Import-time code execution in fastapi-code-generator prior to 0.8.1: the tool writes an OpenAPI path verbatim into a single-quoted @app.get('...') route decorator, so a path containing a single quote closes the string literal and lets an attacker splice a live Python expression into the decorator argument. The payload is evaluated when the generated main.py is imported (for example when the ASGI server starts or a CI job imports the module), giving code execution with the generating application's or pipeline's privileges without the running service ever being remotely reachable. Any workflow that generates a FastAPI app from an attacker-controlled or attacker-influenced spec is affected; a public proof-of-concept harness (reproduce.sh and make_spec.py attached to the advisory) was verified against 0.8.0, and the issue is fixed in 0.8.1.
Import-time code execution in fastapi-code-generator prior to 0.8.1 lets an attacker who controls or influences an OpenAPI specification place a crafted secondary response status-code key that is emitted verbatim into the generated route decorator's responses={...} dictionary; because the key is written as a single-quoted Python literal without escaping embedded quotes, a valid expression can be concatenated into the decorator argument and runs as soon as the generated module is imported or served by the ASGI server, requiring no HTTP request. Only multi-response operations are a sink, since the responses dictionary is emitted solely when a second non-primary response exists, and remote, unauthenticated conditions apply (CVSS:4.0 AV:N/AC:L/PR:N/UI:N, all impact metrics High). It is not in CISA KEV and no exploitation in the wild is reported; a proof-of-concept reproducer is attached to the GitHub advisory and was verified against version 0.8.0, and the priority decision label is act_now. Patch status: Vendor-released patch: 0.8.1.
Code generation in fastapi-code-generator before 0.8.1 writes an OpenAPI Operation.summary verbatim into the generated route handler's triple-double-quoted docstring without escaping embedded """, so a crafted summary can close the docstring and inject a Python expression statement into the handler body that executes with the server process's privileges when that endpoint is called. Only code generated from an attacker-controlled or attacker-influenced spec and subsequently deployed is exposed; a syntax-breaking payload merely aborts generation (black/isort post-processing), so the practical payload must be valid Python such as the advisory's '"""+expr+"""' form kept valid with '(expr or "")'. The vendor CVSS 4.0 vector scores 9.3 Critical, our independent assessment is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (UI:R reflecting that an operator must generate and deploy the code), and the vuln.today decision label is act_now; a public PoC reference exists (reproduce.sh attached to the GitHub advisory, verified against 0.8.0) and no CISA KEV entry applies.
Eclipse Mnestix Browser 1.6.0 through releases before 2.3.0 allows unauthenticated remote attackers to exfiltrate the MNESTIX_BACKEND_API_KEY for every configured Infrastructure. The issue is classified as CWE-918 (SSRF) with a CVSS 4.0 base score of 9.2 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N), and the independent CVSS 3.1 vector confirms network reachability, no privileges, no user interaction, and high confidentiality impact. No public exploit code or CISA KEV entry is identified at time of analysis, but the priority label is act_now and exploitation requires only that the affected instance be reachable and have at least one Infrastructure configured with such a key.
Remote login as the built-in Axxon One administrator is possible through the web client on newly installed systems running versions before 3.0.0, because the default credential is not forced to change at first sign-in. An unauthenticated network attacker who knows the default password can gain high-impact administrative access on Windows or Linux deployments that have not been remediated. No public exploit code was identified at time of analysis, and the vuln.today priority is act_now.
Unsafe class loading (CWE-470) in Amazon Redshift JDBC Driver before 2.3.0 lets an actor who can influence the JDBC connection URL parameters or the AWS credentials profile fields cause the driver to load and instantiate classes present on the application classpath, resulting in code execution inside the application's JVM. The flaw is not reachable against the driver in isolation: it requires an application that constructs connection strings or credentials profiles from externally controllable input, plus a suitable gadget class already available on the classpath, which is why the assessed CVSS 3.1 vector carries AC:H despite PR:N and full confidentiality/integrity/availability impact. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), but the vendor has released a fix and the priority call is act_now given the RCE outcome.
