Google Chrome 151 Security Vulnerabilities

Sandbox escape in Google Chrome's WebSockets implementation (versions prior to 151.0.7922.72) allows a remote attacker to potentially break out of the renderer sandbox when a victim visits a crafted HTML page. The flaw is a use-after-free (CWE-416) rated CVSS 9.6 due to a scope-changing sandbox escape, though Google's own Chromium severity rating is only Low and EPSS exploitation probability is minimal (0.17%). No public exploit has been identified and CISA SSVC lists exploitation status as none.

Sandbox escape in Google Chrome desktop before 151.0.7922.72 lets an attacker who already controls a compromised renderer process break out of the sandbox by triggering a use-after-free in the browser's DNS handling via a crafted HTML page. Chromium rated the issue Low severity, and while the NVD CVSS is 9.6, SSVC records no observed exploitation and it is not automatable; there is no public exploit identified at time of analysis and it is not in CISA KEV. EPSS is low at 0.17% (7th percentile), consistent with a second-stage chaining bug rather than a mass-exploited entry point.

Sandbox escape in Google Chrome for Android before 151.0.7922.72 lets an attacker who has already compromised the renderer process break out of the sandbox via crafted HTML delivered through the Picture-in-Picture feature. Chromium rates the severity Low and CISA SSVC exploitation is 'none', making this a second-stage bug in an exploit chain rather than a standalone entry point. No public exploit identified at time of analysis, and EPSS is low at 0.17% (7th percentile).

Remote code execution in Google Chrome desktop before 151.0.7922.72 arises from a heap buffer overflow in the browser's media Codecs component (CWE-122), letting a remote attacker who serves a crafted HTML page corrupt heap memory and run arbitrary code - though execution is confined inside the renderer sandbox rather than the host OS. Google rates the Chromium severity as Low despite the NVD-style 8.8 CVSS, and there is no public exploit identified at time of analysis; EPSS is low at 0.24% (15th percentile) and CISA SSVC lists exploitation as none. A vendor patch is available in the 151.0.7922.72 stable channel release.

Out-of-bounds memory read in Google Chrome's WebRTC component (versions prior to 151.0.7922.72) lets a remote attacker disclose heap memory when a victim opens a crafted HTML page. The flaw is a CWE-122 heap buffer overflow that Chromium itself rated Low severity, with no public exploit identified at time of analysis and an EPSS probability of 0.19% (9th percentile). CISA's SSVC assessment records no observed exploitation and marks the issue as not automatable, though technical impact is rated total.

Remote code execution in Google Chrome desktop versions prior to 151.0.7922.72 allows a remote attacker to run arbitrary code within the browser by luring a victim to a crafted HTML page. The flaw stems from an inappropriate implementation in the Enterprise component and is classed as CWE-94 code injection. No public exploit identified at time of analysis, exploitation requires user interaction (visiting a malicious page), and EPSS risk is low at 0.26% (17th percentile).

Heap corruption via a use-after-free in Google Chrome for iOS (versions prior to 151.0.7922.72) lets a remote attacker potentially corrupt memory when a victim opens a crafted HTML page, with the CVSS 8.8 vector modeling full confidentiality, integrity, and availability loss. Google reported it internally and Chromium rated the security severity as Low; there is no public exploit identified at time of analysis, EPSS is low at 0.21% (11th percentile), and SSVC records exploitation status as none.

Heap corruption in Google Chrome's Views UI framework on Linux affects all versions prior to 151.0.7922.72, where a remote attacker can leverage a use-after-free by luring a victim to a crafted HTML page. Because exploitation requires the user to visit malicious content (UI:R), it is not fully automatable, and there is no public exploit identified at time of analysis; EPSS estimates only a 0.18% exploitation probability (8th percentile) and SSVC records exploitation status as none. Chromium rated the underlying issue Medium severity, though the CVSS base score is 8.8 due to high confidentiality, integrity, and availability impact if successfully exploited.

Remote code execution in Google Chrome on macOS prior to 151.0.7922.72 stems from an inappropriate implementation in the Safe Browsing component, where a remote attacker can trigger arbitrary code execution by luring a victim into opening or downloading a malicious file. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) requires no privileges but does require user interaction, and Google has shipped a fixed Stable channel build. Despite the 8.8 CVSS, Chromium rated the underlying issue Low severity, EPSS is only 0.20% (10th percentile), and there is no public exploit identified at time of analysis.

Sandboxed remote code execution in Google Chrome desktop before 151.0.7922.72 lets a remote attacker run arbitrary code within the renderer sandbox when a victim opens a crafted HTML page. The flaw stems from an inappropriate implementation in Chrome's Scheduling component; Google rated it Chromium-Low severity and no public exploit has been identified, though the NVD CVSS of 8.8 reflects the high per-system impact once triggered. Exploitation requires user interaction (visiting a malicious page) and, because code executes inside the sandbox rather than escaping it, real-world impact is constrained absent a chained sandbox-escape bug.

