Use-after-free in Google Chrome's Extensions component allows remote, unauthenticated attackers to execute arbitrary code inside the renderer sandbox when a victim opens or is navigated to a crafted HTML page, affecting desktop builds prior to 156.0.8078.47. Google rates the flaw Medium at the Chromium severity level, while the 8.8 CVSS reflects high confidentiality and integrity impact confined to the sandboxed renderer; exploitation requires user interaction (UI:R), and full host compromise needs a separate sandbox escape. No public exploit code was identified at time of analysis, and a vendor patch shipped in the 156.0.8078.47 stable channel update published on the Chrome Releases blog.
Memory corruption in Chrome's ServiceWorker subsystem lets a remote attacker potentially achieve arbitrary code execution inside the renderer sandbox when a victim browses a crafted HTML page, and affects Chrome builds earlier than 156.0.8078.47. Although Google's Chromium severity rating is Medium, the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) describes a network-reachable, low-complexity flaw that requires no credentials - only that the user load attacker-controlled web content. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a patch-now hygiene item rather than a confirmed actively attacked vulnerability; Google issued a fixed build (156.0.8078.47) and the referenced Chromium issue tracker entry remained access-restricted until most users updated.
Use-after-free in Google Chrome's Permissions component before 156.0.8078.47 allows remote attackers to trigger memory corruption and execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page. The issue requires user interaction (CVSS UI:R), needs no authentication (PR:N), and carries a CVSS 8.8 base score even though Chromium rates its security severity as Low; the described code execution is confined to the renderer sandbox and would require chaining with a separate sandbox escape for host compromise. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google has released a fixed build.
Memory corruption in Google Chrome's Network component before 156.0.8078.47 can let an unauthenticated remote attacker execute arbitrary code inside the browser sandbox when a victim visits a crafted HTML page. The 8.8 CVSS reflects high confidentiality, integrity, and availability impact with user interaction required (UI:R) and no privileges (PR:N), while Google's Chromium-Low severity and the sandbox containment mean host compromise requires chaining a separate sandbox escape. No public exploit code was identified at time of analysis, and the vendor has released Chrome 156.0.8078.47 as the fix.
Use-after-free in Google Chrome's Core component on macOS allows remote attackers to execute arbitrary code inside the renderer sandbox when a user opens a crafted HTML page in versions prior to 156.0.8078.47. Exploitation requires user interaction and affects default configurations, but code execution is confined to the Chrome sandbox and cannot reach the host OS without a separate sandbox-escape vulnerability; no public exploit code has been identified at time of analysis.
Code execution inside the renderer sandbox is possible in Google Chrome versions prior to 156.0.8078.47 because of improper input validation in the Actor component, and a remote, unauthenticated attacker can trigger it only if a victim loads a crafted HTML page. The sandbox boundary means full host compromise requires chaining a separate Chrome sandbox-escape flaw, so this is a patch-priority issue rather than a drop-everything emergency, and no public exploit was identified at time of analysis. Google has released the fixed build 156.0.8078.47.
Use-after-free in Google Chrome's Turbolev component allows remote attackers to execute arbitrary code inside the renderer sandbox on any desktop or ChromeOS build prior to 156.0.8078.47. Exploitation requires user interaction: the victim must open a crafted HTML page (directly, or via an ad/iframe on a compromised site), but no authentication or non-default configuration is needed, and confidentiality, integrity, and availability impacts are all rated High. Code execution is scope-unchanged and confined to the sandbox, so full host compromise would require chaining a separate sandbox-escape flaw; no public exploit code has been identified at time of analysis, and Google has released a fixed build.
Use-after-free in Google Chrome's Streaming component (fixed in 156.0.8078.47) lets a remote attacker who convinces a victim to load a crafted HTML page execute arbitrary code inside the renderer sandbox. No authentication or pre-existing privileges are required, but exploitation hinges on user interaction - the target must navigate to or render attacker-controlled content - and any code execution stays confined to the renderer, so host compromise requires chaining a separate sandbox escape. Google rates the issue Chromium severity Medium while NVD-compatible scoring lands at 8.8; no public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available.
