Memory corruption in Google Chrome's Sync component before 156.0.8078.47 allows remote attackers to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. The issue is network-reachable and unauthenticated per the CVSS vector, but exploitation requires user interaction, and code execution is confined to Chrome's sandbox unless chained with a separate sandbox escape. No public exploit was identified at time of analysis, and Google has released a fixed Chrome build.
Memory corruption in Chrome's HID (WebHID) handling lets a remote attacker who convinces a victim to load a crafted HTML page execute arbitrary code inside the browser sandbox on versions prior to 156.0.8078.47. Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R) - the victim must visit or interact with the attacker-controlled page - and the resulting code execution is confined to the sandboxed renderer, so host compromise would still require a separate sandbox-escape bug. No public exploit code or confirmed active exploitation was identified at time of analysis, though the 8.8 CVSS and memory-corruption primitive make it a high-priority patch item; Chromium itself rates the issue Medium and Google has released a fixed build.
Use-after-free in Google Chrome's Workers implementation allows a remote, unauthenticated attacker to execute arbitrary code inside the browser's renderer sandbox if the victim loads a crafted HTML page. Only Chrome builds prior to 156.0.8078.47 are affected; exploitation requires user interaction (UI:R) and remains confined to the renderer sandbox, so host compromise would require a separate sandbox escape. No public exploit code or CISA KEV entry was identified at time of analysis, and the vendor has released 156.0.8078.47 as the fix.
Memory corruption in Google Chrome's Paint rendering component can allow a remote, unauthenticated attacker to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page in a version prior to 156.0.8078.47. Exploitation is user-interaction-gated because the victim must visit or be redirected to attacker-controlled content, and the resulting code execution is confined to the renderer sandbox unless combined with a separate sandbox-escape flaw. No public exploit identified at time of analysis, and the vendor has released Chrome 156.0.8078.47 as the fixed version.
Memory corruption in Google Chrome's Views component before 156.0.8078.47 allows an unauthenticated remote attacker who convinces a victim to open a crafted HTML page to execute arbitrary code inside the renderer sandbox. Google assigns this issue Low severity, and no public exploit was identified at time of analysis; the 8.8 NVD score overstates host-level risk because a separate sandbox escape would be needed to affect the operating system or other origins.
Memory corruption in Chrome's CSS handling lets a remote attacker who convinces a victim to load a crafted HTML page trigger arbitrary code execution inside the renderer sandbox, affecting Chrome builds prior to 156.0.8078.47. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) means exploitation is unauthenticated but requires user interaction - the target must open the malicious page via a link, malvertising, or a compromised site. Impact is capped by the sandbox: full host compromise requires chaining with a separate sandbox-escape, and no public exploit or CISA KEV entry was identified at time of analysis, though Google rates the flaw Medium on its own severity scale.
Memory corruption in Google Chrome's Loader component before 156.0.8078.47 allows remote attackers to execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page. The issue carries a High CVSS score of 8.8 because exploitation is network-reachable and unauthenticated with only user interaction required, although Chromium's own severity rating is Low and the resulting code execution remains confined to the sandbox, so full host compromise would require a separate sandbox-escape chain. The vendor has released a fixed build, and no public exploit code or active exploitation is identified in the provided intelligence.
A use-after-free in Chrome's Animation component affects versions prior to 156.0.8078.47: a remote attacker can lure a victim into loading a crafted HTML page that triggers memory corruption and yields arbitrary code execution - but only inside the renderer sandbox, not on the host. The CVSS 8.8 reflects high confidentiality/integrity/availability impact to the sandboxed renderer, tempered by the required user interaction and the architectural containment; host compromise would require chaining a separate sandbox-escape flaw. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google has released a patched stable build.
Use-after-free in Chrome's Input handling allows remote code execution inside the renderer sandbox when a user opens a crafted HTML page in any Chrome build prior to 156.0.8078.47. Exploitation requires user interaction (UI:R) but no authentication (PR:N), and code execution is confined to the renderer sandbox, so host compromise requires chaining a separate sandbox escape; Google rates the flaw High severity. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fix.