Container-to-host sandbox escape in Docker Desktop for Windows running the WSL2 backend on x86-64: an unprivileged Linux container can use the 32-bit socketcall multiplexer to slip past the default seccomp restriction on AF_VSOCK and then reach host-facing services and Windows files accessible to the logged-in user. LinuxKit-based Docker Desktop backends are explicitly unaffected, and the flaw is confined to x86-64 WSL2 deployments; exploitation requires local code execution inside a container (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N), not remote unauthenticated access. The vuln.today priority label is act_now, driven by the scope-changing host impact, but no public exploit code has been identified at time of analysis. Remediation is only complete when both Docker Desktop 4.98.0 or later and WSL 3.0.3 or later are installed, since Docker Desktop 4.98.0+ on an older WSL remains affected.
NetApp StorageGRID (formerly StorageGRID Webscale) 11.3 and later permits unauthorized requests to be issued against the product by a remote party that can reach the Grid Network on specific ports, with no authentication needed once reachability is established; the CVSS:4.0 vector rates it 9.1 with high confidentiality and integrity impact but no availability impact. Exploitation is not trivial: it demands both access to the Grid Network - StorageGRID's internal inter-node network, normally segmented away from client and general-purpose networks - and product-specific knowledge of how to construct the malicious requests, which is captured by the AC:H and AT:P metrics and makes insider or post-compromise scenarios more plausible than broad internet-facing attacks. The issue is tagged for immediate action (act_now) by vuln.today and NetApp published advisory NTAP-20261103-0001; no public exploit code or CISA KEV entry was identified in the supplied data.
Namespace-level access control configured with Namespace.setDefaultRolePermissions() is silently ignored on the runtime enforcement path in node-opcua 2.42.0 through 2.179.x, so an unauthenticated network client presenting the Anonymous role can write Variables whose access level includes CurrentWrite and invoke bound Methods that the operator believed were locked down by the inherited namespace default. The bypass only affects nodes that carry no explicit per-node RolePermissions; servers that declared no policy at all, nodes with explicit per-node permissions, and namespaces whose metadata was properly bound via setNamespaceMetaData() fall outside it. A public proof-of-concept reference exists (address-space unit tests plus an end-to-end TCP reproduction) and has not been independently verified as working exploit code; the vendor-released fix is version 2.180.0, and the priority label is act_now.
Reflected cross-site scripting in Vembu BDRSuite before 7.6.0 allows remote unauthenticated attackers to execute arbitrary JavaScript in an operator's browser session when the victim opens a crafted link or request, with effects limited to that session. The assessed vector requires user interaction and shows no server-side impact, making this a moderate, not emergency, priority. A public PoC reference exists but is not verified as working exploit code, and no CISA KEV active-exploitation listing is provided.
Unauthenticated remote attackers who can reach a SonicWall GMS 9.5.2 or earlier management interface can read internal GMS files, potentially exposing sensitive information held on the appliance. The independently assessed vector is AV:N/AC:L/PR:N/UI:N with high confidentiality impact and no integrity or availability impact, and exposure is greatest where GMS is internet-facing or reachable from untrusted networks. No public exploit identified at time of analysis and CISA SSVC records no known exploitation, so the priority is monitor rather than emergency.
FreeRDP clients through 3.32.1 silently accept a server certificate whose identity does not match the RDP target, letting an on-path attacker impersonate the RDP server and read or alter the session - keystrokes, clipboard, screen content, and injected input - without any client-side prompt. The defect is an incomplete fix for GHSA-43hh-p3vw-hfx3: tls_verify_certificate() still consults the Common Name via an unconditional OR even when non-matching dNSName SAN entries are present, and still matches IP-literal targets as plain strings against CN/DNS entries because true iPAddress SANs are never parsed. FreeRDP 3.32.2 is the vendor-fixed release; a detailed public proof-of-concept reproduction exists at function level with isolating control cases (not demonstrated end-to-end over a live RDP handshake), no confirmed active exploitation (not in CISA KEV), and the issue carries an act_now priority label - but exploitation is gated on both an on-path position and a certificate chaining to a CA the client already trusts (misissuance, or a rogue/private CA).
