Monthly
Sandbox-escaping remote code execution in Google Chrome for iOS (versions prior to 152.0.7977.65) stems from use of an uninitialized variable that a remote attacker can trigger with a crafted HTML page, potentially running arbitrary code outside the renderer sandbox. Rated Critical by Chromium with a CVSS 9.6 (scope-changed) vector, it requires the victim to visit a malicious page but no authentication. There is no public exploit identified and it is not on CISA KEV; EPSS is low at 0.41% (34th percentile).
Denial of service in the Wireshark ESS protocol dissector affects versions 4.6.0-4.6.7 and 4.4.0-4.4.17, allowing a remote unauthenticated attacker to crash Wireshark by injecting crafted packets into a network segment under active capture. The root cause is CWE-457 (use of an uninitialized variable) in the ESS dissector, which triggers an unhandled crash on malformed ESS traffic. No CISA KEV listing or public exploit has been identified; an EPSS score of 0.25% (16th percentile) and SSVC exploitation status of 'none' collectively indicate low real-world exploitation likelihood despite the high CVSS base score.
Denial-of-service in IBM i 7.3 through 7.6 allows a remote unauthenticated attacker to crash or degrade service availability by triggering an uninitialized variable condition (CWE-457) over the network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, though impact is bounded to partial availability with no confidentiality or integrity exposure. No public exploit code exists and this vulnerability has not been listed in the CISA KEV catalog at time of analysis; a vendor patch is available from IBM.
Use of an uninitialized variable in WonderTrader up to version 0.9.9 allows a remote low-privileged attacker to cause limited availability disruption by manipulating the m_offsetType argument within the TraderATP Cash Trade Conversion component. The flaw resides in src/Includes/WTSTradeDef.hpp and is exploitable remotely, with a public proof-of-concept available via a Feishu document. No patch has been released and the vendor has not responded to disclosure - exploitation conditions are low complexity once authentication is satisfied, making this a persistent unmitigated risk for deployments using the ATP cash trading interface.
Uninitialized memory use in Skia, Chrome's 2D graphics engine, exposes a cross-origin data leak primitive in Google Chrome prior to 151.0.7922.109. Exploitation is constrained to attackers who have already achieved renderer process compromise - making this a second-stage, chained vulnerability rather than a standalone initial-access vector. No public exploit or active exploitation has been identified; SSVC rates this as non-automatable with partial technical impact, consistent with the low CVSS base score of 3.1.
Cross-origin data leakage in Google Chrome's Skia graphics library (versions prior to 151.0.7922.109) enables a remote attacker who has already achieved renderer process compromise to extract cross-origin data through a specially crafted HTML page. The vulnerability is classified CWE-457 (Use of Uninitialized Variable) and carries a low CVSS base score of 3.1, reflecting its dependency on a pre-existing renderer compromise as a prerequisite. No public exploit code has been identified at time of analysis, SSVC exploitation status is rated none, and a vendor-released patch is available in Chrome 151.0.7922.109.
Uninitialized GPU memory in Google Chrome on Android prior to 151.0.7922.109 exposes sensitive process memory contents to a remote attacker who has already achieved renderer process compromise. The CWE-457 flaw allows the GPU component to read and return uninitialized memory regions when processing attacker-controlled HTML, resulting in confidentiality impact bounded to the compromised process scope. No public exploit code exists and CISA SSVC rates exploitation as none at time of analysis, making this a second-stage information disclosure component rather than a standalone critical threat.
Uninitialized memory use in Skia, Chrome's 2D graphics rendering engine, exposes process memory contents to remote attackers on Windows via crafted HTML pages in Google Chrome versions prior to 151.0.7922.72. The flaw is strictly an information disclosure issue (CWE-457), with no integrity or availability impact, affecting only the Windows platform per the vulnerability description. No public exploit code has been identified, EPSS places exploitation probability at 0.19% (9th percentile), and SSVC classifies exploitation as none with partial technical impact - collectively suggesting limited real-world risk despite the CVSS C:H rating.
Uninitialized memory access in Google Chrome's WebXR implementation on Android exposes potentially sensitive browser process memory contents to remote attackers who can direct a victim to a crafted HTML page. All Chrome for Android versions prior to 151.0.7922.72 are affected by this information disclosure weakness (CWE-457). No public exploit identified at time of analysis and SSVC confirms no active exploitation, placing this in routine patch-cycle priority despite the high confidentiality impact rating in the CVSS base score.
Uninitialized GPU memory use in Google Chrome on Android prior to 151.0.7922.72 enables remote attackers to leak cross-origin data by luring victims to a crafted HTML page. The flaw is confined to the Android build of Chrome and results in limited confidentiality exposure with no integrity or availability impact. No public exploit code or active exploitation has been identified; EPSS stands at a very low 0.19%, and Chromium itself rated the issue 'Low' severity.
