Monthly
Remote code execution inside the Chrome renderer sandbox affects Google Chrome builds prior to 156.0.8078.79, where memory corruption in the DOM lets a crafted HTML page execute arbitrary code. Attackers must convince a victim to load attacker-controlled HTML (UI:R) and need no credentials, but the impact is confined to the sandboxed renderer unless a separate sandbox-escape vulnerability is chained. No public exploit identified at time of analysis; the issue is not in CISA KEV, and an EPSS score of 0.20% (10th percentile) indicates low predicted exploitation.
Memory corruption in the Quota component of Google Chrome allows a remote attacker to potentially execute arbitrary code inside the browser sandbox by convincing a user to load a crafted HTML page; all builds prior to 156.0.8078.79 are affected. Exploitation needs the victim to visit or render attacker-controlled content (UI:R) but no authentication or privileges (PR:N), and the resulting code execution is confined to the renderer sandbox, so host compromise would require a separate sandbox escape. No public exploit has been identified at time of analysis, SSVC records Exploitation: none and Automatable: no, and EPSS is low at 0.20% (10th percentile), which supports a this_week rather than emergency response cadence; the vendor has released a fixed build.
Memory corruption in the Dawn (WebGPU) component of Google Chrome affects builds prior to 156.0.8078.79 and lets a remote, unauthenticated attacker potentially execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The user-interaction requirement and the sandbox scope limit real-world impact: exploitation grants code execution within the renderer sandbox, not host compromise, and would require a separate sandbox-escape bug to break out. No public exploit has been identified at time of analysis, EPSS is low at 0.20% (10th percentile), and SSVC records exploitation as none; a vendor patch is available, and the issue is prioritized for remediation this week.
Memory corruption in Google Chrome's garbage collection before 156.0.8078.79 can let a remote, unauthenticated attacker potentially execute arbitrary code outside the browser sandbox when a victim renders a crafted HTML page. The priority label is act_now despite low EPSS (0.20%, 10th percentile) and SSVC reporting no exploitation and not automatable, while the vendor rates the issue High. Google has released a fixed build, 156.0.8078.79; no public exploit was identified at time of analysis.
Memory corruption in the FileSystem component of Google Chrome prior to 156.0.8078.79 allows remote attackers to potentially execute arbitrary code inside the browser's renderer sandbox when a victim loads a crafted HTML page. Affected users are those running any Chrome build below 156.0.8078.79; no authentication is required but successful exploitation depends on user interaction (visiting an attacker-controlled or compromised page). No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and EPSS is low (0.20%, 10th percentile), although the vendor rates the Chromium security severity as High and SSVC assigns total technical impact.
Memory corruption in Google Chrome's network component affects versions prior to 156.0.8078.79 and lets a remote attacker who convinces a user to load a crafted HTML page potentially execute arbitrary code inside the browser sandbox. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U) confirms no privileges are required but user interaction is mandatory, and scope is unchanged, so meaningful host compromise would require chaining a separate sandbox escape. No public exploit has been identified at time of analysis: SSVC records Exploitation as none and Automatable as no, EPSS is low at 0.20% (10th percentile), and the issue is not in CISA KEV despite a total technical impact rating.
Memory corruption in the Autofill component of Google Chrome builds prior to 156.0.8078.79 lets a remote attacker execute arbitrary code inside the renderer sandbox when a victim renders a crafted HTML page. The flaw is unauthenticated per the CVSS vector (PR:N) but requires user interaction (UI:R), and because scope is unchanged (S:U), code execution is confined to the sandbox - escaping to the host requires a separate sandbox-escape vulnerability. No public exploit code and no active exploitation are confirmed (CISA KEV not listed, SSVC exploitation: none), EPSS is low at 0.20% (10th percentile), and a vendor patch is available.
Memory corruption in the V8 JavaScript engine of Google Chrome before 156.0.8078.73 allows a remote, unauthenticated attacker to potentially execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. User interaction is mandatory and the resulting code execution is sandbox-contained, so compromising the host would require an additional sandbox-escape flaw; the CVSS 3.1 score is 8.8 with C:H/I:H/A:H. No public exploit was identified at time of analysis, and the vendor has released Chrome 156.0.8078.73; the priority is this week, not an emergency.
Loading a crafted HTML page can trigger memory corruption in Google Chrome's WebAudio component before version 156.0.8078.73, potentially allowing code execution inside the renderer sandbox. The attack is remote and requires no authentication, but user interaction is required because the victim must visit the attacker-controlled page; scope is unchanged, so host compromise would require chaining a separate sandbox escape. No public exploit was identified at time of analysis, and Google has released Chrome 156.0.8078.73 as the fix.
Memory corruption in Google Chrome's Cache component before 156.0.8078.73 allows a remote attacker to execute arbitrary code inside the renderer sandbox by convincing a user to load a crafted HTML page. The flaw carries a CVSS score of 8.8 (AV:N/AC:L/PR:N/UI:R) and requires user interaction, which is the primary limiting factor; no public exploit code was identified at time of analysis. Google has released a patched build, and the issue is prioritized for remediation this week.