Remote code execution inside Chrome's renderer sandbox is possible in Google Chrome versions prior to 156.0.8078.47 through a use-after-free in the Frames component. An unauthenticated remote attacker can trigger the flaw by convincing a victim to load a crafted HTML page (UI:R). Successful exploitation is confined to the renderer sandbox and would require a separate sandbox escape for host compromise; no public exploit code or CISA KEV entry was identified at time of analysis.
Use-after-free memory corruption in Google Chrome's Canvas implementation allows remote attackers to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, affecting Chrome builds prior to 156.0.8078.47 across desktop and ChromeOS channels. Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R): the target must navigate to or render attacker-controlled content such as a malicious link, compromised site, or injected ad/iframe, and the Canvas path is reachable in default configurations with no special toggle. Impact is bounded by the sandbox - code execution stays within the renderer (S:U) and host-level compromise would require a separate sandbox-escape - and at time of analysis no public exploit code has been identified; enterprise patch cadence, not emergency response, is the driver, and Google rates the flaw Chromium security severity High (CVSS 8.8).
Use-after-free in Google Chrome's PDF handling before 156.0.8078.47 allows a remote attacker to execute arbitrary code inside the Chrome sandbox when a victim opens a crafted HTML page. The issue is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) but requires user interaction; Chromium's own severity rating is Low, reflecting that code execution is confined to the sandbox and host compromise would require chaining a separate sandbox escape. No public exploit was identified at time of analysis, and Google has released a fixed build.
Google Chrome before 156.0.8078.47 contains a use-after-free in the ANGLE graphics backend that can be triggered when a user opens a crafted HTML page, potentially allowing code execution inside the renderer sandbox. The vulnerability is remote and requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), but because scope is unchanged, host compromise would require chaining with a separate sandbox escape. No public exploit code has been identified at time of analysis, and Google has released Chrome 156.0.8078.47 as the vendor fix.
Use-after-free in Google Chrome's CSS handling lets a remote attacker potentially execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in any build prior to 156.0.8078.47. Exploitation requires user interaction (CVSS UI:R) - visiting or being redirected to a malicious or compromised page - but no credentials or non-default configuration, since the flaw sits in the default rendering path. The impact is bounded: the description specifies code execution 'inside the sandbox,' so host compromise needs a separate sandbox escape, and no public exploit code or confirmed active exploitation was identified at time of analysis. Google shipped a stable-channel fix in 156.0.8078.47, and Chrome's automatic updater sharply shrinks the exposed population once that build propagates.
A use-after-free in ANGLE, the graphics translation layer behind Chrome's WebGL and hardware-accelerated canvas rendering, lets a crafted HTML page corrupt renderer memory and achieve arbitrary code execution inside the browser sandbox in Google Chrome builds prior to 156.0.8078.47. Exploitation is unauthenticated (PR:N) but requires the victim to load attacker-controlled web content that exercises WebGL paths, and no non-default configuration is needed - the component is enabled by default. Multiple signals align toward genuine priority with one important nuance: code execution is confined to the renderer sandbox, so host compromise would require chaining a separate sandbox escape. At time of analysis, no public exploit code and no confirmed active exploitation (CISA KEV) were identified, though the 8.8 CVSS and RCE-class tagging warrant prompt patching.
Use-after-free in Google Chrome's Internals component on macOS lets a remote attacker execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, and Google has released Chrome 156.0.8078.47 to fix it. The bug is remotely reachable without credentials but requires the user to open or be redirected to attacker-controlled content (UI:R), is limited to macOS builds, and yields code execution confined to the sandbox - host-level compromise would need a separate sandbox escape, which is why Chrome rates it Medium despite a High 8.8 CVSS. No public exploit code or confirmed active exploitation was identified at time of analysis, so the practical risk is concentrated in targeted phishing or watering-hole delivery against macOS Chrome users.