Sandbox-escaping remote code execution in Google Chrome for iOS (versions prior to 152.0.7977.65) stems from use of an uninitialized variable that a remote attacker can trigger with a crafted HTML page, potentially running arbitrary code outside the renderer sandbox. Rated Critical by Chromium with a CVSS 9.6 (scope-changed) vector, it requires the victim to visit a malicious page but no authentication. There is no public exploit identified and it is not on CISA KEV; EPSS is low at 0.41% (34th percentile).
Denial of service in the Wireshark ESS protocol dissector affects versions 4.6.0-4.6.7 and 4.4.0-4.4.17, allowing a remote unauthenticated attacker to crash Wireshark by injecting crafted packets into a network segment under active capture. The root cause is CWE-457 (use of an uninitialized variable) in the ESS dissector, which triggers an unhandled crash on malformed ESS traffic. No CISA KEV listing or public exploit has been identified; an EPSS score of 0.25% (16th percentile) and SSVC exploitation status of 'none' collectively indicate low real-world exploitation likelihood despite the high CVSS base score.
Denial-of-service in IBM i 7.3 through 7.6 allows a remote unauthenticated attacker to crash or degrade service availability by triggering an uninitialized variable condition (CWE-457) over the network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, though impact is bounded to partial availability with no confidentiality or integrity exposure. No public exploit code exists and this vulnerability has not been listed in the CISA KEV catalog at time of analysis; a vendor patch is available from IBM.
Use of an uninitialized variable in WonderTrader up to version 0.9.9 allows a remote low-privileged attacker to cause limited availability disruption by manipulating the m_offsetType argument within the TraderATP Cash Trade Conversion component. The flaw resides in src/Includes/WTSTradeDef.hpp and is exploitable remotely, with a public proof-of-concept available via a Feishu document. No patch has been released and the vendor has not responded to disclosure - exploitation conditions are low complexity once authentication is satisfied, making this a persistent unmitigated risk for deployments using the ATP cash trading interface.
Uninitialized memory use in Skia, Chrome's 2D graphics engine, exposes a cross-origin data leak primitive in Google Chrome prior to 151.0.7922.109. Exploitation is constrained to attackers who have already achieved renderer process compromise - making this a second-stage, chained vulnerability rather than a standalone initial-access vector. No public exploit or active exploitation has been identified; SSVC rates this as non-automatable with partial technical impact, consistent with the low CVSS base score of 3.1.
Cross-origin data leakage in Google Chrome's Skia graphics library (versions prior to 151.0.7922.109) enables a remote attacker who has already achieved renderer process compromise to extract cross-origin data through a specially crafted HTML page. The vulnerability is classified CWE-457 (Use of Uninitialized Variable) and carries a low CVSS base score of 3.1, reflecting its dependency on a pre-existing renderer compromise as a prerequisite. No public exploit code has been identified at time of analysis, SSVC exploitation status is rated none, and a vendor-released patch is available in Chrome 151.0.7922.109.
Uninitialized GPU memory in Google Chrome on Android prior to 151.0.7922.109 exposes sensitive process memory contents to a remote attacker who has already achieved renderer process compromise. The CWE-457 flaw allows the GPU component to read and return uninitialized memory regions when processing attacker-controlled HTML, resulting in confidentiality impact bounded to the compromised process scope. No public exploit code exists and CISA SSVC rates exploitation as none at time of analysis, making this a second-stage information disclosure component rather than a standalone critical threat.
Uninitialized memory use in Skia, Chrome's 2D graphics rendering engine, exposes process memory contents to remote attackers on Windows via crafted HTML pages in Google Chrome versions prior to 151.0.7922.72. The flaw is strictly an information disclosure issue (CWE-457), with no integrity or availability impact, affecting only the Windows platform per the vulnerability description. No public exploit code has been identified, EPSS places exploitation probability at 0.19% (9th percentile), and SSVC classifies exploitation as none with partial technical impact - collectively suggesting limited real-world risk despite the CVSS C:H rating.
Uninitialized memory access in Google Chrome's WebXR implementation on Android exposes potentially sensitive browser process memory contents to remote attackers who can direct a victim to a crafted HTML page. All Chrome for Android versions prior to 151.0.7922.72 are affected by this information disclosure weakness (CWE-457). No public exploit identified at time of analysis and SSVC confirms no active exploitation, placing this in routine patch-cycle priority despite the high confidentiality impact rating in the CVSS base score.
Uninitialized GPU memory use in Google Chrome on Android prior to 151.0.7922.72 enables remote attackers to leak cross-origin data by luring victims to a crafted HTML page. The flaw is confined to the Android build of Chrome and results in limited confidentiality exposure with no integrity or availability impact. No public exploit code or active exploitation has been identified; EPSS stands at a very low 0.19%, and Chromium itself rated the issue 'Low' severity.