Google Chrome Memory Safety and Implementation Flaws

Sandbox escape in Google Chrome on Windows before 149.0.7827.155 stems from a use-after-free in the DigitalCredentials component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and potentially break out of the renderer sandbox. Rated Critical by Chromium with a CVSS of 9.6 and a scope-changing vector, though there is no public exploit identified at time of analysis and EPSS remains low at 0.31%. Exploitation requires user interaction (visiting a malicious page) but no privileges or authentication.

Heap corruption in the Downloads component of Google Chrome for Android before 149.0.7827.155 lets a remote attacker trigger a use-after-free by luring a victim to a crafted HTML page, potentially achieving code execution in the renderer. Rated High severity by Chromium with an 8.8 CVSS, but there is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none. EPSS is low (0.30%, 21st percentile), consistent with a patched browser bug not yet weaponized.

Heap corruption via use-after-free in Google Chrome's File Input component on Linux affects all versions prior to 149.0.7827.155, allowing a remote attacker to exploit memory corruption through a crafted HTML page that the victim visits. Chromium rates this Critical severity and a vendor patch is available; no public exploit has been identified at time of analysis and the SSVC framework records exploitation status as none. EPSS is low at 0.29% (21st percentile), consistent with a freshly patched, not-yet-weaponized browser flaw.

Privilege escalation in Google Chrome's WebView component on Android (versions prior to 149.0.7827.155) allows a remote attacker to break out of intended privilege boundaries when a victim opens a crafted HTML page. Rated High by Chromium with a CVSS of 8.8, the flaw yields high confidentiality, integrity, and availability impact but requires user interaction. No public exploit is identified at time of analysis, and the low EPSS (0.27%) plus SSVC 'Exploitation: none' indicate it is not currently being exploited despite the severe technical impact.

Remote code execution in Google Chrome on Android before 149.0.7827.155 stems from a use-after-free in the Passwords component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and execute arbitrary code within the browser process. Chromium rates the flaw Critical, though the assigned CVSS is 8.8; there is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none. EPSS is low at 0.39% (30th percentile), consistent with a patched, not-yet-exploited memory bug.

Remote code execution in Google Chrome on Windows (versions prior to 149.0.7827.155) allows a remote attacker to run arbitrary code within the browser process by luring a victim to a crafted HTML page that triggers a heap buffer overflow in the WebRTC component. Rated High severity by Chromium and scored CVSS 8.8, it requires user interaction (visiting a malicious page) but no authentication. No public exploit identified at time of analysis; EPSS is low at 0.40% and CISA SSVC records exploitation status as 'none'.

Heap corruption in Google Chrome's Digital Credentials component (versions prior to 149.0.7827.155) allows remote attackers to trigger a use-after-free condition by enticing a user to visit a crafted HTML page, potentially leading to arbitrary code execution within the renderer process. Chromium rates this issue as Critical severity, and Google has released a patched stable-channel build; no public exploit identified at time of analysis and EPSS sits at 0.31% (23rd percentile), indicating low predicted near-term exploitation pressure despite the high CVSS of 8.8.

Remote code execution in Google Chrome (desktop) versions prior to 149.0.7827.155 stems from a use-after-free in the Web Authentication (WebAuthn) component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and run arbitrary code. Chromium rates the flaw Critical severity; it carries CVSS 8.8 and requires user interaction (visiting a malicious page). No public exploit is identified at time of analysis, and EPSS remains low at 0.44%, but the SSVC 'total' technical impact and the memory-corruption class make it a high-priority browser patch.

Heap-based buffer overflow in Google Chrome's WebRTC component (versions prior to 149.0.7827.155) lets a remote attacker execute arbitrary code inside the browser's renderer sandbox by luring a victim to a crafted HTML page. Google rates the Chromium severity as High and a fixed Stable channel build is available; there is no public exploit identified at time of analysis, and the EPSS score of 0.36% (28th percentile) reflects low near-term exploitation probability. CISA's SSVC framework records exploitation status as 'none,' so this is patch-worthy but not yet an emergency.

Sandbox escape in Google Chrome's Extensions component (versions prior to 149.0.7827.155 on desktop) allows an attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page exploiting a use-after-free (CWE-416). Rated High by Chromium and CVSS 8.3, it is a second-stage bug requiring a prior renderer compromise plus user interaction. There is no public exploit identified at time of analysis, EPSS is low (0.27%), and SSVC records exploitation status as none.

Sandbox escape in Google Chrome desktop prior to 149.0.7827.155 lets an attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page, exploiting an object-lifecycle flaw in the Metrics component. It is a second-stage bug that turns renderer-level code execution into fuller compromise of the browser host, rated High by Chromium and scored CVSS 8.3. There is no public exploit identified at time of analysis, EPSS is low (0.30%, 21st percentile), and CISA/SSVC records no observed exploitation.

Sandbox escape in Google Chrome desktop before 149.0.7827.155 lets an attacker who has already compromised the renderer process leverage a use-after-free in the privileged Browser process to break out of the renderer sandbox via a crafted HTML page. Rated High by Chromium and CVSS 8.3, it is a second-stage exploitation primitive rather than a standalone entry point. No public exploit is identified at time of analysis and EPSS is low (0.27%), consistent with SSVC exploitation status of 'none'.