Unauthenticated arbitrary file deletion in the BuddyPress XProfile Image Field plugin through 3.1.0 allows remote attackers to remove server files, including wp-config.php, when web-server filesystem permissions permit the deletion, potentially leading to remote code execution. The vulnerable path is built from visitor-supplied signup metadata and passed to unlink() without realpath() resolution or containment checks; exploitation requires open registration and an image-type XProfile field on the signup form. No public exploit is identified in the available data, and the vuln.today decision label is act_now.
Cross-site scripting in Dell Wyse Management Suite before 2609.0.0.155 allows a low-privileged authenticated remote user to inject script into web pages that other console users may view. Signals point to elevated but conditional risk: exploitation requires a valid low-privileged account and user interaction from a higher-privileged victim, and the independent assessment rates confidentiality and integrity impact as limited (C:L/I:L) within a changed scope. No public exploit identified at time of analysis; the vuln.today decision label is act_now, and the exact feature or input field carrying the unsanitized data is not described in the available sources.
Incorrect authorization in trapperkeeper-authorization, used by Puppet Server and Puppet Enterprise, lets a client holding a CA-issued certificate whose name extends or shortens an authorized hostname be treated as that host. This enables node impersonation and, in Puppet Enterprise, access to certificate-authority administration and remote command execution on managed nodes. Exploitation requires a colliding certificate issued through CA approval or autosign, and no public exploit code was identified in the provided sources at time of analysis.
Missing authorization in Eclipse Mnestix Browser 1.2.0 through releases before 2.3.0 lets remote unauthenticated attackers invoke privileged functionality - such as changing Infrastructure settings or calling the connected, authenticated AAS Generator backend - without holding a Mnestix user session. The CVSS 4.0 vector (8.8, AV:N/AC:L/AT:N/PR:N/UI:N, high integrity impact) and the assessed CVSS 3.1 vector agree that no credentials or user interaction are required once the instance is network-reachable, and the issue is tagged as an Authentication Bypass affecting Eclipse Foundation software. The vuln.today decision label is this_week; no public exploit identified at time of analysis, and the advisory's version range indicates 2.3.0 is the first unaffected release.
The TYPO3 'frontend_user_registration' extension trusts an attacker-supplied frontend user identifier in its email-driven action handlers, so unauthenticated remote attackers can confirm registrations, disclose the username and email address of frontend users, and delete arbitrary frontend user accounts without a valid hash. Affected are TYPO3 installations where the extension is installed and active and its email-linked actions (registration confirmation, account deletion) are in use; every version of the extension is listed as affected in the CPE data. No confirmed public exploit code and no CISA KEV entry are identified at time of analysis, but the exploitation profile is unusually accessible (CVSS 4.0 AV:N/AC:L/PR:N/UI:N, assessed CVSS 3.1 8.8 with Integrity:High and Confidentiality:Low), which is why it is prioritised as a near-term 'this week' item rather than a high-score-but-low-reality case.
An unauthenticated adjacent attacker who can reach the web management interface of Zyxel GS1900 series switches running firmware through 2.90(AAHK.2)C0 can trigger an out-of-bounds write in the device's CGI program via a crafted HTTP request, with the potential for OS command execution (CVSS 3.1: 8.8, AV:A/AC:L/PR:N/UI:N, C:H/I:H/A:H). The CPE data lists the whole GS1900 family as affected - GS1900-8, -8HP, -10HP, -16, -24, -24E, -24EP, -HPv2, -48 and -48HPv2 - so exposure is not limited to the GS1900-24E named in the description. No public exploit code and no confirmed active exploitation were identified at time of analysis; Zyxel published a security advisory on 11-03-2026 and the issue is prioritised for remediation this week rather than as a drop-everything emergency, because the attacker must first be on the same adjacent/Layer-2 network as the switch's management plane.
