Google Chrome Implementation and Policy Flaws

Sandbox escape in Google Chrome desktop before 151.0.7922.72 lets an attacker who has already compromised the renderer process break out to higher-privileged browser context via a crafted HTML page, rooted in insufficient validation of untrusted input in the AI component (CWE-20). NVD rates it CVSS 9.6 while Google labels the Chromium security severity 'Low', reflecting that renderer compromise is a hard prerequisite; there is no public exploit identified at time of analysis and EPSS is low at 0.17%. A vendor patch is available and CISA SSVC records exploitation as none.

Sandbox escape in Google Chrome before 151.0.7922.72 lets an attacker who has already compromised the renderer process break out of the sandbox by feeding a crafted PDF through the Notifications component, which insufficiently validates untrusted input (CWE-20). Full technical impact (SSVC: total) means a successful escape yields code execution outside the constrained renderer. Despite a 9.6 CVSS, Chromium rated this Low severity, EPSS is 0.16%, and there is no public exploit identified at time of analysis.

Sandbox escape in Google Chrome desktop before 151.0.7922.72 lets an attacker who has already compromised the renderer process abuse insufficient input validation in the WebAuthn implementation, using a crafted PDF file to break out of the renderer sandbox and gain higher-privilege code execution. Google's Chrome team reported the flaw internally and rated it 'Low' severity within Chromium, even though NVD scores it 9.6 (Critical); there is no public exploit identified at time of analysis and CISA SSVC lists exploitation status as none. EPSS is very low at 0.16% (6th percentile), consistent with a second-stage bug that requires a pre-existing renderer compromise rather than a directly weaponizable entry point.

Sandbox escape in Google Chrome's Google Lens component (versions prior to 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the browser sandbox using a crafted HTML page. The flaw is a second-stage privilege boundary bypass rather than an initial-access bug: it requires a pre-existing renderer compromise to reach, and Google's own Chromium team rated its security severity as Low despite the 9.6 CVSS. No public exploit identified at time of analysis, and EPSS is very low at 0.16% (6th percentile).

Sandbox escape in Google Chrome on macOS (versions prior to 151.0.7922.72) stems from an inappropriate implementation in the Tint component and lets a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox. Google rated the Chromium severity as Low, though the reported CVSS is 9.6; there is no public exploit identified at time of analysis and the EPSS score is only 0.16% (6th percentile), pointing to low near-term exploitation likelihood. The flaw is Mac-specific and requires user interaction (visiting a malicious page).

Out-of-bounds memory access in Google Chrome's Frame component affects all Desktop builds prior to 151.0.7922.72, letting a remote attacker read memory outside intended bounds when a victim opens a crafted HTML page. Chromium rated the underlying flaw Low severity, yet NVD scores it 8.8 (High) and tags flag potential RCE; there is no public exploit identified at time of analysis and EPSS is a low 0.18% (8th percentile). A vendor patch is available and the issue is not listed in CISA KEV.

Arbitrary code execution in Google Chrome's V8 JavaScript engine allows a remote attacker to run code inside the renderer sandbox when a victim visits a crafted HTML page, affecting all desktop builds prior to 151.0.7922.72. The flaw is a CWE-843 type confusion in V8 and carries a CVSS 8.8 due to network reach and high CIA impact, though execution is confined to the sandbox and Chromium rates the security severity as Low. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but a vendor patch is available.

Remote code execution in Google Chrome's PDFium component (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code - confined to the renderer sandbox - when a victim opens a maliciously crafted PDF. The flaw is a CWE-416 use-after-free reported by Google's own Chrome team and fixed in the July 2026 Stable channel update; Chromium rated its intrinsic severity Low because execution is contained within the sandbox, though NVD's CVSS scores it 8.8. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Memory-corruption remote code execution in Google Chrome's Dawn WebGPU graphics component affects all Desktop builds prior to 151.0.7922.72, where a crafted HTML page triggers a use-after-free (CWE-416) that lets a remote attacker run arbitrary code - though confined inside the renderer sandbox, which is why Chromium rated it Low despite the CVSS 8.8. Exploitation requires only that a victim load a malicious page (UI:R), with no authentication. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV.