Sandbox escape in Google Chrome on macOS before 149.0.7827.155 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, exploiting a race condition (CWE-362) in the Safe Browsing component. Rated High by Chromium with CVSS 8.3, it is a second-stage exploit-chain primitive rather than a standalone entry point. There is no public exploit identified at time of analysis, CISA SSVC marks exploitation as none, and EPSS is low at 0.24% (15th percentile).

Sandbox escape in Google Chrome's DigitalCredentials component before 149.0.7827.155 lets a remote attacker who has already compromised the renderer process break out of the sandbox and gain broader host access via a crafted HTML page. Reported internally by Google's Chrome security team and rated High severity; no public exploit is identified at time of analysis, and EPSS remains low (0.27%, 19th percentile). CISA SSVC lists exploitation status as none, indicating no observed in-the-wild use despite total technical impact.

Sandbox escape in Google Chrome for Android's WebView allows a remote attacker who has already compromised the renderer process to break out to the more privileged browser process via a crafted HTML page, in all versions prior to 149.0.7827.155. Rated Critical by Chromium and CVSS 8.3 (scope-changing) by NVD, it is a second-stage exploit primitive rather than a standalone entry point. No public exploit is identified at time of analysis and it is not in CISA KEV; EPSS is low at 0.29% (21st percentile).

Sandbox escape in Google Chrome's WebShare component on Windows (versions before 149.0.7827.155) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. The flaw is a critical-severity use-after-free (CWE-416) rated CVSS 8.3; there is no public exploit identified at time of analysis, CISA SSVC lists exploitation status as none, and EPSS is low at 0.31%. It is a second-stage bug meant to be chained after an initial renderer compromise rather than a standalone remote takeover.

Sandbox escape in Google Chrome on macOS before 149.0.7827.155 lets an attacker who has already compromised the renderer process abuse a race condition (CWE-362) in the Updater component to break out of the sandbox via a crafted HTML page. Rated High by Chromium with a CVSS 8.3 and scope-changing impact, but exploitation requires a pre-existing renderer compromise plus user interaction, making it a second-stage bug rather than a single-shot RCE. No public exploit identified at time of analysis; EPSS is low (0.27%) and CISA SSVC lists exploitation as none.

Local privilege escalation in Google Chrome for Windows before 149.0.7827.155 stems from a use-after-free in the Chromoting (Chrome Remote Desktop) component, letting a local attacker who convinces a user to open a malicious file execute code at OS-level privilege. Chromium rates the severity High and a vendor patch is available; currently there is no public exploit identified at time of analysis, and EPSS is low at 0.17% (6th percentile). SSVC lists exploitation as none but technical impact as total.

Arbitrary code execution in Google Chrome's Media component (versions prior to 149.0.7827.155) lets an attacker who has already compromised the renderer process run code within the sandbox by serving a crafted HTML page. Rated High by Chromium and CVSS 7.5, the flaw is a use-after-free (CWE-416); there is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.37%, 28th percentile), consistent with the SSVC 'Exploitation: none' status. In practice it functions as a second-stage bug useful for extending a renderer foothold rather than an initial-access vulnerability.

Use-after-free in the Tab Strip component of Google Chrome before 149.0.7827.155 allows a remote attacker to trigger heap corruption when a victim visits a crafted HTML page and performs specific UI gestures, potentially leading to code execution in the renderer. Google rated it High severity and a vendor patch is available, but no public exploit identified at time of analysis and it is not listed in CISA KEV. EPSS is low at 0.30% (21st percentile), and SSVC records exploitation status as none.

Heap corruption in Google Chrome's Extensions component (versions prior to 149.0.7827.155) allows an attacker who convinces a victim to install a malicious extension to trigger a use-after-free and potentially achieve arbitrary code execution within the renderer or browser process. Rated High by Chromium and scored CVSS 7.5, the flaw was reported internally by the Chrome team and is patched in the stable channel; no public exploit identified at time of analysis and EPSS is low at 0.19%.

Out-of-bounds read in Chrome's WebRTC subsystem on Windows exposes process memory to remote attackers who can lure victims to a crafted HTML page. Affected versions are all Chrome releases prior to 149.0.7827.155 on Windows; the flaw is classified CWE-125 and carries a CVSS score of 6.5 (High). No public exploit or active exploitation has been identified at time of analysis, and SSVC signals low urgency, but the combination of a zero-interaction network delivery path and high-confidentiality impact makes patching a clear near-term priority.

Process memory disclosure in Google Chrome's Media implementation exposes potentially sensitive data to remote attackers via a crafted HTML page. All Chrome versions prior to 149.0.7827.155 on desktop are affected; exploitation requires user interaction but no authentication. No public exploit code has been identified and CISA KEV lists no active exploitation, though the High confidentiality CVSS impact and broad deployment footprint make patching a priority.