Remote code execution inside the Chrome renderer sandbox affects Google Chrome builds prior to 156.0.8078.79, where memory corruption in the DOM lets a crafted HTML page execute arbitrary code. Attackers must convince a victim to load attacker-controlled HTML (UI:R) and need no credentials, but the impact is confined to the sandboxed renderer unless a separate sandbox-escape vulnerability is chained. No public exploit identified at time of analysis; the issue is not in CISA KEV, and an EPSS score of 0.20% (10th percentile) indicates low predicted exploitation.
Memory corruption in the Quota component of Google Chrome allows a remote attacker to potentially execute arbitrary code inside the browser sandbox by convincing a user to load a crafted HTML page; all builds prior to 156.0.8078.79 are affected. Exploitation needs the victim to visit or render attacker-controlled content (UI:R) but no authentication or privileges (PR:N), and the resulting code execution is confined to the renderer sandbox, so host compromise would require a separate sandbox escape. No public exploit has been identified at time of analysis, SSVC records Exploitation: none and Automatable: no, and EPSS is low at 0.20% (10th percentile), which supports a this_week rather than emergency response cadence; the vendor has released a fixed build.
Memory corruption in the Dawn (WebGPU) component of Google Chrome affects builds prior to 156.0.8078.79 and lets a remote, unauthenticated attacker potentially execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The user-interaction requirement and the sandbox scope limit real-world impact: exploitation grants code execution within the renderer sandbox, not host compromise, and would require a separate sandbox-escape bug to break out. No public exploit has been identified at time of analysis, EPSS is low at 0.20% (10th percentile), and SSVC records exploitation as none; a vendor patch is available, and the issue is prioritized for remediation this week.
Memory corruption in Google Chrome's garbage collection before 156.0.8078.79 can let a remote, unauthenticated attacker potentially execute arbitrary code outside the browser sandbox when a victim renders a crafted HTML page. The priority label is act_now despite low EPSS (0.20%, 10th percentile) and SSVC reporting no exploitation and not automatable, while the vendor rates the issue High. Google has released a fixed build, 156.0.8078.79; no public exploit was identified at time of analysis.
Memory corruption in the FileSystem component of Google Chrome prior to 156.0.8078.79 allows remote attackers to potentially execute arbitrary code inside the browser's renderer sandbox when a victim loads a crafted HTML page. Affected users are those running any Chrome build below 156.0.8078.79; no authentication is required but successful exploitation depends on user interaction (visiting an attacker-controlled or compromised page). No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and EPSS is low (0.20%, 10th percentile), although the vendor rates the Chromium security severity as High and SSVC assigns total technical impact.
Memory corruption in Google Chrome's network component affects versions prior to 156.0.8078.79 and lets a remote attacker who convinces a user to load a crafted HTML page potentially execute arbitrary code inside the browser sandbox. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U) confirms no privileges are required but user interaction is mandatory, and scope is unchanged, so meaningful host compromise would require chaining a separate sandbox escape. No public exploit has been identified at time of analysis: SSVC records Exploitation as none and Automatable as no, EPSS is low at 0.20% (10th percentile), and the issue is not in CISA KEV despite a total technical impact rating.
Memory corruption in the Autofill component of Google Chrome builds prior to 156.0.8078.79 lets a remote attacker execute arbitrary code inside the renderer sandbox when a victim renders a crafted HTML page. The flaw is unauthenticated per the CVSS vector (PR:N) but requires user interaction (UI:R), and because scope is unchanged (S:U), code execution is confined to the sandbox - escaping to the host requires a separate sandbox-escape vulnerability. No public exploit code and no active exploitation are confirmed (CISA KEV not listed, SSVC exploitation: none), EPSS is low at 0.20% (10th percentile), and a vendor patch is available.
Memory corruption in the V8 JavaScript engine of Google Chrome before 156.0.8078.73 allows a remote, unauthenticated attacker to potentially execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. User interaction is mandatory and the resulting code execution is sandbox-contained, so compromising the host would require an additional sandbox-escape flaw; the CVSS 3.1 score is 8.8 with C:H/I:H/A:H. No public exploit was identified at time of analysis, and the vendor has released Chrome 156.0.8078.73; the priority is this week, not an emergency.
Loading a crafted HTML page can trigger memory corruption in Google Chrome's WebAudio component before version 156.0.8078.73, potentially allowing code execution inside the renderer sandbox. The attack is remote and requires no authentication, but user interaction is required because the victim must visit the attacker-controlled page; scope is unchanged, so host compromise would require chaining a separate sandbox escape. No public exploit was identified at time of analysis, and Google has released Chrome 156.0.8078.73 as the fix.
Memory corruption in Google Chrome's Cache component before 156.0.8078.73 allows a remote attacker to execute arbitrary code inside the renderer sandbox by convincing a user to load a crafted HTML page. The flaw carries a CVSS score of 8.8 (AV:N/AC:L/PR:N/UI:R) and requires user interaction, which is the primary limiting factor; no public exploit code was identified at time of analysis. Google has released a patched build, and the issue is prioritized for remediation this week.