A buffer overflow in the zdp_wtp binary of Zyxel NWA110AX access points running firmware through 7.12(ABTG.0)C0 allows an unauthenticated attacker who can reach the device over the local network to escalate privileges, with high impact on confidentiality, integrity and availability. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms the flaw is not remotely exploitable from the internet, but requires no credentials or user interaction once the attacker is on an adjacent network segment such as a guest or untrusted LAN. Zyxel has published a security advisory and patched firmware is available for the affected branch; no public exploit code has been identified at the time of analysis, and the issue is assessed as a near-term (this week) priority rather than an emergency, with risk bounded by the adjacent-network precondition.
Command injection in Argo CD Image Updater's SSH Git credential handling lets an attacker who can set the proxy URL on an SSH Git repository run arbitrary commands and reach credentials in the Image Updater process context. The proxy value is interpolated unsanitized into a shell-interpreted SSH command (ProxyCommand/GIT_SSH_COMMAND via connect-proxy), so shell metacharacters in the proxy host break out of the intended argument. The issue is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H), meaning it is remote but requires an attacker to already hold privileges sufficient to create or modify the repository/proxy configuration; an upstream fix is available in PR 1905, and no public exploit was identified at time of analysis.
Dell Wyse Management Suite deployments running versions prior to 2609.0.0.155 contain a cross-site scripting (CWE-79) flaw in web page generation that lets a remote, low-privileged authenticated user inject script content through the WMS web console. An attacker must first hold a valid low-privileged account on the console; the available sources do not identify the specific page, field, or request that carries the injection, so the precise trigger is not described. The vendor scores the issue at 8.8, while our independent assessment lowers it to reflect a required user interaction and scope change (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N); no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor advisory (DSA-2026-405) is the primary reference.
Use-after-free in Google Chrome's media Track component before 157.0.8103.38 allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page (UI:R). The 8.8 base score reflects high confidentiality, integrity and availability impact, but Chromium rates the issue Low because the code execution is confined to the sandbox and full host compromise would require a separate sandbox-escape vulnerability. No public exploit was identified at time of analysis, and a vendor patch is available.
Arbitrary code execution confined to Chrome's renderer sandbox is achievable in Google Chrome builds prior to 157.0.8103.38 when a victim loads a crafted HTML page carrying malicious SVG content. The root cause is uncontrolled recursion (CWE-674) in SVG handling; Chromium itself scored the issue Low severity, CISA's SSVC assessment records exploitation as none and automatable as no, and no public exploit has been identified at time of analysis. The raw CVSS base score of 8.8 should be read alongside our independent assessment, which lowers confidentiality, integrity and availability impact to low because the description limits code execution to 'inside the sandbox' - without a separately chained sandbox escape the attacker cannot reach the host OS or data outside the renderer.
Code execution inside the Chrome sandbox in Google Chrome before 157.0.8103.38 requires social engineering and victim interaction, and the independent assessment lowers confidentiality, integrity, and availability impact to Low because the code stays within the renderer sandbox; this conflicts with the supplied 8.8 CVSS score and should be reconciled before prioritization. Chromium rated the issue Low, no public exploit identified at time of analysis, and the vendor-released fix is Chrome 157.0.8103.38.
Use-after-free in Google Chrome before 157.0.8103.38 allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, with the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8 High) confirming that only user interaction is required. The impact is bounded by Chrome's sandbox: this flaw alone does not compromise the host operating system, and escaping the sandbox would require chaining a separate vulnerability. A vendor patch is available, and no public exploit has been identified at time of analysis.
A use-after-free memory-corruption flaw (CWE-416) in Google Chrome's Scheduling component allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in any Chrome build prior to 157.0.8103.38. The only real barrier is user interaction (UI:R) - no credentials or non-default configuration are needed - and because the impact is contained 'inside the sandbox', full host compromise would require a second, separate sandbox-escape vulnerability. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, but with a CVSS v3.1 base score of 8.8 against a Chromium-assigned severity of Medium and a vendor fix already shipping, signals are mixed and point to an elevated-but-not-emergency priority (this_week).
Type confusion in Google Chrome's V8 JavaScript engine before version 157.0.8103.38 allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The flaw is scored CVSS 8.8 (AV:N/AC:L/PR:N/UI:R) while Chromium rates its security severity Medium; exploitation requires user interaction and the resulting code execution is confined to the sandbox unless chained with a separate sandbox escape. A vendor patch is available, and no public exploit identified at time of analysis, with no CISA KEV confirmation in the provided data.