Use-after-free in Google Chrome's ServiceWorker implementation affects desktop Chrome builds prior to 156.0.8078.47 and can let a remote attacker execute arbitrary code inside the browser sandbox when a victim renders a crafted HTML page. The issue is rated CVSS 8.8 with UI:R and PR:N, so exploitation depends on user navigation rather than credentials; the code-execution impact is constrained to the sandboxed renderer, and a separate sandbox escape would be needed to compromise the host OS. No public exploit was identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Use-after-free in Google Chrome's FileSystem component before 156.0.8078.47 allows remote attackers to trigger memory corruption and execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. The flaw is network-reachable, low-complexity, and unauthenticated (CVSS 3.1 base 8.8, PR:N), but successful exploitation requires user interaction and remains scoped to the sandbox, so host compromise would need a separate sandbox-escape vulnerability. No public exploit code or CISA KEV entry was identified at time of analysis; Google has released a vendor patch in Chrome 156.0.8078.47.
Memory corruption in Google Chrome's Omnibox component before 156.0.8078.47 allows unauthenticated remote attackers to potentially execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction (UI:R), and the impact is confined to the sandboxed renderer unless chained with a separate sandbox-escape flaw. No public exploit code was identified at the time of analysis, and Google has released a fixed build, 156.0.8078.47.
Code execution inside the renderer sandbox in Google Chrome before 156.0.8078.47 is possible when a victim visits a crafted HTML page that exploits improper input validation in the FileSystem component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated issue that requires user interaction; successful exploitation remains confined to the sandbox and host compromise would require chaining a separate sandbox-escape vulnerability. No public exploit identified at time of analysis, and Google has released a vendor patch in Chrome 156.0.8078.47.
Memory corruption in the ContextMenu component of Google Chrome for Android allows remote attackers to potentially execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page, affecting versions prior to 156.0.8078.47. Exploitation requires user interaction (UI:R) and no authentication (PR:N); despite a CVSS base score of 8.8, Chromium rates the issue Low because code execution is confined to the sandbox, so full device compromise would require an additional sandbox-escape primitive. No public exploit has been identified at time of analysis, and the vendor-released fixed version is Chrome 156.0.8078.47.
Memory corruption in the 'Actor' component of Google Chrome for Android before 156.0.8078.47 lets a remote attacker execute arbitrary code inside the renderer sandbox when a victim renders a crafted HTML page. The flaw is unauthenticated (PR:N) and requires only that the target open the malicious page (UI:R), but the resulting code execution is confined to the browser's renderer sandbox on Android - full host compromise would require chaining a separate sandbox-escape bug. Google rates the Chromium security severity as Low because of that sandbox confinement, while the CVSS 3.1 vector (8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects high confidentiality and integrity impact within the sandboxed context; a vendor fix is available in 156.0.8078.47 and no public exploit has been identified at time of analysis.
Google Chrome for Android before 156.0.8078.47 contains a use-after-free in the Notifications component that permits a remote, unauthenticated attacker to execute arbitrary code within the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires the user to visit and interact with attacker-controlled content (UI:R), and any resulting code execution stays inside the browser sandbox (S:U), so a separate sandbox-escape bug is needed for host compromise. No public exploit code or confirmed active exploitation was identified at time of analysis; Google has released a vendor patch in the stable channel.
Memory corruption in Chrome for Android's Omnibox prior to 156.0.8078.47 can let a remote, unauthenticated attacker execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page. The CVSS 3.1 vector scores 8.8 High with user interaction required (UI:R), but scope is unchanged (S:U), so this flaw alone does not provide host or device compromise; chaining with a separate sandbox escape would be needed for that. No public exploit was identified at time of analysis, and Google has released Chrome 156.0.8078.47 as the vendor fix.
Oracle Capacity in Oracle E-Business Suite 12.2.3 through 12.2.15 can be taken over by a low-privileged authenticated attacker who can reach the Capacity module over HTTP, with high confidentiality, integrity, and availability impact (CVSS 8.8). The CVSS vector requires PR:L, so exploitation is not pre-authentication; any valid low-privileged EBS account is sufficient, making multi-user ERP deployments the main exposure. No public exploit code or confirmed active exploitation was identified in the supplied intelligence, and no EPSS score was provided.
Improper access control in Chrome's ANGLE graphics layer enables remote code execution inside the browser sandbox on Google Chrome versions earlier than 156.0.8078.47 when a victim renders a crafted HTML page. The CVSS 3.1 vector is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), but Google rates it Low because the impact is confined to the renderer sandbox and no sandbox escape is shown; exploitation requires user interaction, authentication is not required per PR:N, and no public exploit identified at time of analysis. The conflicting signals - high CVSS and RCE/authentication-bypass tags versus vendor Low and sandbox-only impact - should be weighed when prioritizing.