Privilege escalation in Google Chrome's DevTools component (all desktop builds prior to 151.0.7922.72) lets a malicious browser extension bypass DevTools policy enforcement to gain capabilities beyond its declared permissions. Exploitation is not remote-in-a-vacuum: an attacker must first convince a victim to install a crafted extension, after which the flaw escalates that extension's effective privileges within the browser. Google fixed the issue in the stable channel and rated the Chromium security severity as Low; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Remote code execution in Google Chrome's Sync component (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code within the renderer sandbox when a victim visits a crafted HTML page. The flaw is a CWE-416 use-after-free reported internally by the Chrome team; it carries a CVSS 8.8 but Chromium rated the security severity as Low, and code execution is confined to the sandbox rather than the host OS. No public exploit has been identified at time of analysis, and EPSS is low at 0.21% (12th percentile).

Arbitrary code execution within the renderer sandbox in Google Chrome's V8 JavaScript engine affects all desktop versions prior to 151.0.7922.72, triggered when a victim installs a crafted malicious Chrome extension that exploits a use-after-free memory-corruption bug. Google fixed this in the July 2026 Stable channel update, and no public exploit identified at time of analysis; EPSS is low at 0.13% (3rd percentile), consistent with Chromium's own 'Low' security-severity rating despite the CVSS base score of 8.8.

Remote code execution within the browser's renderer sandbox affects Google Chrome desktop builds prior to 151.0.7922.72, stemming from an inappropriate implementation in the Passwords component (CWE-269). A remote attacker who lures a victim to a crafted HTML page can execute arbitrary code, but execution is confined to the sandbox - which is why Chromium rated the underlying issue Low severity despite the CVSS 8.8. No public exploit identified at time of analysis, and the fix is already shipping in the Stable channel.

Arbitrary code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) is possible when a user is convinced to install a malicious Chrome extension that triggers a type-confusion condition (CWE-843), letting the attacker run code inside the renderer sandbox. Google has shipped a fixed stable build, and while the Chromium team rated the security severity as Low, the CVSS base score is 7.5 due to full confidentiality, integrity, and availability impact on the compromised process. There is no public exploit identified at time of analysis and CISA SSVC marks exploitation as 'none.'

Sandbox-constrained arbitrary code execution in Google Chrome's V8 JavaScript engine affects all desktop builds prior to 151.0.7922.72, where a crafted Chrome extension abuses an inappropriate V8 implementation to run attacker code inside the renderer sandbox. Exploitation requires convincing a user to install a malicious extension, and Google internally rated the Chromium security severity as Low. There is no public exploit identified at time of analysis and CISA SSVC records exploitation status as 'none'.

Sandboxed remote code execution in Google Chrome's DevTools component (versions prior to 151.0.7922.72) lets a remote attacker run arbitrary code within the renderer sandbox when a victim opens a crafted HTML page. The flaw is a use-after-free (CWE-416) rated Medium by Chromium; no public exploit has been identified and EPSS estimates only a 0.27% exploitation probability, indicating low near-term likelihood despite the high CVSS base score. Critically, code execution is confined to the sandbox and does not by itself constitute a full host compromise.

Sandboxed arbitrary code execution in Google Chrome's DevTools component affects all desktop builds prior to 151.0.7922.72, where a use-after-free (CWE-416) can be triggered by a crafted Chrome Extension. An attacker must first convince the victim to install a malicious extension, after which they can run code confined to the browser sandbox. Chromium rated this Low severity; no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.13%, 3rd percentile).

Privilege escalation in Google Chrome desktop versions prior to 151.0.7922.72 allows a remote attacker who has already compromised the renderer process to escape its intended privilege boundary through insufficient policy enforcement in the Settings component, using a crafted HTML page. Chromium rated the security severity as Low, and there is no public exploit identified at time of analysis. The vulnerability is a second-stage flaw: it presumes a prior renderer compromise, so it is not directly exploitable against a fully intact browser.

Privilege escalation in Google Chrome's Extensions component before 151.0.7922.72 lets an attacker who has already compromised the renderer process break out of that sandbox context by serving a crafted HTML page. Chromium rated the underlying issue Low severity, and there is no public exploit identified at time of analysis, though the fix ships in the July 2026 Stable channel desktop update. The bug stems from insufficient validation of untrusted input (CWE-20) crossing the extensions trust boundary.

Privilege escalation in Google Chrome Enterprise on macOS allows a local attacker with physical device access to bypass enterprise policy controls and gain elevated privileges. Affected are all Chrome versions prior to 151.0.7922.72 in managed Enterprise deployments on Mac. The attack requires physical presence at the target device, substantially limiting the threat surface, though the confidentiality, integrity, and availability impact is rated high once exploited. No public exploit identified at time of analysis.

Memory disclosure in Google Chrome's WebXR implementation allows remote attackers to read sensitive data from process memory by directing a victim to a crafted HTML page. Affected versions are all Chrome releases prior to 151.0.7922.72 on desktop platforms. No public exploit code has been identified at time of analysis, and SSVC assessment indicates no current exploitation activity, making this a moderate-priority patching item despite the High confidentiality impact in the CVSS score.