Remote code execution inside the browser sandbox in Google Chrome builds prior to 157.0.8103.38, reachable when a user renders a crafted HTML page. The flaw is a use-after-free in WTF (Web Template Framework), Chromium's core utility library, and carries a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R) with the vendor rating it Medium severity; the compromised WTF object yields high confidentiality and integrity impact but any code execution remains confined to the renderer sandbox, so host compromise requires chaining a separate sandbox escape. Exploitation has not been observed (CISA SSVC: Exploitation none) and no public exploit is identified at time of analysis, though EPSS-style urgency is reflected in the 'this_week' prioritization label and CISA SSVC rates technical impact as total.
Google Chrome builds prior to 157.0.8103.38 contain a race condition in the V8 JavaScript engine that allows an unauthenticated remote attacker to execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) scores 8.8, while Chromium's own severity rating is Medium because the code execution is confined to the sandbox and a separate sandbox escape would be required for host compromise. No public exploit has been identified at time of analysis and the CVE is not in CISA KEV; a vendor fix is available in Chrome 157.0.8103.38 and the priority label is this_week.
Google Chrome versions prior to 157.0.8103.38 contain an out-of-bounds read (CWE-125) in the Media component that a remote attacker can trigger by convincing a victim to load a crafted HTML page, potentially leading to arbitrary code execution inside the browser sandbox. The flaw is assessed at CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), so exploitation is network-reachable and low complexity but requires the victim to navigate to attacker-controlled content, and code execution remains confined to the sandbox absent a separate escape. Exploitation status: no public exploit identified at time of analysis; a vendor patch is available (157.0.8103.38) and Chrome's staged rollout makes this a this_week priority item for browser fleet updates rather than an emergency.
Use-after-free in Google Chrome's Controls component prior to 157.0.8103.38 lets unauthenticated remote attackers execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page. The issue is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and requires user interaction, so it is not automatable per SSVC; the code execution is confined to the renderer sandbox, meaning host compromise would require chaining a separate sandbox escape. No public exploit has been identified at time of analysis, the vendor has released a fixed build, and the issue is prioritized for remediation this week.
Remote code execution inside the V8 sandbox in Google Chrome allows an unauthenticated attacker to potentially run arbitrary code in the renderer by convincing a user to open a crafted HTML page, affecting desktop builds prior to 157.0.8103.38. Exploitation requires user interaction (UI:R) and remains confined to the browser sandbox unless chained with a separate sandbox escape. No public exploit or CISA KEV listing was identified, and a vendor patch is available in Chrome 157.0.8103.38.
Type confusion in Google Chrome's V8 JavaScript engine before 157.0.8103.38 allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, with a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The flaw is a CWE-843 memory-corruption issue with high confidentiality and integrity impact, but exploitation requires user interaction and the impact is confined to the sandboxed renderer unless chained with a separate sandbox escape. SSVC records exploitation as 'none' and the issue as not automatable, and no public exploit is identified at time of analysis; Google rates Chromium security severity High and has released 157.0.8103.38 as the fixed build.
Use-after-free in WebRTC in Google Chrome before 157.0.8103.38 can be triggered when a user opens a crafted HTML page, allowing remote code execution inside the browser sandbox. The CVSS 8.8 vector indicates no privileges are required but user interaction is mandatory, and scope remains unchanged, so escaping the sandbox to compromise the host would require a separate vulnerability. Google has released a fixed build, and no public exploit was identified at time of analysis.
Out-of-bounds read in Chrome's Media component allows a remote attacker who gets a victim to load a crafted HTML page to potentially execute arbitrary code inside the renderer sandbox on Chrome builds prior to 157.0.8103.38. Exploitation requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), and because the sandbox is intact (S:U), host compromise would additionally require chaining a separate sandbox-escape flaw. No public exploit code has been identified at time of analysis, no CISA KEV listing applies, and a vendor patch is available, making this a high-priority this-week patch item rather than an emergency.