Authenticated low-privilege users can achieve takeover of Oracle Business Intelligence Enterprise Edition through its BI Search component, with high confidentiality, integrity, and availability impact. Affected deployments include versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0; exploitation requires network access over HTTP and a valid low-privileged account but no user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis, though low attack complexity makes prompt patching important.
Authenticated low-privileged users can achieve takeover of Oracle Siebel CRM Deployment (Server Infrastructure) in versions 17.0 through 26.9 through the HTTP interface, with high impact to confidentiality, integrity, and availability (CVSS 8.8). The requirement for a valid low-tier CRM session is the main barrier, but no user interaction or special attack complexity is indicated; no public exploit was identified at time of analysis.
Authenticated low-privileged attackers can achieve full takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4 by sending crafted HTTP requests to the Product Quality Management component. The flaw is network-exploitable, requires no user interaction, and yields complete compromise of confidentiality, integrity, and availability (CVSS 8.8). No public exploit code has been identified at the time of analysis, and the vulnerability is not listed in CISA KEV.
An authenticated, low-privileged attacker with network access to the JDENET service can fully compromise JD Edwards EnterpriseOne Tools releases 9.2.0.0 through 9.2.26.5, gaining high impact to confidentiality, integrity, and availability (CVSS 3.1 base 8.8, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The defect sits in the Installation SEC component, and successful exploitation is described by Oracle as enabling takeover of the EnterpriseOne Tools instance. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the low attack complexity and the fact that JDENET is frequently reachable across enterprise networks make this a credible operational priority rather than an inflated high-CVSS score.
Authenticated low-privileged users with HTTP reachability to the JD Edwards EnterpriseOne Tools web tier can take full control of the Web Runtime SEC component in versions 9.2.0.0 through 9.2.26.5, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The barrier to entry is low: any valid non-administrative EnterpriseOne account plus network access to the HTML/web runtime is sufficient, with no user interaction and no non-default configuration precondition cited by Oracle. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but EPSS scoring was not available in the supplied intelligence, so prevalence-weighted risk should be treated as unquantified rather than low.
Heap use-after-free in Google Chrome's Network component allows remote code execution within the browser sandbox: any Chrome build prior to 156.0.8078.47 that renders an attacker-crafted HTML page can trigger memory corruption and achieve code execution at the browser's privilege level. No credentials or privileges are required (PR:N), but exploitation is not zero-click - the victim must navigate to or load the malicious content, as reflected by CVSS UI:R and the vendor's 'crafted HTML page' wording. Chromium rates the issue Medium severity even though the CVSS 3.1 base score computes to 8.8 (C:H/I:H/A:H); no public exploit code or CISA KEV entry was identified at time of analysis, and the practical ceiling on impact is the Chrome sandbox, which must be escaped separately for host-level compromise.
Use-after-free in the Google Lens component of Google Chrome versions prior to 156.0.8078.47 allows a remote, unauthenticated attacker to execute arbitrary code inside the browser sandbox when a victim renders a crafted HTML page. Exploitation requires user interaction (the victim must visit or render attacker-controlled content), and the resulting code execution is confined by Chrome's sandbox, so full host compromise would require chaining a separate sandbox-escape flaw. No public exploit code was identified at the time of analysis, and the vendor has released Chrome 156.0.8078.47 to address the issue.
Arbitrary code execution inside the Chrome for Android sandbox (versions before 156.0.8078.47) can be triggered by a crafted HTML page that exploits a use-after-free in Autofill. The attacker must persuade the victim to load the page (UI:R), but no authentication is required (PR:N); the resulting code runs within the renderer sandbox unless a separate sandbox-escape vulnerability is chained. No public exploit code has been identified at time of analysis, and Google has released fixed build 156.0.8078.47.