Insufficient policy enforcement in Google Chrome for iOS prior to version 151.0.7922.72 enables a remote attacker to bypass discretionary access controls (CWE-284) by delivering a crafted HTML page to a victim, resulting in high integrity impact with no confidentiality or availability consequence. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network reachability with no attacker privileges needed, though user interaction is required. With EPSS at 0.18% (8th percentile), SSVC exploitation classified as none, and no public exploit identified at time of analysis, real-world mass exploitation risk is low despite the meaningful integrity bypass potential on a widely-used mobile browser.

Navigation restriction bypass in Google Chrome prior to 151.0.7922.72 enables a remote attacker who has already compromised the renderer process to circumvent navigation controls via a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) records high integrity impact with no confidentiality or availability loss, reflecting the attacker's ability to redirect or manipulate navigation to otherwise restricted contexts. No public exploit identified at time of analysis; the EPSS score of 0.18% (8th percentile) and Chromium's own internal severity rating of Low collectively indicate minimal real-world exploitation probability despite the Medium NVD score.

Navigation restriction bypass in Google Chrome Enterprise (versions prior to 151.0.7922.72) enables a remote attacker to circumvent administrator-configured policy controls by supplying a crafted domain name, fully defeating enterprise navigation enforcement with high integrity impact. The vulnerability is Enterprise-specific, requiring user interaction to trigger (UI:R), and is limited to deployments using Chrome managed policies for domain-level access control. No public exploit has been identified at time of analysis, and no active exploitation is confirmed; EPSS is 0.17% (7th percentile) and SSVC rates exploitation as none, consistent with low urgency despite the CVSS 6.5 Medium score.

Navigation restriction bypass in Google Chrome's DevTools component (versions prior to 151.0.7922.72) enables remote attackers to circumvent Chrome's browsing navigation policies via a crafted HTML page. Exploitation requires convincing a victim to perform specific UI gestures, confining the attack surface to social engineering scenarios. The Chromium team internally rates this Low severity; the CVSS 6.5 score reflects the high integrity impact of policy bypass if interaction is achieved, but EPSS at 0.18% (8th percentile) and no KEV listing confirm low real-world exploitation probability. No public exploit or POC has been identified at time of analysis.

Navigation restriction bypass in Google Chrome's DevTools component prior to version 151.0.7922.72 allows a remote attacker to subvert browser navigation controls by delivering a malicious file that triggers insufficient input validation. Exploitation requires user interaction (opening the crafted file), limits opportunistic mass exploitation, and impact is confined to high integrity loss with no confidentiality or availability effects. No active exploitation is confirmed - EPSS stands at 0.17% (7th percentile), and no CISA KEV listing is present - indicating low observed threat activity at time of analysis.

Navigation restriction bypass in Google Chrome DevTools (all versions prior to 151.0.7922.72) enables a remote attacker to circumvent navigation security controls by directing a user to a crafted HTML page. The flaw stems from an inappropriate implementation within the DevTools component (CWE-693, Protection Mechanism Failure), resulting in high integrity impact with no confidentiality or availability exposure. No public exploit has been identified at time of analysis; EPSS at 0.18% (8th percentile) and SSVC Exploitation status of none collectively indicate low near-term exploitation probability.

Navigation restriction bypass in Google Chrome's DevTools component (all versions prior to 151.0.7922.72) permits remote attackers to circumvent browser navigation controls when a user is socially engineered into performing specific UI gestures on a crafted HTML page. Despite a CVSS integrity impact of High, the Chromium team internally classifies this as Low severity - a meaningful signal that real-world exploitability is more constrained than the base score implies. No public exploit code or active exploitation has been identified (EPSS: 0.18%, 8th percentile), and a vendor-released patch is available in Chrome 151.0.7922.72.

Memory disclosure in Google Chrome's Dawn WebGPU component (prior to 151.0.7922.72) enables an attacker who has already obtained code execution in the renderer process to read sensitive data from process memory via a crafted HTML page. This is a second-stage, chained vulnerability - not a standalone exploit - requiring a prior, separate renderer compromise before this flaw is reachable. Chromium's own severity rating is Low, consistent with the EPSS score of 0.19% and SSVC classification of no active exploitation and partial technical impact; no public exploit or KEV listing exists.

Navigation restriction bypass in Google Chrome for Android (via WebView) prior to version 151.0.7922.72 enables a remote attacker to circumvent enforced browsing policies using a crafted HTML page, achieving high integrity impact with no privileges required. The flaw resides specifically in WebView's policy enforcement layer, meaning Android applications that embed Chrome WebView and rely on its navigation restriction mechanisms for security enforcement are also at risk. No public exploit has been identified at time of analysis and EPSS stands at 0.18% (8th percentile), though the vendor has confirmed a patch and the Chromium team internally rated this Low severity - lower than the NVD CVSS 6.5 Medium assignment.

