome for Android (versions prior to 156.0.8078.47) lets a remote, unauthenticated attacker potentially execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page - user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:R). Signals conflict sharply and must be weighed carefully: the externally reported base score of 8.8 (C:H/I:H/A:H) implies full compromise, whereas our independent assessment scores it 4.3-level impact (C:L/I:L/A:L) because any code execution is confined to the renderer sandbox and Google's own Chromium severity rating for this issue is 'Low'. No public exploit code exists and the issue is not in CISA KEV, so exploitation is not confirmed actively exploited (CISA KEV) at time of analysis; the practical barrier remains convincing a user to open a malicious page, plus the need for a separate sandbox escape to achieve device-level compromise.
Memory corruption in the Passwords component of Google Chrome for Android prior to 156.0.8078.47 allows a remote attacker to potentially execute arbitrary code inside the renderer sandbox by convincing a victim to load a crafted HTML page. Exploitation requires user interaction (the victim must navigate to attacker-controlled content), and the resulting code execution is confined to the sandbox, so meaningful host-level compromise would require chaining with a separate sandbox escape; only the Android build in the specified version range is affected. No public exploit code or confirmed active exploitation was identified at time of analysis, though EPSS-style urgency is tempered by the conditional, interaction-dependent nature of the flaw.
Remote code execution inside Chrome's renderer sandbox on Android is possible via memory corruption in ANGLE, the browser's graphics translation layer, when a victim running Google Chrome prior to 156.0.8078.47 loads a crafted HTML page. Exploitation requires user interaction, since the victim must navigate to or open the malicious page, and does not require authentication, but successful code execution stays within Chrome's renderer sandbox, so device-level compromise would require chaining a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at the time of analysis.
Use-after-free in Google Chrome for Android's CustomTabs component allows a remote attacker to execute arbitrary code inside the sandboxed renderer when a victim opens a crafted HTML page, affecting versions prior to 156.0.8078.47. Google has released a vendor patch in Chrome 156.0.8078.47, and no public exploit identified at time of analysis. Because exploitation requires user interaction and the resulting code execution is confined to the renderer sandbox, compromise of the host device would require chaining a separate sandbox-escape vulnerability.
Memory corruption in the Toolbar component of Google Chrome for Android before 156.0.8078.47 allows a remote, unauthenticated attacker to potentially execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) yields 8.8, yet Google assigns Chromium severity Low and the independent assessment stresses that code execution is confined to the renderer sandbox, so host-level compromise would require a separate sandbox-escape flaw; exploitation hinges on user interaction (UI:R) and no persistent server-side service is exposed. No public exploit code has been identified at the time of analysis, and the signals around this CVE conflict, so the practical risk should be weighed against the sandbox confinement and the lack of observed exploitation.
Memory corruption in the CustomTabs component of Google Chrome for Android before 156.0.8078.47 can allow a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The CVSS 8.8 score reflects high confidentiality, integrity, and availability impact, but exploitation requires user interaction and remains contained by Chrome's sandbox unless a separate sandbox escape is chained. Google has released a fixed build, and the provided intelligence shows no public exploit identified at time of analysis.
Memory corruption in ANGLE, Chrome's WebGL/graphics translation layer, lets remote attackers potentially achieve arbitrary code execution inside the renderer sandbox on Chrome builds prior to 156.0.8078.47 by convincing a victim to load a crafted HTML page. The bug is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-119), with the mandatory user-interaction requirement and unchanged sandbox scope being the main constraints - full host compromise would require chaining a separate sandbox-escape flaw. Google has released a fixed build, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, making this a high-priority patch item rather than a drop-everything emergency.
An out-of-bounds read in the Android build of Google Chrome before 156.0.8078.47 allows a remote attacker to read past the end of an allocated buffer by getting a victim to load a crafted HTML page, with the vendor noting the possibility of arbitrary code execution confined to the renderer sandbox. Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R) - the target must navigate to or be served the malicious page - and is limited to Chrome on Android running a version below the fixed build. No public exploit code was identified at time of analysis and the CVE is not listed in CISA KEV; the read-class weakness (CWE-125) and the requirement for a separate sandbox escape make realistic impact lean toward memory/information disclosure rather than assured host compromise.
Memory corruption in Chrome's Search component lets a remote, unauthenticated attacker achieve code execution inside the browser sandbox when a victim simply loads a crafted HTML page in any Chrome build prior to 156.0.8078.47 (CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8 High). Because the flaw is explicitly scoped to code execution 'inside the sandbox', it does not by itself grant host-level compromise and would need to be chained with a separate sandbox escape for full system takeover, though an in-sandbox primitive already exposes credentials, session data, and files reachable by the renderer. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but Google has shipped a vendor patch and the required user interaction (a single page visit) keeps the practical bar to exploitation low for targeted campaigns.