Memory corruption in Google Chrome's Picture-in-Picture component before 156.0.8078.47 enables a remote attacker to potentially execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. The flaw is remotely reachable with no privileges but requires user interaction, consistent with CVSS 3.1 score 8.8 and vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; code execution remains confined to the sandbox unless chained with a separate sandbox escape. Vendor patches are available in Chrome 156.0.8078.47, and no public exploit code or CISA KEV listing was identified in the provided data at time of analysis.
Memory corruption in the Extensions component of Google Chrome prior to 156.0.8078.47 lets a remote attacker who convinces a victim to open a crafted HTML page execute arbitrary code inside the browser sandbox. The flaw is unauthenticated (PR:N) and reaches default configurations, but exploitation is not zero-click - user interaction (UI:R) is mandatory, and by Google's own description the resulting code execution is contained within the renderer sandbox, so full host compromise would require chaining with a separate sandbox-escape bug. Google rates the issue as Chromium security severity Medium despite the 8.8 CVSS, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Use-after-free in the Extensions component of Google Chrome prior to 156.0.8078.47 lets a remote attacker who convinces a user to open a crafted HTML page execute arbitrary code within the renderer sandbox. The CVSS 3.1 base score of 8.8 reflects high confidentiality and integrity impact, but per Google (Chromium severity: Medium) code execution is contained inside the sandbox, so host compromise requires chaining a separate sandbox-escape flaw; no authentication is needed but user interaction is mandatory. No public exploit code or confirmed active exploitation was identified at time of analysis, and users on auto-updating channels are remediated without manual action.
Memory corruption in Google Chrome's Interstitials component (versions prior to 156.0.8078.47) can allow remote attackers to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction and no authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), and the unchanged scope indicates that host compromise would require chaining with a separate sandbox escape. No public exploit code has been identified at time of analysis, and Google has released a fixed version.
Improper input validation in the Input component of Google Chrome before 156.0.8078.47 allows remote attackers to potentially execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page; no authentication or non-default configuration is required, though user interaction is required to open the page. The vendor has released a patch in Chrome 156.0.8078.47. At time of analysis there is no CISA KEV listing or public exploit code identified, and because code execution is described as contained within the sandbox, standalone host compromise would require an additional sandbox-escape vulnerability.
Remote code execution confined to Chrome's renderer sandbox can be triggered in Google Chrome desktop builds prior to 156.0.8078.47 when a victim opens a crafted HTML page that drives a use-after-free in the Media component. Exploitation is unauthenticated over the network but requires user interaction (CVSS:3.1/PR:N/UI:R), and because code execution stays 'inside the sandbox' per the vendor description, host compromise requires chaining a separate sandbox escape - which is why Google rated the issue Chromium severity Low even though NVD scored it 8.8 while our own assessment lands at C:L/I:L/A:L. No public exploit code or CISA KEV listing was identified at time of analysis, and the flaw is addressed by the vendor's 156.0.8078.47 stable release.
Memory corruption in Google Chrome's Compositing component allows unauthenticated remote attackers to execute arbitrary code inside the renderer sandbox by convincing a victim to open a crafted HTML page in desktop versions prior to 156.0.8078.47. User interaction is mandatory, and successful exploitation is confined to the sandbox, so host compromise would require chaining a separate sandbox-escape vulnerability. No public exploit was identified at the time of analysis, and Google has released a patched version; the 8.8 CVSS score contrasts with Chromium's Medium severity rating because of the sandbox confinement.
Memory corruption in the OptimizationGuide component of Google Chrome versions prior to 156.0.8078.47 lets a remote, unauthenticated attacker who convinces a victim to load a crafted HTML page potentially achieve arbitrary code execution - but only within the browser's sandbox. Chrome-side exploitation requires user navigation (UI:R), so it is not a fully automatic drive-by, and escaping to the host OS would need a separate sandbox-escape chain; the CVSS 3.1 vector scores 8.8 because of high confidentiality, integrity, and availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch (156.0.8078.47) is available.