Uninitialized memory access in Google Chrome's WebXR implementation on Android exposes potentially sensitive browser process memory contents to remote attackers who can direct a victim to a crafted HTML page. All Chrome for Android versions prior to 151.0.7922.72 are affected by this information disclosure weakness (CWE-457). No public exploit identified at time of analysis and SSVC confirms no active exploitation, placing this in routine patch-cycle priority despite the high confidentiality impact rating in the CVSS base score.

Information disclosure in Google Chrome's Views UI framework on macOS prior to version 151.0.7922.72 exposes potentially sensitive data from browser process memory to local attackers. The flaw is triggered by an inappropriate implementation in the Views rendering layer, reachable via a specially crafted HTML page. No public exploit code exists and the EPSS score sits at the 2nd percentile, indicating very low observed exploitation probability; Chrome's own severity rating of 'Low' is consistent with the local-only attack vector and read-only confidentiality impact.

Universal Cross-Site Scripting (UXSS) in Google Chrome's Blink rendering engine prior to version 151.0.7922.72 enables remote attackers to inject arbitrary scripts or HTML that execute across origin boundaries via a crafted HTML page. Unlike conventional XSS constrained to a single origin, this flaw bypasses the Same-Origin Policy enforced by Blink, potentially allowing script execution in the context of unrelated sites visited by the victim. No active exploitation is confirmed (absent from CISA KEV), EPSS exploitation probability is 0.17% (7th percentile), and the vendor itself classifies this as Low severity - all signals converging on low current real-world risk.

Sandbox escape in Google Chrome DevTools prior to version 151.0.7922.72 requires a pre-compromised renderer process and user interaction with a crafted HTML page to break out of the browser sandbox. The root cause is insufficient input validation (CWE-20) in the DevTools component, where attacker-controlled input from the renderer is not properly sanitized before being processed. No public exploit code or CISA KEV listing is present at time of analysis; EPSS is 0.18%, indicating low observed exploitation pressure despite the meaningful impact of a successful sandbox escape.

Sandbox escape in Google Chrome's ANGLE graphics layer on Android enables an attacker who has already compromised the renderer process to break out of the Chrome sandbox via a crafted HTML page. Affected versions are all Chrome for Android releases prior to 151.0.7922.72. This is a second-stage exploit primitive requiring a prior renderer compromise; no public exploit code exists and SSVC reports exploitation as none, keeping real-world risk moderate despite the scope-change nature of the flaw.

Sandbox escape in Google Chrome's Updater component on macOS (versions prior to 151.0.7922.72) enables a remote attacker who has already compromised the renderer process to break out of Chrome's security boundary via a crafted HTML page. The CVSS scope-change metric (S:C) confirms the exploit elevates impact beyond the sandboxed renderer into a higher-privilege Updater context. No public exploit code has been identified and EPSS stands at 0.18% (8th percentile), reflecting the high prerequisite barrier of requiring prior renderer compromise; however, the Mac-specific Updater's elevated privilege position makes this a meaningful chained-exploit risk in targeted macOS campaigns.

Sandbox escape in Google Chrome's Bluetooth component (all versions prior to 151.0.7922.72) allows an attacker who has already compromised the renderer process to break out of Chrome's sandbox by sending crafted Bluetooth IPC messages triggered via a malicious HTML page. This is a second-stage, chained exploit - not a standalone remote attack - requiring prior renderer compromise as a hard prerequisite, which is why Chromium rates it Low severity internally despite the sandbox escape classification. No public exploit code or CISA KEV listing has been identified; EPSS of 0.17% at the 7th percentile reflects low exploitation probability consistent with the high attack chain complexity.

Sandbox escape in Google Chrome's Printing component on Windows enables a remote attacker who has already compromised the renderer process to break out of Chrome's sandbox via a crafted HTML page. Affected versions are all Chrome releases prior to 151.0.7922.72 on Windows. No public exploit has been identified, EPSS sits at the 7th percentile (0.17%), CISA SSVC rates exploitation as none and the attack as non-automatable, making this a low-urgency patching item despite the sandbox-escape classification.

Use-after-free in Chrome's DataTransfer component on Windows exposes process memory to local attackers who can deliver a crafted HTML page to a victim. The flaw affects all Chrome versions on Windows prior to 151.0.7922.72 and results in high-confidence confidentiality loss with no integrity or availability impact. No public exploit code has been identified and EPSS sits at 0.11% (2nd percentile), consistent with CISA SSVC classifying exploitation as 'none' and technical impact as 'partial' - making this a low operational priority despite the High confidentiality CVSS sub-score.

Insufficient policy enforcement in the Chromecast component of Google Chrome prior to 151.0.7922.72 enables an adjacent-network attacker to inject malicious scripts or HTML into a privileged browser page by sending crafted network traffic on the local network segment. The flaw is classified CWE-79 (Cross-Site Scripting), meaning attacker-controlled content executes in a privileged Chrome page context without requiring authentication or victim interaction. No public exploit code has been identified and EPSS is extremely low at 0.11% (2nd percentile), consistent with Chromium's own Low severity rating; a vendor patch is available.