Use-after-free in Google Chrome for Android prior to 156.0.8078.47 lets a remote attacker potentially execute code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation is unauthenticated (PR:N) but requires the user to open attacker-controlled content (UI:R), and the resulting code execution stays confined to Chrome's sandbox - consistent with the vendor's 'Low' Chromium severity rating - so meaningful compromise of the Android device would require chaining a separate sandbox escape. Google has released a fixed build and no public exploit code has been identified at time of analysis, though NVD's base score of 8.8 is materially higher than our assessed vector (C:L/I:L/A:L) because it does not account for sandbox confinement.
Memory corruption in the Messages component of Google Chrome for Android prior to 156.0.8078.47 lets a remote attacker who convinces a user to open a crafted HTML page potentially execute arbitrary code inside the renderer sandbox. The CVSS vector (AV:N/AC:L/PR:N/UI:R) means no authentication is required but the victim must actively navigate to attacker-controlled content, which materially raises the bar for exploitation. Impact signals conflict: the CVE carries an 8.8 base score while Chromium rates the issue 'Low' severity, and because the description confines the outcome to the sandbox, host-level compromise would require chaining a separate sandbox escape; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Use-after-free in the Media component of Google Chrome for Android lets a remote, unauthenticated attacker execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Only Android builds below 156.0.8078.47 are affected, and Google rates the flaw Low severity even though the CVSS 3.1 vector scores 8.8, because the resulting code execution stays confined to the sandbox and would require chaining with a separate sandbox-escape to impact the host device. No public exploit code has been identified at time of analysis, and a fixed build (156.0.8078.47) has been released by the vendor.
Improper input validation in Google Chrome's Omnibox on Android before 156.0.8078.47 allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox by convincing a victim to load or interact with a crafted HTML page. Exploitation requires user interaction (UI:R) and the resulting code execution is confined to the sandbox, so host-level compromise would require chaining a separate sandbox-escape flaw. Google rates the Chromium severity as Medium and has shipped a fixed build (156.0.8078.47); no public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so real-world priority is lower than the raw 8.8 CVSS score suggests.
Remote code execution in Google Chrome on Android before 156.0.8078.47 allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The CVSS 8.8 rating reflects high confidentiality, integrity, and availability impact, but Scope:Unchanged means the compromise is confined to the browser sandbox unless chained with a separate sandbox-escape vulnerability. Google has released a fixed build, and no public exploit was identified at time of analysis.
Use-after-free in the Passwords component of Google Chrome on Android before 156.0.8078.47 lets a remote attacker execute arbitrary code inside the browser sandbox by convincing a victim to load a crafted HTML page. The flaw is unauthenticated on the attacker's side but requires user interaction (the victim must open the malicious page) and is restricted to the Android build of Chrome; successful exploitation is confined to the renderer sandbox, so full device compromise requires an additional sandbox-escape primitive not covered by this CVE. Vendor patches are available, and no public exploit code or active exploitation has been identified at time of analysis.
Use-after-free in Google Chrome for Android's PerformanceAPIs (versions prior to 156.0.8078.47) can let a remote attacker execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page. Exploitation requires user interaction (UI:R) and no authentication (PR:N); no public exploit identified at time of analysis, and this CVE does not provide a sandbox escape. Risk signals conflict and must be weighed carefully: CVSS 8.8 with high confidentiality/integrity impact contrasts with Chromium's Low severity rating and the renderer-sandbox containment, while a vendor patch is available.
Memory corruption in Google Chrome for Android prior to 156.0.8078.47 allows a remote, unauthenticated attacker to potentially execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page. Exploitation requires user interaction (UI:R) - navigating to attacker-controlled content - and the resulting code execution is confined to the renderer sandbox, so full device compromise would require a separate sandbox-escape vulnerability. Signals conflict sharply: the CVSS 3.1 score is 8.8 while Google assigns Chromium security severity Low, and no public exploit code or CISA KEV entry was identified at time of analysis; a vendor patch is available in 156.0.8078.47.
Use-after-free in the Toolbar component of Google Chrome for Android allows a remote, unauthenticated attacker to achieve arbitrary code execution inside the Chrome sandbox when a victim loads a crafted HTML page. All Chrome builds on Android prior to 156.0.8078.47 are affected; the flaw scores CVSS 3.1 base 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), a classic drive-by browser profile where the only prerequisite is that the user navigates to or renders attacker-controlled content. Google rates the issue Medium in its own Chromium severity scale, and no public exploit code or confirmed active exploitation was identified at time of analysis; a vendor patch is available.