Use-after-free in CSS handling in Google Chrome before 157.0.8103.38 allows remote attackers to execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. Default installations are affected - no authentication or special Chrome configuration is required - but each target must be lured into loading the malicious page (UI:R), and the resulting code execution is confined by the sandbox unless the attacker chains a separate sandbox escape. No public exploit has been identified at time of analysis, SSVC records exploitation as none and automatable as no, and the vendor has shipped Chrome 157.0.8103.38 as the fix; this is a genuine high-priority browser vulnerability but not an immediate emergency, suitable for remediation within this week's patch cycle.
Type confusion in Google Chrome's DevTools affects Chrome builds prior to 157.0.8103.38 and allows a remote attacker who socially engineers a victim into opening and interacting with a crafted HTML page to execute arbitrary code inside the browser sandbox. CVSS 8.8 reflects network delivery, no privileges required, mandatory user interaction, and high confidentiality, integrity, and availability impact, while SSVC marks exploitation as none and automatable as no. No public exploit has been identified at time of analysis, and code execution remains confined to the sandbox unless combined with a separate sandbox escape.
Type confusion in Chrome's V8 JavaScript engine (CWE-843) allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox by convincing a victim to load a crafted HTML page in any Chrome build prior to 157.0.8103.38. The flaw is rated High by Chromium and scores 8.8 on the CVSS 3.1 scale (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), with the mandatory user interaction and the renderer sandbox boundary being the main limiting factors - full host compromise would additionally require a separate sandbox escape. This is a genuinely high-priority browser vulnerability, though the signals are mixed on immediacy: CISA SSVC records no known exploitation, no public exploit code has been identified at time of analysis, and a vendor patch (Chrome 157.0.8103.38) is available.
Type confusion in Chrome's V8 JavaScript engine, affecting Chrome builds prior to 157.0.8103.38, allows a remote unauthenticated attacker to potentially execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation is gated by user interaction (the victim must navigate to and render attacker-controlled content), and because the CVSS vector is S:U with the description explicitly scoping code execution 'inside the sandbox,' this flaw alone yields renderer-level compromise rather than host takeover - escaping to the operating system would require chaining with a separate sandbox-escape bug. No public exploit has been identified at time of analysis (SSVC Exploitation: none, Automatable: no), no CISA KEV listing exists, and a vendor patch is available, placing it in a this-week rather than emergency remediation window.
Use-after-free in Google Chrome's Modularization component before version 157.0.8103.38 lets a remote, unauthenticated attacker execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page (CVSS 8.8, UI:R). The code execution is confined to the sandbox, so full host compromise would additionally require chaining a separate sandbox escape, and the user-interaction requirement is the primary limiting factor - consistent with SSVC Exploitation=none, Automatable=no. No public exploit code was identified at time of analysis, and the vendor has released a fixed build, with a "this_week" priority label reflecting the high technical impact (total) rather than observed exploitation.
Remote code execution inside the browser sandbox affects Google Chrome builds prior to 157.0.8103.38, where a use-after-free in the DOM implementation can be triggered when a victim loads a crafted HTML page. Exploitation requires the user to open attacker-controlled web content (CVSS UI:R, unauthenticated per PR:N), and any code executed remains confined to the renderer sandbox rather than granting host-level control; a separate sandbox escape would be required for full system compromise. Exploitation status is not confirmed by the available data - no KEV listing or verified working exploit code is present - and the vendor has released Chrome 157.0.8103.38 as the fix, consistent with a 'this_week' rather than emergency remediation timeline.
Use-after-free in the Canvas component of Google Chrome allows remote code execution confined to the renderer sandbox when a victim loads a crafted HTML page. All Chrome builds prior to 157.0.8103.38 are affected, and exploitation requires user interaction (PR:N, UI:R) - typically opening a malicious link, page, or ad. No public exploit code or active exploitation has been identified, and the vendor has released a fixed version; the SSVC assessment rates exploitation as none and automatable as no, with the primary risk being attacker-controlled code running inside the browser sandbox rather than full host compromise.