Improper input validation in the Extensions component of Google Chrome builds earlier than 156.0.8078.47 lets a remote, unauthenticated attacker trigger arbitrary code execution inside the browser sandbox when a victim opens a crafted HTML page. The attack is network-reachable and low-complexity but requires user interaction - the target must navigate to an attacker-controlled or compromised page - and, because the resulting code execution is confined 'inside the sandbox,' full host compromise would require chaining a separate sandbox-escape flaw. Google rates the flaw Medium under its own Chromium severity scale even though the CVSS 3.1 base score is 8.8; a vendor patch is available in 156.0.8078.47, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Use-after-free in Google Chrome's Loader component before 156.0.8078.47 allows an unauthenticated remote attacker who persuades a victim to load a crafted HTML page to execute arbitrary code inside the renderer sandbox. Exploitation requires user interaction (UI:R) and no special configuration, but the impact is bounded by Chrome's sandbox; full host compromise would require a separate sandbox escape. No public exploit code or CISA KEV entry was identified in the supplied intelligence, and Google rates the issue Chromium severity Low despite the 8.8 CVSS score.
Use-after-free in Google Chrome's Editing component (all builds prior to 156.0.8078.47) allows an unauthenticated remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation is gated entirely by user interaction - the target must visit or open the attacker-supplied page - and the resulting code execution is confined to the Chrome renderer sandbox, so full host compromise would require chaining a separate sandbox-escape bug; Google consequently rates the standalone issue as Chromium severity 'Low' even though the generic CVSS 3.1 vector scores 8.8. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS data was supplied, so the practical priority hinges on reconciling the high vector score with the sandbox-limited, interaction-dependent impact.
Memory corruption in the Chrome 'Model' component allows a remote attacker who convinces a victim to render a crafted HTML page to execute arbitrary code inside the browser's renderer sandbox in Chrome versions prior to 156.0.8078.47. No authentication is required, but exploitation depends on user interaction (the victim must visit or load the attacker-controlled page), and because the resulting code execution is confined to the sandbox, full host compromise would require chaining a separate sandbox-escape bug - which is why Google assigned this only a 'Low' Chromium security severity despite the 8.8 base score. No public exploit code or confirmed active exploitation was identified at time of analysis.
Memory corruption in the Extensions component of Google Chrome for Android before 156.0.8078.47 allows remote attackers to potentially achieve arbitrary code execution inside the browser sandbox by getting the victim to render a crafted HTML page. Exploitation requires the user to open a malicious page (UI:R) but no authentication or non-default configuration, so any default Android Chrome install below the fixed build is exposed; the payoff is confined to the renderer sandbox and would need a second, separate sandbox-escape bug to reach the Android OS or other apps. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google rates the underlying Chromium issue only Medium severity, making this a medium-to-high priority patching item rather than an emergency.
Use-after-free in Chrome's SiteIsolation component on Android allows a remote, unauthenticated attacker to achieve arbitrary code execution inside the renderer sandbox by convincing a victim to load a crafted HTML page (UI:R required, PR:N). Only Android builds prior to 156.0.8078.47 are affected; the resulting code execution is confined to the sandboxed renderer, so full device compromise would require chaining a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis, though the vendor-rated severity combined with a high CVSS (8.8) and a memory-corruption/RCE tag profile makes prompt patching advisable; the vendor has released a fixed build.
Memory corruption in ContentCapture in Google Chrome for Android before 156.0.8078.47 allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, although the CVSS 8.8 score conflicts with Google's Low Chromium severity and the stated sandbox containment. No public exploit code or active exploitation is identified at time of analysis, and Google has released a fixed build, 156.0.8078.47. The high CVSS versus Low vendor severity and sandbox-limited impact are conflicting signals that should be reconciled during triage.
Arbitrary code execution inside the Chrome renderer sandbox on Android is possible in Google Chrome for Android versions prior to 156.0.8078.47 when a victim loads a crafted HTML page, stemming from improper input validation in the UI (CWE-20). The issue is remotely triggerable without authentication (PR:N) but requires user interaction (UI:R), and the assessed scope is unchanged (S:U), so code execution is confined to the renderer sandbox unless chained with a separate sandbox escape. Google rates the Chromium security severity Low despite the 8.8 CVSS base score, a vendor patch (156.0.8078.47) is available, and no public exploit identified at time of analysis.
Memory corruption in the History component of Google Chrome for Android (versions prior to 156.0.8078.47) lets a remote attacker who persuades a victim to load a crafted HTML page execute arbitrary code, though the impact is bounded by the renderer sandbox. The flaw is unauthenticated from the attacker's perspective and requires only that the target browse attacker-controlled content (CVSS 8.8, UI:R), meaning it can be triggered through ordinary web browsing or a redirect chain. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Google has released a stable-channel fix in 156.0.8078.47.