Use-after-free in Google Chrome for Android before 156.0.8078.47 can allow a remote, unauthenticated attacker to execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page (UI:R). Although the CVSS 3.1 base score is 8.8 and tags include RCE and memory corruption, Google rates the Chromium issue Low because code execution is confined to the renderer sandbox and full device compromise would require chaining a separate sandbox escape. Patch to 156.0.8078.47 or later; no public exploit was identified at time of analysis, and no CISA KEV status was provided.
Memory corruption in the Chrome FileSystem component allows a remote, unauthenticated attacker to achieve arbitrary code execution inside the renderer sandbox by convincing a victim to load a crafted HTML page. All Chrome builds prior to 156.0.8078.47 on desktop are affected, and because exploitation requires only a page visit (UI:R) with no privileges (PR:N), browsing-driven attacks are practical despite the medium rating Chromium assigned. Code execution is confined to the sandbox, so full host compromise would require chaining a separate sandbox escape; no public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS data was not provided.
Code execution inside the renderer sandbox is achievable in Google Chrome desktop builds prior to 156.0.8078.47 through a use-after-free in the Streaming component. A remote, unauthenticated attacker can trigger the flaw by convincing a victim to open a crafted HTML page, but the CVSS vector requires user interaction (UI:R) and the resulting code execution remains confined to the renderer sandbox, so a separate sandbox escape is needed to compromise the host. No public exploit was identified at time of analysis, and the vendor has released Chrome 156.0.8078.47 to address the issue.
Memory corruption in Google Chrome's Media component on Windows allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page, affecting versions prior to 156.0.8078.47. The CVSS 3.1 vector (8.8) reflects network reach, low complexity, no privileges, and required user interaction, with high confidentiality, integrity, and availability impact; code execution is sandbox-confined, so host compromise would require a separate sandbox escape. No public exploit was identified at time of analysis and no CISA KEV entry is indicated in the supplied data, while Google has released a fixed Chrome build.
Use-after-free in Google Chrome's Media component allows remote code execution inside the renderer sandbox when a victim opens a crafted HTML page in versions prior to 156.0.8078.47. No authentication is required, but exploitation requires user interaction, and code execution is confined to the sandbox unless chained with a separate sandbox escape. Chrome 156.0.8078.47 fixes the issue; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and assessment signals are moderately consistent but incomplete.
Use-after-free in Google Chrome's Input handling prior to 156.0.8078.47 enables remote code execution inside the browser sandbox when a user opens a crafted HTML page. Exploitation requires user interaction (UI:R) and no authentication (PR:N), but the assessed impact is contained to the renderer sandbox; full host compromise would require chaining a separate sandbox-escape vulnerability. No public exploit code or CISA KEV entry was identified at time of analysis, and the vendor has released 156.0.8078.47 to address the flaw.
Memory corruption in PDFium, Chrome's built-in PDF engine, lets a remote attacker potentially execute arbitrary code inside the renderer sandbox on desktop Chrome builds prior to 156.0.8078.47 when a victim opens a crafted HTML page that triggers PDF rendering. Exploitation requires user interaction (UI:R) but no authentication (PR:N), and because execution is confined to the sandbox, full host compromise would require chaining with a separate sandbox-escape bug. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google has released a fixed build; note the scoring split between NVD's 8.8 and Chromium's own Medium severity, which reflects the sandbox containment.
Arbitrary code execution inside the Chrome renderer sandbox is possible in Google Chrome versions prior to 156.0.8078.47 due to a use-after-free in the Turbolev component. A remote attacker can trigger it only when a victim opens a crafted HTML page (UI:R, PR:N), and the resulting code execution is confined to the sandbox, so full host compromise would require a separate sandbox escape. No public exploit was identified at time of analysis, and Google has released Chrome 156.0.8078.47 to address it.
Memory corruption in the Input Method Editor (IME) component of Google Chrome allows a remote attacker to potentially achieve code execution inside the browser sandbox by convincing a victim to load a crafted HTML page. All Chrome builds prior to 156.0.8078.47 are affected, and exploitation requires user interaction (CVSS UI:R) with no authentication or privileges needed (PR:N). Impact is bounded by sandbox containment - the assessed vector is S:U, so full host compromise would require chaining with a separate sandbox-escape flaw; no public exploit code or CISA KEV active-exploitation entry was identified at time of analysis, though a vendor fix is available.
