Google Chrome Memory Safety Flaws

Signals diverge in a way worth stating plainly: Google Chrome before 156.0.8078.79 can allow code execution outside the renderer sandbox when a victim loads a crafted HTML page, due to improper input validation in Skia. Exploitation requires user interaction (UI:R) and an unpatched browser, no authentication is needed, and no public exploit has been identified at time of analysis; EPSS is 0.21% and SSVC marks exploitation none and automatable no. The 9.6 CVSS score and act_now decision indicate prompt patching despite those lower exploitation signals.

Memory corruption in Google Chrome's garbage collection before 156.0.8078.79 can let a remote, unauthenticated attacker potentially execute arbitrary code outside the browser sandbox when a victim renders a crafted HTML page. The priority label is act_now despite low EPSS (0.20%, 10th percentile) and SSVC reporting no exploitation and not automatable, while the vendor rates the issue High. Google has released a fixed build, 156.0.8078.79; no public exploit was identified at time of analysis.

Memory corruption in the Autofill component of Google Chrome builds prior to 156.0.8078.79 lets a remote attacker execute arbitrary code inside the renderer sandbox when a victim renders a crafted HTML page. The flaw is unauthenticated per the CVSS vector (PR:N) but requires user interaction (UI:R), and because scope is unchanged (S:U), code execution is confined to the sandbox - escaping to the host requires a separate sandbox-escape vulnerability. No public exploit code and no active exploitation are confirmed (CISA KEV not listed, SSVC exploitation: none), EPSS is low at 0.20% (10th percentile), and a vendor patch is available.

Memory corruption in Google Chrome's network component affects versions prior to 156.0.8078.79 and lets a remote attacker who convinces a user to load a crafted HTML page potentially execute arbitrary code inside the browser sandbox. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U) confirms no privileges are required but user interaction is mandatory, and scope is unchanged, so meaningful host compromise would require chaining a separate sandbox escape. No public exploit has been identified at time of analysis: SSVC records Exploitation as none and Automatable as no, EPSS is low at 0.20% (10th percentile), and the issue is not in CISA KEV despite a total technical impact rating.

Use-after-free in Google Chrome's FileSystem component allows remote attackers to execute arbitrary code inside the renderer sandbox when a user loads a crafted HTML page, affecting all Chrome builds prior to 156.0.8078.79. Exploitation requires user interaction (UI:R) and no authentication (PR:N), and code execution is confined to the sandbox, so host compromise would need a separate sandbox escape. No public exploit code has been identified at time of analysis and Chrome is not in CISA KEV; EPSS is 0.20% (10th percentile), so risk is serious but not emergency-grade, with patching targeted for this week.

Heap use-after-free in Google Chrome's Input component allows a remote attacker to execute arbitrary code inside the sandbox if a victim opens a crafted HTML page in any Chrome build prior to 156.0.8078.79. User interaction is mandatory (CVSS UI:R) and no authentication or non-default configuration is needed, so the realistic delivery path is a malicious or compromised site, injected page content, or malvertising; because the flaw yields renderer-level execution described as 'inside the sandbox', host impact is bounded absent a separate sandbox escape. Exploitation is not confirmed in the wild (SSVC exploitation: none, EPSS 0.24%, 15th percentile), but the vendor-rated Chromium severity is High with a total technical impact score, and a fixed build is already published.

Arbitrary code execution inside the renderer sandbox is possible in Google Chrome builds prior to 156.0.8078.79, where improper input validation in the V8 engine lets a crafted HTML page drive the engine into executing attacker-influenced code. The attack is network-delivered and needs no credentials, but requires the victim to open attacker-controlled web content (CVSS 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), and scope is unchanged - the payload runs inside the sandbox rather than on the underlying host. No exploitation has been observed per SSVC (Exploitation: none), no public exploit was identified at time of analysis, EPSS is 0.24% (15th percentile), and the vendor has shipped a fixed build (156.0.8078.79).