Universal Cross-Site Scripting (UXSS) in Google Chrome's Serial API implementation prior to version 149.0.7827.155 allows a remote, unauthenticated attacker to inject and execute arbitrary scripts or HTML across any browser origin by luring a user to a crafted HTML page. The Scope:Changed CVSS metric underscores the cross-origin nature of this flaw, which bypasses the Same-Origin Policy and can affect trusted co-loaded or previously visited sites. No active exploitation has been confirmed by CISA KEV, and EPSS at 0.27% (18th percentile) alongside SSVC 'exploitation: none' signal low real-world exploitation activity at time of analysis. Vendor-released patch: 149.0.7827.155.

Out-of-bounds read in Chromoting (Chrome Remote Desktop) on Windows exposes process memory to local attackers who can persuade a victim to open a malicious file. Affected are all Chrome releases on Windows prior to 149.0.7827.155. No public exploit code has been identified and EPSS places exploitation probability at the 8th percentile, indicating low near-term threat despite the High confidentiality impact rating assigned by the CVSS vector.

Universal Cross-Site Scripting (UXSS) in the Views component of Google Chrome on Linux (prior to 149.0.7827.155) enables an attacker who has already compromised the renderer process to inject arbitrary scripts or HTML across security origins via a crafted HTML page, breaking Chrome's same-origin policy isolation. This is a post-renderer-compromise escalation step in a multi-stage attack chain, Linux-platform specific, requiring prior renderer RCE as a prerequisite. No public exploit code has been identified at time of analysis; EPSS sits at 0.29% (21st percentile), and CISA SSVC assesses exploitation status as none with partial technical impact.

Cross-origin data leakage in Google Chrome on Android prior to 149.0.7827.155 is triggered by an uninitialized GPU memory condition exploitable through a crafted HTML page. An unauthenticated remote attacker (per CVSS PR:N) can cause a victim's Android Chrome browser to expose limited data from other browser origins when the user visits a malicious page. No public exploit has been identified and EPSS at 0.30% (21st percentile) with SSVC exploitation:none signals low real-world exploitation probability at time of analysis.

Cross-origin data leakage in Google Chrome's Passwords component prior to version 149.0.7827.155 enables a remote attacker to read sensitive cross-origin data by directing a victim to a crafted HTML page. The root cause is an incorrect authorization check (CWE-863) within the browser's built-in password subsystem, which improperly permits cross-origin access to data that should be origin-restricted. No public exploit code exists and CISA has not listed this in KEV; EPSS at 0.29% (21st percentile) and SSVC exploitation=none collectively indicate low near-term exploitation likelihood despite the broad user base.

Extensions subsystem in Google Chrome before 149.0.7827.155 contains a protection mechanism failure (CWE-693) that enables a post-compromise attacker to break Chrome's site isolation boundary using a crafted HTML page. This is a second-stage chained vulnerability - not an initial access vector - as exploitation explicitly requires the attacker to have already gained control of the renderer process through a separate flaw. No public exploit has been identified at time of analysis, and EPSS places exploitation probability at 0.23% (14th percentile), consistent with the SSVC assessment of no observed exploitation and non-automatable attack chain.

Same-origin policy bypass in Google Chrome's Extensions subsystem prior to version 149.0.7827.155 allows an attacker to read or modify cross-origin web content after convincing a target user to install a crafted malicious extension. The attack is network-delivered but hinges entirely on social engineering the victim into extension installation, reflected in the CVSS AC:H and UI:R ratings and SSVC's 'Automatable: no' determination. No active exploitation has been identified at time of analysis; EPSS probability is 0.18% (8th percentile), consistent with SSVC's 'Exploitation: none' assessment.

Same-origin policy bypass in Google Chrome prior to 149.0.7827.155 enables a remote attacker who has already compromised the renderer process to read or modify cross-origin content via a crafted HTML page. The flaw resides in Chrome's Input component, where insufficient validation of untrusted input fails to enforce origin boundaries under this post-compromise condition. No public exploit code or active exploitation has been identified; EPSS places this at the 20th percentile with a 0.29% probability of exploitation, and CISA SSVC rates technical impact as partial with no automatable path.

Site isolation bypass in Google Chrome prior to 149.0.7827.155 enables a remote attacker who has already compromised the renderer process to cross site isolation boundaries by delivering a crafted PDF file through the File System Access API. Chromium's internal severity is rated High despite NVD scoring this at 4.2/Medium - the gap reflects the high attack complexity bar of requiring a pre-compromised renderer. No CISA KEV listing exists and EPSS sits at 0.29% (21st percentile), placing this in a low-urgency exploitation tier; however, its value as a post-exploitation pivot in multi-stage attack chains targeting high-value users should not be dismissed.

Cross-origin data leakage in Google Chrome's Passwords component (all versions prior to 149.0.7827.155) enables a remote attacker to extract sensitive cross-origin information by engineering a scenario where a victim performs specific UI gestures on a crafted HTML page. The flaw is an inappropriate implementation in the browser's password-related UI surface that fails to enforce cross-origin isolation boundaries under manipulated gesture sequences (CWE-451). No public exploit code or active exploitation has been identified; EPSS probability stands at 0.27% (19th percentile) and the vulnerability is absent from the CISA KEV catalog, collectively indicating low real-world exploitation urgency despite Chrome's massive deployment footprint.