Use-after-free in Google Chrome's Views component (desktop builds prior to 156.0.8078.47) can corrupt memory when a victim loads a crafted HTML page, potentially allowing arbitrary code execution inside the renderer sandbox. Exploitation is network-reachable, requires user interaction (UI:R), and needs no authentication or special configuration; Google rates the Chromium security severity as Low even though the CVSS 3.1 base score is 8.8, and host compromise would require chaining a separate sandbox escape. Vendor patching is available, and no public exploit identified at time of analysis.
Crafted HTML pages can trigger improper input validation in Google Chrome's Extensions component before 156.0.8078.47, allowing remote attackers to execute arbitrary code within the browser sandbox. Exploitation requires the victim to open attacker-controlled web content and does not require authentication, but the impact is sandbox-confined, so host compromise would require a separate sandbox escape. No public exploit was identified at time of analysis, and Google has released Chrome 156.0.8078.47; the 8.8 CVSS score should be read alongside the Medium Chromium severity and UI requirement.
Use-after-free in Google Chrome's Web Workers implementation before 156.0.8078.47 allows unauthenticated remote attackers to execute arbitrary code inside the renderer sandbox when a victim loads crafted HTML/JavaScript; the CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-416), while Chromium itself rates the issue Low. The assessed impact is sandbox-confined, so system-level compromise would require chaining a separate sandbox escape, and exploitation requires user interaction plus a vulnerable pre-156.0.8078.47 build. No CISA KEV entry or public exploit is present in the supplied data, so the status is no public exploit identified at time of analysis; signals are mixed in a way that matters for prioritization because the numeric severity is high but the practical exploit path is constrained.
Memory corruption in the DevTools component of Google Chrome builds prior to 156.0.8078.47 lets remote attackers execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page that exercises the DevTools code path. Exploitation is unauthenticated (PR:N per the CVSS vector) but requires user interaction (UI:R), and the vendor-confirmed scope is unchanged (S:U), meaning code execution is confined to the Chromium sandbox rather than the host operating system - which is why Chromium assigns this a Low security severity despite the 8.8 CVSS base score. No public exploit identified at time of analysis, and a vendor patch is available in Chrome 156.0.8078.47; the sharp gap between the NVD-style 8.8 score and the vendor's Low rating is the central judgement call in this case.
Google Chrome builds prior to 156.0.8078.47 contain an improper input-validation weakness in the GPU component that allows a remote, unauthenticated attacker to execute arbitrary code inside the browser sandbox after a victim loads a crafted HTML page. Exploitation requires user interaction but no privileges, and the resulting code execution is confined to Chrome's sandbox unless chained with a separate sandbox-escape flaw. CVSS 3.1 scores this as 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); no public exploit was identified at time of analysis, and it is not reported as actively exploited.
Google Chrome on Windows before 156.0.8078.47 contains a use-after-free in CredentialProvider that can let a remote, unauthenticated attacker run arbitrary code inside the browser’s renderer sandbox when a victim opens a crafted HTML page. Exploitation requires user interaction and is contained by the sandbox, so host-level compromise would require a separate sandbox escape. No public exploit code or CISA KEV entry was identified at time of analysis, and the independently assessed impact is limited to low confidentiality, integrity, and availability effects within the sandbox.
Strategic Network Optimization in Oracle E-Business Suite versions 12.2.3 through 12.2.15 can be taken over through a network-based attack that requires no credentials but does require a victim to interact with attacker-controlled content. The CVSS 3.1 score is 8.8 with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, reflecting high confidentiality, integrity, and availability impact; no public exploit was identified at time of analysis. The limiting prerequisite is user interaction, not authentication, so exposure of the SNO HTTP interface together with successful social engineering is the practical attack path.