Out-of-bounds memory read in the Dawn (WebGPU) component of Google Chrome before 151.0.7922.72 lets a remote attacker read memory outside intended bounds when a victim opens a crafted HTML page. Google's Chrome team reported it and a fixed Stable-channel build is available; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.17%, 7th percentile). Notably, Chromium internally rated the security severity 'Low' even though the NVD-style CVSS base score is 8.1, so real-world impact is likely narrower than the raw score implies.

Remote code execution in Google Chrome's V8 JavaScript engine (all versions prior to 151.0.7922.72) allows a remote attacker who lures a victim to a crafted HTML page to execute arbitrary code, though confined inside the renderer sandbox rather than achieving a full sandbox escape. Google rated the Chromium security severity as Low, and there is no public exploit identified at time of analysis and no evidence of active exploitation (CISA SSVC exploitation status: none). Exploitation hinges on winning a timing race, so despite the 7.5 CVSS score it is regarded as difficult to trigger reliably.

Local privilege escalation in the Google Chrome Updater on Windows (versions prior to 151.0.7922.72) lets a low-privileged local attacker win a race condition and substitute a malicious file to elevate privileges. The flaw carries a CVSS 7.0 score, and while Chromium rates its security severity as Low, the SSVC technical impact is Total. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Navigation restriction bypass in Google Chrome's DevTools component (versions prior to 151.0.7922.72) allows a local attacker to circumvent browser navigation policies via a crafted HTML page. The insufficient policy enforcement within DevTools produces an integrity-high impact (CVSS I:H) without requiring attacker privileges. No public exploit code or CISA KEV listing exists; an EPSS score of 0.12% (2nd percentile) and Google's internal 'Low' Chromium severity rating together confirm this as a low immediate exploitation priority.

Process memory leakage in Google Chrome's IME (Input Method Editor) implementation on macOS allows remote unauthenticated attackers to obtain potentially sensitive data from Chrome's process memory by luring a user to a specially crafted HTML page. The flaw affects all Chrome for Mac versions prior to 151.0.7922.72, is platform-scoped to macOS only, and carries a CVSS 6.5 (Medium) despite Chromium's own 'Low' severity designation. No public exploit code exists and EPSS sits at 0.17% (7th percentile), indicating very low current exploitation probability.

Insufficient policy enforcement in Chrome's Speech component prior to version 151.0.7922.72 enables remote attackers to bypass site isolation - a core security boundary - via a crafted HTML page requiring only user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) signals high integrity impact with no privilege requirement, meaning an unrelated web page can be weaponized as the delivery vehicle. No public exploit code has been identified and EPSS sits at a low 0.18% (8th percentile), consistent with the Chromium team's own 'Low' severity classification despite the NVD medium score; however, the site isolation bypass class of vulnerability is historically sensitive and warrants prompt patching.

Same-origin policy bypass in Google Chrome's Bluetooth subsystem (prior to 151.0.7922.72) can be triggered by an attacker who has already achieved renderer process compromise, using a crafted HTML page to abuse insufficient policy enforcement in the Web Bluetooth layer. The exploit chain requires a pre-existing foothold in the renderer, which limits real-world risk considerably - Chrome's own security team rated this 'Low' severity. No active exploitation has been confirmed (not listed in CISA KEV), and the EPSS score of 0.18% (8th percentile) reflects negligible observed exploitation activity.

Navigation input validation bypass in Google Chrome prior to 151.0.7922.72 enables a renderer-compromised attacker to circumvent navigation restrictions via a crafted HTML page. The flaw is the second stage of a chained attack - exploitation requires a prior renderer process compromise, substantially raising the practical bar for abuse. No public exploit code or active exploitation has been identified; EPSS sits at 0.18% (8th percentile), consistent with its role as a post-exploitation primitive rather than an initial access vector.

Uninitialized memory use in Skia, Chrome's 2D graphics rendering engine, exposes process memory contents to remote attackers on Windows via crafted HTML pages in Google Chrome versions prior to 151.0.7922.72. The flaw is strictly an information disclosure issue (CWE-457), with no integrity or availability impact, affecting only the Windows platform per the vulnerability description. No public exploit code has been identified, EPSS places exploitation probability at 0.19% (9th percentile), and SSVC classifies exploitation as none with partial technical impact - collectively suggesting limited real-world risk despite the CVSS C:H rating.