Memory corruption in the Voice component of Chrome for Android allows a remote attacker who convinces a victim to open a crafted HTML page to execute arbitrary code inside the renderer sandbox, and Google has addressed it in the 156.0.8078.47 stable release. The vendor's Medium rating reflects containment: exploitation yields code execution within the sandbox (S:U), so reaching the host OS or other apps would require chaining a separate sandbox-escape flaw, and no public exploit code or confirmed active exploitation has been identified at time of analysis. The attack is unauthenticated but requires user interaction (UI:R), which limits scalability compared with a zero-click flaw.
Use-after-free in Google Chrome's Glic component (versions prior to 156.0.8078.47) allows a remote, unauthenticated attacker (PR:N) to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, requiring user interaction (UI:R) such as visiting a malicious or compromised site. The impact is scope-unchanged (S:U): code execution is confined to the Chrome renderer sandbox, and achieving host-level compromise would require chaining a separate sandbox-escape vulnerability. Available intelligence shows no public exploit identified at time of analysis and no CISA KEV confirmation of active exploitation; Google has released a vendor patch in Chrome 156.0.8078.47.
Memory corruption in Google Chrome's Canvas rendering path affects desktop and ChromeOS builds prior to 156.0.8078.47, allowing a remote, unauthenticated attacker to potentially execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction (UI:R) to open the crafted page, and the CVSS 3.1 score of 8.8 reflects high confidentiality, integrity, and availability impact within the renderer sandbox; no public exploit identified at time of analysis and no CISA KEV listing was provided. Google has released a vendor patch in version 156.0.8078.47.
Memory corruption in Chrome's SiteIsolation component lets a remote attacker who convinces a user to open a crafted HTML page potentially execute arbitrary code inside the browser sandbox on Chrome builds prior to 156.0.8078.47. Exploitation is not silent or wormable: the CVSS vector AV:N/AC:L/PR:N/UI:R means no credentials are needed but victim interaction is mandatory, and the vendor scopes the outcome to code execution 'inside the sandbox,' so full host compromise would require chaining a separate sandbox-escape flaw. Google rates the underlying bug Medium severity while the derived CVSS base score is 8.8; no public exploit code or active exploitation is identified in the available intelligence at time of analysis, and a vendor patch (156.0.8078.47) is already published.
Memory corruption in the SignIn component of Google Chrome releases prior to 156.0.8078.47 lets a remote, unauthenticated attacker potentially execute arbitrary code - but only inside the renderer sandbox - after convincing a victim to open a crafted HTML page. Google's Chromium team rated this 'Low' severity even though the CVSS 3.1 base score is 8.8, because the corruption yields in-sandbox code execution and host compromise would require chaining a separate sandbox escape. No public exploit code has been identified and the issue is not in CISA KEV, although the vendor has already shipped a fixed build; the conflict between the high numeric score and the Low vendor rating is the main judgement call for prioritisation.
Memory corruption in Google Chrome's Bindings component before 156.0.8078.47 allows remote, unauthenticated attackers to potentially achieve arbitrary code execution inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction (UI:R) and is constrained by Chrome's sandbox, so full host compromise would need a separate sandbox-escape flaw; no public exploit code was identified at time of analysis, and the vendor rates the issue Chromium severity Medium despite an 8.8 CVSS score.
Memory corruption in the FullScreen component of Google Chrome prior to 156.0.8078.47 allows a remote, unauthenticated attacker to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation is not zero-click: per the UI:R metric the victim must visit or be directed to attacker-controlled content that exercises the FullScreen code path, after which a successful heap/out-of-bounds style corruption can yield code execution at the renderer's privilege level. Impact is bounded by Chrome's sandbox (S:U), so a standalone exploit does not by itself reach the host operating system and would need a separate sandbox-escape flaw for full post-exploitation; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, though Google rated it Chromium security severity Medium and has shipped a fixed build. The practical risk is drive-by web compromise of unpatched desktop fleets, session cookie/credential theft from within the browser, and chaining with a sandbox escape in targeted campaigns.
Memory corruption in Google Chrome's PerformanceAPIs component before 156.0.8078.47 allows a remote attacker to potentially execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. Exploitation requires user interaction (UI:R) but no authentication (PR:N), so default desktop installations are exposed; the 8.8 CVSS score reflects high confidentiality, integrity, and availability impact, although Scope Unchanged means host compromise would require chaining with a separate sandbox escape, and Chromium rated the issue Medium. Vendor patches are available in Chrome 156.0.8078.47, and no public exploit or CISA KEV active-exploitation signal was identified at time of analysis.
Google Chrome before 156.0.8078.47 contains a use-after-free in its Transactions Platform that allows unauthenticated remote attackers to execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. Exploitation requires user interaction but no privileges or non-default configuration, so default installations are in scope; code execution is sandbox-confined unless chained with a separate sandbox escape. No public exploit identified at time of analysis, and the vendor has released Chrome 156.0.8078.47 as the fixed version.