Monthly
Improper CORS handling in Google Chrome versions prior to 155.0.8059.39 allows a remote attacker to bypass the browser's web origin policy by delivering crafted cross-origin network traffic to a victim who visits attacker-controlled content (UI:R). The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, 4.3) shows no authentication requirement but a mandatory user-interaction step and integrity-only impact, matching Chromium's own 'Low' severity rating; there is no public exploit identified at time of analysis and EPSS is negligible at 0.17% (6th percentile). Risk is further reduced by Chrome's silent auto-update channel, which quickly shrinks the exposed population.
Safebrowsing information omission in Google Chrome on macOS prior to 153.0.8010.36 allows a remote unauthenticated attacker to bypass system access restrictions by delivering a crafted HTML page that causes Chrome's Safe Browsing subsystem to silently suppress or lose security-relevant signals. The CVSS vector (PR:N/UI:R/I:H) reflects that a victim need only visit a malicious page, after which Safebrowsing protections fail to surface warnings - exposing users to malicious downloads or sites without Chrome's normal safety guardrails. No public exploit code exists and EPSS is very low (0.20%, 10th percentile); no CISA KEV listing at time of analysis.
Insufficient audit logging in HCL IntelliOps Event Management (IEM) allows an authenticated low-privilege network user to perform workflow actions that are not captured in security logs, breaking observability for incident response teams. All versions of IEM are affected per the wildcard CPE, and the CVSS Scope:Changed metric indicates the logging gap propagates impact to downstream audit platforms or SIEMs that depend on IEM event data. No public exploit code exists and CISA has not listed this in the KEV catalog; the primary risk is forensic and compliance-oriented rather than direct system compromise.
Improper CORS handling in Google Chrome versions prior to 155.0.8059.39 allows a remote attacker to bypass the browser's web origin policy by delivering crafted cross-origin network traffic to a victim who visits attacker-controlled content (UI:R). The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, 4.3) shows no authentication requirement but a mandatory user-interaction step and integrity-only impact, matching Chromium's own 'Low' severity rating; there is no public exploit identified at time of analysis and EPSS is negligible at 0.17% (6th percentile). Risk is further reduced by Chrome's silent auto-update channel, which quickly shrinks the exposed population.
Safebrowsing information omission in Google Chrome on macOS prior to 153.0.8010.36 allows a remote unauthenticated attacker to bypass system access restrictions by delivering a crafted HTML page that causes Chrome's Safe Browsing subsystem to silently suppress or lose security-relevant signals. The CVSS vector (PR:N/UI:R/I:H) reflects that a victim need only visit a malicious page, after which Safebrowsing protections fail to surface warnings - exposing users to malicious downloads or sites without Chrome's normal safety guardrails. No public exploit code exists and EPSS is very low (0.20%, 10th percentile); no CISA KEV listing at time of analysis.
Insufficient audit logging in HCL IntelliOps Event Management (IEM) allows an authenticated low-privilege network user to perform workflow actions that are not captured in security logs, breaking observability for incident response teams. All versions of IEM are affected per the wildcard CPE, and the CVSS Scope:Changed metric indicates the logging gap propagates impact to downstream audit platforms or SIEMs that depend on IEM event data. No public exploit code exists and CISA has not listed this in the KEV catalog; the primary risk is forensic and compliance-oriented rather than direct system compromise.