Monthly
Remote code execution in Microsoft Edge (Chromium-based) is enabled by a type confusion vulnerability (CWE-843) that can be triggered when a user visits attacker-controlled web content. All versions of Edge (Chromium-based) are affected per the wildcard CPE, with full confidentiality, integrity, and availability impact at a CVSS 8.8. A vendor patch is available via the Microsoft Security Response Center; no active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Improper content-type caching in the Avro component of Spring Cloud Stream can produce incorrect content-type metadata on processed messages, creating a low-severity information-disclosure and data-integrity risk. Affected versions span the 4.2.x, 4.3.x, and 5.0.x release trains. Exploitation requires network access, high privilege level, high attack complexity, and user interaction, making real-world impact minimal; no public exploit code or active exploitation has been identified at time of analysis.
OpenStack Keystone before 29.0.3 allows any authenticated user holding role:reader on any project to enumerate all role assignments across any domain in the cloud by exploiting a type-confusion bug in the GET /v3/role_assignments endpoint. The attack supplies a domain ID as scope.project.id with include_subtree, triggering a null domain_id policy check that passes unconditionally for all callers because domains are internally modeled as projects with domain_id=null. With include_names, the response discloses the names and home-domain IDs of every user, group, project, and role across the targeted domain - and the well-known 'default' domain constant works against every deployment bootstrapped with keystone-manage bootstrap, requiring no prior reconnaissance. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV.
Type confusion in BlueZ's SDP XML parser (sdp-xml.c) allows a low-privileged local caller to crash the bluetoothd daemon by submitting a crafted nested ServiceRecord via the RegisterProfile() D-Bus API. The parser stack is corrupted so scalar union data is misread as a sequence pointer, causing an invalid dereference and process termination - a local denial-of-service with no confidentiality or integrity impact. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Type confusion in Chrome's V8 JavaScript engine exposes memory contents within the browser sandbox to remote attackers who can socially engineer victims into visiting a crafted HTML page. All Chrome desktop releases prior to 152.0.7977.65 are affected, confirmed by the Chrome Stable Channel advisory linked in references. Despite the vendor-assigned CVSS 8.8, Chromium's own security team rated this 'Low' severity - reflecting the sandboxed scope of the memory disclosure and the required social engineering step - and EPSS probability stands at only 0.26% (18th percentile) with no CISA KEV listing, consistent with SSVC 'Exploitation: none'.
Type confusion in Chrome's V8 JavaScript engine (versions prior to 152.0.7977.65) enables remote code execution within the browser sandbox when a victim is socially engineered into visiting a crafted HTML page. The vulnerability arises from a CWE-843 type confusion flaw in V8, allowing an attacker to manipulate object type assumptions at runtime to achieve arbitrary code execution. Importantly, execution is constrained to the Chrome sandbox, which Chromium's own severity rating of 'Low' reflects; no public exploit code or CISA KEV listing has been identified at time of analysis.
Type confusion in Google Chrome's DevTools component prior to version 152.0.7977.65 enables remote code execution within the browser sandbox when a victim is social-engineered into visiting a crafted HTML page. The flaw affects all Chrome platforms where DevTools is accessible and results in high confidentiality, integrity, and availability impact to the sandboxed process. No public exploit code has been identified at time of analysis, and SSVC assessment confirms no observed active exploitation, though the technical impact rating is classified as total.
Type confusion in Chrome's ANGLE graphics abstraction layer (all versions prior to 152.0.7977.65) enables remote attackers to potentially execute arbitrary code outside the browser sandbox by directing a user to a specially crafted HTML page. The CVSS 8.8 score reflects network-accessible delivery with no privilege requirements, full confidentiality, integrity, and availability impact, though user interaction is necessary. No public exploit identified at time of analysis; SSVC rates exploitation as 'none', yet technical impact is rated 'total' given the sandbox-escape language in the description.
Type confusion in Chrome's Animation component allows remote unauthenticated attackers to potentially execute arbitrary code within the browser sandbox by luring a user to a crafted HTML page. All Chrome versions prior to 152.0.7977.65 are affected across desktop platforms. No public exploit code or active exploitation has been identified at time of analysis, and EPSS places this at the 19th percentile (0.27%), suggesting limited immediate exploitation pressure despite the high CVSS score.
Type confusion in V8, Chrome's JavaScript engine, allows remote unauthenticated attackers to execute arbitrary code within the Chrome renderer sandbox by luring a user to a crafted HTML page. All Google Chrome desktop versions prior to 152.0.7977.65 are affected across Windows, macOS, and Linux. No public exploit has been identified at time of analysis, and the EPSS score of 0.33% (25th percentile) reflects limited current exploitation probability; the vendor patch is available and should be applied promptly.