Domain spoofing in Google Chrome on Android (all versions prior to 151.0.7922.72) results from a race condition in the PictureInPicture component, enabling a remote attacker to misrepresent the origin domain shown to a user when they interact with a crafted HTML page. The integrity impact is limited to the browser UI trust indicator - no code execution or data exfiltration occurs directly - but successful spoofing can be chained with credential phishing against a falsely trusted domain. No active exploitation has been confirmed (not listed in CISA KEV), and the EPSS score of 0.16% at the 6th percentile reflects very low exploitation probability, consistent with Chromium's own 'Low' severity classification.

Process memory disclosure in Google Chrome's WebGL implementation allows a remote attacker to read potentially sensitive data from the browser's memory by luring a user to a specially crafted HTML page. Affected versions are all Chrome releases prior to 151.0.7922.72 across desktop platforms. No public exploit code has been identified and EPSS sits at 0.16% (6th percentile), indicating low real-world exploitation probability despite the High confidentiality rating in the CVSS vector.

Information disclosure in Google Chrome's WebXR subsystem prior to version 151.0.7922.72 allows unauthenticated remote attackers to read potentially sensitive process memory contents by luring a victim to a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) indicates a network-accessible, low-complexity path to high confidentiality impact, though Chromium's internal severity rating of Low and an EPSS of 0.16% (6th percentile) reflect limited real-world exploitation risk. No public exploit code exists and CISA SSVC rates exploitation as none, making this a watch-and-patch item rather than an emergency response trigger.

Navigation restriction bypass in Google Chrome DevTools prior to version 151.0.7922.72 enables remote attackers to circumvent browser navigation controls by luring a user into opening a specially crafted malicious file. The flaw stems from CWE-20 insufficient input validation within the DevTools component, resulting in high integrity impact per CVSS. No public exploit has been identified and EPSS exploitation probability is very low at 0.16% (6th percentile); notably, the Chromium security team internally rated this 'Low' severity despite the medium NVD CVSS score of 6.5.

Navigation restriction bypass in Google Chrome on macOS (versions prior to 151.0.7922.72) permits a local attacker to circumvent the browser's navigation controls by delivering a crafted malicious file. The CVSS vector (AV:L/I:H) confirms the impact is limited to integrity - an attacker who achieves local access can subvert Chrome's navigation security model without requiring elevated privileges or user interaction beyond obtaining local system access. With an EPSS score of 0.10% (1st percentile), no CISA KEV listing, and Chromium's own classification of Low severity, real-world exploitation risk is low despite the 6.2 CVSS base score.

Information disclosure in the Views UI component of Google Chrome on macOS allows a local attacker to read potentially sensitive data from browser process memory by inducing a user to open a crafted HTML page on versions prior to 151.0.7922.72. The flaw is Mac-platform-specific, categorized by Chromium itself as Low severity, and carries no integrity or availability impact. No public exploit exists and no active exploitation has been identified; EPSS probability sits at 0.11% (2nd percentile) and CISA SSVC classifies exploitation as none.

Side-channel memory leakage in Chrome's WebCodecs API prior to version 151.0.7922.72 enables a remote, unauthenticated attacker to extract potentially sensitive data from the browser's process memory by luring a victim to a crafted HTML page. The vulnerability stems from improper protection of physical side-channels (CWE-1300) within the WebCodecs media processing subsystem. No active exploitation has been identified - SSVC rates exploitation as none and EPSS places this in the 7th percentile - but the high confidentiality impact score reflects that successful exploitation could expose in-memory session data or other sensitive content.

UI spoofing in Google Chrome's Passwords component allows an attacker occupying a privileged network position (man-in-the-middle) to manipulate password-related interface elements via malicious network traffic. All Chrome releases prior to 151.0.7922.72 on desktop are affected. Exploitation requires both a privileged network position and user interaction, substantially constraining real-world risk; no public exploit code exists and EPSS sits at the 2nd percentile, consistent with no observed exploitation in the wild.

UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote, unauthenticated attacker to misrepresent security-critical interface elements - such as the address bar or origin indicators - by serving a crafted HTML page to a victim. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-delivered and requires no privileges, but does require the user to interact with the malicious page, limiting its reach. No public exploit or active exploitation has been identified; EPSS at 0.17% (7th percentile) and SSVC exploitation status of 'none' collectively indicate low real-world risk at this time.

Insufficient policy enforcement in the Extensions subsystem of Google Chrome prior to 151.0.7922.72 allows an attacker to bypass discretionary access controls by deploying a malicious extension that uses a specially crafted domain name. The attack is fully dependent on social engineering - the victim must be convinced to install the malicious extension, which significantly constrains opportunistic exploitation. With a CVSS score of 4.3, EPSS at 0.12% (2nd percentile), no CISA KEV listing, and a 'Low' Chromium-internal severity rating, no public exploit identified at time of analysis, this represents a minimal real-world priority for most organizations, particularly those with enterprise extension management controls in place.

Cross-origin data leakage in Google Chrome prior to 151.0.7922.72 is achievable through a CSS policy bypass, enabling remote unauthenticated attackers to exfiltrate data across origin boundaries when a victim visits a crafted HTML page. The root cause is improper origin validation (CWE-346) in Chrome's CSS subsystem, allowing CSS mechanisms to circumvent same-origin policy enforcement and read restricted cross-origin content. No public exploit code exists and no active exploitation has been identified; EPSS probability is 0.18% (8th percentile), consistent with the SSVC 'Exploitation: none' assessment and Chrome's own 'Low' severity designation for this issue.

Cross-origin data leakage in Google Chrome's Blink rendering engine (versions prior to 151.0.7922.72) exposes data protected by the Same-Origin Policy to remote attackers who can lure a victim to a crafted HTML page. The flaw, classified as CWE-346 (Origin Validation Error), allows Blink to improperly handle origin boundaries, enabling a malicious page to read cross-origin resource data. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), consistent with SSVC's 'Exploitation: none' designation and absence from CISA KEV.

Same-origin policy bypass in Google Chrome's Cast component allows remote attackers to perform limited cross-origin integrity actions against victims who visit a crafted HTML page. All Chrome versions prior to 151.0.7922.72 are affected across Windows, macOS, and Linux. No active exploitation is confirmed (not in CISA KEV), no public exploit code has been identified, and Chromium's own internal severity rating is Low - signals that align with the very low EPSS score of 0.18% at the 8th percentile.

UI spoofing in Google Chrome's Global Media Controls component prior to version 151.0.7922.72 enables remote attackers to misrepresent interface elements when a victim visits a crafted HTML page. The flaw is rooted in CWE-451 (misrepresentation of critical UI information), allowing attacker-controlled content to manipulate what the media controls overlay displays. No public exploit code exists and no active exploitation has been identified; EPSS at 0.17% (7th percentile) and SSVC exploitation status of 'none' both corroborate this as a low-urgency, routine-patching-priority finding.

Navigation restriction bypass in Google Chrome for Android (prior to 151.0.7922.72) originates from an inappropriate implementation in the browser's Media component, permitting a remote attacker to circumvent built-in navigation controls by delivering a crafted HTML page to a victim. The CVSS 4.3 score reflects a limited integrity-only impact - no code execution, no data exfiltration - and user interaction is required per the vector (UI:R). EPSS at 0.18% (8th percentile) and the absence of any KEV listing or public exploit indicate low real-world exploitation probability; Chromium's own internal severity rating of 'Low' is consistent with this assessment.

UI spoofing in Google Chrome's Extensions subsystem (all versions prior to 151.0.7922.72) allows an attacker who tricks a user into installing a crafted malicious extension to misrepresent critical security indicators within the browser interface. The flaw stems from incorrect security UI rendering in the Extensions component (CWE-451), enabling deceptive presentation of extension trust signals or permissions. No public exploit has been identified at time of analysis and EPSS is 0.10% (1st percentile), aligning with Chromium's own internal 'Low' severity rating; however, the ubiquitous deployment footprint of Chrome elevates the aggregate exposure.

