20 New Chrome Vulnerabilities - 1 Critical, 19 High Severity

Heap corruption in Google Chrome's Digital Credentials component (versions prior to 149.0.7827.155) allows remote attackers to trigger a use-after-free condition by enticing a user to visit a crafted HTML page, potentially leading to arbitrary code execution within the renderer process. Chromium rates this issue as Critical severity, and Google has released a patched stable-channel build; no public exploit identified at time of analysis and EPSS sits at 0.31% (23rd percentile), indicating low predicted near-term exploitation pressure despite the high CVSS of 8.8.

Process memory disclosure in Google Chrome's Media implementation exposes potentially sensitive data to remote attackers via a crafted HTML page. All Chrome versions prior to 149.0.7827.155 on desktop are affected; exploitation requires user interaction but no authentication. No public exploit code has been identified and CISA KEV lists no active exploitation, though the High confidentiality CVSS impact and broad deployment footprint make patching a priority.

Out-of-bounds read in Chrome's WebRTC subsystem on Windows exposes process memory to remote attackers who can lure victims to a crafted HTML page. Affected versions are all Chrome releases prior to 149.0.7827.155 on Windows; the flaw is classified CWE-125 and carries a CVSS score of 6.5 (High). No public exploit or active exploitation has been identified at time of analysis, and SSVC signals low urgency, but the combination of a zero-interaction network delivery path and high-confidentiality impact makes patching a clear near-term priority.

Universal Cross-Site Scripting (UXSS) in Google Chrome's Serial API implementation prior to version 149.0.7827.155 allows a remote, unauthenticated attacker to inject and execute arbitrary scripts or HTML across any browser origin by luring a user to a crafted HTML page. The Scope:Changed CVSS metric underscores the cross-origin nature of this flaw, which bypasses the Same-Origin Policy and can affect trusted co-loaded or previously visited sites. No active exploitation has been confirmed by CISA KEV, and EPSS at 0.27% (18th percentile) alongside SSVC 'exploitation: none' signal low real-world exploitation activity at time of analysis. Vendor-released patch: 149.0.7827.155.

Out-of-bounds read in Chromoting (Chrome Remote Desktop) on Windows exposes process memory to local attackers who can persuade a victim to open a malicious file. Affected are all Chrome releases on Windows prior to 149.0.7827.155. No public exploit code has been identified and EPSS places exploitation probability at the 8th percentile, indicating low near-term threat despite the High confidentiality impact rating assigned by the CVSS vector.

Universal Cross-Site Scripting (UXSS) in the Views component of Google Chrome on Linux (prior to 149.0.7827.155) enables an attacker who has already compromised the renderer process to inject arbitrary scripts or HTML across security origins via a crafted HTML page, breaking Chrome's same-origin policy isolation. This is a post-renderer-compromise escalation step in a multi-stage attack chain, Linux-platform specific, requiring prior renderer RCE as a prerequisite. No public exploit code has been identified at time of analysis; EPSS sits at 0.29% (21st percentile), and CISA SSVC assesses exploitation status as none with partial technical impact.

Cross-origin data leakage in Google Chrome's Passwords component prior to version 149.0.7827.155 enables a remote attacker to read sensitive cross-origin data by directing a victim to a crafted HTML page. The root cause is an incorrect authorization check (CWE-863) within the browser's built-in password subsystem, which improperly permits cross-origin access to data that should be origin-restricted. No public exploit code exists and CISA has not listed this in KEV; EPSS at 0.29% (21st percentile) and SSVC exploitation=none collectively indicate low near-term exploitation likelihood despite the broad user base.

Cross-origin data leakage in Google Chrome on Android prior to 149.0.7827.155 is triggered by an uninitialized GPU memory condition exploitable through a crafted HTML page. An unauthenticated remote attacker (per CVSS PR:N) can cause a victim's Android Chrome browser to expose limited data from other browser origins when the user visits a malicious page. No public exploit has been identified and EPSS at 0.30% (21st percentile) with SSVC exploitation:none signals low real-world exploitation probability at time of analysis.