Arbitrary code execution inside Chrome's renderer sandbox is possible in Google Chrome versions prior to 157.0.8103.38 when a user opens a crafted HTML page. The flaw is a use-after-free in the Paint component, rated 8.8 with AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; exploitation requires user interaction and yields code execution only within the sandbox, so full host compromise would require a separate sandbox escape. A vendor patch is available in 157.0.8103.38, no public exploit was identified at time of analysis, and the priority is this_week.
Remote code execution inside the renderer sandbox affects Google Chrome builds prior to 157.0.8103.38 through a use-after-free in the printing component, triggered when a victim loads a crafted HTML page. The flaw is network-reachable and requires no privileges (CVSS 3.1 AV:N/AC:L/PR:N/UI:R, 8.8 High), but the victim must navigate to attacker-controlled content and reach the browser's printing functionality, so SSVC marks it non-automatable. No public exploit has been identified at the time of analysis and SSVC records exploitation as none, while the vendor lists 157.0.8103.38 as the fixed release.
Remote code execution inside the browser sandbox affects Google Chrome builds earlier than 157.0.8103.38, where a race condition in the V8 JavaScript engine can be reached when a victim opens a crafted HTML page. Exploitation requires that user interaction, no authentication is required, and the resulting code execution is limited to the renderer sandbox (S:U), so host compromise would require a separate sandbox-escape flaw. No public exploit was identified at time of analysis, and the vendor has released Chrome 157.0.8103.38 as the fixed build.
Type confusion in Chrome's V8 JavaScript engine lets a remote attacker execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, affecting every build prior to 157.0.8103.38. Exploitation needs the user to open attacker-controlled HTML/JavaScript (CVSS UI:R) but no authentication or non-default configuration (PR:N), and the impact stays confined to the renderer sandbox (S:U), so host-level compromise would require an additional sandbox-escape chain. CISA SSVC records no known exploitation and no automatable path, and no public exploit was identified at time of analysis; risk signals are mostly consistent and point to a serious but not emergency-grade issue that should be patched this week.
Use-after-free in Google Chrome's Animation component before 157.0.8103.38 allows unauthenticated remote attackers to execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The issue is rated CVSS 8.8 and is a genuine but not emergency-grade priority: exploitation requires user interaction, SSVC marks it non-automatable, and host-level compromise would require chaining a separate sandbox escape. No public exploit was identified at time of analysis, and Chrome builds updated to 157.0.8103.38 are not affected.
Type confusion in the V8 JavaScript engine of Google Chrome before 157.0.8103.38 allows remote code execution confined to the browser's renderer sandbox when a victim visits a crafted HTML page; the user must interact with attacker-controlled content and no authentication is needed against default browser settings. Because the CVSS scope is Unchanged and the flaw is described as executing code 'inside the sandbox', a full host compromise would require chaining a separate sandbox-escape vulnerability. No public exploit code and no confirmed active exploitation are reported, SSVC marks exploitation as none and automatable as no, and the vendor has released a fixed build.
Type confusion in the V8 JavaScript engine of Google Chrome desktop builds prior to 157.0.8103.38 allows a remote attacker to achieve arbitrary code execution inside the renderer sandbox when a victim loads a crafted HTML page. No authentication is required, but exploitation depends on user interaction (the victim must visit or render attacker-controlled web content), and the resulting code execution remains confined to the sandbox, so host compromise would require a separate sandbox-escape flaw. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has released a fixed build.
Use-after-free in WebAudio in Google Chrome before 157.0.8103.38 allows unauthenticated remote attackers to execute arbitrary code inside the browser's renderer sandbox by convincing a victim to load a crafted HTML page. The CVSS 3.1 score is 8.8 (High) with UI:R, so exploitation depends on the victim rendering attacker-controlled HTML; successful code execution is confined to the renderer sandbox, and escaping to the host would require chaining a separate sandbox-escape vulnerability not covered by this CVE. No public exploit was identified at time of analysis, CISA KEV does not list this CVE, and SSVC records exploitation as none, making this a high-priority patch item this week rather than an active-exploitation emergency.