UI spoofing in Google Chrome on iOS prior to 151.0.7922.72 enables a remote attacker to deceive users about page identity or browser security state by serving a crafted HTML page. The flaw is iOS-specific, exploiting an inappropriate implementation in the Chrome for iOS rendering layer rather than the broader Chromium engine, and requires only that the victim navigate to an attacker-controlled page. No public exploit has been identified and EPSS stands at 0.19% (9th percentile), consistent with Chromium's own 'Low' internal severity classification; this is a real but low-urgency integrity issue.

Cross-origin data leakage in Google Chrome's Speech component prior to version 151.0.7922.72 exposes sensitive information to attackers who have already achieved renderer process compromise. The vulnerability stems from insufficient policy enforcement in the Speech API, allowing a crafted HTML page to bypass cross-origin boundaries and exfiltrate data. With no CISA KEV listing, no public POC, and an EPSS of 0.16% (6th percentile), this is a low-probability exploitation scenario best understood as a potential second-stage component in a multi-vulnerability chain rather than a standalone attack.

UI spoofing via Google Lens in Google Chrome prior to 151.0.7922.72 is achievable by a remote attacker who has already compromised the renderer process, using a crafted HTML page to misrepresent interface elements to the victim. The attack requires a chained exploitation scenario: renderer compromise as a prerequisite, followed by abuse of an inappropriate implementation in the Lens component (CWE-451) to manipulate what the user perceives in the browser UI. No active exploitation is confirmed - CISA KEV does not list this CVE, SSVC assessment shows exploitation status of none, and EPSS sits at 0.16% (6th percentile), indicating very low real-world exploitation probability at time of analysis.

UI spoofing in Google Chrome for Android (prior to 151.0.7922.72) enables remote unauthenticated attackers to present misleading interface elements to users through a crafted HTML page. The flaw stems from an inappropriate implementation in Chrome's input handling on Android, classified under CWE-451 (UI Misrepresentation of Critical Information), meaning the browser fails to correctly represent critical UI state to the user. No public exploit code exists and CISA has not listed this in KEV; EPSS is extremely low at 0.16% (6th percentile), consistent with Chromium's own Low severity classification.

UI spoofing in Google Chrome's Settings component (versions prior to 151.0.7922.72) enables remote attackers to misrepresent critical interface elements to victims via malicious network traffic, requiring user interaction to trigger. EPSS at 0.15% (5th percentile) and CISA SSVC exploitation rating of none align with the Chromium team's own Low severity classification, making this a low-urgency issue despite its network-accessible attack vector. Google has released a patch in stable channel version 151.0.7922.72; no public exploits are identified at time of analysis.

UI spoofing in Google Chrome's Passwords component (versions prior to 151.0.7922.72) allows a remote unauthenticated attacker to manipulate how credential-related UI elements are displayed by delivering maliciously crafted network traffic to a browsing user. The root cause is insufficient input validation (CWE-20) in the Passwords subsystem, which fails to sanitize externally sourced data before rendering it in the browser interface. No public exploit code has been identified and CISA has not listed this in KEV; EPSS of 0.15% (5th percentile) confirms low automated exploitation probability, consistent with the SSVC rating of exploitation: none.

UI spoofing in Google Chrome's Passwords subsystem (versions prior to 151.0.7922.72) enables remote attackers to manipulate password-related UI elements through malicious network traffic, potentially deceiving users into submitting credentials to unintended destinations. Exploitation requires active user interaction (UI:R per CVSS), and real-world risk is constrained by an EPSS of 0.15% (5th percentile) and SSVC confirmation of no known exploitation and a non-automatable attack path. No public exploit identified at time of analysis; vendor patch is available in Chrome 151.0.7922.72.

UI spoofing in Google Chrome for iOS prior to version 151.0.7922.72 enables a remote unauthenticated attacker to misrepresent critical interface elements - such as the address bar or origin indicators - through a specially crafted HTML page. Classified as CWE-451 (UI Misrepresentation of Critical Information), the impact is limited to integrity: no code execution or data exfiltration is possible directly, but users can be deceived into trusting a malicious page as legitimate. No public exploit code exists, EPSS sits at 0.16% (6th percentile), and Chromium internally rated this as Low severity - consistent with a constrained, social-engineering-dependent attack surface.

UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to deceive users into believing they are interacting with a legitimate browser interface by serving a crafted HTML page. The root cause is insufficient policy enforcement (CWE-346, origin validation error), allowing the attacker to manipulate rendered UI elements. No public exploit code exists and no active exploitation has been confirmed; EPSS stands at 0.16% (6th percentile) and CISA SSVC classifies exploitation as none, placing this firmly in a patch-and-monitor priority tier rather than an emergency response.

Side-channel information leakage in Google Chrome's Media component (versions prior to 151.0.7922.72) enables a remote attacker to leak cross-origin data by directing a victim to a crafted HTML page, bypassing same-origin policy protections through measurable side effects of media processing. Affected desktop users on all platforms running any Chrome release before 151.0.7922.72 are exposed to limited confidentiality loss. EPSS is 0.16% (6th percentile), SSVC exploitation status is none, and no public exploit has been identified at time of analysis - all signals converge on low real-world risk.

UI spoofing in the Google Chrome Updater component on Windows (prior to 151.0.7922.72) enables a local attacker to present a falsified interface to users by placing a malicious file in a location the Updater processes. Chromium's own team rates this 'Low' severity, consistent with the 4.0 CVSS score, EPSS of 0.10% (1st percentile), and SSVC exploitation status of 'none'. No public exploit exists at time of analysis, and a vendor-confirmed patch is available in Chrome 151.0.7922.72.

Cross-origin data leakage in Google Chrome on Android prior to 151.0.7922.72 enables a local attacker to read data from a different origin by directing a victim user to a crafted HTML page. The flaw stems from an inappropriate browser implementation (CWE-346 Origin Validation Error), undermining the Same-Origin Policy's isolation guarantees on the Android platform. No public exploit code exists and no active exploitation has been observed; SSVC assessment confirms exploitation status as none, making this a low-urgency but noteworthy information-disclosure defect.

Cross-origin data leakage in Google Chrome on Android (prior to 151.0.7922.72) results from an inappropriate UI implementation that allows a remote attacker to extract data from a different web origin when a user is socially engineered into performing specific UI gestures on a crafted HTML page. Rated CVSS 3.1 (Low) with EPSS at 0.17% (7th percentile) and SSVC exploitation status of 'none,' this vulnerability presents minimal immediate operational risk. No public exploit code exists and the issue is not listed in CISA KEV; a vendor-released patch is available in the stable channel update.

Cross-origin data leakage in Google Chrome's Passwords component (versions prior to 151.0.7922.72) exposes password-related data to attackers who have already compromised the renderer process and can deliver a crafted HTML page. The flaw stems from an inappropriate implementation that fails to enforce proper origin validation within the Passwords subsystem, making it a second-stage element in a chained attack rather than a standalone threat. No public exploit has been identified, EPSS is 0.16% (6th percentile), SSVC records no known exploitation, and Chromium internally rates this Low severity - consistent with the high prerequisite bar of prior renderer compromise.

Cross-origin data leakage in Google Chrome for Android (prior to 151.0.7922.72) stems from insufficient policy enforcement in the USB component, exploitable only after the attacker has already compromised the renderer process. Exploitation requires luring a victim to a crafted HTML page in a pre-compromised renderer context, making this a secondary-stage vulnerability in a chained attack rather than a standalone threat. EPSS sits at 0.19% (9th percentile), SSVC records no exploitation activity, and the vulnerability is not listed in CISA KEV - consistent with its low severity rating and demanding prerequisite.

Chrome for iOS prior to 151.0.7922.72 exposes potentially sensitive process memory contents to an attacker with physical access to the device through an inappropriate implementation flaw. The vulnerability is classified CWE-200 (Information Disclosure) and is iOS-platform-specific, not affecting Chrome on other operating systems. No public exploit code exists and CISA SSVC confirms no active exploitation, placing this firmly in the low-urgency tier despite requiring prompt patching for high-assurance mobile environments.