Google Chrome builds prior to 156.0.8078.47 carry an input-validation flaw in an exposed API that allows a remote, unauthenticated attacker to achieve arbitrary code execution inside the renderer sandbox when a victim simply loads a crafted HTML page. Exploitation hinges entirely on the user-interaction requirement (UI:R): the victim must open attacker-controlled HTML in a vulnerable, default-configured Chrome, and the resulting code execution stays inside the browser's renderer sandbox (S:U), so host-level compromise would additionally require chaining an unrelated sandbox-escape bug that is not part of this CVE. Although the base score reaches 8.8, no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, and Chromium's own rating for the issue is only Medium, so real-world priority sits below what the numeric score suggests. Vendor-released patch: 156.0.8078.47.
Memory corruption in Google Chrome's Sensor component prior to version 156.0.8078.47 allows a remote attacker to potentially execute arbitrary code inside the browser sandbox when a victim renders a crafted HTML page. The flaw is rated CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) - network reachable, low complexity, no privileges required, but contingent on one user action (opening the page) - and Google classifies it as Chromium security severity Medium. Because the corruption occurs in the sandboxed renderer, any code execution is confined there; achieving host-level compromise would require the attacker to additionally chain a separate sandbox-escape bug. No public exploit code has been identified at the time of analysis, and the issue was fixed by the Chrome stable channel update.
Memory corruption in Google Chrome's DevTools component before version 156.0.8078.47 lets a remote attacker who convinces a victim to open a crafted HTML page potentially execute arbitrary code within the browser sandbox. The flaw requires user interaction and no authentication; while the CVSS base score is 8.8, Google rates it Low severity, and code execution is scope-limited to the sandbox, so host compromise would require a separate sandbox escape. No public exploit was identified at time of analysis, and a vendor patch is available.
Improper input validation in Google Chrome's password-handling component before 156.0.8078.47 allows a remote attacker to run arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The issue is unauthenticated from the attacker's perspective (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) but depends entirely on user interaction - the target must actively navigate to the attacker-controlled page in a vulnerable desktop Chrome build. Chromium itself rated the flaw 'Low' because the resulting execution stays confined to the sandbox (S:U), meaning host-level compromise would require chaining a separate sandbox-escape vulnerability; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Memory corruption in the HTML handling component of Google Chrome prior to 156.0.8078.47 lets a remote attacker trigger a buffer-related fault and potentially execute arbitrary code, though strictly inside the renderer sandbox. Affected users are those running Chrome builds older than 156.0.8078.47 across desktop platforms; exploitation requires the victim to open a crafted HTML page (UI:R) and needs no credentials or prior privileges. Google rates the issue Low on its Chromium severity scale despite the 8.8 CVSS, and no public exploit code or confirmed active exploitation was identified at time of analysis; the practical ceiling on impact is the sandbox boundary, so host compromise would need a separate sandbox-escape chained in.
Use-after-free in Google Chrome's API layer allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in versions prior to 156.0.8078.47. CVSS 3.1 is 8.8 (High) with UI:R, while Chromium rates it Medium because code execution remains confined to the sandbox and host compromise requires a separate sandbox escape. No public exploit was identified at time of analysis, and the vendor has released Chrome 156.0.8078.47 as the fix.
Improper input validation in Chrome's Extensions component allows a remote, unauthenticated attacker to achieve arbitrary code execution inside the renderer sandbox in Google Chrome desktop builds prior to 156.0.8078.47, triggered when a victim renders a crafted HTML page (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation is not zero-click: the UI:R metric and the 'crafted HTML page' wording confirm the user must actively visit or load attacker-controlled content, and the resulting code execution is contained within the browser sandbox unless chained with a separate sandbox-escape flaw. No public exploit code has been identified at the time of analysis, there is no CISA KEV listing, and EPSS is low at 0.30% (22nd percentile), so real-world priority is moderate even though vendor-released patch 156.0.8078.47 is available.
Authentication bypass in Cruise Control (Red Hat Streams for Apache Kafka 2.x and 3.x) lets adjacent-network attackers reach all 15 administrative REST endpoints without credentials by abusing exact-path Jetty security constraints and servlet path normalization. The CVSS 3.1 score is 8.8 (AV:A/AC:L/PR:N/UI:N), but in AMQ Streams the Strimzi operator NetworkPolicy limits Cruise Control port 9090 to operator pods, so realistic exposure requires that policy to be absent, disabled, or misconfigured. No public exploit was identified at time of analysis.