UI spoofing in Google Chrome for iOS (versions prior to 151.0.7922.72) enables remote attackers to misrepresent browser interface elements through specially crafted HTML pages, potentially deceiving users into disclosing information or taking unintended actions. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network-deliverable exploitation requiring only user interaction with no attacker privileges needed. EPSS at 0.21% (11th percentile), no CISA KEV listing, and Chromium's own internal 'Low' severity rating all converge on low real-world exploitation pressure; no public exploit identified at time of analysis.

UI spoofing in Google Chrome's WebView component on Android (versions prior to 151.0.7922.72) allows a remote attacker to mislead users about the origin or security context of displayed content via a crafted HTML page. Classified by Chromium as Low severity and rooted in CWE-451 (UI Misrepresentation of Critical Information), this flaw could be leveraged to facilitate phishing or social engineering by making malicious content visually indistinguishable from trusted interfaces. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), indicating this is a routine patch-cycle issue rather than an active threat.

Cross-origin data leakage in Google Chrome's Isolated Web Apps (IWA) feature, versions prior to 151.0.7922.72, enables remote attackers to exfiltrate data across origin boundaries via crafted network traffic, contingent on user interaction. With an EPSS of 0.16% (6th percentile), no CISA KEV listing, and Chromium's own 'Low' severity classification, real-world exploitation risk is constrained despite the network-accessible vector. No public exploit has been identified at time of analysis, and impact is limited to partial confidentiality loss with no integrity or availability consequence.

Side-channel information leakage in Chrome's Skia graphics engine allows remote attackers to read potentially sensitive data from browser process memory by delivering a crafted HTML page to an unpatched user. Affected versions span all Google Chrome releases prior to 151.0.7922.72. No public exploit code exists and EPSS sits at 0.17% (7th percentile), but the high confidentiality impact (C:H) combined with Chrome's ubiquitous deployment warrants timely patching despite the low current exploitation signals.

Cross-origin data leakage in Google Chrome's DataTransfer API implementation (prior to 151.0.7922.72) allows a remote unauthenticated attacker to read sensitive data from a different origin when a victim performs specific UI gestures - such as drag-and-drop interactions - on a crafted HTML page. The vulnerability is rated CVSS 4.3 (Medium) with an EPSS probability of just 0.18% (8th percentile), indicating very low observed exploitation activity. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but Chrome's widespread deployment makes even medium-severity browser flaws worth prioritizing for rapid patching.

Cross-origin data leakage in Google Chrome prior to 151.0.7922.72 is achievable by remote unauthenticated attackers who can lure a victim to a crafted HTML page that abuses an inappropriate implementation in Chrome's Opaque Response Blocking (ORB) mechanism. ORB is specifically designed to prevent unauthorized cross-origin reads; this flaw undermines that protection, allowing an attacker's page to read data belonging to a different origin in violation of the same-origin policy. EPSS is 0.18% (8th percentile), SSVC classifies exploitation as none, and no active exploitation or public exploit code has been identified at time of analysis.

Cross-origin data leakage in the Enterprise policy implementation of Google Chrome on Windows (versions prior to 151.0.7922.72) enables a remote attacker to extract data across origin boundaries by delivering a malicious file to a victim user. The CWE-346 (Origin Validation Error) root cause indicates Chrome's Enterprise component fails to enforce same-origin boundaries in this specific code path, exposing data that should be restricted. No public exploit has been identified and EPSS sits at the 6th percentile, with CISA SSVC confirming no current exploitation; this is a low-urgency but real information disclosure risk for enterprise Chrome deployments on Windows.

Navigation restriction bypass in Google Chrome for Android (prior to 151.0.7922.72) stems from insufficient input validation in the Sharing component, enabling a remote attacker to circumvent Chrome's navigation controls via malicious network traffic when a user interacts with the Share feature. The flaw yields limited integrity impact only - no confidentiality or availability compromise - consistent with Chromium's own 'Low' severity classification and an EPSS of 0.17% (7th percentile). No public exploit code exists and no active exploitation has been confirmed; a vendor-released patch is available.

Cross-origin data leakage in Google Chrome for Android (prior to 151.0.7922.72) stems from insufficient policy enforcement in the NFC subsystem, enabling a remote attacker to read data across origin boundaries. An unauthenticated attacker (per PR:N in the CVSS vector) can serve a crafted HTML page that, when visited by a target on Android Chrome, bypasses same-origin policy checks tied to NFC API handling, resulting in limited confidentiality disclosure. No active exploitation has been identified at time of analysis, EPSS sits at 0.17% (7th percentile), and Chromium itself rates this Low severity - placing real-world risk well below its nominal network-accessible footprint.