Remote code execution in Microsoft Edge (Chromium-based) is enabled by a type confusion vulnerability (CWE-843) that can be triggered when a user visits attacker-controlled web content. All versions of Edge (Chromium-based) are affected per the wildcard CPE, with full confidentiality, integrity, and availability impact at a CVSS 8.8. A vendor patch is available via the Microsoft Security Response Center; no active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Improper content-type caching in the Avro component of Spring Cloud Stream can produce incorrect content-type metadata on processed messages, creating a low-severity information-disclosure and data-integrity risk. Affected versions span the 4.2.x, 4.3.x, and 5.0.x release trains. Exploitation requires network access, high privilege level, high attack complexity, and user interaction, making real-world impact minimal; no public exploit code or active exploitation has been identified at time of analysis.
OpenStack Keystone before 29.0.3 allows any authenticated user holding role:reader on any project to enumerate all role assignments across any domain in the cloud by exploiting a type-confusion bug in the GET /v3/role_assignments endpoint. The attack supplies a domain ID as scope.project.id with include_subtree, triggering a null domain_id policy check that passes unconditionally for all callers because domains are internally modeled as projects with domain_id=null. With include_names, the response discloses the names and home-domain IDs of every user, group, project, and role across the targeted domain - and the well-known 'default' domain constant works against every deployment bootstrapped with keystone-manage bootstrap, requiring no prior reconnaissance. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV.
Type confusion in BlueZ's SDP XML parser (sdp-xml.c) allows a low-privileged local caller to crash the bluetoothd daemon by submitting a crafted nested ServiceRecord via the RegisterProfile() D-Bus API. The parser stack is corrupted so scalar union data is misread as a sequence pointer, causing an invalid dereference and process termination - a local denial-of-service with no confidentiality or integrity impact. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Type confusion in Chrome's V8 JavaScript engine exposes memory contents within the browser sandbox to remote attackers who can socially engineer victims into visiting a crafted HTML page. All Chrome desktop releases prior to 152.0.7977.65 are affected, confirmed by the Chrome Stable Channel advisory linked in references. Despite the vendor-assigned CVSS 8.8, Chromium's own security team rated this 'Low' severity - reflecting the sandboxed scope of the memory disclosure and the required social engineering step - and EPSS probability stands at only 0.26% (18th percentile) with no CISA KEV listing, consistent with SSVC 'Exploitation: none'.
Type confusion in Chrome's V8 JavaScript engine (versions prior to 152.0.7977.65) enables remote code execution within the browser sandbox when a victim is socially engineered into visiting a crafted HTML page. The vulnerability arises from a CWE-843 type confusion flaw in V8, allowing an attacker to manipulate object type assumptions at runtime to achieve arbitrary code execution. Importantly, execution is constrained to the Chrome sandbox, which Chromium's own severity rating of 'Low' reflects; no public exploit code or CISA KEV listing has been identified at time of analysis.
Type confusion in Google Chrome's DevTools component prior to version 152.0.7977.65 enables remote code execution within the browser sandbox when a victim is social-engineered into visiting a crafted HTML page. The flaw affects all Chrome platforms where DevTools is accessible and results in high confidentiality, integrity, and availability impact to the sandboxed process. No public exploit code has been identified at time of analysis, and SSVC assessment confirms no observed active exploitation, though the technical impact rating is classified as total.
Type confusion in Chrome's ANGLE graphics abstraction layer (all versions prior to 152.0.7977.65) enables remote attackers to potentially execute arbitrary code outside the browser sandbox by directing a user to a specially crafted HTML page. The CVSS 8.8 score reflects network-accessible delivery with no privilege requirements, full confidentiality, integrity, and availability impact, though user interaction is necessary. No public exploit identified at time of analysis; SSVC rates exploitation as 'none', yet technical impact is rated 'total' given the sandbox-escape language in the description.
Type confusion in Chrome's Animation component allows remote unauthenticated attackers to potentially execute arbitrary code within the browser sandbox by luring a user to a crafted HTML page. All Chrome versions prior to 152.0.7977.65 are affected across desktop platforms. No public exploit code or active exploitation has been identified at time of analysis, and EPSS places this at the 19th percentile (0.27%), suggesting limited immediate exploitation pressure despite the high CVSS score.
Type confusion in V8, Chrome's JavaScript engine, allows remote unauthenticated attackers to execute arbitrary code within the Chrome renderer sandbox by luring a user to a crafted HTML page. All Google Chrome desktop versions prior to 152.0.7977.65 are affected across Windows, macOS, and Linux. No public exploit has been identified at time of analysis, and the EPSS score of 0.33% (25th percentile) reflects limited current exploitation probability; the vendor patch is available and should be applied promptly.