Arbitrary code execution inside the renderer sandbox is possible in Google Chrome for Android builds prior to 156.0.8078.47, where a range error (CWE-118) in the SiteIsolation component is reachable through a crafted HTML page. Attackers who convince a victim to navigate to such a page can corrupt memory in the renderer process; because the flaw is confined to the sandbox (CVSS S:U), the practical outcome is renderer-process compromise rather than direct operating-system takeover unless the attacker chains a separate sandbox-escape bug. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, though the vendor rates it Medium severity while the CVSS 3.1 base score of 8.8 reflects high confidentiality and integrity impact with mandatory user interaction (AV:N/AC:L/PR:N/UI:R).
Authenticated low-privileged attackers can achieve full takeover of Oracle REST Data Services in versions 24.2.0 through 26.2.2 by sending crafted HTTP requests to the ORDS interface, with high impact to confidentiality, integrity and availability (CVSS 8.8). Oracle rates the flaw easy to exploit - no user interaction, no race condition and no non-default configuration is required - so the practical barriers are simply any valid low-privilege ORDS account plus network reachability of the ORDS listener. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so active exploitation is not confirmed; realistic risk is concentrated in internet-exposed ORDS deployments that issue accounts broadly.
Use-after-free in Google Chrome's SiteIsolation component before 156.0.8078.47 allows unauthenticated remote attackers to trigger memory corruption and execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. The attack requires user interaction (UI:R) and does not by itself escape Chrome's sandbox, so host compromise would require chaining an additional sandbox-escape vulnerability. No public exploit identified at time of analysis, but the vendor has released a fixed build and the issue is rated High severity.
Oracle Database's OLAP component in versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3 can be compromised by an authenticated, low-privileged database user who holds the DBMS_AW privilege and can reach the Oracle Net listener; successful exploitation can result in takeover of Oracle OLAP with high confidentiality, integrity, and availability impact (CVSS 8.8). The attack requires network access via Oracle Net but no user interaction, and the main exposure control is limiting who receives DBMS_AW and how broadly the listener is reachable. No public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4: a low-privileged attacker with HTTP network access to the Product Quality Management component can compromise confidentiality, integrity, and availability at high impact (CVSS 3.1 base 8.8, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The PR:L authentication prerequisite is the main limiting factor - an attacker must already hold or obtain a valid low-privileged account, so this is not anonymous exploitation, but once inside no user interaction or special configuration is required. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV); the intelligence signals are sparse, resting on a single Oracle CPU reference with no CWE mapping or CPE data.
Memory corruption in Chrome's CustomTabs component on Android can let an unauthenticated remote attacker execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page, requiring user interaction. Google rates the Chromium security severity Low and the vendor notes impact is confined to the sandbox, which tempers the 8.8 CVSS score; affected builds are Chrome for Android before 156.0.8078.47, and no public exploit was identified at time of analysis. The issue is fixed in 156.0.8078.47.
Improper input validation in the Omnibox of Google Chrome for Android (versions prior to 156.0.8078.47) lets a remote, unauthenticated attacker potentially execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page - user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:R). Signals conflict sharply and must be weighed carefully: the externally reported base score of 8.8 (C:H/I:H/A:H) implies full compromise, whereas our independent assessment scores it 4.3-level impact (C:L/I:L/A:L) because any code execution is confined to the renderer sandbox and Google's own Chromium severity rating for this issue is 'Low'. No public exploit code exists and the issue is not in CISA KEV, so exploitation is not confirmed actively exploited (CISA KEV) at time of analysis; the practical barrier remains convincing a user to open a malicious page, plus the need for a separate sandbox escape to achieve device-level compromise.
Memory corruption in the Passwords component of Google Chrome for Android prior to 156.0.8078.47 allows a remote attacker to potentially execute arbitrary code inside the renderer sandbox by convincing a victim to load a crafted HTML page. Exploitation requires user interaction (the victim must navigate to attacker-controlled content), and the resulting code execution is confined to the sandbox, so meaningful host-level compromise would require chaining with a separate sandbox escape; only the Android build in the specified version range is affected. No public exploit code or confirmed active exploitation was identified at time of analysis, though EPSS-style urgency is tempered by the conditional, interaction-dependent nature of the flaw.
Remote code execution inside Chrome's renderer sandbox on Android is possible via memory corruption in ANGLE, the browser's graphics translation layer, when a victim running Google Chrome prior to 156.0.8078.47 loads a crafted HTML page. Exploitation requires user interaction, since the victim must navigate to or open the malicious page, and does not require authentication, but successful code execution stays within Chrome's renderer sandbox, so device-level compromise would require chaining a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at the time of analysis.