SurfaceCapture in Google Chrome prior to 151.0.7922.72 leaks cross-origin data to remote attackers through a crafted HTML page, violating browser same-origin isolation. The flaw is classified as CWE-346 (Origin Validation Error), meaning the SurfaceCapture subsystem fails to properly enforce origin boundaries, allowing data from one origin to be read by another. No public exploit code has been identified at time of analysis, and CISA SSVC assessment confirms no active exploitation.

Side-channel information leakage in Google Chrome's Network component prior to version 151.0.7922.72 enables remote attackers to infer cross-origin data by directing users to a crafted HTML page, violating Same-Origin Policy boundaries at the side-channel layer. The Chromium team rated this Low severity internally; with no public exploit code and no CISA KEV listing, the EPSS score of 0.17% (7th percentile) confirms that near-term mass exploitation is highly unlikely. The impact is limited to partial confidentiality loss (C:L) with no integrity or availability consequences, making this a low-urgency patch for most environments, though higher priority in privacy-sensitive or intelligence-adjacent deployments.

Cross-origin data leakage in Google Chrome for Android (prior to 151.0.7922.72) stems from insufficient policy enforcement in the browser's Web NFC API, classified under CWE-346 (Origin Validation Error). A remote attacker can serve a crafted HTML page that - when visited by a victim on an Android device - causes Chrome to violate its cross-origin isolation policy via the NFC subsystem, exposing cross-origin data to the attacker-controlled page. No public exploit has been identified at time of analysis; EPSS is 0.17% (7th percentile) and CISA SSVC rates exploitation as none, confirming low real-world urgency despite the network-accessible vector.

Cross-origin data leakage in Google Chrome versions prior to 151.0.7922.72 stems from insufficient policy enforcement in the SVG rendering engine, allowing remote attackers to read data across origin boundaries by enticing a victim to visit a crafted HTML page. The CVSS vector (PR:N, UI:R) confirms unauthenticated exploitation but mandates active user interaction, constraining mass exploitation. No public exploit has been identified at time of analysis; EPSS stands at 0.17% (7th percentile) and SSVC signals exploitation status of none, placing this firmly in routine-patch priority.

Navigation restriction bypass in Google Chrome for iOS (prior to 151.0.7922.72) enables a remote attacker to redirect users to unintended URLs via a crafted HTML page, exploiting a CWE-601 open redirect condition. The Chromium team rated this Low severity, consistent with the CVSS 4.3 score and the limited integrity-only impact (no confidentiality or availability consequences). No public exploit identified at time of analysis, and the EPSS score of 0.18% (8th percentile) reflects minimal exploitation interest from the threat actor community.

Same-origin policy bypass in the Cast component of Google Chrome on Android prior to 151.0.7922.72 allows a remote, unauthenticated attacker to perform cross-origin write operations by luring a user to a crafted HTML page. The vulnerability stems from an origin validation error (CWE-346) in Chrome's Cast media-streaming feature, exclusive to the Android platform. No active exploitation has been confirmed (not in CISA KEV), and EPSS at 0.18% (8th percentile) reflects low real-world exploitation probability consistent with the vendor's own 'Low' Chromium severity rating.

DevTools policy enforcement failure in Google Chrome prior to 151.0.7922.72 enables cross-origin data leakage through a malicious Chrome Extension that a victim is socially engineered into installing. The vulnerability is classified as information disclosure only (C:L/I:N/A:N), requires active user participation to exploit, and carries Chromium's lowest internal severity rating. No public exploit code exists and no active exploitation has been identified; EPSS places this at the 2nd percentile, and SSVC confirms exploitation status as none with non-automatable delivery.

Cross-origin data leakage in Google Chrome prior to 151.0.7922.72 allows remote attackers to read sensitive data from other origins by luring a victim to a crafted HTML page that abuses an inappropriate implementation in the DataTransfer API. The impact is limited to partial confidentiality loss (C:L) with no integrity or availability effects, and Chromium's own security team rated this Low severity. No public exploit code or active exploitation has been identified at time of analysis; EPSS probability of exploitation is very low at 0.17% (7th percentile).

Cross-origin data leakage in Google Chrome's DOMStorage component (versions prior to 151.0.7922.72) permits a remote attacker to read storage data belonging to a different origin by luring a victim to a crafted HTML page. The flaw is rooted in an origin validation error (CWE-346) within the DOMStorage subsystem, violating same-origin policy enforcement. EPSS is very low at 0.17% (7th percentile), no active exploitation is confirmed, and Chromium itself rates this Low severity, placing this in the lower tier of browser security issues despite its network-reachable attack surface.

Navigation restriction bypass in Google Chrome's DevTools component (all versions prior to 151.0.7922.72) enables a remote attacker to circumvent browser navigation controls by delivering a crafted HTML page that exploits insufficient input validation. The CVSS vector (PR:N, UI:R) confirms unauthenticated exploitation contingent on user interaction, with impact limited strictly to integrity. No public exploit has been identified, EPSS sits at 0.22% (13th percentile), and Chromium's own team rated this Low severity - signals that collectively place this well below emergency response thresholds. Vendor-released patch is available in Chrome 151.0.7922.72.