Arbitrary code execution confined to the Chrome renderer sandbox is possible in Google Chrome builds prior to 156.0.8078.79, where a use-after-free in the Quota component is reachable when a victim renders a crafted HTML page. Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R) - the target must visit or load the attacker-controlled page - and the description scopes the resulting code execution to 'inside the sandbox', so impact on the underlying operating system would require chaining a separate sandbox-escape flaw not covered by this CVE. No public exploit or PoC is identified in the available sources, CISA SSVC records Exploitation: none and Automatable: no, EPSS is low at 0.20% (10th percentile), and a vendor patch exists, which places this at a this_week remediation cadence rather than an emergency response.

Remote code execution inside the Chrome renderer sandbox affects Google Chrome builds prior to 156.0.8078.79, where memory corruption in the DOM lets a crafted HTML page execute arbitrary code. Attackers must convince a victim to load attacker-controlled HTML (UI:R) and need no credentials, but the impact is confined to the sandboxed renderer unless a separate sandbox-escape vulnerability is chained. No public exploit identified at time of analysis; the issue is not in CISA KEV, and an EPSS score of 0.20% (10th percentile) indicates low predicted exploitation.

Improper input validation in Chrome's CacheStorage component allows a remote, unauthenticated attacker to execute arbitrary code inside the browser's renderer sandbox by convincing a user to open a crafted HTML page in a Chrome build older than 156.0.8078.79 (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R, High Chromium severity). The user-interaction requirement (UI:R) is the main practical barrier, and any code gained this way is confined to the sandboxed renderer, so reaching the host would need a second, separate sandbox-escape flaw. No public exploit code was identified at time of analysis, there is no CISA KEV listing, EPSS is low at 0.21% (12th percentile), and CISA SSVC rates exploitation as none and automatable as no, which supports treating this as a real but moderate-urgency patch-this-week item rather than an emergency.

Use-after-free in Google Chrome's Frames component before 156.0.8078.79 allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction, and the resulting code execution is confined to the sandbox; full host compromise would require a separate sandbox escape that this CVE does not describe. The vendor has released a fixed build, while the supplied data shows no public exploit identified at time of analysis and an EPSS score of 0.20% (10th percentile).

Memory corruption in the Dawn (WebGPU) component of Google Chrome affects builds prior to 156.0.8078.79 and lets a remote, unauthenticated attacker potentially execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The user-interaction requirement and the sandbox scope limit real-world impact: exploitation grants code execution within the renderer sandbox, not host compromise, and would require a separate sandbox-escape bug to break out. No public exploit has been identified at time of analysis, EPSS is low at 0.20% (10th percentile), and SSVC records exploitation as none; a vendor patch is available, and the issue is prioritized for remediation this week.

Memory corruption in the Quota component of Google Chrome allows a remote attacker to potentially execute arbitrary code inside the browser sandbox by convincing a user to load a crafted HTML page; all builds prior to 156.0.8078.79 are affected. Exploitation needs the victim to visit or render attacker-controlled content (UI:R) but no authentication or privileges (PR:N), and the resulting code execution is confined to the renderer sandbox, so host compromise would require a separate sandbox escape. No public exploit has been identified at time of analysis, SSVC records Exploitation: none and Automatable: no, and EPSS is low at 0.20% (10th percentile), which supports a this_week rather than emergency response cadence; the vendor has released a fixed build.

Integer overflow in Google Chrome's Editing component (CWE-190) lets a remote, unauthenticated attacker who convinces a victim to load a crafted HTML page potentially execute arbitrary code, though the vendor states the resulting execution is confined to the Chromium sandbox. All Chrome builds prior to 156.0.8078.79 are affected; the flaw carries a CVSS score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and a Chromium security severity of High. No public exploit code has been identified at time of analysis and EPSS is low at 0.20% (10th percentile), while SSVC rates technical impact as total but exploitation as none and automatable as no, placing it in a 'this_week' remediation queue rather than an emergency.