Use-after-free in Google Chrome for Android's CustomTabs component allows a remote attacker to execute arbitrary code inside the sandboxed renderer when a victim opens a crafted HTML page, affecting versions prior to 156.0.8078.47. Google has released a vendor patch in Chrome 156.0.8078.47, and no public exploit identified at time of analysis. Because exploitation requires user interaction and the resulting code execution is confined to the renderer sandbox, compromise of the host device would require chaining a separate sandbox-escape vulnerability.
Memory corruption in the Toolbar component of Google Chrome for Android before 156.0.8078.47 allows a remote, unauthenticated attacker to potentially execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) yields 8.8, yet Google assigns Chromium severity Low and the independent assessment stresses that code execution is confined to the renderer sandbox, so host-level compromise would require a separate sandbox-escape flaw; exploitation hinges on user interaction (UI:R) and no persistent server-side service is exposed. No public exploit code has been identified at the time of analysis, and the signals around this CVE conflict, so the practical risk should be weighed against the sandbox confinement and the lack of observed exploitation.
Memory corruption in the CustomTabs component of Google Chrome for Android before 156.0.8078.47 can allow a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The CVSS 8.8 score reflects high confidentiality, integrity, and availability impact, but exploitation requires user interaction and remains contained by Chrome's sandbox unless a separate sandbox escape is chained. Google has released a fixed build, and the provided intelligence shows no public exploit identified at time of analysis.
Memory corruption in ANGLE, Chrome's WebGL/graphics translation layer, lets remote attackers potentially achieve arbitrary code execution inside the renderer sandbox on Chrome builds prior to 156.0.8078.47 by convincing a victim to load a crafted HTML page. The bug is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-119), with the mandatory user-interaction requirement and unchanged sandbox scope being the main constraints - full host compromise would require chaining a separate sandbox-escape flaw. Google has released a fixed build, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, making this a high-priority patch item rather than a drop-everything emergency.
An out-of-bounds read in the Android build of Google Chrome before 156.0.8078.47 allows a remote attacker to read past the end of an allocated buffer by getting a victim to load a crafted HTML page, with the vendor noting the possibility of arbitrary code execution confined to the renderer sandbox. Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R) - the target must navigate to or be served the malicious page - and is limited to Chrome on Android running a version below the fixed build. No public exploit code was identified at time of analysis and the CVE is not listed in CISA KEV; the read-class weakness (CWE-125) and the requirement for a separate sandbox escape make realistic impact lean toward memory/information disclosure rather than assured host compromise.
Memory corruption in Chrome's Search component lets a remote, unauthenticated attacker achieve code execution inside the browser sandbox when a victim simply loads a crafted HTML page in any Chrome build prior to 156.0.8078.47 (CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8 High). Because the flaw is explicitly scoped to code execution 'inside the sandbox', it does not by itself grant host-level compromise and would need to be chained with a separate sandbox escape for full system takeover, though an in-sandbox primitive already exposes credentials, session data, and files reachable by the renderer. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but Google has shipped a vendor patch and the required user interaction (a single page visit) keeps the practical bar to exploitation low for targeted campaigns.
Improper input validation in the Extensions component of Google Chrome builds earlier than 156.0.8078.47 lets a remote, unauthenticated attacker trigger arbitrary code execution inside the browser sandbox when a victim opens a crafted HTML page. The attack is network-reachable and low-complexity but requires user interaction - the target must navigate to an attacker-controlled or compromised page - and, because the resulting code execution is confined 'inside the sandbox,' full host compromise would require chaining a separate sandbox-escape flaw. Google rates the flaw Medium under its own Chromium severity scale even though the CVSS 3.1 base score is 8.8; a vendor patch is available in 156.0.8078.47, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Use-after-free in Google Chrome's Loader component before 156.0.8078.47 allows an unauthenticated remote attacker who persuades a victim to load a crafted HTML page to execute arbitrary code inside the renderer sandbox. Exploitation requires user interaction (UI:R) and no special configuration, but the impact is bounded by Chrome's sandbox; full host compromise would require a separate sandbox escape. No public exploit code or CISA KEV entry was identified in the supplied intelligence, and Google rates the issue Chromium severity Low despite the 8.8 CVSS score.