Navigation restriction bypass in Google Chrome's DevTools component affects all versions prior to 151.0.7922.72, allowing a remote unauthenticated attacker to circumvent navigation controls by delivering a crafted HTML page to an unsuspecting user. The root cause is improper input validation (CWE-20) within DevTools, with impact limited to integrity (I:L) and no confidentiality or availability consequence. No public exploit exists and no CISA KEV listing is present; EPSS of 0.18% (8th percentile) and Chromium's own Low severity rating together indicate minimal real-world exploitation risk.

UI spoofing in Google Chrome for Android prior to version 151.0.7922.72 stems from an inappropriate FullScreen API implementation that allows remote attackers to deceive users with a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms this is network-accessible without authentication but requires user interaction with a malicious page. With an EPSS of 0.21% at the 11th percentile, no CISA KEV listing, and Chromium's own 'Low' severity designation, real-world exploitation interest is minimal and no public exploit code has been identified at time of analysis.

UI spoofing in Google Chrome's Passwords component before version 151.0.7922.72 allows remote attackers to manipulate credential-related UI elements via malicious network traffic, exploiting insufficient input validation in the password manager subsystem. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-reachable without authentication but requires user interaction, limiting automated mass exploitation. With an EPSS of 0.16% (6th percentile), no KEV listing, and no known POC, real-world exploitation risk is low despite the ubiquitous deployment footprint of Chrome.

Omnibox (URL bar) spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to display misleading URL content to a victim by serving a crafted HTML page, undermining the browser's fundamental trust signal. The flaw is iOS-specific and classified by Google as low severity (Chromium severity: Low), with EPSS at 0.21% and SSVC exploitation status of none, indicating no public exploitation at time of analysis. No public exploit code exists; the primary risk is phishing and credential harvesting against users who rely on the Omnibox to authenticate site identity.

Side-channel information leakage in Google Chrome's SVG rendering engine prior to version 151.0.7922.72 allows a remote attacker to infer cross-origin data by luring a user to a crafted HTML page. Rooted in CWE-1300 (Improper Protection of Physical Side Channels), the flaw violates the browser's same-origin policy isolation by exposing measurable signals during SVG processing that reveal data from a separate origin. No public exploit has been identified, SSVC confirms exploitation status of none, and EPSS sits at 0.17% (7th percentile), placing real-world priority firmly in the low tier for most environments.

Content Security Policy bypass in Google Chrome's HTML parser (versions prior to 151.0.7922.72) allows a remote, unauthenticated attacker to neutralize CSP protections by serving a crafted HTML page to a victim who visits it. The vulnerability stems from an inappropriate implementation in the parser component (CWE-693, Protection Mechanism Failure), earning a Chromium internal severity of Low and a CVSS base score of 4.3. No active exploitation is confirmed - CISA KEV is not listed, EPSS sits at 0.18% (8th percentile), and SSVC assesses exploitation status as none - making this a low-priority finding for most organizations despite Chrome's ubiquitous deployment footprint.

Navigation restriction bypass in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to serve a crafted HTML page that circumvents the browser's navigation controls, resulting in limited integrity impact. The flaw is confined to Chrome's iOS-specific implementation layer (CWE-284: Improper Access Control) and is not present in Chrome on other platforms. No public exploit code has been identified at time of analysis, and EPSS exploitation probability is very low at 0.18% (8th percentile), consistent with SSVC's 'exploitation: none' determination.

UI spoofing in Google Chrome's Navigation component prior to version 151.0.7922.72 enables an attacker who has already compromised the renderer process to manipulate browser UI elements via crafted HTML pages. The Chromium team assigned Low internal severity, consistent with a CVSS score of 4.3, EPSS at the 7th percentile (0.17%), and SSVC exploitation status of 'none'. No public exploit code or active exploitation has been identified, and the vulnerability is only meaningful as a second-stage element in a multi-vulnerability attack chain.

Uninitialized GPU memory use in Google Chrome on Android prior to 151.0.7922.72 enables remote attackers to leak cross-origin data by luring victims to a crafted HTML page. The flaw is confined to the Android build of Chrome and results in limited confidentiality exposure with no integrity or availability impact. No public exploit code or active exploitation has been identified; EPSS stands at a very low 0.19%, and Chromium itself rated the issue 'Low' severity.

Cross-origin data leakage in Google Chrome's MHTML parser prior to version 151.0.7922.72 enables remote attackers to read data from origins they should not have access to, violating the Same-Origin Policy. The vulnerability requires user interaction - a victim must open a crafted MHTML page - and produces a limited confidentiality impact with no integrity or availability exposure. No public exploit code exists and no active exploitation has been identified; EPSS of 0.17% (7th percentile) and Chromium's own 'Low' severity rating confirm this is a low-urgency finding despite broad product deployment.