A use-after-free flaw in Chrome's Blink rendering engine affects versions prior to 156.0.8078.79 and lets a remote attacker run arbitrary code inside the browser sandbox when a victim opens a crafted HTML page. Exploitation requires the user to visit or be navigated to attacker-controlled content (UI:R) but no credentials or privileges (PR:N), and the resulting code execution is confined to the sandbox, so reaching the host operating system would require chaining a separate sandbox-escape bug. No public exploit has been identified at time of analysis, EPSS is low at 0.20% (10th percentile), and the issue is not in CISA KEV; the vendor-rated Chromium severity is High and the priority is to patch this week.

Use-after-free in Skia, Chrome's graphics rendering library, lets a remote, unauthenticated attacker execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in Google Chrome builds prior to 156.0.8078.79. The attack is a drive-by or malicious-link scenario requiring only that the target browses to attacker-controlled content (UI:R), with no credentials or non-default configuration needed; code execution remains confined to the renderer sandbox, so host compromise would require chaining a separate sandbox escape. No public exploit has been identified at time of analysis, CISA KEV does not list the issue, and EPSS is low at 0.20% (10th percentile), though the vendor rates the flaw High severity and SSVC assigns total technical impact, yielding an overall priority of remediating this week rather than an emergency response.

Use-after-free in Google Chrome releases prior to 156.0.8078.79 can let an unauthenticated remote attacker execute arbitrary code inside the renderer sandbox if a victim opens a crafted HTML page; because the CVSS scope is unchanged, host compromise would require chaining a separate sandbox escape. No public exploit has been identified at time of analysis, EPSS is low at 0.24% (15th percentile), and CISA SSVC records no known exploitation and no automatable delivery. A vendor patch is available in Chrome 156.0.8078.79, and the issue is assessed as serious but not an emergency under the this_week priority.

Memory corruption in the FileSystem component of Google Chrome prior to 156.0.8078.79 allows remote attackers to potentially execute arbitrary code inside the browser's renderer sandbox when a victim loads a crafted HTML page. Affected users are those running any Chrome build below 156.0.8078.79; no authentication is required but successful exploitation depends on user interaction (visiting an attacker-controlled or compromised page). No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and EPSS is low (0.20%, 10th percentile), although the vendor rates the Chromium security severity as High and SSVC assigns total technical impact.

Out-of-bounds memory corruption in Chrome's MediaStream component (versions prior to 156.0.8078.79) allows a remote attacker to read memory inside the renderer sandbox by convincing a victim to load a crafted HTML page. Per the CVSS vector the attack is network-reachable and needs no authentication (PR:N), but requires user interaction (UI:R) - the victim must open the malicious page - and the assessed impact is confidentiality-only (C:H, I:N, A:N), with no sandbox escape or code execution claimed. No public exploit or exploit code has been identified at time of analysis (SSVC exploitation: none; EPSS 0.18%, 7th percentile), and the vendor has released a fixed build, so this is a this-month, patch-on-normal-cadence item rather than an emergency.

Memory corruption in Google Chrome's CacheStorage subsystem, affecting versions prior to 156.0.8078.79, allows a remote attacker who convinces a victim to render a crafted HTML page to read memory contents; the issue is rated moderate (CVSS 4.3) because exploitation requires user interaction and the confirmed impact is limited to confidentiality. No public exploit has been identified at time of analysis, EPSS is 0.20% (9th percentile), and CISA SSVC records no known exploitation with partial technical impact. Authentication is not required per the CVSS vector (PR:N), but the crafted page must be visited and rendered (UI:R), and no code execution or availability impact is confirmed from this issue alone.

An out-of-bounds read in the FileSystem implementation of Google Chrome versions prior to 156.0.8078.79 lets a remote attacker who convinces a user to open a crafted HTML page read memory that is confined to the renderer sandbox. The exposure is limited to confidentiality inside the sandboxed process; there is no integrity or availability impact and no path to code execution or sandbox escape on its own. EPSS is 0.16% (5th percentile), no public exploit code or active exploitation is confirmed, and CISA SSVC marks exploitation as none with the flaw not assessed as automatable, consistent with a low-priority this_month remediation cadence.