UI spoofing in Google Chrome's Payments component (versions prior to 151.0.7922.72) permits remote attackers to deceive users by rendering fraudulent payment-related interface elements through a specially crafted HTML page. The flaw carries a CVSS score of 4.3 and Chromium's own 'Low' severity rating, consistent with EPSS at 0.17% (7th percentile), signaling negligible real-world exploitation probability. No public exploit code exists and the vulnerability is absent from CISA's KEV catalog; Google has issued a patch in stable channel version 151.0.7922.72.

UI spoofing in Google Chrome's Views component (prior to 151.0.7922.72) enables a remote unauthenticated attacker to deceive a victim about browser UI state or page origin by serving a crafted HTML page that triggers CWE-451 misrepresentation of critical interface elements. The CVSS vector (PR:N/UI:R) confirms the attack requires no authentication but does require the victim to visit the attacker-controlled page, limiting automated mass exploitation. No public exploit exists and SSVC rates current exploitation as none, with EPSS at only 0.17% (7th percentile), consistent with a low-severity, user-interaction-dependent flaw.

Cross-origin data leakage in Google Chrome's network layer prior to version 151.0.7922.72 enables remote attackers to read sensitive cross-origin data by luring a victim to a crafted HTML page. Rooted in an inappropriate network implementation (CWE-346, Origin Validation Error), the flaw breaks the browser's cross-origin boundary enforcement without requiring any attacker authentication. No public exploit has been identified at time of analysis; EPSS places exploitation probability at 0.17% (7th percentile), and SSVC confirms no active exploitation, making this a low-urgency but valid information disclosure risk given Chrome's ubiquitous deployment.

No-referrer policy bypass in Google Chrome for iOS prior to 151.0.7922.72 allows a remote, unauthenticated attacker to exfiltrate origin page URL information that the site operator explicitly suppressed via the Referrer-Policy header. Exploitation requires luring a victim to a crafted HTML page, classifying this as a social-engineering-dependent, low-severity integrity/confidentiality boundary failure. No active exploitation is confirmed (not in CISA KEV), EPSS sits at the 8th percentile (0.18%), and SSVC rates technical impact as only partial - signaling a low operational priority despite the network attack vector.

Navigation restriction bypass in Google Chrome on Android (prior to 151.0.7922.72) enables remote unauthenticated attackers to circumvent session-based navigation controls by inducing a victim to load a crafted HTML page. The root cause is an improper access control implementation (CWE-284) specific to Chrome's Session component on the Android platform. No public exploit has been identified at time of analysis, and CISA's SSVC framework rates exploitation as none with only partial technical impact, consistent with the low EPSS score of 0.18%.

Cross-origin data leakage in Google Chrome's SVG implementation affects all versions prior to 151.0.7922.72, exploitable by a remote attacker who can convince a user to visit a crafted HTML page. The flaw violates the browser's Same-Origin Policy via improper SVG origin validation (CWE-346), allowing an attacker's page to infer or extract data belonging to cross-origin resources the victim's browser can reach. No active exploitation has been identified - CISA KEV is absent, SSVC exploitation status is 'none', and EPSS sits at a low 0.17% (7th percentile) - placing real-world urgency in the lower-priority tier despite the network attack vector.

Domain spoofing in Google Chrome on Android (prior to 151.0.7922.72) enables remote unauthenticated attackers to present misleading security UI indicators to users via a crafted HTML page. The flaw stems from CWE-451 - user interface misrepresentation of critical information - where Chrome's Android UI fails to accurately convey the true origin or domain of the page being visited. No public exploit code exists, EPSS sits at 0.17% (7th percentile), and SSVC confirms exploitation status as none, collectively indicating low urgency despite the broad user base.

UI spoofing in Google Chrome for iOS prior to version 151.0.7922.72 enables remote attackers to deceive users by manipulating security indicators through a crafted HTML page. The vulnerability causes incorrect rendering of Chrome's browser-managed security UI elements - such as origin display or HTTPS trust badges - potentially causing victims to mistake malicious pages for legitimate or secure ones. No active exploitation has been confirmed (not in CISA KEV), EPSS at 0.17% (7th percentile) indicates low near-term exploitation probability, and a vendor-released patch is available in version 151.0.7922.72.

Cross-origin data leakage in Google Chrome on Linux (prior to 151.0.7922.72) stems from an inappropriate implementation in the browser's Editing subsystem, enabling a remote attacker to exfiltrate limited cross-origin information when a victim interacts with a crafted HTML page. The CVSS vector (PR:L/UI:R) confirms exploitation requires both some authenticated context and active victim interaction, materially reducing opportunistic risk. No public exploit has been identified and EPSS sits at the 7th percentile, consistent with the vendor's own 'Low' severity classification.

Cross-origin data leakage in Google Chrome's CORS implementation enables a post-exploitation information disclosure step for attackers who have already compromised the renderer process. All Chrome versions prior to 151.0.7922.72 are affected, with exploitation requiring both a pre-existing renderer compromise and user interaction with a crafted HTML page. No public exploit code exists and no CISA KEV listing; EPSS at 0.17% (7th percentile) and SSVC Exploitation: none confirm this is a low-priority, chained-attack-only vulnerability in practice.